Facebook reportedly researching ways to use encrypted WhatsApp messages for ads

https://www.macrumors.com/2021/08/03/facebook-researching-analyzing-encrypted-data/

by arkadiyt • 5 years ago

133 96 5 years ago

macrumors.com

stuaxo• 5 years ago

And of course the same tech can be used for surveillance.

fsflover• 5 years ago

Targeted ads is surveillance.

WhyNotHugo• 5 years ago

[...] is hoped to allow companies to read information from encrypted sets of data while also preserving privacy [...]

These tow items sound mutually exclusive.

Ensorceled• 5 years ago

I don't know, how could figuring out the message is about arranging an extramarital affair or discussing cancer treatment options with your spouse be an invasion of privacy.

This stuff is so obvious that it's obviously just willfull at this point.

tmcb2• 5 years ago

Not only that, but if they can generate meaningful targeted advertising from encrypted data, that would be pretty a strong indicator that the encryption method is not strong enough. Ideally, encrypted data must be indistinguishable from random noise.

bovine3dom3• 5 years ago

As another comment mentioned, they're talking about using a technique that allows you to perform computations on encrypted data, with encrypted results output - the thing doing the computation never sees any decrypted data.

So they could target advertisements but, as far as I can tell, they wouldn't be able to know which advertisements were served ... until the phone makes a request to download them, which seems to me to render it fairly but not entirely pointless.

capableweb• 5 years ago

They are not, they are referring to "Homomorphic encryption" which basically allows you to do computation on encrypted data without decrypting it or otherwise reveal the encrypted data. https://en.wikipedia.org/wiki/Homomorphic_encryption

howaboutnope• 5 years ago

These resulting computations are left in an encrypted form

As opposed to "read information from encrypted sets of data"

villgax• 5 years ago

They'll do something like FLOC but right before it's being sent lol

gentleman11• 5 years ago

See also: Facebook Wanted NSO Spyware to Monitor Users, NSO CEO Claims

https://news.ycombinator.com/item?id=28001207

101_101• 5 years ago

well, the dumb fucks won't mind.

coldcode• 5 years ago

Maybe they plan on making the encryption slightly less encrypted so they can tell something about the content? Would that not mean the encryption is basically pointless?

Infinitesimus• 5 years ago

This seems like a good thing for FB and users (isn't that why researchers playing with homomorphic encryption more and more)?

This way, FB gets to make money off ads with fewer privacy concerns.

I have no insider knowledge but I fully expect Apple, Google and MS are actively trying to do this too.

dirkmode2• 5 years ago

Funny that for an "ad" company, I do not see a single ad on their frontpage nor on any pages that require me to create a facebook account.

rietta• 5 years ago

Why not simply display generic ads to people and be done with it. Use more specific ads on certain pages/groups. Content tracking should not be necessary and is creepy.

jonathanlydall• 5 years ago

While from a technology point of view this is very interesting, I would really prefer an option to pay a reasonable subscription fee to have adverts turned off for me.

Before Facebook bought WhatsApp it actually used to require a small annual fee, but it was removed.

Alas, I fear that as tends be the case with advertising companies, they know that the willing to pay users are the most valuable advert audience, so are unlikely to give anyone an option to opt out.

On an unrelated note, I wish that YouTube offered a "no adverts" subscription option, I don't want to have to pay the full price for their premium package when I watch very little YouTube and the only thing I want from it is the lack of adverts.

8ytecoder2• 5 years ago

YouTube seem to be testing it in Europe.

https://www.theverge.com/2021/8/2/22605455/youtube-premium-l...

nounaut• 5 years ago

There's Youtube Premium Lite now which just stops the ads.

paxys2• 5 years ago

I keep telling people that YouTube Premium is the most cost effective membership there is, and they look at me like I'm crazy. Since I got it YouTube has become a service I genuinely love.

jasonlotito• 5 years ago

This. No ads is great, but the big surprise was the ability to download videos on my device and bring it with me when traveling. It's one of those features I didn't know I wanted until I had it, now I can't see myself not having it.

judge2020• 5 years ago

This is a bigger thing on reddit it seems, where I assume more readers are teenagers with little/no income.

fjert• 5 years ago

Definitely worth it. I'm glad to have had my YT Red / Google Play Music subscription grandfathered into YT Premium / YT Music Premium for the original price.

rvbissell• 5 years ago

I cancelled mine, because the ads provide enough friction to keep me from spending too much time there.

BuildTheRobots• 5 years ago

If you're on android then NewPipe is fantastic for watching YouTube without adverts, in a hovering window or even just listening to the audio with the screen off.

