The Great Illusion of WhatsApp: Why Encryption Does Not Mean Privacy

The Great Illusion of WhatsApp: Why Encryption Does Not Mean Privacy

If there is one thing that makes my ears bleed, it is hearing some IT manager – the kind raised on bread and useless corporate policies – or some clueless colleague repeat like a reassuring mantra: "Don't worry, WhatsApp uses end-to-end encryption, Zuckerberg doesn't read my messages."

Technically, that's true. The cryptographic protocol (Signal Protocol) is exactly the same. But that's only half the truth. And the missing half is precisely the one that screws you over.

We've already talked about the glass metropolis and metadata in general here (if you missed the article, go back and read it so I don't have to repeat myself). Today we get down to practical business. Because when the dust settles, you need to understand how to convince people – from your aunt to a government official – to ditch Meta's junk and switch to something serious.

Let's go in order, from the least technical to the most nerdy.

Level 1: For your aunt (the one obsessed with "good morning" GIFs)

If you try to explain public-key cryptography to your aunt, she'll look at you like you're speaking ancient Aramaic. With her, you need to talk about money and basic spying.

WhatsApp is free. There are no ads (for now). And you know very well that in this world, nobody gives you anything for nothing. How do you maintain an infrastructure handling billions of messages a day? Simple: by selling you. Or rather, your digital footprint.

Try showing her this screen. It's the official list of data that the application collects and associates directly with the user (from the official privacy label on the App Store):

A merciless comparison: WhatsApp plunders your address book, tracks your location, and harvests device IDs. Signal knows only one thing: your phone number.

Auntie will get it immediately: on WhatsApp, it's like being in a shop where the clerk follows you everywhere, rummages through your pockets, takes notes on what you buy, where you go, and who you say hello to. On Signal, you enter a closed room, talk, and leave without leaving any footprints.

Level 2: For the marketing colleague (or the self-proclaimed SEO expert)

Here we enter the magical world of metadata and the social graph.

"Yeah, whatever, but the messages are encrypted anyway, what do they do with the contact list?" – says the average expert while sipping vending machine coffee.

Here is what they do. Meta doesn't need to read that you wrote "I have a fever, I'm not coming to the office today". It's enough for them to know that:

1. You connected from a hospital IP at 08:30.
2. You exchanged 3 messages with your doctor.
3. You contacted your boss right after.

By crossing this clean, structured, database-ready metadata with your Instagram and Facebook profiles and your GPS location (which WhatsApp constantly begs you to share "with friends"), Meta reconstructs your entire existence. They know who you hang out with, your political ideas, your sexual orientation, your health issues.

They don't read your words, but they read you.

A typical metadata correlation graph. You don't need to read the text to know who is in charge, who loves whom, and who is meeting in secret.

Metadata is worth far more than the message text because it is easy to process for advertising profiling algorithms. And on WhatsApp, this data is the fuel used to sell you stuff. Signal collects none of this. Zero.

Level 3: For the terminal commandos (sysadmins and hackers)

If you want to be refined and speak to someone who has a terminal open on their second monitor, here are the four structural differences that bring WhatsApp's house of cards crashing down.

1. The closed-source client (The black box)

Signal's code is entirely open-source (both client and server). You can go to GitHub, compile it, and verify that there is no telemetry or backdoor. WhatsApp's client is closed-source. You have to trust Meta. And in our line of work, trusting the closed code of a company that lives off mass surveillance is a blocking bug at the logical level.

2. The Sealed Sender protocol

In normal routing, the server must know who is sending the message to deliver it to the recipient. Signal introduced the Sealed Sender protocol. In practice, the sender packages their encrypted information inside the cryptographic envelope. The Signal server only reads the recipient's address on the outside, delivers the envelope, and has no idea who sent it. No traffic relationship is logged.

Difference between classic routing (where the server sees sender and recipient) and Signal's Sealed Sender (where the sender is hidden inside the encryption).

