Skip to content
Naked Security Naked Security

Facebook to tie together WhatsApp, Instagram and Facebook Messenger

Should we cheer for WhatsApp-esque, end-to-end encryption everywhere, or tremble at creeping Facebookism?

Facebook plans to take all of its chat apps – Messenger, WhatsApp and Instagram – and smoosh them into one interconnected chat blob, in spite of having promised to retain the independence of WhatsApp and Instagram when it bought them.

The New York Times reported on Friday that the plans come directly from CEO Mark Zuckerberg. It cited four anonymous sources involved in the effort, which will reportedly entail keeping the three as standalone apps but stitching their technical infrastructure together so that users of each app can talk to each other more easily.

The plan also includes slathering the end-to-end encryption of WhatsApp – which keeps anyone, including Facebook itself, from reading the content of messages – onto Messenger and Instagram. At this point, Facebook Messenger supports end-to-end encryption in “secure connections” mode: a mode that’s off by default and has to be enabled for every chat. Instagram has no end-to-end encryption on its chats at all.

The move will tie together the world’s biggest message networks: the resulting chat blob will encompass more than 2.6 billion users.

The NYT’s sources said that the plan is in the early stages at this point and that Facebook’s goal is to wrap up the integration by early 2020. Tying together the apps will be involved: the reconfiguration will require thousands of Facebook employees to rework how the three apps function “at their most basic levels,” said the sources.

Zuckerberg’s goal is to keep people’s attention focused on Facebook. The more time they spend on the platform, the better for its advertising revenue, the sources said. As it is, WhatsApp sees heavy use in South America, while Facebook’s Marketplace – similar to the free Craigslist marketplace – is popular in Southeast Asia and other markets outside the US.

Zuckerberg reportedly hasn’t yet ironed out the details of how integrating the chat apps will be monetized, but last month, he told employees of WhatsApp and Instagram that the mandate will be a priority in 2019. The NYT’s sources said that multiple WhatsApp employees have already left, or plan to, in response to the mandate.

How will users’ privacy be affected?

WhatsApp users were understandably concerned when Facebook acquired the privacy-minded app in 2014. At the time, co-founder and then-CEO Jan Koum promised that respect for privacy was coded into WhatsApp’s DNA and that the Facebook deal would never have happened if it meant changing the company’s existing policy of collecting as little personal information about users as possible.

Much changed in the years since he said that. In August 2016, WhatsApp announced that it was going to start sharing users’ phone numbers and other personal information with Facebook, in spite of years of promises that it would never, ever do such a thing. In March 2018, Facebook signed a public commitment not to do so… yet… At least, not until it figured out how to do so without breaking the General Data Protection Regulation (GDPR).

The past few years have also seen Facebook’s growth and reputation get dinged by scandals over allowing election meddling and fake news on its platform, as well as playing fast and loose with users’ data.

Over the past year, #DeleteFacebook became an oft-heard cry from people whose trust in the platform hit rock-bottom, and that included some big names.

WhatsApp’s Koum and his co-founder, Brian Acton, bolted from Facebook in September. Acton said at the time that he realized that he’d sold his users’ privacy. The straw that broke the camel’s back: a disagreement over how to monetize WhatsApp, whose co-founders were known for despising ads. Instagram’s founders, Kevin Systrom and Mike Krieger, likewise left the company in September, over what many suspected was increased meddling from Zuckerberg.

WhatsApp now requires only a phone number when new users sign up. By contrast, Facebook and Facebook Messenger both ask users to provide their “true identities.” As the NYT suggests, the integration of the three chat apps could give pause to WhatsApp users if it means that their handles could be linked across all the apps, each with its disparate approach to how much personal data it demands.

Facebook responded to the news with this statement:

We want to build the best messaging experiences we can; and people want messaging to be fast, simple, reliable and private.

We’re working on making more of our messaging products end-to-end encrypted and considering ways to make it easier to reach friends and family across networks. As you would expect, there is a lot of discussion and debate as we begin the long process of figuring out all the details of how this will work.

Encryption everywhere vs. creeping Facebookism

Matthew Green, a cryptography professor at Johns Hopkins University, said that Facebook’s move could be good for security and privacy… or then again, given Facebook’s track record, maybe not so much:

At first blush, it might seem like end-to-end encryption everywhere will be better for privacy, and that it will flummox law enforcement agencies that already spend gobs of time demanding backdoors into the encryption we already have.

But some privacy experts are saying that Facebook’s moves to tie our bits and pieces ever more tightly together will be a boon for those whose business it is to track us and our social ties. Sarah Jamie Lewis, executive director of the Canadian non-profit Open Privacy:

Marc Rotenberg, president and executive director of the Electronic Privacy Information Center (EPIC), told the NYT that the change would be “a terrible outcome for internet users.” He urged the Federal Trade Commission (FTC) to “act now to protect privacy and to preserve competition.”

3 Comments

What will happen to those uesrs who only have WhatsApp?
Not all WhatsApp uesrs use Facebook or Instagram..(like me)
I hope they don’t force us to make accounts on Facebook/Instagram.

Reply

Darkside,

FB creates a shadow profile on people that it identifies that do not have a FB account or where there is not enough data available (yet) to create a fully qualified profile. As you surf the web to pages that contain FB scripts, your IP is logged (not only on that website but at FB as well) as are your interests based on the pages you visit and links you click on. If you enter personally identifying info on a web page with FB scripts that data may too be sent to FB.

With whatsapp, FB may not know your name for example but it does have your phone number and your IP address. If someone who knows you has a facebook account and their contacts list you with the phone number you use for whatsapp, then FB will get all the data your “friend” has on you including your name, address, any other phone numbers, email address etc all based on whatever info is listed in their contacts list. Abracadabra, FB now has a name and potentially an address to go with that previously limited shadow profile that it created based on just your phone number and IP address when you used whatsapp.

This tracking by the Big 5 and their minions is insidious. It is predatory and it is invasive. For a long time now, having an account on FB or Google for example has not been a prerequisite for being tracked, identified, cataloged and sold. With some effort you can make it difficult to follow you around, but you cannot completely hide. Being stealthy when your OS, your browser, individual websites, distributed content networks, your ISP, your email platform, all of your social media platforms, your phone, your connected IoTs all give you up is darned near impossible.

Blocking all Google and/or all Amazon sever interaction pretty much breaks the internet for anyone who tries it. You can block all Facebook interaction without much negative impact except for losing dopamine rush that getting liked all the time causes but you can recover from that in time. Online privacy is not a simple or narrow subject which is why so many internet users have absolutely no clue as to how widespread the tracking and sharing of user info actually is. Between the software, our computer/phone operating system, websites and everything else that sends our data to the mothership, all of us are easily connecting to data gobbling servers hundreds of thousands of times every week.

Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!