It does not tie into your YouTube account (so no watch history or recommended vids) which may or may not work for you, but it's a fantastic resource.

the-dude• 5 years ago

uBlock origin.

nostromo• 5 years ago

If you use the Brave browser on iOS and ad block on your laptop, you’ll never see an ad on YouTube.

nerdponx2• 5 years ago

Visually seeing ads is usually not the biggest problem, although there are issues with too many ads (bandwidth, bad UX) and the security risk of malicious stuff embedded in ads.

The issue (for me), and I think for many people, is the quantity and nature of the data that is collected, and the total lack of oversight for its sharing and usage.

Also, no company will ever remove you from the tracking/data pool just because you're a paying customer. Why would they? Now they can extract revenue from you in two ways!

RpFLCL• 5 years ago

Why they can't just use ads without the targeting...

keyme• 5 years ago

Isn't there client side code in every Whatsapp client that analyzes your messages and sends data to FB for ad targeting?

I know for a fact they can block certain message content from being sent. So at least a hash of every message is sent to FB. This isn't very far from it.

deweller• 5 years ago

Well, I suppose it is possible to target ads to specific users without knowing anything about the user other than an anonymous user ID.

Of course, this requires one to trust that Facebook is not actually collecting any identifying info. The temptation to cut corners for more profit or for sheer expediency might be hard to resist.

ndkwj• 5 years ago

Can someone explain this? How can they not know what I'm talking about on WhatsApp if they show me targeted ads?

thamer• 5 years ago

The article mentions homomorphic encryption, which is a way to perform computation on encrypted text, yielding encrypted results _without_ revealing the plaintext. Instead of f(x) → y, you do f(encrypted(x)) → encrypted(y).

So if you think of a function 'f' that can take text content and produce a relevant ad for it, and an encryption algorithm that converts plaintext 'x' into an encrypted 'X', then instead of running f(x) and getting an ad 'y', you'd instead run homomorphic_apply(f, X) – on the encrypted text – and you'd get an encrypted ad 'Y' without revealing 'x'. The device can keep the keys and do the decryption of 'Y', but running 'f' using homomorphic_apply can happen on the server side.

In principle homomorphic encryption is very cool and the "trick" involved to get fully homomorphic encryption described in Craig Gentry's dissertation in 2009 is pretty amazing. When it finally clicked for me I thought this was one of the most clever papers I'd ever read and truly a "mind: blown" moment.

That said, this is Facebook. As others have pointed out here, there's no need for such fancy processing and it makes much more sense to run the targeting algorithm on-device with access to the plaintext.

danuker• 5 years ago

Update: Will Cathcart, head of WhatsApp, has tweeted in response to The Information's report that WhatsApp is not exploring the use of homomorphic encryption. Cathcart states that there should be skepticism of "technical claims that apps like ours could see messages in "good" cases only."

There is no way to match advertising keywords in encrypted content without also allowing matches of arbitrary keywords, at which point the encryption is broken.

derefr2• 5 years ago

There is no way to match advertising keywords in encrypted content

Complete tangent, since this has nothing to do with what Facebook are looking into here, but:

If you control both ends of the connection (like Facebook does in WhatsApp), you can match on advertising keywords securely. By doing it client-side, after the text is decrypted.

As I understand it, this is essentially what Apple's iAds framework does: all possible advertising content that could be run in an iAd view gets pre-cached on the client; the iAds framework—running inside the client's address space—then chooses what to show the user, selecting ads based on demographic/interest information it has available locally on the device, never leaked outside. The iAd framework then collects just the impression metrics — how many times each ad was shown to a given user — and then every-so-often batches those metrics out to Apple's servers. Apple then reports re-groups and anonymizes these metrics, and reports them to the advertiser / charges the advertiser for them.

Of course, this means that advertisers need to be able to trust Apple's impression reporting; and to do that, they need to trust that Apple has set up iOS devices so that iAd selection + reporting is basically inviolable, such that nobody on the client end is generating false impressions. (Or, at least, that devices generating such impressions can be detected as being jailbroken through some mechanism, and so their iAd impression reports culled from the corpus.)

blensor2• 5 years ago

I think Telegram does that. I had someone send me a message about our video call we had that day and in the same minute I suddenly received a message from Telegram about their video call features

MikeUt2• 5 years ago

The iAd framework then collects just the impression metrics — how many times each ad was shown to a given user — and then every-so-often batches those metrics out to Apple's servers.

