WhatsApp is more secure than iMessage: Mark Zuckerberg

https://www.facebook.com/zuck/posts/whatsapp-is-far-more-private-and-secure-than-imessage-with-end-to-end-encryption/10114735238351021/

by amrrs • 4 years ago

57 93 4 years ago

facebook.com

snickmy• 4 years ago

this is technically correct. Yet missing the bigger point of the privacy war between Apple & Meta

fshbbdssbbgdd• 4 years ago

Maybe the fact that Apple is worse in one of the few areas the user can actually verify should make us second-guess our preconceived notions? What if Apple is just better at PR?

howinteresting• 4 years ago

This is generally true, though there's an asterisk: https://www.rollingstone.com/politics/politics-features/what...

Whatsapp adding end to end encryption for backups is a big deal, though. The FBI pressured Apple to not do so for iMessage.

avarun• 4 years ago

The other tech giant that can be compelled by law enforcement to hand over potentially large amounts of sensitive messaging data is Apple. iMessage, Apple’s text-message service, comes loaded on the iPhone and is used by 1.3 billion people worldwide. According to the FBI’s “Lawful Access” guide, if served with a court order or a search warrant, Apple must hand over basic subscriber information as well as 25 days’ worth of data about queries made in iMessage, such as what a targeted user looked up in iMessage and also which other people searched for that targeted user in the app. That doesn’t include actual message content or whether messages were exchanged between different users.
But the amount of data available to law enforcement is potentially far greater — greater even than the user data provided by WhatsApp — if a targeted user backs up their iMessage activity to iCloud, Apple’s online storage platform. If that’s the case, the FBI document says, then law enforcement can request back-ups of the target’s device, including actual messages sent and received in iMessage if they’re backed up in the cloud.
While Apple describes iCloud as an encrypted service, it comes with a giant loophole. Apple holds an encryption key that can unlock user data in iCloud, and so police departments or federal agencies can request that key with a search warrant or a customer’s consent to access certain user data. “You’re handing someone else the key to hold onto on your behalf,” says Mallory Knodel of the Center for Democracy and Technology. “Apple has encrypted iCloud but they still have the keys, and as long as they have the key, the FBI can ask for it.”

robg• 4 years ago

And yet, nothing Zuck says will help me to trust him. Makes me wonder what Meta / Fb could be with a different leader. He’s not a product visionary.

Jyaif• 4 years ago

He created facebook and is responsible for the purchase of Instagram. That makes him a product visionary in my book.

AlexandrB2• 4 years ago

The question is whether he still is one or the market has moved past him. No one stays relevant forever.

rvz• 4 years ago

There you go.

Founding the fastest $1 trillion dollar company in the 21st century sounds like what a product visionary would make and Zuckerberg is undisputed over that claim, while many have told him the Instagram purchase was a mistake, after finding another billion users again.

The proclaimed death of Meta Platforms. Inc has been greatly exaggerated (again).

lavventura2• 4 years ago

He created facebook but over time the number of people using it dramatically decreased and it will never be same again. All the ads make me feel controlled by their product.

Everday I ask this question to myself. Will the world a better place without Facebook and Instagram?

robertlagrant• 4 years ago

I don't think being a product visionary would make his statements about messaging privacy more trustworthy. Or at least, they shouldn't. Peter Molyneux is a product visionary, but I'm still not playing the full release of Godus.

joshe2• 4 years ago

WhatsApp also doesn't get screwed up by weird carrier sms integration like iMessage does.

Just traveled overseas and used a different sim card with my phone. Not only does this screw up iMessage while overseas (it shouldn't), but for 2 weeks after getting back iMessage would occasionally just not receive texts. Did 3 Network resets and the last one (at 2 week mark) finally fixed it.

I'm sure this is more verizon's fault, but Apple needs to work around it.

oneplane2• 4 years ago

You must have never had to transfer WhatsApp on a new carrier and find out that the carrier MITMs your SMS and you cannot activate that way and you have to ask your carrier for that. Not common in the US or western EU I suppose, but there are lots of countries that aren't in those areas and they have carriers too...

aoetalks• 4 years ago

I had this problem too. Call your carrier and convert your domestic SIM to an eSIM and pop a new physical one in.

