Germany's data chief tells ministries WhatsApp is a no-go

https://www.dw.com/en/germanys-data-chief-tells-ministries-whatsapp-is-a-no-go/a-53474413

by rguiscard • 6 years ago

376 257 6 years ago

pjmlp11• 6 years ago

I also had the same experience in some client projects where we were explicitly told not to use it for anything work related.

edejong• 6 years ago

Then provide useful, technically complete, secure alternatives that are vetted by the government. The expectations of your employees are changing, so the technology you provide should change along.

rapsey2• 6 years ago

Unfortunately the agencies in charge of vetting this kind of software work in timespans of 2-3 years (not just Germany in most other countries as well).

raverbashing2• 6 years ago

Gov IT departments are a couple of years behind (average) company IT departments which are a couple of years behind what people use.

jeltz2• 6 years ago

The French government uses Matrix so it does not have to be like that. And the German military is looking into moving to Matrix too.

rad_gruchalski• 6 years ago

The article says: The Düsseldorf newspaper Handelsblatt said Kelber, previously a Social Democrat (SPD) federal parliamentarian, was reacting to complaints from citizens about the use of WhatsApp by unnamed federal authorities.

It seems some „authorities” used it as a citizen communication channel for official contact.

anoncake2• 6 years ago

Banning WhatsApp actually accomplishes that by creating demand for these alternatives.

VMG3• 6 years ago

nope, people will use SMS and email

captainmuon5• 6 years ago

Generally I'm for stronger data protection, but German officials relationship to WhatsApp is a bit silly, I always wonder what their conrete worry or attack scenario is. That a rouge employee at WhatsApp can see your metadata or access your telefone book? That the US government can see your metadata? Criminal and state actors have access to most of that information anyway.

lysium• 6 years ago

Cambridge Analytica showed there is a huge private market for data. Why should any government put its connections into a private corporation?

Just because some criminals or state actors can obtain that information illegally does not mean we should provide that data willingly and legally.

As a side note, I find it strange that you are for stronger data protection and at the same time think it is "silly" to avoid data collection companies such as WhatsApp.

captainmuon5• 6 years ago

As a side note, I find it strange that you are for stronger data protection and at the same time think it is "silly" to avoid data collection companies such as WhatsApp.

For example, I would advocate to allow anonymous phones again. Since a few years you can only get a SIM card with identity verification in Germany.

I would also disallow third parties to create profiles of anybody, and I would ban the sale of such data. Currently as a company you can even make queries to the local "Einwohnermeldeamt" (registration office) and for a fee get address and other data of residents. I'm opposed to that, as well as the data collection going on at credit score agencies.

Personally I think what German officials are doing is often data protection theatre, akin to security theatre.

But I think WhatsApp is somewhat unavoidable, and after weighing the pros and cons I don't think it is reasonable to ban it (I know it is banned e.g. by many municipalities, schools, and trade unions for communication with citizens). It's better to allow it so you can reach people for whom this is the medium of choice, as long as you always provide a safer alternative of course.

If I could decide, I would also require every messenger and social network above say one million users to provide federation. Being able to access your own data the way you want is just as important an aspect of "data protection" as locking it down! And it would force competition and prevent one entitiy from being too big to avoid.

est314• 6 years ago

Already the fact that you are talking to a psychologist is worth a lot to insurances and job candidate assessment platforms. Or to a midwife. Pregnant women are worth a lot in the adtech industry because especially if it's their first baby, they are about to buy lots of things they haven't bought before. Classical example is diapers.

This is from the metadata alone.

But Whatsapp goes further: it also encourages Google Cloud backups. Quite many people enable it. That way, the content becomes accessible to Google.

Other apps like Threema don't have the option of online backups of message content. You can back up some stuff online, but it's only stuff like your list of contacts, stuff that for Whatsapp already resides on the servers. For the content, you must use offline backups.

captainmuon5• 6 years ago

But Whatsapp goes further: it also encourages Google Cloud backups. Quite many people enable it. That way, the content becomes accessible to Google.

What's the bigger danger for most people? - You talk about pregnancy on WhatsApp, and they - illegally - extract this information so that some website can show you diaper ads? (I'm not even considering the possibility that this information would leak to an employer or heathcare - because such a leak, or anybody doing anything with that info would be considered completely outrageous here.) - Or: your phone breaks and you loose extremely important information stored in chats - passwords, photos, and so on?

For most normal people I know, #2 is the greater hazard. So I , too, would encourage them to back up their stuff in the cloud.

atoav• 6 years ago

I always wonder what their conrete worry or attack scenario is

There are laws in place who require German institutions to keep data privacy to a certain standard. This standard cannot be guarantueed when using e.g. Whatsapp.

Of course one could argue the Germans are too paranoid when it comes to privacy – but keep in mind where this comes from: Germany knows first hand what impact state lead data collection can have from it's own history on not one but two occasions (the Nazi-apparatus and the Eastern German STASI surveillance).

This historic backdrop lead to a widespread mindset that one should collect as little data as necessary (search for privacy by design or Datensparsamkeit). This mindset is also enshrined in law.

If you work in an government entity IT-department who is responsible for complying to these laws recommending a messenger which does "something" to your users data (where this "something" can change at any point), is something you could do, but on the other hand you could also just tell them not to use it at all (or to use Signal etc).

bad_user• 6 years ago

WhatsApp is a proprietary app and Facebook did plan to implement client-side agents that would extract info from content, or blacklist it. This means Facebook has the capability of backdooring WhatsApp and by extension the US government has this capability.

This isn't just about the metadata, you would be naive to think so. Proprietary apps, especially those that get automatically updated, will always have this loophole.

[1] https://www.schneier.com/blog/archives/2019/08/facebook_plan...

"Criminal and state actors have access to most of that information anyway."

You don't have evidence for this and regardless, metadata access can be prevented and it's in a country's best interest to protect its affairs from governments of other countries or from organized crime.

throwaway3603• 6 years ago

WhatsApp is a proprietary app and Facebook did plan to implement client-side agents that would extract info from content, or blacklist it.

This was debunked. Read Schneier’s correction: https://www.schneier.com/blog/archives/2019/08/more_on_backd...

captainmuon5• 6 years ago

This isn't just about the metadata, you would be naive to think so. Proprietary apps, especially those that get automatically updated, will always have this loophole.