If Apple knows how many times you were shown each ad, and which keywords are associated with that ad, then they are able to reconstruct which keywords appeared in your encrypted chat, and how often.

slg2• 5 years ago

Of course, this means that advertisers need to be able to trust Apple's impression reporting;

And that is why it won't work for Facebook. They have already been caught lying about impressions in a way that ended up destroying companies.

https://www.hollywoodreporter.com/business/business-news/fac...

JohnWhigham2• 5 years ago

What's that quote again from that early engineer? The smartest, highest paid engineers, and they fucking work on making you view more ads.

We're living in an embarrassing era of massively misallocated resources.

inciampati• 5 years ago

This is even more true today, with a decade of research into the ROI of advertising showing that it isn't even making money for those who buy it. What a sad waste of energy and imagination. We can do better.

LeifCarrotson2• 5 years ago

Can we?

As Churchill said, democracy is the worst form of government -- except for all the others which have been tried. Similarly, capitalism is the worst form of economics -- except for all the others which have been tried. I mean, it's obvious to an external observer that a prisoner's dilemma, sub-optimal Nash equilibrium, or other coordination problem can best be solved by all sides cooperating. But the reason they're called dilemmas and problems is that there's no clear way for participants in the system to solve them.

It's not like anyone actually likes the system. But no one has (nor could be trusted to use) the power to coordinate an action of the sort that could end it. This is just the state of the world right now, we opened Pandora's box with web technology and pulled out the undesirable factoid "It's lucrative to run individual profiling and sell ads." Society has a limited ability to push an agenda against incentives; pushing past tech giant privacy invasion and attention abuse is not something we are capable of doing right now.

I think the only thing that can be hoped to change this equilibrium is to change the playing field. Change technology, improving adblockers, anti-tracking tools, and encryption. Educate kids and those willing to listen about the harms of advertising. The current generations of adult Americans grew up with roadside, TV, and radio ads, they view web ads as an extension of that and don't think about the privacy implications of that, but a kid who grows up in the Internet era aware that their activity is tracked and profiled (unless they use particular encryption tech and VPNs) will have a very different attitude, and perhaps eventually this abuse will be unprofitable.

Lammy• 5 years ago

Advertising is a way to backdoor surveillance in a post-Snowden era when people are wise to TLSing All the Things. The dollars were never a real concern imo.

ssss11• 5 years ago

This 100%

paxys2• 5 years ago

People are discussing a lot of advanced encryption in this thread, but the much more simpler explanation is that they will do the ad processing client side where the messages are already in plain text.

satysin2• 5 years ago

Exactly. They don't have to "break" the E2EE design. Simply make use of the "end device" to analyse the contents and feed that into their advertising profile for the user(s).

TBH I am surprised they're not already doing that?

anthony_r• 5 years ago

How about decrypting the messages on the device and then sending them for ad classification to a remote service? Sounds like a no-brainer.

andai• 5 years ago

Wouldn't that still be a privacy violation? The messages themselves would be protected, but advertising companies would receive a constant stream of keywords or categories over time.

my_usernam3• 5 years ago

Still big red flag to me! If I'm secretly talking to someone about health concerns I might have, the last thing I want is facebook sending me ads for medicine about that concern.

"But we didn't read you messages, only took keywords" sounds like a child's excuse for bad behavior

est31• 5 years ago

Also people forget that facebook gets all the metadata. The encryption leaves the length of the messages intact as well as the identities of both parties. A conversation with someone who is known to be a hairdresser is likely about making an appointment, so maybe the person is interested in ads about hair products. A conversation with a midwife might yield in ads for baby products.

kop316• 5 years ago

This is a dup of:

https://news.ycombinator.com/item?id=28053808

From my other comment: https://news.ycombinator.com/item?id=28054329

There is a severe misunderstanding of what Homomorphic Encryption is, but how they explain facebook is trying to use it is not how it works.

mrkramer2• 5 years ago

Zuckerberg said that they combat spam on WhatsApp not by reading your messages because since they are end to end encrypted they are obviously unable to do it but by analyzing your metadata and your behavior on the service. So I assume the same strategy can be used for ads.

Encryption is not a problem; if I'm not mistaken various security agencies in USA also bet on metadata when strong encryption is in question.

axiosgunnar• 5 years ago

Perhaps we consumers should demand E2EE metadata then?

Would such a thing be theoretically feasible?