Turn off roaming on main SIM card and iMessage still works, but uses the data of the other SIM card.

heystefan2• 4 years ago

I've tried doing this, only the other way around — kept my provider's physical SIM and bought an eSIM for travel.

Turned off roaming on the physical SIM and made data only go through eSIM, but it still got all messed up. :(

joshe2• 4 years ago

Interesting and thanks! I'll give this a shot.

heystefan2• 4 years ago

Ugh, this is the worst. And then people are like "why are you suddenly messaging me from this other account".

dzhiurgis• 4 years ago

Started using whatsapp few weeks ago in new area where is common.

Very annoying UI to get started. You need to add new contact, then from massive list select country code and finally you get to paste number.

For iMessage - default yourself and others to use apple id email address.

zamalek• 4 years ago

If it is, then why would he be so desperate for us to use it?

randoglando3• 4 years ago

I would assume he has a bone to pick with Apple (see the not-so-subtle jab at Connect as well).

dabedee• 4 years ago

Except you can never trust Facebook to care for user's metadata in a privacy-preserving way, which, to me at least, seems like a security risk. While the actual messages are encrypted, everything else (i.e the metadata such as your contacts, your connections, etc.) is not and is probably used/mined by Facebook. Why anyone would trust that company to do the right thing at this point is beyond me.

tapoxi4• 4 years ago

This is why I recommend friends & family use Signal, and they've actually adopted it due to the really easy on-boarding. It's probably the best iMessage alternative out there.

zaik3• 4 years ago

That's why I run an XMPP server for family and friends. It's the IETF standard, no vendor lock-in and has Signal-style encryption nowadays.

aleksandrm• 4 years ago

Signal is dropping SMS support soon. It was one of the main features that I was able to convince my friends and family to use this app, a convenient all-in-one messaging app. Without it I'm not sure anymore, quite a baffling decision on their part.

godelski6• 4 years ago

And to onboard iPhone users you just need to get them frustrated with not being able to send photos and videos to Android users. Thanks Apple. Apple users get tired of sending videos to Android users and them responding "email it to me" or "let's use Signal."

soperj3• 4 years ago

I was chatting with a friend on whatsapp about a guy we used to play sports with in our childhood. Hadn't really seen or heard of him in decades. Very next day, top recommended friend on facebook was that guy. Seems unlikely to be a wild coincidence. That said, I wouldn't(and don't) trust Apple either.

markstos• 4 years ago

WhatsApp may be sharing your contacts with Facebook to provide friend suggestions.

Reference: https://webapps.stackexchange.com/a/117130

greatwhitenorth• 4 years ago

People care about utility, usability, and cost. Except for the 10 neckbeards in Hacker News, no one cares about privacy in the real world. People won't stop using Apple products which is built on slave labor in China but will froth in the mouth about privacy.

tinus_hn3• 4 years ago

The mainstream media will be frothing at the mouth at how Apple products are built on slave labor, while all phones, Apples and their competitors, are built in mostly those same factories.

The only difference is that Apple publishes their yearly Supplier Responsibility report, which, yes, does contain reports that their audits found violations. And then the violations are resolved or the supplier is banned. What more are they to do?

There is a long way to go, that’s why it’s a progress report. And yes, there are aspects that are left unmentioned, like the unionization debacle in the stores. But really Apple is not who you should be focusing on for slave labor.

https://www.apple.com/supplier-responsibility/pdf/Apple_SR_2...

martin1975• 4 years ago

Nailed it. WhatsApp was the first or among the first few kids on the block... and maybe if FB didn't acquire them, they'd have improved or heck, even gotten subsumed by Signal. Signal's non-profit and for now, well funded... nowhere near the coverage of WhatsApp but I steer everyone toward Signal when I can...

thefz• 4 years ago

I don't trust Apple either.

dilap• 4 years ago

On the face of it, this is true. Since most people enable iCloud backups of messages, which are not encrypted, you should basically think of iMessage as unencrypted, unless you are very sure both you and the person you are messaging do not have iCloud backups enabled.

On the other hand, I'm not sure how much to trust Zuck's claims of WhatsApp encryption, or if external people have attempted to verify the claims, but it seems like such a big deal to lie about, that it's probably true?

