How much worse is it privacy wise for me to give them access to my contacts?

all 65 comments

sorted by: hot top controversial new old
[–] 50 points 4 weeks ago (18 children)

Personally I wouldn't give Facebook and Meta access to the list of people I know with their names, phone numbers, and some addresses.

  • source
  • hideshow 18 child comments
  • [–] [S] 0 points 4 weeks ago (16 children)
  • [–] 3 points 4 weeks ago (13 children)

    Can you have separate WhatsApp contacts to your phone contacts? Maybe copy them manually to WhatsApp if needed?

  • source
  • parent
  • hideshow 13 child comments
  • [–] [S] 3 points 4 weeks ago (12 children)

    u can't do that without giving it permission to all contacts

  • source
  • parent
  • hideshow 12 child comments
  • [–] 4 points 4 weeks ago (9 children)

    I use Launch Chat for the occasional use. You can paste the number there and press a button to open whatsapp dms for given number. Been using it for a very long time without contacts access and never faced an issue, installed from fdroid repo.

  • source
  • parent
  • hideshow 9 child comments
  • [–] [S] 0 points 3 weeks ago* (8 children)

    I do that too, but I got way too many ppl on wa and its hard to keep track of them.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 1 point 3 weeks ago (7 children)

    So you want all your contacts to show up within the app?

  • source
  • parent
  • hideshow 7 child comments
  • [–] [S] 0 points 3 weeks ago (6 children)

    I just want to have their names instead of phone numbers....

  • source
  • parent
  • hideshow 6 child comments
  • [–] 4 points 3 weeks ago (5 children)

    For which whatsapp will need to know their names and numbers... You do see the problem right?

  • source
  • parent
  • hideshow 5 child comments
  • [–] [S] -1 points 3 weeks ago (4 children)

    I do, but I have like 50 PPL ON WHATSAPP, HOW AM I SUPPOSED TO KEEP TRACK OF THEM

  • source
  • parent
  • hideshow 4 child comments
  • [–] 3 points 3 weeks ago (3 children)

    Write their names and numbers down in a notebook, or a seperate offline notes app on your phone.

    Seems a little silly but this is what you get if you insist on using such a terrible app

  • source
  • parent
  • hideshow 3 child comments
  • [–] [S] -1 points 3 weeks ago* (2 children)

    That's why the contacts app exists....

    or just fucking give them my contacts since pretty much everyone in my country has done it anyways, so they don't gain shit

  • source
  • parent
  • hideshow 2 child comments
  • [–] 40 points 4 weeks ago*

    It's disrespectful of their privacy, not only your own.

  • source
  • [–] 38 points 4 weeks ago (20 children)

    No. Meta is a data harvesting company. Any points of data you give them is bad, privacy-wise.

    And don't believe the claptrap that WhatsApp is "safe" from prying eyes or truly E2EE. Meta is not and has never been trustworthy, and they have been caught lying on countless occasions.

    Use their products at your own peril.

  • source
  • hideshow 20 child comments
  • [–] [S] 6 points 4 weeks ago (18 children)

    but everyone I know uses them and no, they're not switching to signal...

  • source
  • parent
  • hideshow 18 child comments
  • [–] 1 point 4 weeks ago (11 children)

    Not with that attitude (like, unironically speaking, you have to be more insistent)

  • source
  • parent
  • hideshow 11 child comments
  • [–] [S] 1 point 3 weeks ago* (10 children)

    they just said no, I respect that

    EVERYONE IN MY COUNTRY USES WHATSAPP, YOU CAN'T LIVE WITHOUT WA HERE YK...

  • source
  • parent
  • hideshow 10 child comments
  • [–] 2 points 3 weeks ago (9 children)

    EVERYONE IN MY COUNTRY USES WHATSAPP, YOU CAN'T LIVE WITHOUT WA HERE YK...

    Same thing probably could have been said about my country (Germany) 10 years ago, and look where we're at now.

    I spontaneously deleted my WhatsApp account a few years ago and haven't regretted it once. When people suddenly can't contact you through WhatsApp anymore, they can still use SMS (which is horrible as well but still better than any services by Meta) or hopefully give in at some point and also use Signal.

