Remix.run Logo
lordofgibbons 3 days ago

Given how WhatsApp is the de-facto way to communicate outside of the West and China, these security/data-handling "weaknesses" are most likely a feature, not a bug. An absolute bonanza for the certain intelligence services.

Remember, kids: End to end encryption is useless if the "ends" are fully controlled by an (untrustworthy) third party.

cataflam 3 days ago | parent | next [-]

> outside of the West

you probably mean outside of the USA, it's huge in Europe/UK

(which doesn't contradict your main point)

kwanbix 3 days ago | parent | next [-]

It is huge in Latin America.

USA is special because it is the (only?) country where iPhone has more users than Android.

brazukadev 3 days ago | parent | next [-]

It's crazy how an US company dominates the world's messaging market but not in the US

somenameforme 3 days ago | parent | next [-]

It's definitely not the world's messaging market. For instance in Japan and many places in SEA, Line is the standard messenger - one many people probably haven't even heard of. Though it does have a nice play on words - are you on Line?

oarla 3 days ago | parent | prev | next [-]

It’s not uncommon. Orkut back in the day was wildly popular in Latin America and India. WhatsApp is the same. I think users in NA have a lot of high quality options as against those in Asia and LatAm who don’t have much reliable options other than ones developed in NA.

SoftTalker 3 days ago | parent [-]

You can get an android phone for about one tenth of what a new iPhone costs. That’s why android dominates lower income markets. Apple decided they just don’t want to be there.

unethical_ban 3 days ago | parent | prev | next [-]

Instagram and iMessage are also US owned services.

tacker2000 3 days ago | parent | prev [-]

Well, FB didnt build up the initial user base, just purchased it and grew it from there.

101008 3 days ago | parent | prev | next [-]

Yeah, huge in Latin America in the sense that a lot (most?) business only have a number that they use with Whatsapp (you can't call or even text them). Is it the same in Europe? Since I am from Latin America I never know if people from other continents use Whatsapp as much as we do, and if when I ask them to use Whatsapp I am imposing a new app or it's what they regularly use.

Semaphor 3 days ago | parent | next [-]

No. Here in Germany WhatsApp is not even that widespread for businesses. But WA is very big here for personal communication, though Signal comes in second (at least amongst older people, and amongst my circle)

Vinnl 3 days ago | parent | prev | next [-]

I think Europe is not homogenous enough for this, but in the Netherlands at least, there are plenty of companies that you can't call, email or text, but they'll have some other options: a chatbot, a web form, maybe a Twitter account, and sometimes via WhatsApp indeed.

dontlaugh 2 days ago | parent | prev [-]

Not quite, but not too far off.

If you give someone your number, they’ll text you on WhatsApp.

heresie-dabord 3 days ago | parent | prev | next [-]

https://worldpopulationreview.com/country-rankings/iphone-ma...

Sgt_Apone 3 days ago | parent | prev [-]

iPhone has more users than Android in Canada and Japan as well. I think some Nordic countries too.

thaumasiotes 3 days ago | parent | prev | next [-]

I would have thought he meant "inside of the West". Outside of the West you have other channels.

Russia: Telegram

Taiwan: Line

Japan: Line

By contrast, WhatsApp is best known to me for being used in Europe, Australia, and India.

RyJones 3 days ago | parent | next [-]

Japan is mostly Instagram, line, WhatsApp, telegram, in that order, for me.

For business comms drop instagram and move WhatsApp to first.

For Singapore it seems LinkedIn messages are the go to IM for business.

Europe p2p: telegram number one by a huge margin, then WhatsApp. B2b: WhatsApp, period.

throwaway290 3 days ago | parent | prev | next [-]

Telegram is degraded/blocked in russia depending where you are and how authorities feel today

N19PEDL2 3 days ago | parent | prev | next [-]

I think the most used messaging app in Russia now is Max.

throwaway290 3 days ago | parent [-]

According to official statistics it is the most used app since 1 september 2025 /s

jjani 3 days ago | parent | prev [-]

Central Asia is Telegram as well.

guappa 17 hours ago | parent [-]

I think in italy telegram is 2nd to whatsapp

zer0zzz 3 days ago | parent | prev [-]

I’m not sure that’s true. I’m fairly certain UK, France, AU, Canada WhatsApp is not vastly more popular than the blue bubble alternative. At least I believe this was the case a few years ago, based on data I’d seen.

cataflam 3 days ago | parent | next [-]

France and UK, from personal experience, whatsapp is big, especially for professional use, or friends/family groups.

Blue bubble isn't really a thing ever mentioned in France either, not enough iPhone market share.

StopDisinfo910 3 days ago | parent [-]

> Blue bubble isn't really a thing ever mentioned in France either, not enough iPhone market share.

Nobody uses iMessage. People with iPhone use WhatsApp too.

The user experience of iMessage used to be subpar and now everyone has WhatsApp installed anyway, the feature set is the same and it works on all phone brands so nobody feels like switching.

discomrobertul8 3 days ago | parent [-]

Same in the UK. The fact that iMessage only works for iOS devices means it's a complete non-starter. What's the point in using a messaging app if you can't add all your contacts to a group? And if you're using a different app for group chats for this reason, then why not use it for 1-1 messaging, too?

OJFord 3 days ago | parent | prev [-]

I'm in the UK, I don't even know what 'the blue bubble alternative' is (Signal? Telegram?), everyone's on WhatsApp.

serial_dev 3 days ago | parent [-]

I guess that it’s the iPhone’s messenger app? I heard that in that app, fellow iOS users have blue bubble messages and Android / other users have green bubble messages, and all the teens in the US /maybe Canada think it’s lame if you don’t have blue bubbles.

OJFord 3 days ago | parent | next [-]

Oh. I remember hearing about that about 15y ago, didn't realise it was still a thing. I suppose because I haven't heard of anyone using iMessage for almost as long!

3 days ago | parent | prev [-]
[deleted]
achrono 3 days ago | parent | prev | next [-]

From the article:

> According to the 115-page complaint, Baig discovered through

> internal security testing that WhatsApp engineers could “move

> or steal user data” including contact information, IP addresses

> and profile photos “without detection or audit trail”.

That isn't really the breach you're making it out to be. Profile photos, unless made private/contacts only, are already publicly visible, and so is "contact information".

Of course these are useful to intelligence services, but this doesn't mean that Baig found they don't have true end-to-end encryption.

crypto_throwa 3 days ago | parent | prev | next [-]

Without open source, end to end encryption is useless. It's not hard to hide a piece of code that defeats the encryption in closed source code.

__spooky__ 3 days ago | parent | next [-]

iMessage is end to end encrypted. Although Apple says it secure and the courts and FBI seem to not be able to get it in, it is still closed source.

bigiain 3 days ago | parent | next [-]

I can't tell if I'm being paranoid or just realistic, when I suspect that FBI/Apple fights over decrypting/unlocking iPhones or iMessage are just part of Apple's security theater.

If I were Evil-Tim-Cook, I'd have a deal with the FBI (and other agencies) where I'd hand over some user's data, in return for them keeping that secret and occasionally very publicly taking Apple to court demanding they expose a specific user and intentionally losing - to bolster Apple's privacy reputation.

throw0101a 3 days ago | parent | next [-]

> If I were Evil-Tim-Cook, I'd have a deal with the FBI (and other agencies) where I'd hand over some user's data, in return for them keeping that secret and occasionally very publicly taking Apple to court demanding they expose a specific user and intentionally losing - to bolster Apple's privacy reputation.

The FBI wants its investigations to go to court and lead to convictions. Any evidence gained in this way would be exposed as coming form Apple; notwithstanding parallel construction:

* https://en.wikipedia.org/wiki/Parallel_construction

As for other agencies, I'm sure many have exploits to attack these devices and get spyware on them, and so may not need Apple's assistance.

14 3 days ago | parent [-]

I imagine if you have the information parallel construction becomes trivial.

worthless-trash 3 days ago | parent [-]

The killers app for ai.

somenameforme 3 days ago | parent | prev | next [-]

It's possible for it to be a facade, but also real.

Apple is a part of PRISM so there's approximately a 100% chance that anything you send to Apple via message, cloud, or whatever else, gets sent onto the NSA and consequently any agency that wants it. But the entire mass data collection they are doing is probably unconstitutional and thus illegal. But anytime it gets challenged in courts it gets thrown out on a lack of standing - nobody can prove it was used against them, so they don't have the legal standing to sue.

And the reason this is, is because its usage is never acknowledged in court. Instead there is parallel construction. [1] For instance imagine the NSA finds out somebody is e.g. muling some drugs. They tip off the police and then the police find the car in question and create some reason to pull it over - perhaps it was 'driving recklessly.' They coincidentally find the cache of drugs after doing a search of the car because the driver was 'behaving erratically', and then this 'coincidence' is how the evidence is introduced into court.

----

So getting back to Apple they probably want to have their cake and eat it too. By giving the NSA et al all they want behind the scenes they maintain those positive relations (and compensatory $$$ from the government), but then by genuinely fighting its normalization (which would allow it to be directly introduced) in court, they implicitly lie to their users that they're keeping their data protected. So it's this sort of strange thing where it's a facade, but simultaneously also real.

[1] - https://en.wikipedia.org/wiki/Parallel_construction

JumpCrisscross 3 days ago | parent [-]

> the entire mass data collection they are doing is probably unconstitutional and thus illegal. But anytime it gets challenged in courts it gets thrown out on a lack of standing

It's kind of wild that this is the part of the deep state MAGA just forgot about.

MangoToupe 3 days ago | parent | prev | next [-]

Maybe. I think they'd have a hard time keeping that under wraps—governments aren't typically very careful (and the FBI is about as careful as a bull in a china shop) about not showing their hand when it comes to charging people. If you're strict about keeping certain info on certain channels, smart observers would notice if someone were snooping.

For instance, if someone shared something incriminating in a group chat and got arrested, and that info was only shared in the group chat, they'd have to silence everyone in that group chat to ensure that the channel still seemed secure. I don't think at least our government is that competent or careful.

But also, people wayyyy overhype how much apple tries to come off as privacy-forward. They sell ads and don't even allow you to deny apps access to the internet, and for the most part their phone security seems more focused on denying you control over your own phone rather than denying a third party access to it. I think they just don't want the hassle of complying with warrants. Stuff like pegasus would only be so easy to sell if you couldn't lean on the company to gain access, and I think it'd be difficult for hundreds of countries to conspire to obscure legal pressure. Finally Apple generally has little to gain from reading your data, unlike other tech giants with perverse incentives.

Of course this is all speculation, but I do trust imessages much more than I trust anything coming out of meta, and most of what comes out of google.

sokoloff 3 days ago | parent | next [-]

> someone shared something incriminating in a group chat and got arrested, and that info was only shared in the group chat

“Only” is doing an incredible amount of work there.

Unless you concoct something incriminating solely for the purpose of testing this, the something incriminating being discussed in group chat previously happened in the real world. Ripples of information were created there and can be found (parallel construction).

MangoToupe 3 days ago | parent [-]

Right, but parallel construction only works if opsec fails. Good luck with repeating that feat forever. You clearly have far more faith in the FBI than I do. Now repeat this feat for every dumbass in intelligence in every country.

sokoloff 3 days ago | parent [-]

My position doesn’t require a lot of faith in the FBI.

If they fail in parallel construction, they always have the option to continue. For the vast majority of cases where opsec isn't 100% foolproof, we hear about them. For the few cases where it was foolproof, we just don't hear about them.

MangoToupe 3 days ago | parent [-]

It requires faith that they prioritize keeping such abilities a secret rather than prosecuting, and again, I do not share this faith.

Terr_ 3 days ago | parent | prev [-]

> For instance, if someone shared something incriminating in a group chat and got arrested, and that info was only shared in the group chat, they'd have to silence everyone in that group chat to ensure that the channel still seemed secure.

Corrupt investigators can use parallel construction to pretend that the key breakthrough in the case was actually something legal.

MangoToupe 3 days ago | parent [-]

See the sibling comment. The odds of nobody noticing still don't make any sense.

const_cast 3 days ago | parent [-]

PRISM went undetected for a long, long time and it's essentially a wiretapping of the entire internet.

Clearly, you are underestimating the intelligence and capabilities of the US government. They have a lot of money. Like... A lot of money.

MangoToupe 3 days ago | parent [-]

What do you think I based this analysis on?

nkrisc 3 days ago | parent | prev [-]

Wouldn’t it be easier to just not do that and have the same thing happen, but for real?

paulryanrogers 3 days ago | parent | prev | next [-]

iMessage backups in the cloud are subject to warrants. Even if you don't use iCloud backups, can you be sure everyone you communicate with also abstains?

stingraycharles 3 days ago | parent [-]

Aren’t those encrypted with a key that lives on your device only?

bri3d 3 days ago | parent | next [-]

Only if you enable Advanced Data Protection, but in that case, yes, absolutely

ants_everywhere 3 days ago | parent | prev [-]

how would you restore if you lost your device?

bri3d 3 days ago | parent [-]

Backups with Advanced Data Protection also enroll:

* Recovery Keys

* Recovery Contact (someone who holds your recovery key in key escrow)

ants_everywhere 3 days ago | parent [-]

right, the ability to recover implies keys exist outside the device. even if they gossip keys to other devices you control, there are lots of people with only a single apple device.

rpdillon 3 days ago | parent | prev | next [-]

Just don't back it up to iCloud!

yamazakiwi 3 days ago | parent | prev [-]

Not able to get into it legally or without consequence, it is not infallible.

saagarjha 3 days ago | parent | prev | next [-]

It is actually quite difficult.

another_twist 3 days ago | parent | prev [-]

Curious, is there a poc somewhere demonstrating an attack like this ?

joaomacp 3 days ago | parent [-]

Sure:

  plain_msg = decrypt(encrypted_msg)
  send_to_nsa(plain_msg)
dijit 3 days ago | parent | prev | next [-]

> End to end encryption is useless if the "ends" are fully controlled by a (..) third party.

YES!

sulandor 3 days ago | parent [-]

although e2ee does raise the cost for an attacker, the perceived gain in trustworthiness of the system is unjustified

tgsovlerkhgsel 3 days ago | parent | prev | next [-]

E2EE is likely the reason why this supposedly includes "contact information, IP addresses and profile photos" and not message content.

3 days ago | parent | prev | next [-]
[deleted]
saagarjha 3 days ago | parent | prev | next [-]

Ok, what do you suggest instead?

realz 3 days ago | parent | next [-]

I think Signal is the safest choice. If you want to be absolutely sure, host your own service, and hope you know how to make it have airtight security.

dontlaugh 2 days ago | parent [-]

Signal got US state department funding, if you’re not American you should be sceptical.

3 days ago | parent | prev [-]
[deleted]
thewebguyd 3 days ago | parent | prev [-]

Makes you wonder if Meta got one or more of those secret national security letters, or foreign equivalents.

Also makes me wonder about Google's change wrt android security patches - under the guise of "making it easier for OEMs" by moving to quarterly is actually just so that Paragon and other nation state spyware has access to the vulnerabilities for at least 4 months before they get patched.