3. Address book management

WhatsApp uploads your address book in the clear to Meta's servers. Signal uses a system based on local cryptographic hashing and queries secure enclaves on the server (Intel SGX). Phone numbers are verified without the Signal server ever knowing or saving them in the clear.

4. Cloud backups (The masterpiece of the "botch")

This is the ultimate masterpiece of corporate hack jobs. WhatsApp pushes you to back up your chats to Google Drive or iCloud. By default, these backups are uploaded to the cloud in the clear (or with keys managed by Google/Apple). In practice, you encrypt the data only to hand it over to whoever runs your cloud storage. Signal does not offer third-party server backups: backups are strictly local, encrypted with a strong 30-digit passphrase. If you want to move them, you manage them yourself. Secure, with no mental gymnastics of delegating security to third parties.

Level 4: Organizational and State suicide (For companies and governments)

If using WhatsApp on a personal level is just laziness, at an organizational level – and even more so in a public body or government agency – it is pure suicide.

Yet, how many ministerial coordination groups, how many communication channels between mayors and directors run on WhatsApp? Countless. Tons of confidential documents exchanged on Meta's platform.

1. Closed source and State spyware

The fact that the client is closed-source makes it an impenetrable black box. No one can audit it. And while you trust Meta's word, intelligence agencies and surveillance software vendors (heard of Pegasus?) find zero-days in the code to install government Trojans and steal your entire digital existence.

WhatsApp is historically one of the favorite vectors for State spyware. Thanks to "zero-click" vulnerabilities (where just receiving a call, even without answering, is enough to infect you), diplomats, officials, and politicians have found their phones completely compromised. With open source, flaws would be caught much sooner. With closed code, you are sitting on a mine with a random timer.

2. Loss of digital sovereignty

All communication flows of the State or your company transit through Meta's servers, a private US company subject to laws like FISA 702 and the CLOUD Act. If US intelligence decided to map the internal relationships of an Italian ministry, it would only need to compel Meta to turn over the metadata. You've just gifted your social graph to a foreign power.

To top off the mess, public employees back up these work chats to their personal Google Drive or iCloud accounts, exposing sensitive State data to further third-party servers without any centralized control.

The only real escape routes

For a private citizen, a serious business, or a government body, there are only two solutions. There is no middle ground.

1. Matrix: The sovereign way for on-premise (Companies and Public Admin)

For complex organizations and Public Administration, the mandatory choice is called Matrix.

Matrix is an open, federated protocol for real-time encrypted communication.

• Total On-Premise: The State or company installs its own Matrix server inside its own datacenters. All messages, users, and logs remain on their own machines. No data leaves the perimeter.
• Secure Federation: Servers of different departments communicate with each other in a federated way (e.g., the Ministry of the Interior server speaks to the Ministry of Defense), but they maintain absolute control over their local servers.
• Open Source: The code is entirely auditable, ruling out the risk of silent backdoors.

This isn't science fiction: France created Tchap (a government Matrix client for all public employees) and Germany uses BundesMessenger for its armed forces and administrations. They got it. When will we wake up?

2. Signal: For fast and secure transit

If you don't have the resources or the need to host an on-premise server, but you need a team of people or your personal contacts to communicate securely, the only acceptable commercial alternative is Signal.

• Impeccable encryption: The protocol is the same, but here the client is completely open-source.
• Data minimization: Signal doesn't store metadata. If someone requests a user's logs, they only get the account creation date and the last connection time.
• Centralized but clean: Sure, servers are managed by the Signal Foundation in the US (so there is still a centralized element), but the architecture is designed to know nothing about you.

In conclusion

Continuing to use WhatsApp for personal, corporate, or institutional communications is irresponsible. It means throwing the doors wide open to State malware and gifting the sovereignty of your data to proprietary platforms.

If you manage an organization, push for the adoption of on-premise Matrix. If you are a private individual or a small team that needs to coordinate securely without server configuration headaches, install Signal. But do yourself a favor: uninstall WhatsApp from your phones.

[May the Talpone be with you]

Discussion & Support

Discussion and support channel. To discuss configurations or other topics, join us on fluxer.dreadful.work.