    Also, do those friends of yours know that you don't have to immediately abandon WhatsApp to use Signal? Both can be used simultaneously, like many of my family and relatives do, and I see almost no logical reason to refuse that.

  • source
  • parent
  • hideshow 9 child comments
  • [–] [S] 1 point 3 weeks ago (8 children)

    BRO SMS AIN'T BETTER THAN WHATSAPP IT HAS NO ENCRYPTION, PURE FANBOYISM

    They just don't want another chat app on their phone, they just use wa for almost everything

  • source
  • parent
  • hideshow 8 child comments
  • [–] 2 points 3 weeks ago (7 children)

    It's not "fanboyism", I already wrote that SMS is horrible. And what makes you so sure that WhatsApp really is really properly encrypted and not doing some shenanigans? Proprietary apps can claim all kinds of things. So call me naive, but I'll take minimal non-sensitive unencrypted SMS through a somewhat trustworthy service provider over basically spyware on my phone any day, although that may of course be because I live somewhere with relatively decent data protection laws (not that one should put too much trust in those either, but eh, still better than trusting fucking Meta imho).

    People install all kinds of crap on their phones, but a single more private messenger is suddenly too much to ask for? Some people really are beyond saving... Though I can kinda relate, my brother is just as stubborn. Any way, I'd still advise to just quit WA and tell them you'll only communicate through Signal (or SimpleX, Session, etc.) in the future, which should help as an incentive. If you're willing to do that is of course up to yo

  • source
  • parent
  • hideshow 7 child comments
  • [–] [S] -1 points 3 weeks ago* (last edited 3 weeks ago) (6 children)

    Open source doesn't mean it's secure and closed source doesn't mean it's not secure. Also, if it wasn't e2e encrypted, we would find out pretty much instantly since there are a lot of people who reverse engineering apps like WhatsApp, since zero-day exploits cost a lot of money, you know. So, personally, I would be pretty sure that WhatsApp is absolutely end-to-end encrypted.

    Also, how is it a good idea to give a signal my contacts if it's not okay to give meta my contacts?

    Also, if you don't accept this argument, then how do you know there's not a component in your phone that listens to everything you say that's above system level?...

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 3 weeks ago* (5 children)

    Of course closed source software can be secure, but given that you can't verify that it actually is, it's better to treat it as if it's not. And I'm not saying that WhatsApp isn't encrypted, but we can't know if this also applies properly to metadata, or which encryption algorithm is actually used, if the keys are really only accessible to end users (i.e. if it's really E2EE), etc.

    It's not unreasonable to think that Meta (or any other Big Tech company) makes their products just secure enough to not allow just about anyone with the right abilities to exploit weaknesses (which would obviously hurt their business), while still retaining the ability for themselves to have access to at least some of the data.

    Also, how is it a good idea to give a signal my contacts if it's not okay to give meta my contacts?

    Also, if you don't accept this argument, then how do you know there's not a component in your phone that listens to everything you say that's above system level?...

    You seem to be treating privacy like an all-or-nothing situation. There's different levels to privacy, with different realistic possibilities and threat models. To give you the short answers to both questions: It's not a good idea to give Signal access to your contacts, and I indeed don't know if there's a component in my phone spying on everything. But there is nuance to both.

    First off, Signal's Contact Dicovery Service is open source. Of course there's still a level of trust required regarding Signal's operational integrity, as we can't know if this is really what runs on their servers, but at least the Signal Foundation doesn't have a history of countless known privacy violations like Meta does, which means it all comes down to how much you trust either of those organisations. So even though I wouldn't recommend granting Signal access to your contacts and personally prefer messengers without such a feature (e.g. SimpleX), I also don't yet insist on recommending against it.

    As for the hardware: Assuming that there is indeed some component spying on me, why would this be a justification to become careless about privacy on the software level? And the real difference between the arguments is the availability of alternatives. While there are quite a few open-source messenger alternatives, the same can't be said about hardware. And it's unlikely for there to be anything on the hardware level that could be spying without anyone noticing, at least if we assume that this hardware would send this data somewhere, which one would surely notice when analysing network traffic or by checking for emitted radio frequencies if the manufacturer had the genius idea of using mesh networks instead.
    However, certain components could certainly be used as a backdoor for state actors if they gain physical access to a device, so I'm still advocating for open hardware and firmware.