Or not because it would be like Tor with the entire Internet controlled by the adversary?

mrkramer2• 5 years ago

I don't know about E2EE metadata but I was referring to WhatsApp metadata in general, for example: "Alice sent 3 messages to Bob at 7:05 AM"

forrestgumbc• 5 years ago

How dare they try to make money from their business

LightG3• 5 years ago

If ad revenue is your only go to for money, maybe your business model just ... sucks.

nerdponx2• 5 years ago

Lots of people are happy with products that are supported by advertising. Problems arise when the business model relies on surveillance, which endangers and violates the rights of end users.

littlecranky67• 5 years ago

This should not be possible, or must be considered crypto analysis right away. An encryption is build by design such that it is not possible to obtain any knowledge of the content of the encrypted message (or series of consecutive encrypted messages). If I can make some assumptions about an encrypted message (i.e. its content, the authors interesets etc.) the encryption is flawed by definition.

forcry• 5 years ago

We should all just switch to something like https://delta.chat/en/ where the messaging protocol is implemented over plain old emails.

It makes the most sense, even without Facebook being bad and all.

kylehotchkiss• 5 years ago

I'm not very well versed in encryption but I know many here are and wanted to see if how I imagined this has any merit -

is this something where WhatsApp could encrypt messages word by word instead of by message, and keep a list of the hashes of top sent words and their counts somewhere, then facebook would send some ads directory to WhatsApp clients, where they'd encrypt each keyword in the dictionary, and then compare the dictionary hashes to the top send word hashes, and try to make a match on the client side for specific ads to show?

Or is this more that full encrypted messages would be scanned for some type of needle in the haystack that could infer some value about what's being sent?

elromulous• 5 years ago

I am not a cryptographer.

At a quick inspection this kind of thing would result in pretty bad encryption. A hash of each word (unless salted with a different salt each time, defeating the purpose) is easily broken, even if the hash is a cryptographic hash. I.e. I can build up a dictionary by hashing the top 100k most common words. This kind of attack is why every encryption needs some randomness (or something that's changing) injected to it. It's also unprotected against replay attacks, etc. And I'm probably just scratching the surface.

You really have to encrypt full messages. And sending the same message twice has to result in different ciphertexts. And you need nonces. And probably many other things. Cryptography is hard.

weex• 5 years ago

This would only be possible if the same encryption key was used for every message. But I don't think that's the case. So the same plaintext word is encrypted differently every time.

LightG3• 5 years ago

I'm just about still on Whatssap because my network are on it and I'm assured that messages are encrypted.

The moment ads arrive, I'm done.

I get the need to make money but this isn't it. *

* look at what Google did to Youtube for an abject demonstration in how to ruin your own platform ... 6 second ads because longer and longer, became multiple ads became full screen ads, became un-skippable, became ... all completely blocked or piped in separately now otherwise I'd go bananas.

beauHD• 5 years ago

I just wish AdTech companies had a system where you could fill out an extensive form, where you openly state what your preferences are, because the targeting seems very skewed and wrong, at least from what I've experienced.

Facebook thinks I like rock music, but I really like house music. Facebook thinks I eat meat, but I am a vegan. Facebook thinks I like cars, but I don't even drive. There's no way of telling Facebook what my tastes and lifestyle preferences even are.

Facebook just infers based on keywords and what things I interact with on their platform, which is a terrible way to gauge preferences, since I could talk about cars in a comment, per se, but that doesn't mean I drive.

It's the same with all other ADs I get. They're all almost fraudulently inaccurate, and as an engineer I think we should be building things that work properly, are lucrative on their own merit, and not based on borderline fraud.

JKCalhoun2• 5 years ago

Form I would fill out:

[√] Doesn't like ads.

emsy• 5 years ago

I mean I get it. I got to know somewhere that something I’m interested in buying exists. However, there has to be a better system then tracking my every move online and then force-feeding me ads about crappy products that I don’t like or worse, outright scams. I even watch videos on youtube about products I’m interested in VOLUNTARILY. How is this a billion dollar industry?

g_p• 5 years ago

There's a growing base of evidence in both the US and the Netherlands (from news media websites, I believe), that targeted advertising is effectively a bubble, and didn't yield higher metrics or revenues. In fact I believe in a couple of examples, they saw higher growth and revenues from ads by going totally non-targeted.

There's an entire sector now focused on trying to hyper-target ads, on the presumed basis they're more effective. If the house of cards falls down, and people realise untargeted ads perform better without all that extra cost, things could get interesting.

Unfortunately it isn't as simple as that, as "independent" audience measurement seems to still be a requirement that leads to adtech type solutions emerging.