I would say most applications that goverment offices in Germany use to interact with citizens are proprietary. For example Outlook as a mail client. SAP is used in some administrations. Many cities and police departments have presences on Facebook and Twitter and communicate with people there. Nobody has any issue with using proprietary SMS apps or iMessage.

In fact, open source in administration is currently so rare that it is newsworthy.

rapsey2• 6 years ago

German officials relationship to WhatsApp is a bit silly,

I find HN hivemind relationship to these apps quite silly. A government should never entrust any information to a third party it has zero control over. An individual consumer and a government employee working with classified information have vastly different responsibilities.

I always wonder what their conrete worry or attack scenario is

The security of these public apps are akin to a glass cannon. Strong in one scenario, hilariously weak in another. State actors can easily circumvent and extract full text messages and not just metadata.

captainmuon5• 6 years ago

It's not clear from the article, but the debate in Germany is about local offices using WhatsApp to interact with citizens. Like people asking about garbage collection dates, or informing about school closings. Things you might as well post on a wall or send with a postcard. Anything remotely sensitve, like getting a certificate of residence, has to be done in person anyway.

You're right when it comes to government officials working with classified information. But otherwise its completely normal to subcontract IT to third parties, even (especially) in the US.

mytailorisrich• 6 years ago

That the US government can see your metadata?

Not only metadata but the whole data transmissions.

Whatsapp may claim that transmissions are encrypted end-to-end but they control the app itself so can do whatever they want. The app distribution channels are also controlled by American companies.

So any government conducting communications through Whatsapp has in effect outsourced its communications to the US.

For important communications governments do not even trust off-the-self smartphones.

WJW• 6 years ago

To add to this point: The US government is not at all trusted in Germany (or most of the EU) at the moment. "America first", combined with numerous withdrawals from international bodies like the WHO and the climate agreements has given the impression that the old allies are no longer beneficial to the European cause.

ThePhysicist• 6 years ago

From my experience a lot of people will not hesitate to contact you via WhatsApp even in a professional setting if they can get hold of your phone number. After this happened several times to me I made sure to have a separate phone for business where no messengers or any "social" apps are installed.

The funny side of this behavior is your client messaging you via WhatsApp but forgetting their profile picture shows them drunk emptying a giant beer shoe :D

tasogare• 6 years ago

I’ve never understood the appeal of WhatsApp: it requires a phone number (so it’s useless or hard to setup abroad, and it’s tied to a very personal data), handle very poorly wifi connection (somehow it seems to only update when connected over 4G) and force me to download pictures and videos to see them, trashing my photo folder in the process. It also has no killer features in comparison to any existing messaging app, nor the defunct MSN. And finally it’s now owned by Facebook, so using it to avoid Messenger is moot. Yes, this app success is truly a mystery for me. I have it for speaking with two family members, otherwise I would not bother.

riantogo• 6 years ago

You can change the setting for photos not be saved to your camera roll. And in my experience whatsapp has the best connectivity.

Aaronmacaron• 6 years ago

The appeal of WhatsApp is simply that everyone already has it. It's the only messaging platform that can be used to message all your contacts. Network effect, that's it.

maltelandwehr2• 6 years ago

The appeal of WhatsApp was free text messages, which is still not a thing in many countries.

Plus free international text messages.

That’s is how they grew to a billion users without being a success in either the USA or China.

kxxsc• 6 years ago

I think you are underestimating the degree to which requires only a phone number is a killer feature:

-you download the app and can immediately get started after verifying your phone number (no ID or password required) -you don't need to share any ID or connection details other than just your phone number

I spend a lot of time in India, and I think this lack of complexity has contributed significantly to its virality (I'd estimate that a pretty significant percentage of the user base does not have or regularly use an email account, which is usually a prerequisite to setting up many accounts).

Markoff5• 6 years ago

I have no problem with wifi connection and whatsapp, neither does anyone in my circle

There is option in Chats\media visibility to not trash your photo folder

not sure what are you using what is safer and/or does not require phone number

fruffy• 6 years ago

It's a simple calling and messaging app without the baggage of Facebook integration. That is all people wanted.

It is now redundant but that was not the case 10 years ago. People just stick with it since there is little incentive to adapt anything else. WhatsApp just works.

vidarh• 6 years ago

It's "killer feature" is that it's just another messaging app that only requires a phone number. I don't want to add people to yet another proprietary network.

pydry• 6 years ago

Whatsapp's killer feature was reliability, 10 years ago. It simply had better message delivery.

Now most apps are pretty much equally good but the network effect already did its job.

overheadnoise5• 6 years ago

I got my first smart phone around 2011.

In 2011 I was a student in university and I had friends in my circle from Erasmus so they kept their phone number from their own country. In 2011 it wasn’t even free for me to send a sms to people from my own country so I couldn’t even imagine sending sms to people internationally even though they were physically in the same city as me.

Well one day a friend told me to download WhatsApp. So I did. All it wanted me to do was verify my phone number and that’s it.

Now suddenly all of my friends with smart phones could just sms me for free. And I could sms them back too. For free.

That was the value of WhatsApp. The fact that all you needed was a phone number, which you already had saved in your phone. Now instead of opening your phones messages app, you just open whatsapp.

There was no extra step of signing up for a new account or telling people “search for my name on Facebook my profile picture is blah blah.”

tarsinge• 6 years ago

iPhones are in minority outside the US, WhatsApp is simply the Universal Apple Messages replacement, because it’s a lightweight app.

Jtsummers• 6 years ago

You can disable storing media to your photo folder. That was the first thing I did after installing it. I've never had issues with support on wifi, and that's a large amount of my usage of it.

Its killer feature was what it did before it was acquired by FB, really not much difference since then. The killer feature was international messaging without SMS/MMS costs (and poor reliability) and only needing a phone number, so you could take it with you easily as you moved through devices so long as you controlled the same number. This got presence around the globe making it easy to message almost anyone, almost anywhere.

Markoff5• 6 years ago

If they discourage people from using something, they should tell people what is the alternative.

I've been user of Signal for years, but with recent changes especially with screen nagging me and everyone else to enter PIN I'm going back to Whatsapp, which was my secondary messenger, but which has most contacts anyway.

What are the other options - Messenger, Telegram, Skype or whatever Google kills this year, which are all not even E2E encrypted by default (let alone colecting metadata)? Anything else has zero users and it's not user friendly.

