Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I already knew this but it's still fucked.

In my country WhatsApp is used for everything from talking to friends through setting up a date with your hairdresser to group activities like school parents groups.

There is an expectation that the information you share by someone having your number is very limited - the person that has your number can text you, yes, but they can't know about you, and you can limit the small amount of info you let through like your profile picture or your online state using privacy controls.

This expectation is completely removed when adding somebody's number to your contact list is enough for Facebook to do its magic and reveal the owner in your Facebook friends suggestions.

I've had it happen dozens of times, I start texting a tinder match and suddenly her profile is there in my suggestions. It's common for it to misfire and I end up being suggested the personal account of the owner of a business I bought something for. They don't even need to text you, you add the number to your phone's contact list and it's there.

Facebook needs to be broken apart, and we need a law that the data you share with an app can't be used for others period, even more so if they were separate businesses when you started using the service, and a change of policies is not enough - you might already be locked in.



Stop giving your Facebook apps access to your contacts. Newly added contacts were also showing up as suggestions in Facebook and Instagram until I turned this off. iOS and Android give you all the control you need to stop this from happening you just have to use it.


For most people it’s not reasonable to use WhatsApp without sharing your contact list.

How do you know who you can message with it if the app can’t check who has it?

Do you, every time you want to message someone, manually copy in their number? For every person you communicate with?

What if they previously didn’t have WhatsApp installed, but have since installed, so you also need to check again every time you want to message someone who formerly didn’t have WhatsApp.

That’s not going to work for people.


I've been using WhatsApp without giving it contact access for a few years and it's possible but annoying. Since WhatsApp still shows you recent chats you don't have to type phone numbers each time, you just select from the list of recent chats. You also get to see people's WhatsApp profile photo so it's generally possible to know who you're talking to even though their username is their phone number. This works ok for me with around a dozen frequent WhatsApp contacts but I could see it breaking down if you have more than 20 frequent contacts.

> What if they previously didn’t have WhatsApp installed, but have since installed, so you also need to check again every time you want to message someone who formerly didn’t have WhatsApp.

Why is this important? I use WhatsApp instead of SMS for contacts who don't have (free) SMS or who want the extra security. It's pretty intentional. Why would I want to use WhatsApp with everyone? That concept seems aligned with Facebook's goals, not mine.


> Why is this important? I use WhatsApp instead of SMS for contacts who don't have (free) SMS or who want the extra security.

Because WhatsApp (and other messengers) offer a far superior messaging experience to SMS: higher fidelity media, on time delivery, delivery status, e2e, and many more. Better experience means that people actually use it.

As you say, for “extra security”. But not everyone arrived at the decision of “how much security” they need at the same moment in time. People come to and leave the WA platform, and it’s desirable for me to know where people are at now so I can use e2e in new places as opposed to only with the subset of my social graph that I manually copied and pasted in which had installed WA before me.

I don’t deny that you like your setup, but it sounds pretty painful and pretty unlikely to appeal to a broad swathe of people, which is essential when trying to combat mass surveillance.

(is mass surveillance why you jump through these hoops?)


On my prepaid plan in Europe I get a lot more data for the money than I get SMS messages. Text messages cost me 10 cents per message.

WhatsApp by comparison was practically free. So it is not even about superior messaging experience, it also comes down to cost.


> possible but annoying

That's the thing: people (non-tech, non-privacy aware) are always trading privacy for convenience.


What's sorely needed is a way to stop the exfiltration of private data when it's not provided for a specific reason. I bet very few people who share their contacts with WhatsApp know they're getting uploaded to Facebook.


Contact sharing between Facebook and WhatsApp should be opt-in with GDPR, but enforcement has been almost non-existent these last few years.


How do you know who you can message with it if the app can’t check who has it?

You ask them via other means? It might be slightly inconvenient, yes, but you almost make it sound like even SMS is an impossible task; SMS is not even that old and none of the millions who used it before there were even apps to do so had much of the problems you mention. Also because not everyone has a usecase requiring to know who has what app.

I run WhatsApp on an Android instance with an account solely for that, so no contacts etc, and literally all my contacts/groups in WhatsApp are people who at one point told 'let's do this via whatsapp'. Then again, I don't need to message people I don't know with it so I don't have any problems.