Of course, that's only going to provide you passive protection from things like automated scanning of messages. If you become a target, it seems as though there are always exploits floating around which can be used to hack your phone, and then all bets off.

sfvegandude3• 4 years ago

iCloud backups are encrypted, just not end to end. Which is as good as not encrypted.

oneplane2• 4 years ago

How good it is depends on the actor/threat model. I'd say that server-side encryption is always a good thing when you include someone trying to steal disks from a SAN array to see if there's tasty data on it.

On the other hand, if your adversary wants to get your stuff, they will find a way. The whole cryptography thing is just imposing cost on a potential attacker, not a universal warranty against any possible attack. Someone can still locate you and beat you with XKCD's $5 wrench for your password.

Ideally we'd have end-to-end encryption on everything without adding complexity for end-users. But a lot of that stuff seems to be hard to build and at least just as hard to retroactively bolt on to a system. iMessage (iChat) goes back a long time and supports many platforms (yes, within the apple ecosystem, that is) which means they can't easily nuke every legacy API at once.

tinus_hn3• 4 years ago

They are end to end encrypted, but you are not the only one holding the key. So although you can’t see for yourself, Apple does control who gets to look and there is no analytics going on.

And you can of course always chose to run local, encrypted backups.

dartharva• 4 years ago

WhatsApp backups also aren't encrypted by default. You need to turn that feature on manually.

iamjk• 4 years ago

There was an external audit in 2021 – https://research.nccgroup.com/2021/10/27/public-report-whats....

madeofpalk• 4 years ago

Mark Zuckerberg says his product is more secure than his competitors. I would expect him to say that, regardless of the 'truth'.

AlexandrB2• 4 years ago

He's probably right but, based on past experience, there's significant risk of Meta changing this in the future for revenue-generation reasons. Trust is hard to earn and easy to lose.

annadane2• 4 years ago

lol. Zuck, you spied on people with Onavo and kicked Acton and Koum out of the company, you have no moral standing whatsoever

BiteCode_dev• 4 years ago

Or, maybe or, they are both closed source and given the USA mass spying and secret tribunal we gotta assume they all have a backdoor. And that this backdoor has been found and exploited by black hats and corrupted employees or politicians.

super2562• 4 years ago

Except for the fact that a new exploit which allows RCE is found every year.

It's beyond me how WhatsApp has had so many exploitable memory bugs compared to e.g. Signal or Telegram. Is it really just because security researchers would rather look at WA than Signal because of it's bigger user base?

geophertz2• 4 years ago

Except for the fact iMessage is well known for its RCEs as well: search for "iMessage RCE" you will find them.

Furthermore (this may not be the case anymore), iMessage is more privileged than other apps and so once exploited an attacker has a far greater reach.

super2562• 4 years ago

Yup. That's why I don't use iMessage. :)

nvrspyx• 4 years ago

Probably because they're a large target and because it's more financially worthwhile. I imagine their bug bounty program pays out more, plus I know they've awarded $50,000 per research grant in the past.

exabrial• 4 years ago

Independent Fact Checkers have confirmed this is false.

geophertz2• 4 years ago

Would you mind sharing who those independent fact checkers are?

danpalmer2• 4 years ago

I think it's a joke, this is the text that Facebook puts at the bottom of some false information.

As with all jokes though, I think there's an element of truth to it. May not be independent fact checkers, but discussion in this thread covers the iMessage comparison and I wouldn't say it's as clear cut as Zuckerberg would like to make out.

alphabettsy• 4 years ago

Apple should make iMessage backups E2E encrypted but I otherwise trust Fb far less.

lvass• 4 years ago

Client-side encrypted, rather.

mandeepj• 4 years ago

Not true https://www.livemint.com/news/india/whatsapp-says-indian-gov...

filmgirlcw2• 4 years ago

lol.

(I know we should have more substantive comments, but honestly, anything Mark says, I assume is false on its face)

mikro2nd2• 4 years ago

I agree with you regarding Zuckerberg -- he's in the same camp as every politician (imho). Nevertheless, if you don't have anything substantive to say, it's always an option to just not say anything. Just saying.

filmgirlcw2• 4 years ago

I usually do refrain. This time, I just couldn't. In all honesty, replying with "lol." was at least the safe for work version of what was actually in my head.

tpush• 4 years ago

He's not wrong in this case, though.

boomboomsubban• 4 years ago

Then adopt Signal's GPL and prove it. Or any other free license. Until then, any claims are hollow.

sleepybrett• 4 years ago

Shouldn't he be cracking a whip over at the 'legs in vr' division?

wronex• 4 years ago

I've been trying to figure out how end-to-end encrypted communication is supposed to work in these apps. From what I can gather you need two things, a central server, and public key encryption. To start a conversation your first task is getting the public key of your intended recipient. This is supplied by a central server that acts as a public key repository and message relay/store. Then you can send your message by leaving it at the central server for later delivery to the recipient (encrypted with their public key.) This is also the start of some form of key exchange in the hopes of switching to symmetric encryption for future communication.