It's not like there is user friendly completely safe service, after all even Signal now collects and stores your contacts in cloud after forcing you to create PIN nobody asked for, while they still keep asking for phone number and nag you with other prompts instead of adding basic features like pin conversation to top.

urxvtcd3• 6 years ago

forcing you to create PIN nobody asked for

You do realize that user profiles is one of the most requested features, right?

Markoff5• 6 years ago

these are not user profiles, this is cloud backup of your contacts and settings

if it was trade off that together with PIN I can start using Signal without phone number on devices without SIM I would be much more understanding

0x006A• 6 years ago

Nobody asked for spaced repetition nagging, and no way to turn it off. its so condescending and stupid of them. If you don't give users a choice, the only choice left to them is to stop using your app.

est314• 6 years ago

For further reading (in German), there's been a nice and well-researched article on Golem a while ago: https://www.golem.de/news/datenschutz-duerfen-aerzte-lehrer-...

Also, Microsoft sending Cease and Desist letter to the German city-state of Berlin as it wrote a policy advising against Skype (German too): https://www.t-online.de/digital/internet/id_87890600/skype-u...

liotier2• 6 years ago

And the German army just announced it follows the French government in migrating its instant messaging entirely to Matrix. https://www.golem.de/news/messenger-bundeswehr-will-komplett... (and recent discussion https://news.ycombinator.com/item?id=23152780)

est314• 6 years ago

I'm very glad of this development. Kelber has repeatedly made public statements in support of Matrix. Hope that more German government entities will adopt it.

lambentor• 6 years ago

I wasn't aware that the German government had a "Data Chief" position. This article refers to the Federal Commissioner for Data Protection and Freedom of Information. Because of the federal structure, his authority is complicated with many important decisions based on the regional level (Bundesland). While some people do use Signal, most people, don't care. Many doctors communicate via WhatsApp, as it's just faster / easier.

maltelandwehr2• 6 years ago

There is a company in Germany that will do remote flu diagnostics via WhatsApp. They even send you the sick note for your employer via WhatsApp.

Schools use it to communicate with parents.

qznc• 6 years ago

In german companies, I see an increasing use of Threema as the "official" messenger. Is that only a german trend?

Markoff5• 6 years ago

threema is not open source and it is not free, Signal (better some European fork) without recent baggage would be better option

user base is extremely slow, in Slovak media Threema is associated with mafia and murder of journalist, it will be hard to convince people to use same app as mobsters

jacquesm8• 6 years ago

People also use money, mobsters do too. They breathe air, mobsters do too. I don't think mobsters using something that is otherwise legal to use is going to stop adoption.

akvadrako2• 6 years ago

I live in NL and have never heard of Threema, so it doesn't seem like a spreading trend.

Though it does look interesting. Not FOSS like Signal, but at least a step better than Whatsapp.

neuronic• 6 years ago

One cluster of my friend base has entirely switched to Telegram.

Now I know I will get hit with a barrage of information why Telegram is also bad and blah but honestly at least it's a bit less info for the POS company Facebook.

BjoernKW2• 6 years ago

Just a few years ago, paramedics in Germany were routinely (and probably not entirely legally) using WhatsApp for communicating with the hospital while en route because there wasn't (and still isn't) a reliable, secure and interoperable system allowing healthcare providers to communicate with each other.

It's not like people in Germany are using tools such as WhatsApp in a professional context because they're negligent or careless (at least not entirely). Often, the digital infrastructure available to them is so woefully inadequate they have to resort to non-official tools.

ganzuul• 6 years ago

TETRA isn't interoperable?

BjoernKW2• 6 years ago

Its introduction has been an unmitigated disaster in Germany (as apparently and unfortunately is wont in Germany), see https://de.wikipedia.org/wiki/BOS-Funk#Einf%C3%BChrung_in_De... (German-only, sorry).

It's still not universally implemented and hospitals aren't part of the network either.

ancaster• 6 years ago

Just a few years ago, paramedics in Germany were routinely (and probably not entirely legally) using WhatsApp for communicating with the hospital

Here in Canada, WhatsApp is routinely used in the hospitals for doctors to communicate with each other about patient care. We aren't supposed to send identifiable information but... it happens all the time, of course. And for the same reason: no sanctioned system to replace it.

javieranton• 6 years ago

Why would FB have paid top dollar for Whatsapp if not to use its data? Come on ppl

VMG3• 6 years ago

From personal experience, I can tell you that the consequence of this will be that ministries will be using unencrypted and unauthenticated email and SMS.

rmoriz2• 6 years ago

At least in Germany companies and government are required to configure mandatory TLS for SMTP and IMAP so the biggest attack vector is gone. No end-to-end encryption though.

mercacona2• 6 years ago

The most significant attack vector might be the admin of the email service. In European public institutions, the admins have access to your work account (which is healthy and ok). WhatsApp, it’s the equivalent to share a coffee some blocks far away from the office (which is healthy and ok).

mioelnir• 6 years ago

Or not. Landesregierung BaWü for example distributes the daily COVID-19 news via Threema.

VMG3• 6 years ago

I didn't say this will always be the consequence, but it will be the typical result.

Leace• 6 years ago

Germany already experimented with a couple of hosted open services: https://www.golem.de/news/whatsapp-matrix-oder-xmpp-bmi-such...

The Conversations.im team also leaves in Germany so I wonder why won't they just utilize their own solutions? Or maybe that's being considered...

openplatypus2• 6 years ago

Let's hope that Germany and other EU countries, including EU institutions adopt or at least consider Matrix, like French did.

https://matrix.org/blog/2018/04/26/matrix-and-riot-confirmed...

WanderPanda2• 6 years ago

And they did, what governments do, they failed...

https://techcrunch.com/2019/04/19/security-flaw-in-french-go...

openplatypus2• 6 years ago

While it is sad they had to resort to custom fork, they didn't really fail, did they?

Tchap wasn’t built from scratch. The DINSIC, France’s government agency in charge of all things digital, forked an open-source project called Riot, which is based on an open-source protocol called Matrix.

liotier2• 6 years ago

There was a bug, not exploited, fixed immediately... And you hold that as government failure... I won't try and lecture you about government efficiency, but you really should do something about your confirmation bias.

kome• 6 years ago

Here on HN people want to believe that WhatsApp is more secure than Telegram, when all the evidence points to the contrary. Also: don't trust closed source protocols.

Hokusai3• 6 years ago

This is part of a broader problem.