Do you, every time you want to message someone, manually copy in their number? For every person you communicate with?

No, just once, or else they send me a message and we're talking.

tldr; ok I'm not 'most people' in this regard, but still I think you're making things look way harder then they actually are


SMS is 25+ years old -- I only know I had it on my first phone -- and the absolute ubiquity of replacements (of which WhatsApp is just one) suggests those problems are real ones for a lot of people. If you're not "most people" in this conversation, that's a pretty big caveat when talking about how the problems are not actually so, really.


Yes, even if you are careful about Privacy, your friends will betray you by adding your data (phone, photos, etc.) to big tech services

Even if you never touched Google/Facebook in your life, they have your number and many other data about you via other persons

Even if you never touched an Apple device in your life, they already have done Facial Recognition on you because your friends took a photo of you and tagged you (see the creepy HomeKit doorbells that recognise you despite you have never agreed to facial recognition)

Laws totally fail to address that aspect of Privacy


Alternatively, delete the Facebook app from your mobile devices and only use Facebook via web (or only on your computers and not mobile).


Plus removing IG, FB and other social media apps dramatically improves battery life on older phones.


Stopped contact access, but my business Instagram handle keeps recommending me to follow my personal friends.


WhatsApp is nearly unusable without contact access in iOS. That’s why I installed it a long time ago.


It's annoying, but not "nearly unusable". I've been using it that way for a long time. I've gotten pretty good at figuring people out from their display pics.


It happens without any facebook app installed, just tinder + whatsapp and voilá, you'll get the suggestion when you log on with a browser.


Whatsapp is a facebook app, that's the point.


Well I installed whatsapp early on when it was just and only a messaging app. I couldn't possibly have predicted that it would be bought by facebook and used to cross-reference with some dating app.


it still gets your information if you're in someone else's contact list and they make the connection


This. I recently installed Telegram without giving access to my contact list.

Within seconds of installing, I received a telegram from a co-worker who jokingly said: "For privacy reasons, when you install Telegram, it sends a message to all of your contacts."

It simply creates your virtual contact list from the contact lists of your contacts.


Same in mine, but instead of WhatsApp it is Rakuten Viber, which is massively popular in Eastern Europe. Beats me why, I don't like it that much and don't have a slightest idea about what are they doing with our data. But it became an issue trying to communicate without it. I'm a WhatsApp user from the early days, and I'm still dreaming about a day WhatsApp will be "independent" again.


Hi, it wont be independent again.


I am trying to get rid of WhatsApp. My strategy for this is: Use iMessage with friends in the Apple world. Convince the Android folks to start using Signal. Has been quite successful so far.


I'm excited for the public launch of e2e encryption in the Android default Messages app. This would provide encrypted messages to a huge audience, everyone already on Android.

Signal has stated that they will not support RCS (possibly that they can't due to technical limitations).


iMessage's end to end cryptography has been backdoored via iCloud Backup, on by default since 2011. It uploads complete message history to Apple (even SMS, which they would not normally see) with Apple keys. Even if you have it turned off, your conversation partners won't.

Have your Apple friends install Signal, too.


https://support.apple.com/en-us/HT202303

> To access your data on a new device, you might have to enter the passcode for an existing or former device.

> Messages in iCloud also uses end-to-end encryption. If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages. This ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices. When you turn off iCloud Backup, a new key is generated on your device to protect future messages and isn't stored by Apple.

I didn't realize messages was an exception to storing the key on local devices.


> If you have iCloud Backup turned on, your backup includes a copy of the key protecting your Messages.

iCloud Backup is not end to end encrypted.

That linked article is designed to be intentionally misleading.


Whenever I try to install Signal, it asks me to update Google Play Services. Sorry, but using Google Play Services seems worse than using Whatsapp.


doesn't whatsapp use Google play services? that's how you normally do push notification on android


When I disable all Google services, I still recieve Wire, whatsapp, Messenger Lite (for marketplace), and email messages. All messages are on-time, with Whatsapp coming through faster than on my coworkers iphones.

Ironically, Fluffychat, a Matrix client, is the outlier - it relies on Google Services Framework to deliver messages


It works fine for me. Maybe notifications don't appear as fast as they did when I used Google Play Services (I'm not sure about this), but everything else works fine.