  • source
  • parent
  • hideshow 5 child comments
  • [–] [S] 1 point 2 weeks ago* (last edited 2 weeks ago) (4 children)

    yes you can verity that it is secure by reverse engineering, just like someone can read the code, someone can reverse engineer it.

    And I'm not saying that WhatsApp isn't encrypted, but we can't know if this also applies properly to metadata, or which encryption algorithm is actually used, if the keys are really only accessible to end users (i.e. if it's really E2EE), etc.

    It DOESN'T, they literally state that they don't have encrypt metadata and can share it with other meta services

    which honestly as long as the messages themselves are encrypted is sadly still a much better option than sms

    Of course there's still a level of trust required regarding Signal's operational integrity, as we can't know if this is really what runs on their servers, but at least the Signal Foundation doesn't have a history of countless known privacy violations like Meta does, which means it all comes down to how much you trust either of those organisations

    thanks for proving you don't know, even the signal server doesn't know ur contacts...

    https://signal.org/blog/private-contact-discovery/

    https://support.signal.org/hc/en-us/articles/360007061452-Does-Signal-send-my-number-to-my-contacts

    As for the hardware: Assuming that there is indeed some component spying on me, why would this be a justification to become careless about privacy on the software level?

    because it'd be above everything else and could see everything, no matter the sw ur using... so it'd be pointless anyways

    And it's unlikely for there to be anything on the hardware level that could be spying without anyone noticing, at least if we assume that this hardware would send this data somewhere, which one would surely notice when analysing network traffic or by checking for emitted radio frequencies if the manufacturer had the genius idea of using mesh networks instead.

    Just like with whatsapp...

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 2 weeks ago (3 children)

    yes you can verity that it is secure by reverse engineering, just like someone can read the code, someone can reverse engineer it.

    No, you can't, at least not reliably. Reverse engineering is nowhere near as simple as "just like someone can read the code".

    It DOESN'T, they literally state that they don't have encrypt metadata and can share it with other meta services

    I don't keep up with whatever WhatsApp is doing, so nice to know that it's already worse than I thought, but it doesn't really change my point.

    which honestly as long as the messages themselves are encrypted is sadly still a much better option than sms

    If I could be certain that the messages are in fact encrypted as claimed, I'd agree.

    thanks for proving you don't know, even the signal server doesn't know ur contacts...

    They do, just not in the way you probably think. Unique identifiers (which phone numbers typically are) can always be used to track users, even if they're just stored as a hash value on a server. They don't immediately reveal the identity of a person like clear text phone numbers could do, but there's still information that can be extracted through metadata analysis. Though to be fair, this discussion is more relevant to anonymity than to privacy.

    because it'd be above everything else and could see everything, no matter the sw ur using... so it'd be pointless anyways

    Why would it be pointless? If some random person broke into your home, would you just open all the doors because apparently doors are pointless? Having one entity spy on you is a weird excuse to let another one do the same. I mean... you do you, but I think it's a weird mentality to have.

    Just like with whatsapp...

    Not really, as any unwanted traffic to WhatsApp's servers would just get drowned within wanted traffic, making it effectively unnoticeable to the user. The same can't be said for hardware that tries to connect somewhere despite no software on that device being allowed to connect to the internet.

  • source
  • parent
  • hideshow 3 child comments
  • [–] [S] 1 point 2 weeks ago (2 children)

    No, you can't, at least not reliably. Reverse engineering is nowhere near as simple as "just like someone can read the code".

    sure, but someone would find out if WhatsApp didn't e2ee their messages, which is the most important thing

    If I could be certain that the messages are in fact encrypted as claimed, I'd agree.

    Well you literally can be, because if it was not someone would find out instantly, it'd be a huge thing and meta would suffer greatly if they lied about e2ee

    They do, just not in the way you probably think. Unique identifiers (which phone numbers typically are) can always be used to track users, even if they're just stored as a hash value on a server. They don't immediately reveal the identity of a person like clear text phone numbers could do, but there's still information that can be extracted through metadata analysis. Though to be fair, this discussion is more relevant to anonymity than to privacy.

    Sealed sender...., also signal is private, not anonymous, if you want both, simplex is ur friend

    Why would it be pointless? If some random person broke into your home, would you just open all the doors because apparently doors are pointless?

    well that's not the same situation the robber wouldn't see everything, the hw component would.... also other doors have the function of keeping heat inside, not keeping robbers away

    Not really, as any unwanted traffic to WhatsApp's servers would just get drowned within wanted traffic, making it effectively unnoticeable to the user. The same can't be said for hardware that tries to connect somewhere despite no software on that device being allowed to connect to the internet.

    Well again if it did something like that, we would know thanks ro reverse engineering

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 2 weeks ago (1 child)

    sure, but someone would find out if WhatsApp didn't e2ee their messages, which is the most important thing

    Not necessarily. Code can be obfuscated.

    Well you literally can be, because if it was not someone would find out instantly, it'd be a huge thing and meta would suffer greatly if they lied about e2ee

    "Instantly", yeah, sure... WhatsApp isn't really used for secure communication (I wonder why), but by normies who don't know any better. I doubt most users would care if something like this came to light.

    Sealed sender...., also signal is private, not anonymous, if you want both, simplex is ur friend

    Sealed sender has nothing to do with this, as it applies to messages. You can still build a profile of users based on which users submit which hashes for contact discovery, without the need for them to send any message to those contacts at all.

    well that's not the same situation the robber wouldn't see everything, the hw component would.... also other doors have the function of keeping heat inside, not keeping robbers aw

    Not necessarily true, and also not really relevant to the analogy. If a hardware component would spy on basically everything, I'd find it weird to just say "Hey Intel, you already have all my data any way, so I'm just going to freely give it to Meta as well."

    Well again if it did something like that, we would know thanks ro reverse engineering

    You're putting too much blind trust in reverse engineering. And since you seem to be insistent on naively trusting Meta and proprietary applications, I won't try to convince you otherwise. Have fun, I guess.

  • source
  • parent
  • hideshow 1 child comment
  • [–] [S] 1 point 2 weeks ago

    Not necessarily. Code can be obfuscated

    Sure, but someone would still find out. We can be 100% sure of that, so it's still better than SMS period.

    Instantly", yeah, sure... WhatsApp isn't really used for secure communication (I wonder why), but by normies who don't know any better. I doubt most users would care if something like this came to light

    You have no idea how many businesses use WhatsApp and have their trade secrets on there even. And it is used for secure communication in the real world, in a lot of cases.

    Sealed sender has nothing to do with this, as it applies to messages. You can still build a profile of users based on which users submit which hashes for contact discovery, without the need for them to send any message to those contacts at all.

    That assumes the server can see which hashes belong to which account. Signal’s contact discovery is designed to match contacts inside a protected enclave, so the server doesn’t get a readable list of them. It may see that a lookup happened, but that alone doesn’t show it can build a contact profile

    Not necessarily true, and also not really relevant to the analogy. If a hardware component would spy on basically everything, I'd find it weird to just say "Hey Intel, you already have all my data any way, so I'm just going to freely give it to Meta as well."

    Well, have you ever heard of Prism? But I do agree that the less companies you give your data, the better. But still... I don't really think in this scenario it would make any difference.

    You're putting too much blind trust in reverse engineering. And since you seem to be insistent on naively trusting Meta and proprietary applications, I won't try to convince you otherwise. Have fun, I guess.

    No, I'm not. You're putting way too much trust into open source software, since I'm sure you don't read all the lines of code that there are. You're basically doing the same thing as me.

  • source
  • parent
  • [–] -1 points 4 weeks ago (3 children)

    The bigger question is why are your so-called friends not respecting your privacy? Anyone who wouldn't switch to signal for me is not someone I would want to call a friend.

    But as the other person said, no it's not safe to use WhatsApp.

  • source
  • parent
  • hideshow 3 child comments
  • [–] [S] 1 point 3 weeks ago (2 children)

    because they don't care about privacy and I also need business associates on there...

    how am I their friend if I'm forcing them to care about something they don't care about.

    also they "want to give meta their data so that the algorithm keeps them on the app as long as possible", since they got nothing to do. also these friends are more like colleagues than anything else, but I need to keep up with them because of work

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 3 weeks ago (1 child)

    You wouldn't be forcing them to care about something they don't care about. You don't have to care about privacy to use signal.

    I have friends from all walks of life that message me on signal because that's all I use, most of them don't care about privacy. To them it's just another messaging app like WhatsApp, messenger, discord, etc.

    But I guess that's unfortunately not an option in your particular circumstance

  • source
  • parent
  • hideshow 1 child comment
  • [–] 23 points 4 weeks ago* (7 children)

    This is literally the main thing Meta is interested in. DO NOT EVER DO THAT, please.

    This app can be used as a work around to add contacts in WhatsApp: https://f-droid.org/en/packages/dev.theolm.wwc/

    Or this one: https://f-droid.org/en/packages/org.vinaygopinath.launchchat/

  • source
  • hideshow 7 child comments
  • [–] [S] 2 points 4 weeks ago (6 children)

    but it doesn't show u ppls names, and when you have a lot of ppl on the app, it's impossible to keep track od them...

    also ur carrier knows ur contact list aswell...

  • source
  • parent
  • hideshow 6 child comments
  • [–] 6 points 4 weeks ago (5 children)

    It is also inconvenient in many other ways, because Meta makes it intentionally annoying to use WhatsApp without contact permissions 🤷

    And no, your carrier does not have access to your phone's contact list. There is a lot more privacy relevant details in it than pure calling information.

  • source
  • parent
  • hideshow 5 child comments
  • [–] [S] -1 points 4 weeks ago (4 children)

    Yes they do, when I message them via sms, which I've done w most od my contacts list

  • source
  • parent
  • hideshow 4 child comments
  • [–] 6 points 4 weeks ago* (3 children)

    No, why would give sending SMS give access to your contact list? The carrier has no system access to the phone contacts app.

    Edit: The phone contact app includes a lot more details than just the number. Names, alternative numbers, associated email addresses etc are all in the contacts app and potentially accessible to WhatsApp.

    What the carrier has is no different to what WhatsApp gets when you use a number on their service.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 4 weeks ago (2 children)

    Actually, some carrier and SMS apps do need that permission.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 12 points 4 weeks ago (1 child)

    I've been refusing to give them permission for about 5 years now, and the only ill effect I've really had is not having a name associated with the contact when texting them

  • source
  • hideshow 1 child comment
  • [–] 20 points 4 weeks ago (12 children)

    You need to ask your contacts if that's ok. Not us.

  • source
  • hideshow 12 child comments
  • [–] 9 points 4 weeks ago (6 children)

    Yeah, here in Germany, we've had a verdict that you need to get written permission from all your contacts, if you give WhatsApp access to their data: https://www.rv.hessenrecht.hessen.de/bshe/document/LARE190000029

    I would assume, the same is true in the entire EU.

  • source
  • parent
  • hideshow 6 child comments
  • [–] [S] -1 points 4 weeks ago (2 children)

    what about signal, is that illegal aswell?

  • source
  • parent
  • hideshow 2 child comments
  • [–] [S] -1 points 4 weeks ago* (3 children)

    bro pretty much all of them use WhatsApp, let's be real

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 4 weeks ago (2 children)

    are the terms that you accept when using WhatsApp real enough for you?

    You provide us, in accordance with applicable laws, the phone numbers in your mobile address book on a regular basis, including those of both the users of our Services and your other contacts. You confirm you are authorized to provide us such numbers to allow us to provide our Services.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 3 weeks ago

    I've not read an actual answer to your question in the comments so far.

    If you live somewhere where WhatsApp is the dominant chat app, then you are already a data point for Meta. Unless nobody has your phone number in their contacts.

    If you're concerned about a specific entry in your list of contacts, then it depends on your own point of view. You could use the same logic a above to justify sharing it. You could also decide that you don't like that logic and you do not.

    So, how much worse is it? Probably inconsequential.

    Just to add some aluminium; when using whatsapp your phone data (brand, android version, etc) are added to big data.

  • source