Many "apps" from WhatsApp to Zoom are treated as public spaces by citizens. But, legally the app-space is closer to a private space. This creates a mismatch between reality and expectations. (Zuckerberg can delete his chat history and you could not until Europe passed legislation forcing Facebook to do so.)

I suffered the "Windows only" of gubernamental applications that excluded Linux users from using them. I see a new wave of iPhone/Android apps, WhatsApp/Twitter official accounts, etc. creating the same monopolistic synergy where the government decides what apps the citizens have to install and what Operating Systems to use. The abuse of monopolies is not fight against but government officials take sides and choose which monopolies to grow.

Finally, a point missed in the comments: WhatsApp is an American company. The misalignment between Europe and the USA has grown the recent years meanwhile the technological dependence of Europe towards the USA has increased. That will not end well. The USA is in a position to shutdown all the technological infrastructure of Europe (AWS, Google, Facebook, Azure, ...) and to openly spy its citizens. When the two blocks were in more friendly terms that was seen as acceptable, today that is creating an uneasy feeling.

As an European citizen I do not feel safe with such an American oversight of my private and job-related activities. And, this is the most important point, when citizens feel threatened they will react or over-react to the situation. The USA has not been a trustworthy partner for some time. And ,the rise of TikTok and other Chinese apps are bringing that fear to public attention.

The solution is trivially easy and has existed for long: open standards. Mail has been around as long as the Internet and proven its value, the same applies to the World Wide Web. The only reason for the rise of apps is that companies see them as a good way of lock-in customers, gather data and increase influence. All that reasons are bad for the economy, for the freedom of countries and individuals. Open standards should be pushed as a leveling field for competing companies, as a form to increase freedom of expressions and communication and to avoid single-points-of-faiulre that risk big parts of the economy.

I hope for a return to sanity and open standards. The alternative is heavy regulated monopolies, no government is going to allow this situation to go for long, like the telecommunications industry. And, that does not work so well.

dijit6• 6 years ago

I wish I had more than one upvote, this capitulates perfectly my feelings on the situation.

I see the same sentiment echoed in our American friends w.r.t. Chinese spying. Huawei is dangerous and must be stopped, but the NSA having broken encryption a bunch of times, sending NSL's to chip makers and such is fine.

And that is not seen as hypocritical.

We as Europeans have no technological industry without the USA, and the USA has done nothing to assuage fears that they will backdoor everything they can without remit.

In fact, it's not only that we have no technical industry; it's that we actively pander to it and lock ourselves into it in perpetuity, ensuring that in a given future where we desire some level of independence that it will be as painful as possible.

"Chrome only" is the new "IE6 only" and services only accessible via Android/iPhone apps are a part of it too.

vinay4274• 6 years ago

Plenty of European countries are complicit in similar acts of their own, and many more tacitly assist. I don't think many deserve being painted as a victim of this situation. There's an article right now on the FP about the Netherlands helping GCHQ break Argentinean encryption.

In any case, I think the hypocrisy makes sense if you consider that the people saying this are from places (the US + close allies) that probably, all things considered, benefit [EDIT:] more than others by government privacy invasions. The goal of these governments is presumably to further their own interests at the cost of everyone else's. Why else do several of these allies willingly sign up to trade information with the NSA?

EDIT: "more than they are harmed" => "more than others"

tomComb2• 6 years ago

I interpreter the Huawei example quite differently than you.

In attacking Huawei, the U.S. is using it's tech power to further it's economic and geo-political ends. There are, of course, legit reasons to be concerned about Huawei but Trump has made it clear that the attacks on them go away if he gets a trade deal he likes.

The ironic thing is that this is their primary nominal concern about Huawei in the first place: that its close ties to the Chinese government and pwa suggest it would be used to further their interests rather then simply pursuing corporate interests.

tomComb2• 6 years ago

Yes, "Chrome only" is bad, but the web, open standards, and open source are the solution to the problem being discussed, so putting Chrome in the same bucket as IE6 seems quite backwards to me.

ryukafalz• 6 years ago

but the NSA having broken encryption a bunch of times, sending NSL's to chip makers and such is fine.

Fine according to whom? Many Americans, myself included, are outraged at this.

specialist• 6 years ago

"Many "apps" from WhatsApp to Zoom are treated as public spaces by citizens. But, legally the app-space is closer to a private space."

Clay Shirky's Here Comes Everyone points out this disconnect between social norms and technical reality.

IIRC the book example is kids talking at the mall's food court. While it's not private, as in hidden away, they're talking to each other, not to us adults.

You could eavesdrop. But why would you? That's creepy.

ChuckNorris895• 6 years ago

The USA is in a position to shutdown all the technological infrastructure of Europe (AWS, Google, Facebook, Azure, ...) and to openly spy its citizens

OK, and what can we do about that?

We build our own successful cars, we build our own successful planes but it seems like when it comes to building highly scalable world dominating software we are powerless even though our universities churn out tons of talented CS engineers and researchers.

What does the US do right that we do wrong here? Besides paying our devs worse.

vbezhenar• 6 years ago

I thought that in US salary is significantly higher than in EU. Probably that's the main differentiator.

gruturo2• 6 years ago

We pay devs worse because software is a complete aftertought, and the guys who produce it therefore are not seen as adding much value, if any. Meanwhile, the "software is eating the world" memo is almost 10 years old yet nobody this side of the pond got it.

Fix this mindset (good luck!), which is the real issue, and dev wages will correct themselves too.

Hokusai3• 6 years ago

What does the US do right that we do wrong here?

I have worked for a number of really successful Swedish software companies, all of them have been purchased by American companies. From Skype to Candy Crush, all companies are owned by USA corporations. USA is a rich country and has accumulated enough wealth to buy any competing economy.

China, when it comes to technology, has created an extremely innovative environment and growth local talent beyond what Europe can dream. (Before anyone complains about China "stealing" American technology, just remember that most of American technology was "stolen" from Europe after WWII. Except, that sharing technological advances should not be seen as stealing but as global collaboration for the improvement of humankind).

Just to make sure that I am not misunderstood. I do not think that the USA has done anything wrong, I just think that Europe, until recently, has not been in a position to compete with the USA. Not even Germany, one of the biggest and one of more successful economies in Europe, can compete with the USA as a whole. Europe failure has been to not unite and align their positions. A divided Europe cannot compete internationally, that is our fault. Internal-country markets are too small to create a software industry, or a film industry. Only aviation and car manufacturing have growth thanks to a heavy government intervention that forced a consolidation and shared efforts at European level, showing that the approach works.

