As someone formerly working for one of the largest WhatsApp messaging API providers, this whole controversy is really unfortunate.
The problem boils down to the way the business API works: as WhatsApp is using e2e messaging, they could not simply offer a standard HTTP API for customers to use. In that case, WhatsApp would have to read messages received via such an API, and user responses to send webhooks.<p>To solve this problem, they provided a Docker stack that would essentially spin up a specialised WhatsApp Client on the customer’s infrastructure - so you’d be running the API locally, send and receive messages in your own network, and the client would handle encryption before transmitting to the WhatsApp servers. All containers would connect to a local SQL database to store their data, and included a REST API (curiously written in PHP).
To handle high load, you had to spin up more images in distinct patterns and configure sharding per stack.<p>This was a nice, albeit highly technical solution to the problem. As WhatsApp partners we built lots and lots of additional infrastructure to manage 12000 individual Docker-Compose stacks in a distributed, reliable way. That worked surprisingly well, but obviously is way too complex.
So in the end WhatsApp concluded it would be easier to take care of the container hosting themselves, shoving them into AWS, integrated with the Facebook business manager.
And all this lead to a necessary change in the terms of service, as WhatsApp hosting containers in AWS opened the possibility of e2e no longer being given.
My personal impression is that there has been a huge movement away from WhatsApp to Signal and Telegram in Germany in the last months.<p>Not just typically privacy sensitive people, but also lots of normal people.<p>Most people still have WhatsApp for that one or two friends and relatives that don't want to switch. But most activity has moved on.
among those lines of "lot of incorrect or inaccurate information",<p>>DER SPIEGEL: Soon after you announced your new privacy policies, chain letters started circulating on WhatsApp. People recommended other messenger apps like Signal, Threema or Telegram and said WhatsApp would read phone books and misuse the contacts.<p>Cathcart: There is a lot of incorrect or inaccurate information. That’s why we have delayed the update and send additional information to users directly in WhatsApp. Let me be very clear: We cannot read your messages, we cannot listen to your calls. When you send your location over WhatsApp, we do not know where you are.<p>>WhatsApp would read phone books and misuse the contacts?<p>We cannot read your messages, we cannot listen to your calls. When you send your location over WhatsApp, we do not know where you are.
> WhatsApp CEO: I am worried by another surveillance law that Germany plans to pass that could force messenger apps and email providers to actively help government agencies to smuggle malware onto the devices of their customers.<p>> Der Spiegel: The government says it needs this technology to read messages from terrorists at a point before they are encrypted on their phone. What’s wrong with that?<p>Maybe Der Spiegel is asking the question simply to elicit the interviewee's opinion. But it strikes me as very strange that a German paper aimed at a German audience would be asking why citizens need protection from government surveillance. Germans are possibly the most privacy conscious folks in the world because of a history of invasive government surveillance.
I am sorry but this is bull, has been bull and continues to be bull.<p>If you actually read the PP and TOS, you see that:<p>1. Nothing you share (content, pictures etc.) will be VISIBLE on Facebook for others to see (literally what they say), but it is pretty clear that this does not include what facebook does with the data aka sell it for ads.
This is the only absolute protection that the PP/TOS affords you. They promise not the go an post your pictures or locations on some random facebook profile. That's it.<p>2. Naturally, they say that CURRENTLY do not share "sensitive" data with facebook for ad purposes. To quote:
"Today, Facebook does not use your WhatsApp account information to improve your Facebook product experiences or provide you more relevant Facebook ad experiences on Facebook."
But what about tomorrow? Why this wording, which appears several times in the PP/TOS?<p>The intention of this PP is clearly to pave the way to use Whatsapp to enrich the ad targeting in Facebooks network. This was always the goal for Facebook, and they will fight tooth and nail to get that done.<p>So where do we stand?
You can accept the TOS/PP, allowing Facebook to do all the nefarious things it wants, simply because Whatsapp tells you that currently, "today", your data is safe. But you explicitly allow them to do all sorts of things.<p>To wit, they also tell us (less prominently) that they will immediately share all data with facebook once an agreement with the Irish government is reached. However, even without that, you can count on them doing so if profit > fine.<p>Beyond all the bull that has been produced by FB and Whatsapp, the reality is obviously that the singular goal of this entire exercise is to syphon off as much data from Whatsapp as they can get away with, relative to the fines they will have to pay.<p>Anyone who agrees to this is naive.
This is very troubling "Messages that are highly forwarded can only be forwarded to one chat since last spring. That led to a drop in 70 percent of these messages. More recently, we are additionally showing you a link to the Google search on those messages, to let you check the facts directly." Earlier he claims they cannot read messages but somehow they can filter out the RNA spam? It makes no sense. What am I missing?
>DER SPIEGEL: But you do save data about your users like the device ID, the phone model, the WhatsApp user name, the phone book and thereby also the numbers of all their contacts, right?<p>>Cathcart: It’s true that <i>we do have some information about how people use WhatsApp</i> and that we do know, for example, the device ID. We collect this only to secure our services and protect from attacks. When you use WhatsApp and allow access to your phone book, we only see the phone numbers, not the name.<p>In particular, they have (meta)data regarding specific messages being sent, as evidenced by their approach to curtailing misinformation:<p>>Cathcart: Messages that are highly forwarded can only be forwarded to one chat since last spring. That led to a drop in 70 percent of these messages. More recently, we are additionally showing you a link to the Google search on those messages, to let you check the facts directly.<p>I'm not sure how easy it is to figure out whether those 'highly forwarded messages' are all the same, or somehow link them without knowing anything about their content or linking them to information you already know about people. Maybe it's easy and I'm making a mountain out of a molehill, I don't know.
The points about e2e encryption deflects from the bigger problem - the parent company FB's user-hostile track record with privacy, their constant flip-flopping on privacy settings and policies, and their consistent pattern of unethical behaviours.<p>While we are debating the pros and cons of WhatsApp's policy update, I can bet anything we will see more user hostile policy changes, data sharing, data mining and exploitation in future, because this is the business model of the parent company. It makes no sense to <i>not</i> exploit the gold mine of metadata and personally identifiable information if that's the foundation of your business model.<p>At this point, I don't even mind using vanilla SMS compared to WhatsApp or FB messenger since it's my telco who's doing the data collection, and the telco is governed by a different and far stricter legislation in my country.