Telegram is a great alternative to WhatsApp. It's better in almost every aspect, as far as I can tell.


It's worse in the most important aspect for messaging: it is not end-to-end encrypted by default. It wouldn't be crazy to assume some could get access to your messages.

[0] https://www.independent.co.uk/news/world/europe/telegram-rus...


Except message security. Whatsapp is end2end encrypted by default. Telegram does not, they only provide transport security by default.


Besides the obvious downside of not being meaningfully encrypted (even pointing out transport encryption as just "encryption" is borderline deceptive marketing these days, IMO), until recently it also had a very dubious business model.

It now seems to be pivoting towards ad support, but isn't this exactly what people have been trying to get away from Facebook for?


Signal is a better choice because it uses end-to-end encryption by default.


This has never happened to me, probably because I don't install the Facebook app and don't give Messenger Lite access to my contacts. If Facebook and Whatsapp were sharing phone numbers or metadata behind the scenes I would expect to see a lot of suggestions when I log in to the Facebook website, but I don't.

Still agree with your opinion, though. Also, I find it annoying that you can't message someone on WhatsApp without adding them to contacts.


You can actually send a message without saving a contact. Using WhatsApp's click to chat:

  wa.me/263xxxxxxxxx?text=Hello
Note: The phone number with country code and no preceding plus.

Opening that link will launch WhatsApp (or WhatsApp web) to the user's number and the text "Hello" in the message field.


On Chrome Desktop Linux, it doesn't work despite me being logged into whatsapp web. Tries to do some xdg-open thing, but clearly that will never work considering whatsapp web has no registered protocol handlers...

Looks like it is some half completed demo integration rather than production ready...


Send the link to yourself in whatsapp and then click on it.

Open a chat with yourself in whatsapp. https://wa.me/your-number . You can spam anything here, it's personal and only you can see it.

They send wa.me/number-of-person-you-are-contacting in that chat. Click on it and it will start a chat with person-you-are-contacting.

All numbers MUST be in international format. Country code and number.


I made a tool exactly to do this: https://trianguloy.github.io/OpenInWhatsapp_Web/


Yeah it used to be quite hopeless unless you opened the link in a tab that had already loaded WhatsApp web. Now however, if you click the green button that says "CONTINUE TO CHAT" on the initial screen, it'll load a page with an option to download WhatsApp and another that's titled "use WhatsApp Web", just click on that one. Unfortunately, it will load a new instance of WhatsApp web in the current window even if you already have another open in another tab.


Doesnt seems to work for me. Get directed to a page saying I don't have WhatsApp installed (I do).

Android v8, Firefox v68.6.


That is because you are opening in browser. You have to set wa.me links to open in app.

Open firefox settings, toggle 'open links in app'.

(or)

Open a chat with yourself in whatsapp. https://wa.me/your-number . You can spam anything here, it's personal and only you can see it.

They send wa.me/number-of-person-you-are-contacting in that chat. Click on it and it will start a chat with person-you-are-contacting.

All numbers MUST be in international format. Country code and number.



They don't as much share info as live off the same ecosystem in your phone. Regular users, who don't actively block their FB apps from accessing their phones in depth, will store Whatsapp contacts on their phones, which in turn are read by the FB and/or Messenger app. Since neither knows the context, it just assumes its a new contact and show you info accordingly.


>I don't install the Facebook app and don't give Messenger Lite access to my contacts

Literally doesn't matter what you do, it's what other people do with your data. I can tell from this guy I interned for 15 years ago that at one point he uploaded his entire address book to Facebook including my name, email and phone number because he still shows up in facebook recommendations to me today on Facebook and IG.

Never gave them access to my contacts either or even had him in my contacts but FB's shadow profile knows he knows who I am.


But your contacts do install the apps and Facebook can now match you.


I don't use their apps.

They are almost certainly sharing data behind the scenes, they openly say this in op's link about how WhatsApp uses your data:

> improving their services and your experiences using them, such as making suggestions for you (for example, of friends or group connections, or of interesting content), (...) across the Facebook Company Products;

There is a small chance that they've gotten all my data from the people at the other side of the conversation if they have the fb app installed I guess, which really isn't much better.


> Also, I find it annoying that you can't message someone on WhatsApp without adding them to contacts.