To go back to your observation about the quality of targeting though, this shows in a way that it simply doesn't work... The trouble is advertisers continue to throw money at the services falsely claiming to have these accurate data-driven targeting models, without seemingly ever thinking to cross-validate them to be sure they aren't absolute nonsense of false claims of targeting demographics - your ones having entirely the opposite of Boolean demographics show how wild it can be.

I fetched my data from Spotify and the limited data they had (in theory objective data) was chronically wrong - they had tried to put me into a group based on phone network used, but it didn't even get that right, despite that being trivial to do(!)

marketingtech• 5 years ago

There's growing evidence that large media companies can generate revenue from advertising deals from large brands with high-level interest targeting.

That doesn't say anything about the performance of targeted ads - just that high-level targeting is a suitable replacement for narrow targeting at a certain scale.

That's a separate concern from niche publishers (without direct sales teams) and niche brands (who only have a few thousand dollars to spend on marketing) who both want to maximize the value they're getting from the ecosystem.

And that's where the real money in advertising is. Fortune 500 companies boycotted FB last year and it didn't make a dent in their revenue, because they have millions of small businesses that all spend $50 on ads per month. That level of spending is only effective with narrow targeting.

foobarian• 5 years ago

Interesting. Reminds me of the analogous process of iteratively improving a model or fitness function and over time ending up with something overfit.

8ytecoder2• 5 years ago

There is. It’s a bit crude and as far as I remember you can only remove things.

https://www.facebook.com/help/247395082112892

bastardoperator• 5 years ago

Couple this with the questionable junk they're always advertising too. Even when they do advertise correctly it's not anything I would ever consider buying. I left the platform last year and haven't looked back, it's a time suck/waste all around.

russh• 5 years ago

I'm convinced that the real target of targeted advertising is actually the ad buyers and not the ad viewers. It's a tool to increase the revenue of the ad sellers.

dunnevens• 5 years ago

Facebook kinda lets you do this now. Filling out a preference sheet, that is. Buried in your ad settings is a list of what FB thinks are your interests. You can remove any that don’t match.

Doesn’t always work though. You can remove all “interests” related to meat, and then still get slammed with steak ads after you clicked “like” on an article criticizing the beef industry. There seems to be a shadow list of interests that the user can’t see or edit.

The one combo that does work over time is deleting interests and consistently choosing “Do not show this ad again” for the unwanted subjects. But that’s more work than most are willing to do. I only did it because the ad system is interesting to me and I wanted to see how trainable it is.

heavyset_go• 5 years ago

Facebook thinks I like rock music, but I really like house music. Facebook thinks I eat meat, but I am a vegan. Facebook thinks I like cars, but I don't even drive. There's no way of telling Facebook what my tastes and lifestyle preferences even are.

Advertisers can also choose to target you via Facebook, even if you aren't in their apparent target demographic. I think this issue is a combination of both innaccurate and accurate targeted advertising.

treeman79• 5 years ago

Someone in your network, Ethernet sort, likes those things. Either at home or at work.

Lots of targeting is based on IP Adresss not device.

bromuro• 5 years ago

Ads are intended to make you to need something new, or to like something that you don’t need.

Ads showing you something you cannot afford can increase your desire of it, thus envying who can afford it, etc.

An ad appearing over and over is not necessarily intended to make you buy something. There are lot of sociological and psychological implications behind.

endisneigh• 5 years ago

I'm sure end-to-end encryption is great and all, but if a company like Facebook is giving you the client, what difference does e2e encryption make if you're trying to prevent Facebook from seeing your stuff?

Obviously you can see the plain text messages even if it was encrypted, and so Facebook/WhatsApp could theoretically see it too. Isn't this true of any app, e2ee or not?

Adding ads at that point is just trivial - process on the client.

i-848181-neev• 5 years ago

How I’m using WhatsApp today: because I have to in order to communicate with businesses and contacts that are required to use it in their home countries.

Ínstalled with no permissions to an address book, camera or mic. Somewhat of a pain that I can’t save contacts but at least it’s still possible to communicate.

tjmehta• 5 years ago

Head of WhatsApp (Will Cathcart) responded:

“We're not pursuing homomorphic encryption for @WhatsApp…”

Full tweet: https://twitter.com/wcathcart/status/1422611553954668546?s=2...

8eye• 5 years ago

i am sure “they” are reading this, others downvote me but, maybe ask our opinion before signup, like a quick 3 question survey. that would be less extreme than sounding creepy

Facebook reportedly researching ways to use encrypted WhatsApp messages for ads

Related Stories