Whatsapp - sensibly private; but tainted by Facebook
published: (updated: )
by Harshvardhan J. Pandit
Android apps Facebook privacy Whatsapp
Update: clarification regarding Wi-Fi and IMEI related permissions
As part of the Privacy Guard series, I look at the functionality of various mobile apps in respect to the data they use. One of the most frequent apps I use (and I suspect a large population does) is the Whatsapp Messenger.
The premise of the app is simple - the app is registered against your phone number, and so you can find all your contacts on whatsapp without adding their usernames and such. While this adds a great deal of ease to the end-user, it also exposes your entire contact list to a company that provides you 'free' services - a misnomer used to collect and commercialise your data. In the case of Whatsapp, the company used to be independent, and over time managed to amass a large following owing to the simple model of usage and the cheap cost of free for the first few years. Technologically, Whatsapp has always been a strong and stable platform. Recently, they implemented Open Whisper System's Signal protocol which enables end-to-end encryption on all chats. This allows secure messaging between contacts, and gives a degree of credibility to the fact that no one can read the messages while they are in transit. So Facebook does not have any access to the contents of messages.
But, and here is an important part - Facebook can and does access the metadata of these messages. This is information that is monetised in the larger social graph that is used to target ads. Metadata is information such as who do you talk to, how often, at what time, how long do the chats go on, what is your location, and everything else except the actual contents of the message itself. In a startling revelation of how powerful metadata can be, consider that much of wiretapping and surveilance depends on access to such metadata. Data that can provide such powerful analytics and inferences in the hands of a vested commercial entity is certainly a cause of concern on ethical and moral grounds. And this is only metadata in Whatsapp, whereas much of the actual information is hidden inside the Facebook social graph.
In terms of using data in a smartphone, the Whatsapp application itself is well behaved. It clearly signals when it needs information, and specifies for what purposes. The permissions as requested by the app on Android are quite numerous. Below I list all of them along with information about when they are requested, their possible justifications, and what happens when that piece of data is denied to the app.
Device & app history - retrieve running apps
- What is this?
- This is information about what apps are running on the phone
- Why is this needed?
- To my information, there is no reason this is needed.
- Android permissions can be pretty vague and unclear at times.
- Still, I'm skeptical as to why a messaging app needs knowledge about running apps. And more importantly, is it sending this information out to someone else?
Identity
- What is this?
- accounts on the device
- add or remove accounts
- read your own contact card that stores your name and number
- Why is this needed?
- Presumably to set up a Whatsapp account on the phone
- It needs to read your contact card to get your name and number
- There is no way to deny this information to the app
Contacts
- What is this?
- fread and modify contacts
- Why is this needed?
- Because Whatsapp adds its own account information to every contact that has an account
- This allows you to do things like directly call or message a contact using Whatsapp
- What happens if this is denied?
- If contact information is denied, then Whatsapp can no longer resolve phone numbers to contact names.
- All functionalities still work, except all messages are shown against the phone number and you do not see any contacts name.
Location
- What is this?
- location information whether approximate (network-based) or precise (GPS and network-based)
- Why is this needed?
- Whatsapp has a location sharing feature that allows you to send your location in a message
- What happens if this is denied?
- nothing really, you cannot share the location with your friends, and also with Facebook
SMS
- What is this?
- It allows Whatsapp to send and receive text messages (SMS)
- Why is this needed?
- This is required during the registration stage where Whatsapp receives a text verification code. I did not find any justification for why it should need to send SMS. Maybe there is no way to get those permissions separately in Android.
- What happens if this is denied?
- Whatsapp cannot automatically detect the verification code, and you must enter it manually.
- Privacy Guard says that Whatsapp has never read SMS after that initial usecase.
- Still, I would suggest not having this permission as in the future it just may decide to start reading messages
Phone
- What is this?
- This is information regarding your phone such as model, make, operating system, whether it is rooted and so on
- Why is this needed?
- Purely speculating, but this may be valuable information for developers to see the device breakdown of their users
- This does not contain any personal information apart from perhaps the IMEI number
- update: IMEI number is (supposedly) used to ensure only one device is running an account
Photos/Media/Files
- What is this?
- Whatsapp can read all of your files in the common storage
- Why is this needed?
- To store media, files, audio clips, shared items and so on
- What happens if this is denied?
- Whatsapp can no longer store media shared with users
- One thing to note here would be that Facebook aggresively looks at metadata of shared media in Whatsapp. To what end, I do not know.
Camera
- What is this?
- Whatsapp can access and control the camera to get a clicked picture
- Whatsapp cannot control the actual camera itself, just the ability to open it from within the app
- Why is this needed?
- So that you can click and share pictures directly within Whatsapp
- What happens if this is denied?
- Whatsapp nicely informs that it cannot open the camera and continues with no effect on other features
- In Privacy Guard, I have set the permission to Ask Always for this one
Microphone
- What is this?
- Ability to record audio
- Why is this needed?
- To send voice messages
- What happens if this is denied?
- Whatsapp fails to create a voice message. Nothing else is affected.
- Privacy Guard does not have the option to block the use of microphone.
Wi-Fi connection information
- What is this?
- Whatsapp can see information such as Wi-Fi connections
- Why is this needed?
- Whatsapp can store backups to Google Drive over Wi-Fi
- What happens if this is denied?
- Whatsapp fails to backup.
- There are also permissions to toggle Wi-Fi and NFC, but they are never used.
- Whatsapp works just fine with these set to Ask Always in Privacy Guard
Other
- read sync statistics
- Allows Whatsapp to sync its contacts with the server
- Disabling this will stop the sync
- receive data from Internet
- Is needed to send and receive data
- view network connections
- Is needed to check when you are 'online' and 'offline'
- I have a suspicion that even this metadata is valuable to be mined by Facebook
- run at startup
- This allows Whatsapp to start again if your phone is restarted
- Reasonable, considering its a messaging app
- These are used in notifications
- control vibration
- change your audio settings
- These are used to enable Whatsapp to work in the background and to stop the phone from going to sleep
- prevent device from sleeping
- allow in background
- In Privacy Guard, disabling these both makes Whatsapp update less frequently, but everything works fine.
These permissions make no sense and are outright denied
- pair with Bluetooth devices
- send sticky broadcast
- connect and disconnect from Wi-Fi
- update: presumably, Whatsapp needs this to inform and help users when Wi-Fi is connected, but doesn't have internet access
- full network access
- control Near Field Communication
- modify system setting
- toggle sync on and off
- read Google service configuration
Overall, Whatsapp is a good application. It does not appear to 'leak' any data, and the use of Signal Protocol ensures that messages are not read by anyone in between. That said, it is still owned by Facebook, who has been known to be quite greedy and morally questionable in many cases. There have been several news reports where Facebook was asked to stop collecting data from Whatsapp users, particularly in the EU. However, Facebook is still looking actively into monetising this platform (it paid billions for it, after all). I'd be vary of using Whatsapp simply to avoid the tentacles of Mark Zuckerberg & Co.