The trick that i use is to type their number into the domain wa.me in the following format https://wa.me/xxxxxxxxxxx

That allows you to open a chat to that specific number without adding them to your contact list.


That’s a neat trick, but “Works for me” is not a solution for mass surveillance.


> Also, I find it annoying that you can't message someone on WhatsApp without adding them to contacts.

You can, if you're both part of a group chat together. Tap on their number and a pop up comes up allowing you to message said person.

Also agree with the opinions expressed even with similar experience to yourself (no Facebook or messenger apps installed, WhatsApp contacts don't appear as suggestions on FB website).


There are also third party apps like "Click to Chat" that let you start conversations with phone numbers. Once you sent 1 message you can just use whatsapp normally.


> Also, I find it annoying that you can't message someone on WhatsApp without adding them to contacts.

Is this a new limitation? On iOS I'm still able to message someone new using only their phone number. Though I'm blocking contact access so perhaps that's why.


Facebook doesn't have my phone number but it still happens to me regularly, because I need the Facebook messenger app. Its really fucked.


My suggestion would be to not connect any Facebook services. I have an old school FB.com account, an Instagram and a WhatsApp. All three of these accounts are not aware of one another. I'm sure FB probably still has ways of figuring this out but it gets you pretty far in mitigating the infomation flow between various FB products.


Signal (signal.org) is a good replacement!


Given that all features are known, how difficult is to build p2p WhatsApp clone ? Including all feature parity ?


It already exists, but there's one feature that you can't copy from Whatsapp: its 2 billion users.


Also, free WhatsApp data is a perk of telcos in many countries (most of the Americas). A service that uses up expensive data just cannot compete with one that does not.


> Given that all features are known, how difficult is to build p2p WhatsApp clone ? Including all feature parity ?

Signal. It even has one of WhatsApp's founders behind it now.


Signal doesn't have feature parity with WhatsApp.

Signal groups are a mess.


here in israel its the same

and we also got very high presence of Truecaller so basically if you expose your phone number anybody can find your real name and FB profile


To hide names from Truecaller, we have to create a truecaller account with the phone number and then change the name from your profile.


i thought truecaller used an average of everybody else's contacts to figure what to display


Ah, latin america.

Ah, Brazil.


Why are you still using their products? From your comment you seem pretty passionate about this issue.

From economics there is the concept of "revealed preference", your individual subjective preferences are revealed by the choices you make. In this case, we can observe that Facebook's subjectively bad qualities are enough to demand politicians Do Something, but not enough to suffer the inconveniences of using a different chat app, etc.

The sad irony is that these points of concern are also potential advantages for competing platforms (e.g., Signal), and by regulating them away, Facebook/Whatsapp become further entrenched.


> In my country WhatsApp is used for everything from talking to friends through setting up a date with your hairdresser to group activities like school parents groups.

Presumably because they would like to be able to set up a date with their hairdresser and participate in parents groups. Maybe they could convince their friends to switch, but also maybe not. This is why there is a call for government intervention: a single person faces an enormous social cost for boycotting FB properties, but the government can coordinate either a change on Facebook’s end or a simultaneous changeover to other services.


It is sometimes even worse than that, my doctor appointments have to go through WhatsApp too. I don't like WhatsApp but I have no choice when my health depends on it.


> Presumably because they would like to be able to set up a date with their hairdresser and participate in parents groups.

That's a problem, but it's their problem. Having a problem doesn't justify coercing others (in this case, Facebook) to solve it for them.

It's OK if we want to solve those problems for them, but it's not OK to force someone else to solve them.


> a single person faces an enormous social cost for boycotting FB properties

I'm not clear on how to quantify "enormous". Many people don't use facebook and still manage to make appointments and lead fulfilling social lives.

That said, it is clear that for many people the "social cost" is larger than the "facebook evil cost", even for people demanding government intervention. I guess for those people, the cost for demanding politicians Do Something is even less.


I'm not clear on how to quantify "enormous". Many people don't use facebook and still manage to make appointments and lead fulfilling social lives.

It depends a lot on your country or region. Your life is different from other people's lives.

In my country, decoupling from Facebook is pretty easy. Google, less so, but doable.

In some countries, decoupling from certain apps or ecosystems will leave you pretty much stranded.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: