r/privacy • u/JustAnotherUser43 • 18h ago
question Can someone explain to me in layman terms why WhatsApp is not as good for privacy as Signal?
As per the title. I know WhatsApp “tracks” things identified to you, but all messages are encrypted and if you use it on an iPhone with “ask app not to track” enabled, then it can only get data if you purchase something through WhatsApp? Right?
I am clearly missing something - can someone explain in layman terms what the WhatsApp risk really is from a privacy point of view.
22
77
u/Comfortably_drunk 18h ago
In laymans terms: Meta bad. Signal not as bad. Yet.
12
u/Timbit42 17h ago
If the government decides Signal should collect more metadata and share it with the government, then Signal won't be much better than WhatsApp. Both are centralized and Signal could easily start collecting metadata.
The most private messengers do not collect metadata and hide your IP through multi-hop routing and do not have a central server where metadata can be collected. If a government does force Signal to collect metadata, people will move to the more private messengers. It may only be a matter of time.
15
u/Busy-Measurement8893 17h ago
If the government decides Signal should collect more metadata and share it with the government, then Signal won't be much better than WhatsApp. Both are centralized and Signal could easily start collecting metadata.
Sure, but that would require client changes due to Sealed Sender preventing a lot of metadata from being collected in the first place.
-9
u/Timbit42 17h ago
So what? Do you think Signal would not comply with a government order? US citizens are supposed to have a right to privacy but the founding documents aren't being followed as religiously these days.
20
u/TopExtreme7841 16h ago
Considering they were about to totally shut down their EU servers over shit like that, no, they most likely wouldn't.
If they made those changes we'd see it, and if it was re-licensed as proprietary, that would end 99% of the users, normal people don't use Signal in the first place, so again, no.
15
u/Busy-Measurement8893 17h ago
I think they would sooner do a Session/Quad9 and move to another country than comply.
Also, Signal is FOSS. You could easily dodge any such changes to the client by just using Signal-FOSS or Molly.
-5
2
11
17h ago
[deleted]
14
u/cryptosupercar 17h ago
A reminder that the US drone assassination program solely uses metadata for targeted strikes, in the event that anyone thinks, well at least they can’t see my messages.
10
u/GhostInThePudding 15h ago
WhatsApp isn't open source, therefore it can't be trusted for privacy.
Sure it may encrypt your messages, but how do you know it doesn't also send a copy of some messages to Meta, or has a backdoor so they can decrypt your messages.
When it comes to privacy, nothing that isn't open source can ever be trusted. Yes open source apps can have things snuck into them too, but at least it is possible to check. Non open source apps can simply never be trusted.
8
u/theantnest 16h ago
Whatsapp has encrypted backups turned off by default.
So even if you turn it on, everybody you message must also have it turned on for it to be secure.
14
u/LurkerByNatureGT 17h ago
Meta may not know the content of the message, but they know who is messaging the crisis text line at 2am. And they will add that to their profile to target advertising.
3
u/tacularia 13h ago
Something to do with the way spyware is deployed. And the reputation of the parent company. Most users don't have to be worried about that kind of thing though.
1
u/wierd010 11h ago
How’s spyware deployed through whatsapp ?
1
u/tacularia 6h ago
Any chat app can receive files, whether they are legitimate or malware. They are one of the most vulnerable apps you can have on a phone and if you're targeted that would be a potential way in.
3
u/The-Last-Lion-Turtle 11h ago edited 8h ago
Signal regularly replies None to a subpoena.
This is what Whatsapp collects and sends when asked.
Also I don't believe in anything privacy that's based on asking rather than it being cryptographically secure.
6
u/UniqueClimate 12h ago
lol, here I’ll actually provide a layman’s term, unlike others in this thread:
Signal is more secure because they publish their code, as opposed to WhatsApp where we just “have to take Facebooks word for it” that it’s secure and private.
“Take Facebooks word for it” let that sink in.
8
3
u/Tough_Promise5891 8h ago
Meta ( Facebook ) owns WhatsApp, but signal is independent. Facebook makes money by selling your data, signal does not need to
3
16
u/fdbryant3 17h ago
I was going to write a reply but decided to let an AI I am not allowed to name do it for me:
Signal offers superior privacy compared to WhatsApp in several key areas:
- Metadata protection: Signal uses a feature called Sealed Sender to hide metadata, including who sent a message and when, even from Signal itself. WhatsApp, on the other hand, can access and share metadata with Meta and third parties.
- Data collection: Signal collects minimal user data, while WhatsApp gathers extensive information such as device ID, usage data, purchase history, location, and contact information4. This data can be used for Meta's research purposes.
- Open-source transparency: Signal's code is open-source and peer-reviewed, allowing for independent verification of its security claims. WhatsApp's code is not open-source 3.
- IP address protection: Signal offers a call relay feature that hides users' IP addresses during calls, whereas WhatsApp does not provide this option.
- Customizable privacy settings: Signal allows for more granular control over privacy features, such as adjusting notification content and using disappearing messages across all chats.
- Address book handling: WhatsApp uploads users' address books to Meta servers without encryption, potentially exposing contact information to bad actors. Signal handles this data more securely.
- Corporate ownership: Signal is independent, while WhatsApp is owned by Meta (formerly Facebook), which has a history of data privacy concerns.
9
1
u/Creative_Crayon 2h ago
Point one is so important - Sealed Sender means that only the recipient can access the data. Whatsapp could be compelled by a court order to release data, or they could choose to look at the contents of a message.
Signal has no access to the message, so can never be forced to disclose it.
All the over features are bonuses, but Sealed Sender and minimal meta data are key for why privacy advocates recommend it.
4
u/Icy_Jeweler_9508 15h ago
WhatsApp is owned by meta who collects a bunch of metadata about who you call and message and when, etc. and shares this info with other meta companies such as Facebook to better advertise to you and what not. Collecting this data also means it's more subject to hackers, law enforcement, etc to see it (fortunately messages themselves are e2ee)
Signal does not collect this metadata and therefore doesn't have this information for themselves (or others) to use to track who you have in your contacts, who you message and when
2
u/Ibe_Lost 6h ago
Whatsapp has been known to be hacked. Signal likes to yell to people on your contact list hey this guy just installed signal.
2
3
u/mercistheman 17h ago
Trying to see the value using signal if your contacts are not planning on switching also.
1
-2
u/Own-Custard3894 17h ago
WhatsApp and signal are end to end encrypted. When talking about end to end encryption, you need to be very specific about from which end to which end. In the case of both signal and WhatsApp, they are encrypted from the signal or WhatsApp app, to the recipient signal or WhatsApp app. That means the apps themselves have full access to everything being sent, unencrypted. For that matter, all messages are also fully available unencrypted to the system (eg iOS or android), in order to display them on the screen.
The next question is how much do you trust the app developers. I for one trust signal (open source, nonprofit) a lot more to not violate my private data than Meta (which claims it doesn’t use WhatsApp messages, but it’s definitely harvesting something, IMO).
3
u/MoxFuelInMyTank 16h ago
Signal is sealed sender and best they can give is the phone number and unix date of creation. Ultimately you can never unsend a message so security is always reliant on never sending things in the first place.
-5
u/RemarkableWorms 18h ago
WhatsApp uses the Signal protocol as far as I know
2
u/Dako1905 17h ago
You are correct, but Signal tries its best to delete all metadata where Meta instead tracks and gives the glowies all your metadata.
-9
u/Danoweb 17h ago
Answer: encryption.
Longer answer: signal uses a specific protocol for its encryption that makes it much more difficult to intercept and read messages. Other apps like whatsApp, etc simply encrypt the messages "en route". But signal encrypts things en route, as well as in storage, and it doesn't use the same encryption key for everyone, it uses a form of GPG encryption so that the keys for each conversation are different from the keys for other conversations... This makes "brute forcing" or other "test and check" approaches much more cumbersome for would be attackers.
8
u/Busy-Measurement8893 17h ago
WhatsApp uses the exact same protocol as Signal and has been doing so for almost a decade:
5
193
u/Vast-Total-77 17h ago edited 17h ago
On WhatsApp it is impossible to hide from someone who knows your number unless you block them especially if you are in a country where WhatsApp is the equivalent of iMessage in popularity. They’ll know for sure you blocked them. Signal on the other hand you can fully prevent someone from finding you even if they have your number.
Signal can be seen in multiple court documents providing useless info whereas WhatsApp provides lots of useful metadata, etc.
Signal doesn’t belong to any ecosystem. Signal is signal. WhatsApp is Facebook. Facebook is Instagram. Privacy consumers, you get the idea.
Reading through signals blog, they are aware of modern threats to cell phones such as Cellebrite, Graykey. They even went as far as exploiting one of the devices. I can safely assure myself that if all parties involved in a signal chat factory reset their cell phone, those messages are gone forever. For a device that isn’t wiped, deleting the app should be sufficient, but you’ll need a strong password + BFU so that certain iOS logs will expire that could contain incoming notifications of signal messages or other remenants.
If you still aren’t convinced read this excerpt from the FBI themselves on what they can obtain from each app through the legal process.
WhatsApp
*Message content limited. *Subpoena: can render basic subscriber records. *Court order: Subpoena return as well as information like blocked users. *Search warrant: Provides address book contacts and WhatsApp users who have the target in their address book contacts. *Pen register: Sent every 15 minutes, provides source and destination for each message. *If target is using an iPhone and iCloud backups enabled, iCloud returns may contain WhatsApp data, to include message content.
Signal
*No message content. *Date and time a user registered. *Last date of a user’s connectivity to the service.
Furthermore I’ve studied many cases, and I have to say using an ecosystem product makes the FBI happy. All it takes is one fbi agent who knows how to correctly word a search warrant and you’re cooked. You’ll get caught by something you weren’t even aware could be used to identify you. The January 6th riot is an example of this.