USA and Europe should be partners, a week European Union will not be relevant in the world, a divided European Union would individual states up for grabs for other international powers (UK probably by the USA, southern regions have seen China investment increasing and Russia maybe temporally incapacitated but sooner or later will come back).

So, I believe that Europe has done some things poorly, event that also had done great things, as keeping one of the higher standards of living in the world. The current pandemic is creating a re-thinking on how countries interact between them. Isolation is not a solution, not even for China, and I hope that we do not get there. But, we need to find a way that each region can protect its own interest while sharing its wealth and knowledge with the rest.

fluffything7• 6 years ago

What does the US do right that we do wrong here? Besides paying our devs worse.

The reason there is really no cool tech firms in the EU is because the EU economic policies make them impossible.

Working for a startup is an extremely risky decision. As a top engineer, you get shitty pay, and a really good options package that in most cases ends up being worth nothing because most startups fail.

In the US, however, if your startup cashes out, you end up rich. This is not only a life changing experience, some of these rich top tech engineers end up creating their own startups afterwards with the money they make, which perpetuates the cycle.

In Europe, if as a top engineer your startup cashes out, you only end up marginally better than if you had had an 8-5 job at BigTech (Google, Apple, Microsoft). Almost 50% of your cashout goes away in taxes, and the rest barely compensates the bad paid you got the last 5-10 years of your life, and if you take "worked hours/week" into account, quality of life, and risk taken, the value proposition is just a joke.

Startups already have a very hard time flourishing with top talent. Europe makes it almost impossible for these to attract top talent, so that's why you don't see as many unicorns here as you do in the US.

This doesn't mean there aren't any startups in Europe. There are. There are just much fewer than in the US, have an even lower success rate, and a less qualified and risk-friendlier employee base.

Source: my own personal experience job hunting in Germany, for many US startups operating here, where most of them actually try to offer BigTech salaries without option packages because they know option packages do not make sense here.

Source 2: https://notoptional.eu/

Techcrunch: https://techcrunch.com/2018/11/27/30-european-startup-ceos-c...

rb2k_2• 6 years ago

From my (German moved to the US) perspective:

1. Stop putting college kids with a bachelor degree in business in charge of software development teams. "Management" is still seen as something very 'fancy' in Germany. Being "a manager" carries a lot of weight.

2. Allow Engineers to advance without forcing them into management. A lot of very talented engineers in Germany are forced in mediocre middle management / product owner positions as the only option to gain some more influence.

3. Pay

tgragnato• 6 years ago

open standards

Meh, a friend recently sent me this study from the parliament: https://www.europarl.europa.eu/RegData/etudes/STUD/2020/6487... .

There is not much consensus regarding open standards, and the first plan of action would appear to be "a European firewall" (quickly renamed to the cloud for obvious reasons). So there will probably be some action, but I don't think it will be what many hope for. We Europeans may end up with a more closed, albeit more local, network.

mercacona2• 6 years ago

“I hope for a return to sanity and open standards. The alternative is heavy regulated monopolies, no government is going to allow this situation to go for long, like the telecommunications industry. And, that does not work so well.”

I do hope for heavily regulated and accountable monopolies. Open standards what for? The current internet doesn’t differ from electricity or water; it’s not a network running on top of the phone network, but a commodity by itself.

You cannot avoid hardware manufactures, so let’s stop to argue idealistically about a technological solution to a political problem.

My current view is “the more people in WhatsApp, the more power for states to rule” –so spent your time caring of your institutions and not creating utopian technological alternatives; look at the Pinboard’s guy: ACT.

braza• 6 years ago

As a European resident and previously lived in Asia and the US, I think that EU become a 3rd tier player in that game (user data) as stated by the EU Commission [1] due to an inability to develop those services by itself.

I mean, what's the EU option for whatssup?

[1] https://ec.europa.eu/info/files/white-paper-artificial-intel...

ajconway2• 6 years ago

The only reason for the rise of apps is that companies see them as a good way of lock-in customers, gather data and increase influence

Apps live and thrive because they are convenient and provide the most value to most people.

As a user, I wouldn't want the government to tell me what software I should use. As a software engineer, I wouldn't want to be told what software I should write.

If the problem lies in bad foreign apps, a possible solution is to educate citizens using facts and evidence.

polycaster• 6 years ago

As a user, I wouldn't want the government to tell me what software I should use. As a software engineer, I wouldn't want to be told what software I should write.

As far as I am aware nobody is telling anyone what exact software to use or to engineer. Also nobody seems to be calling for that.

What has been applied here instead are standards. That's quite a different thing and I'm pretty sure, as a software engineer, you're used to be told to follow standards, aren't you? They exist in other fields, too. Like citizen rights and protection of personal data.

The advise not to use a specific piece of software because it doesn't appear to adhere to existing standards (by an agency with the sole purpose to watch over compliance) is also very different from telling people what software to use specifically.

ryandrake• 6 years ago

Thank you for comparing to E-mail. E-mail federation has been a solved problem for decades. Why on Earth is it so chronically intractable for chat? It's as if every time a new chat app is created, the developer's #1 requirement is: "Must be incompatible with every other chat app"

With so much, frankly, miraculous software systems out there in production, built by some of the smartest minds in software, it's just stupefying how "send text from one person to another, regardless of the sender's and receiver's client" continues to escape us.

fomine3• 6 years ago

Also should be referred to XMPP.

marto1• 6 years ago

The misalignment between Europe and the USA has grown the recent years

I wouldn't count the last 20+ years as "recent", but ok.

The solution is trivially easy and has existed for long: open standards.

What we usually get is a hybrid "compromise". Things of absolutely no consequence are using open standards, e.g. Messenger will send JSON back and forth and things that matter a lot, e.g. social engineering algorithms for "ads" are black boxes.

It is my personal opinion these heavily asymmetric compromises are a consequence of severe technical inadequacy from most power bearing persons in the EU parliament. Another plausible explanation might be mind boggling corruption.