I see problems with this setup. The central server is responsible for relaying communication since there is no directly link between those trying to communicate. It is also responsible for handing out public keys. It is literally a man in the middle. What is stopping the central server from lying about the public keys? What is stopping the server from decrypting everything?

Hopefully my understanding of this is wrong. It is certainly incomplete.

zhackay• 4 years ago

Isn't WhatsApp messages sent to Apple's Push Servers without e2e encryption. Just stating the obvious

godelski6• 4 years ago

I think people are missing the point here. The reason he is calling it more secure is because it is multi-platform. iMessage isn't secure if you aren't talking to another iMessage user. Apple's walled garden is a great strength but also their Achilles heel.

But of course, this is why I use Signal instead. If I'm going to use a 3rd party app, why not use one that is actually secure.

annadane2• 4 years ago

But given his history of acquiring the product he has no right to talk; what he did is blatantly criminal

godelski6• 4 years ago

I'm not sure what that has to do with my comment though. I think we are all in agreement that Zuckerberg is not a "cool dude". But that seems relevant for a different thread and not a response to what I wrote.

laylomo2• 4 years ago

The Zuck cares about our security and privacy? Cute.

quitit2• 4 years ago

That's not a statement that is supported by Whatsapp's own privacy policy, and it's deliberately vague to subvert from how Meta uses your available data for advertising purposes.

To use a few examples:

- When sharing your location with a contact. This feature is provided by sending your location to Meta, not directly to the contact through E2EE. Even when not sharing your location Meta will approximate your location from your IP address and other available information such as the phone number area codes. For both of these scenarios Meta feed this information back into their system for other uses.

- Your contacts, and all metadata are taken by Meta for their usual purposes.

- Any kind of status update is immediately provided to Meta. Whatsapp's E2EE applies to only a specific subset of the app's functions.

- There are a range of automatically collected pieces of information that the app provides whatsapp, anecdotal evidence also indicates that whatsapp reports back conversation keywords. Such reporting usually presents unseen security risks to users.

Meta have been attempting to dilute the conversation about privacy and security by providing sly talking points for how their products are "private" and "secure". For example: They have stated that facebook is private because their servers are well maintained against hackers. They're currently heavily advertising whatsapp as secure because it offers E2EE messaging - neither of these statements address the underlying issue with Meta: it's an advertising company based on invasive data collection. Meta build profiles on users which are unacceptably detailed, we wouldn't trust our own elected representatives with such detailed profile building.

randoglando3• 4 years ago

From a personal standpoint, why should I care about having profiles built for ad targeting anyway?

quitit2• 4 years ago

This would be a long reply that duplicates a lot of information you can find online about the dangers resulting from such profiling, such as how that information is shared and joined with other sources to accurately identify individuals. The short answer is that it's not just ad targeting and Meta have proven repeatedly that they're not good custodians of such data. Additionally this presents scenarios where such information can be subpoenaed - to use a recent example there are now legitimate concerns for such data since the rolling back of abortion rights in the USA.

emareg• 4 years ago

Only an open protocol like Matrix will end this race of platforms/apps for users and their data. WhatsApp or iMessage is not a real decision from a user perspective...

dclaw• 4 years ago

Never use any Zuckerberg products. Delete them all.

nathanaldensr• 4 years ago

How about this: neither are secure. If you want security, use PGP or something like Wickr (if you trust Wickr's security claims).

rreyes1979• 4 years ago

My wife was planning a trip with a friend on Whatsapp and for the first time in her life mentioned something about renting a car. She never searched for it in Google or anywhere else but not 24h after that, car rental ads for the specific city she will be visiting started to appear in her Instagram feed.

So I guess when Zuck talks about security that doesn't include privacy.

WhatsApp is more secure than iMessage: Mark Zuckerberg

Related Stories