The alternative is heavy regulated monopolies, no government is going to allow this situation to go for long

What we get so far are monopolies that are heavily regulated in inconsequential aspects to "please the crowd". Also, it has been a tendency of humans to underestimate how long a bad situation could last. Governments are very much a reflection of it's people(believe it or not) and they mostly "don't want trouble" - it is my belief it's exactly this attitude that has lead us so far astray.

ho_schi• 6 years ago

There are very good messengers, they are just not pushed by big money and group pressure. The problem is always, that people don't care about what they do (to others) and apply group pressure for the benefit of the company.

matrix.org For professional usage and IRC like chatrooms. Free and open source software, with several native desktop and phone clients. Doesn't require any phone number and offers E2E encryption. You can use the central server or host your own ones and connect everyone through federation. The official app for iOS/Android is getting currently a rewrite because it is chubby. I'm using Fractal happily on Linux as IRC replacement, because it lacks E2E at the moment. Developed by a company which offers support and libraries for development. Therefore you could criticize that there are no RFCs floating around, but looking at XMPP which created a lot of RFCs this is probably quicker and better.

The germany army will use Matrix and also the french government. No joke! The germany army is here an example to follow.

signal.org Also free and open source software, but you won't get your own server and federation. Very easy to use for everyone, hard linked to phone numbers with default E2E encryption always on. Childs can use it. No native desktop clients, only the fat Electron "Flash for the desktop" thing.

The european parliament is using it in future. Probably a wise decision in their case ;)

PS: Facebook claims that WhatsApp uses the E2E of Signal. Nobody can proof that without source code. Nobody is allowed to write own clients for other platforms than iOS and Android. Nobody ever has seen the server code. Haven't we seen enough greedy monopolies since the 80s?

akvadrako2• 6 years ago

There are not really any good messengers across the board.

I have most experience with Signal and though I think the security side is good and it ticks lots of boxes, I often encounter bugs; overall a much worse UX than Whatsapp or Telegram.

b0tch7• 6 years ago

I'm an Android lifer (all my smartphones) and now live in Australia. I use Whatsapp for 99% of my personal messaging and frankly, I love it.

Same messaging experience for everyone (including emojis), great desktop app, easy backup & restore as you switch phones, was early on the reply-swipe functionality, easy forwarding, voice messages, . No, none of these are "killer" features, but it's honestly one of the purest examples of 'Just Works'(TM) I can think of in my digital ecosystem.

SMS on Android is pretty crap, and it's a particularly shitty experience communicating with an iPhone user or in groups.

Every time an article about Whatsapp on HN or Reddit pops up I fearfully look to see if there are legitimate privacy concerns. Afaict, all my messages are still E2E encrypted, and all my stuff is saved to my Google Drive.

Unless you're in a sheltered circle of only iPhones (probably in America), Whatsapp is the best choice by miles IMO. (Edit: sure if Apple would democratize iMessage for x-platform I'd consider it, but given that will never ever happy, Whatsapp is the great equaliser)

No other messaging app has the reach and consistency. And yea, this is a hill I'm willing to die on.

FrojoS• 6 years ago

Add to that great voice and video calls.

GekkePrutser2• 6 years ago

Skype is still way better for those. I use both regularly, WhatsApp has choppy video and phone-like audio whereas Skype has smooth video and HQ audio. I only use WA with contacts that don't have skype.

dijit6• 6 years ago

FD: I'm an iPhone user. (not a die-hard, but I haven't found a decent android I can get along with permanently).

Aside from the number of people (network effects) on WhatsApp, what does it have over something like telegram, signal or any of the other cross-platform messengers?

Devils advocate for a moment:

Signal is pretty consistent, for a "no frills" chat solution, the UX is worse but it is still consistent across platforms.

Telegram does everything WhatsApp does but "better", native desktop apps, voice calling is clearer, it still very consistent. You can even have "usernames"; the UX is clearly superior. But the security model is questionable.

And if the answer is: "but network effects", why not Facebook messenger? it has the same reach if not greater.

So, why WhatsApp?

(this is a genuine question, I'm not trolling).

nujabe• 6 years ago

I'm an iPhone user. (not a die-hard, but I haven't found a decent android I can get along with permanently

Try Google Pixel. Always have been an Android user and the Pixel has the Android experience imo.

lucideer• 6 years ago

Aside from the number of people (network effects)

Network effects is it.

if the answer is: "but network effects", why not Facebook messenger?

This is a good point, and I'm not really sure, but some guesses:

- Branding. During it's initial growth WhatsApp was a FB alternative and FB was in decline. Even after acquisition, awareness of the ownership wasn't immediately widespread.

- Contextual app differentiation. Facebook didn't separate its messenger from it's main platform quickly enough and even when they did, they're both conceptually considered a single package. People these days like separation of contexts.

- Phone numbers. WhatsApp was hard-linked to your phone contacts from the off, making it familiar to SMS users. Facebook jumping on phone numbers has followed slowly in a less focused manner.

- Less confusion for tech-illiterate. There's no posts or pages or walls. It's just like SMS.

it has the same reach if not greater.

Anecdotal, but I don't feel this is true anymore. I certainly know a lot more people without Facebook than without WhatsApp.

Deganta• 6 years ago

Where I live (Austria), Facebook messenger does not have the same reach as Whatsapp.

Pretty much everyone with a Smartphone has Whatsapp, but there are lots of people without a Facebook Account. These are mostly older people. There are also people (like me, but I know several others) who do have a Facebook account, but don't use it on their phone.

The really nice thing about Whatsapp is the installation experience. Just download the App from Google Play/Appstore. Start it. Confirm your phone number. And you can communicate with all your friends. Facebook is much harder in this regards. Signal is similar, "but network effects".

technicaldonut• 6 years ago

Not OP but I'll chime in. I have a range of devices myself and within in my social circle. I also live abroad from my family so good communication is key.

My work phone is an iPhone, my personal an Android, and across the family there is a multitude of old and new, Android and Apple.

Telegram is using (or used) some homebrew encryption protocol and I simply don't trust it. As it doesn't have a proper tried and tested encryption I'm not going to use it. (The encryption may have changed by now, as I haven't kept tabs on it.)

Signal is okay. There are 2 main things that irk me. Signal's Windows App is bad. Long loading times, bad UI. Keeps crashing for me. I also frequently video chat with family. Signal's quality is considerably worse than that of other services. The sound is choppy and video may or may not work. This is on all devices I own, regardless of network speed.

iMessage and FaceTime are good but platform locked. The video call quality on FaceTime is the best one across all services for me. The picture and sound is just significantly clearer than anywhere else. If I talk to family members with an Apple device I will generally use FaceTime.

WhatsApp still remains my main one for the simple reason that it gives me the best average experience across all devices and circumstances. Video and phone calls could be better but are acceptable. Chats are easy to use and work. Service quality is generally good. WhatsApp for me stands out because it doesn't really negatively stand out anywhere else. Yes, owned by Facebook is something I'm not entirely comfortable with, but right now, there simply isn't any other application that for me is consistently average across every platform.

sobani• 6 years ago

And if the answer is: "but network effects", why not Facebook messenger? it has the same reach if not greater.

The last message in my Facebook messenger is almost a year old when a single person wished me a happy birthday.

My WhatsApp is 'a bit' more active than that with 9 different groups / people in the past 7 days.

I know only a single person that doesn't use WhatsApp. He uses Signal over privacy concerns.

In my experience Facebook messenger usage is a rounding error.

greggman33• 6 years ago

great desktop app

Beg to differ. The Windows WhatsApp App has full permissions to use your entire machine, change your register, use your camera and mic without notification, read and or modify all your files, scan your network, watch all network traffic, catalog all the apps you have and see what they are doing, and use/access any all peripherals

No, that is not a "great app". Especially coming from Facebook.

chpmrc2• 6 years ago

Use the web app then. Once you're on the page use one of the "shortcut" features of Chrome or Edge and you can open it as a separate app.

vincentmarle• 6 years ago

was early on the reply-swipe functionality

I’ve been using WhatsApp daily for years, how did I not know this? Thanks! (This is why I read HN)

beagle3• 6 years ago

Backup works android->android and iOS->iOS but not if you want to cross the lines; guess you don’t care about that... but:

If you use Google’s backup for WhatsApp, it is NOT encrypted. Your local backup IS encrypted. It’s not your data - you can’t have it except through the app. But google can (and does) have that data for likely 95% of android WhatsApp users; E2E with this state of affairs is not very useful. (I assume the iOS situation is similar, but don’t know for sure)

Also, a copy of your phone book, continuous IP (and likely location) and all your conversation metadata is stored on Facebook’s servers even if you don’t use the google drive backup.

Yes, WhatsApp is useful and works well, But the E2E aspect is false safety. For many practical purposes, you should assume there’s No encryption. For the purposes that inconvenience you, it’s obviously there.

GekkePrutser2• 6 years ago

Yeah the backup is really bad... WhatsApp put so much effort into the E2E encryption and then just dumped the backups on Google. It was all just window dressing.

I bet this is also why the intelligence agencies aren't pounding on them for having E2E encryption, obviously Google is an open book to them. And Google has access to all your history for their own purposes.

Of course you can choose to turn off the backups, but you can't be sure all your contacts are doing the same.

hutzlibu• 6 years ago

They say, back-up encryption is supposed to work soon.

https://www.digitalinformationworld.com/2020/03/whatsapp-tes...

But even if, WhatsApp remains a closed source app, owned by Facebook. I really see no reason to trust them. Zuckerbergs privacy policy seems unchanged, since he called his user dumb fucs for trusting him with their data, while at the same time, buying the surrounding houses of his Villa, to protect his own privacy.

The only thing holding them back is a bit public image, but the general population do not care much and maybe breaking of privacy laws. But since the governments also really do not want real encryption for everyone, I would rather imagine "gentlements agreement" behind doors, than real investigations, in case for example WhatsApp would secretly send also the key for the backup to someone else.

niklasrde• 6 years ago

Whilst it does not work natively, there are working 3rd party products that let you backup on Android and restore on iPhone. Or at least there were 2.5 years ago.

madballster• 6 years ago

I really dislike the Whatapp desktop experience, specifically the fact it's still going through Bluetooth using the phone even though I am on my desktop. Sometimes I leave my phone on another level in the house (yes I don't carry it around 24/7) and then Whatsapp desktop simply won't work as the distance is too great.

I prefer desktop apps that are 'standalone' such as Telegram's or Skype's.

vinay4274• 6 years ago

It doesn't actually use Bluetooth. When you scan the QR code your browser pairs with your phone and messages are relayed back through WhatsApp servers between the two, so as long as both have an internet connection it should work regardless of where they are.

Galaxeblaffer• 6 years ago

What about metadata ?

goalieca• 6 years ago

Afaict, all my messages are still E2E encrypted, and all my stuff is saved to my Google Drive.

There’s two things here: who controls the endpoints and who controls the key exchange. For now, I’m less concerned with reading your texts on the end than anything else any other Facebook app does to ping back and track you. The key management to me seems to be less than paranoid.

mosselman2• 6 years ago

Every time an article about Whatsapp on HN or Reddit pops up I fearfully look to see if there are legitimate privacy concerns.

There are legitimate privacy concerns. The main concern here is that Facebook builds up a network of who you are in contact with, how often you message them, when you message them, etc.

You are either not aware of this or you don't mind, but calling it illegitimate is not a fair assessment of the risk.

What if this data is leaked, hacked or sold or Facebook is pressured to release it to certain governments and they use this data to find dissidents?

This data, in combination with other Facebook data, could also be used by advertisers to target people specifically with questionable offers and materials, etc. People might object to their data being sold this way.

What if the US regime changes to a dictatorship, I know, it might seem very far fetched that some insane barbarian becomes president, but bear with me. Facebook might be forced to reveal said information and the regime will then use this to find dissidents.

What you should be asking yourself is 'Why is this app, that costs millions to make and maintain, that was bought for billions, free for me?' There is someone out there making a profit. This might not be a big concern to you personally, but it is not an illegitimate concern.

rpastuszak• 6 years ago

+1 althought I'd replace "why is this thing free" with "what am I paying with"

2ion• 6 years ago

Curious how your enthusiasm develops when they start injecting ads into their application chats. I haven't seen a single ad all year and will keep it that way.

MichaelMoser123• 6 years ago

i think the federal government also doesn't quite like the fact that it can't wiretap WhatsApp calls upon court order or decree; i don't know which possibility is worse - possible privacy violation or possible wiretapping.

jillesvangurp• 6 years ago

The bigger issue here is that while currently there are quite many communication tools with various degrees of central control, effective encryption, cross platform availability, user adoption, etc., none of them nail a optimum on all these dimensions. You are always compromising on something.

Uneducated users just use what everybody else uses that is "free". This tends to be stuff that is provided by big US based companies like Google, Facebook, Apple, etc. Free here is primarily about pricing and convenience. Recently, people value encryption a bit more but most users lack the expertise to make good decisions for this. So, they'll use something that supports encryption without realizing that might need configuration or turning on.

Companies have to deal with employees using non-sanctioned devices and solutions (i.e. uneducated users), which means the above tools are used. Additionally, they tend to have internal tools that are required to used for internal communication. Typically these too are provided by big US based companies (Slack, Microsoft, Facebook, Google) but are optimized for corporate requirements (better security, team features). A problem with these tools is that they are useless for communicating with people outside the company. Most companies are part of a complex supply chain involving companies that typically don't align on this. So, things like Skype, Google Meets, Zoom, etc. are popular in this space. Or email. A surprising amount of communication still happens via unencrypted email.

Finally, educated users tend to pick solutions that are a bit more on the paranoid side of the spectrum when it comes to privacy, encryption, data ownership, etc. Additionally, open source clients and servers are important in this space. Signal, Matrix, etc. are some better known solutions in this space. Unfortunately, these solutions tend to be not widely adopted and make it harder to communicate with "normal" people in the above two groups. I have signal on my phone but less than 99% of my phone book actually is reachable via it (not counting sms messages here for obvious reasons).

Companies are increasingly valuing this type of solutions from a security point of view. Industrial espionage is a thing and it's a thing companies with representatives in countries like China, Russia, or even the US have to worry about. These countries have very active intelligence agencies and a long track record of actively serving local businesses with basically any information they can get their hands on. Therefore companies that care about keeping secrets ought to be highly paranoid about popular solutions controlled by US incs that must be assumed to be actively under the attention of intelligence agencies.

IMHO OSS, federated solutions, with multiple implementations, clients, and no central control is what is needed. Unfortunately the dominant business models in this space favour closed source, non federated solutions with maybe some OSS clients but typically no independent server side implementations. Signal and matrix are exceptions in this space and neither has meaningful (> 1%) traction in the any market. I guess matrix is growing nicely regardless. Also signal has one big flaw: it uses phone numbers for authorizing users. This gives a large amount of control to operators.

chakalakasp• 6 years ago

If you like WhatsApp but don’t like Facebook having your meta-data, and don’t like the fact that your Google Drive back-ups are not E2E encrypted, then use Signal. WhatsApp’s encryption algorithm is based on the protocol that Signal invented, so you get the same and E2E security — but without the potential for Facebook snooping on you.

dividedbyzero3• 6 years ago

In my case I'd also lose about 98% of my contacts, who're non-technical and don't care enough about some very abstract threats to abandon their social network or use yet another messenger app in parallel. Also, since it's not well-known here, people tend to be very suspicious of it at first, because it's not known to be super safe like Whatsapp.

tgsovlerkhgsel• 6 years ago

WhatsApp is a no-go. Unencrypted e-mail is a no-go.

Please send a fax instead.

I wish I was joking.

j7ake• 6 years ago

What are the chances that this could be solved by having the German government (or EU) overpay to poach a team of instant messaging engineers from around the globe (give them 2x their current salary, have milestones to unlock more money) to have them develop a Whatsapp alternative that can be used in EU?

tehlike• 6 years ago

Or use something that's already opensource

jeroenhd• 6 years ago

Several European government bodies are looking into/starting to transition to self-hosted Matrix servers. Further development on the protocol with government funding could very well happen.

France already started developing their own alternative: https://matrix.org/blog/2018/04/26/matrix-and-riot-confirmed... The German government is trialing it already: https://www.heise.de/newsticker/meldung/Open-Source-Bundeswe...

Advancements are definitely being made, though because of the way governments operate I doubt we'll see their contributions be open sourced very soon. It's nice to know there are developments in the right direction, though.

throwawaylolx• 6 years ago

And does the German government care what the data chief says or is this just a HN-feel-good article of no consequence or substance?

rsynnott3• 6 years ago

This is the data privacy commissioner giving an advisory on what the law means. The government is bound by the law.

rsynnott3• 6 years ago

"WhatsApp cannot read messages because they are encrypted throughout by default," said its spokesman.

Feels like a bit of a non-denial denial, given that that's not what the official claimed.

patja• 6 years ago

I was appalled when I went to install it and there was no way I could see to avoid handing 100% of my contacts to it.

Do people keep a private offline contacts list, or a clean phone just for this?

Or do folks just not care about giving away the mobile phone numbers (and addresses? email addresses? birthdays? other notes on the contact about kids names, etc.?) to an app?

Am I behind the times and everyone just knows none of this stuff is private anyways due to leaks etc.? Even if that is your attitude, it seems you are feeding more links to the graph someone else is maintaining. Did you get consent from every one of your contacts to do so?

I feel like I must be missing something here. Am I over-reacting or paranoid?

pccole• 6 years ago

No, you're not over-reacting. I refuse to give access to my contacts to any app; however, that doesn't stop my friend, mom, or a cousin from giving access and Facebook/Google building a profile on you. The other issue here is Apple and Google have not updated these permissions to only get access to certain contacts you choose, its either all or nothing.

switch11• 6 years ago

Google, Facebook, Whatsapp (part of Facebook now), Amazon are all basically spy companies

They are 'America's Edge'

Let's consider the narrative ->

That one corner of the world (Silicon Valley) is so good at technology that it produces nearly ALL of the world dominating technology companies

Let's consider another narrative ->

While most countries were asleep at the wheel, the US (or some group of people in the US) figured out that the next wave of imperialism would be

- technology - data - surveillance

And they devoted all their resources to making sure these 'big data collection and surveillance companies' would be American companies

If you remember the example of the spy hardware company in Switzerland that turned out to be owned by the CIA

If you remember how US tried to fund a social network app in Cuba but failed to get traction

Then does it not make sense that all the things we think are 'accidents' are perfectly reasonable when considered as a collection of dots that link together

Cisco hardware = backdoors

Intel chips - backdoors

Amazon/Google/Facebook - data collection and surveillance

All the smart countries are gradually ditching Facebook and Google

If you look at actual innovation, there is now lots of great stuff coming out of Europe. China, etc

US seems completely focused on

A) data surveillance companies

B) advertising tech

C) 'Outspend everyone else to become market leader' type companies

Reply

Germany's data chief tells ministries WhatsApp is a no-go

Related Stories