Frank Slootweg <this@ddress.is.invalid> wrote:

> Carlos E.R. <robin_listas@es.invalid> wrote:
>> On 2024-01-27 22:54, Andrew wrote:
>>> Carlos E.R. wrote on Sat, 27 Jan 2024 22:30:50 +0100 :
>>>
>>>>> The people who take your contacts make it very convenient to upload them.
>>>>> Did you ever stop to wonder why they make it so easy to get your contacts?
>>>>
>>>> I don't upload them.
>>>
>>> Google does.
>>
>> So?
>
> Indeed. And "Google does" [upload your contacts] is also misleading,
> because Google only does that if you - implicitly or explicitly -
> tell/ask them to do so. You can select to not sync contacts or/and other
> parts of your Google Accounts.
>
> The wording also - dishonestly - implies that you give your contacts
> to Google and that 'hence' Google can and does abuse/misuse/spread that
> information. That's ofcourse nonsense, because Google would be sued to
> bits.
>
> *Fact* is that *if* you choose to upload your contacts to 'Google', it
> only gets into *your* Google Account storage. Duh!

Yep. If you do not create a Google account, or assign your phone to
one, then your phone has no Google account to which it can sync
anything.

Android settings -> General -> Accounts
(navpath on my LG V20 smartphone)

You can store your contacts, and other info, anywhere on your phone, but
they won't get sync'ed anywhere unless you added a sync account. That
was the whole point of managing accounts in Android was to have one
place to manage them. In fact, when you install or configure an app,
you may be asked to select an account already defined. Instead of
having to go through all the settings to get an app to connect online,
you reuse an account already defined.

If you delete a sync account, no more sync'ing to it. Most of mine are
for e-mail accounts. However, that's a list of accounts, not what app
or sync is involved with that account. My Hotmail account, for example,
is used for: dropbox, Exchange and IMAP apps (e-mail), and OneDrive.
Deleting a sync account, or not creating it, means no sync with that
account. I have done this accidentally where I deleted an account for
e-mail sync that I didn't realize that account was used for other
purposes. Oops.

VanguardLH wrote on Sun, 28 Jan 2024 15:10:31 -0600 :

>> *Fact* is that *if* you choose to upload your contacts to 'Google', it
>> only gets into *your* Google Account storage. Duh!
>
> Yep. If you do not create a Google account, or assign your phone to
> one, then your phone has no Google account to which it can sync
> anything.

All three of you are always dead wrong because you've never tested it.
I have.

Try this simple test _before_ you respond and say Google doesn't get your
contacts the very first time you log into your Google account to get email.

1. (Optional) Wipe out every vestige of your Google Account on your phone
2. Create a new contact "Frank Carlos Vanguard, +1-234-567-8910 & save it
3. Simply tap on the default GMail app, get your mail & close the app

Guess what.
Google got your contacts.

Note it doesn't matter *how* you set up GMail to *not* get your contacts.
Google got them. (I have tested this many times, but not recently.)

Do not respond to this until you've tried it.

> Android settings -> General -> Accounts
> (navpath on my LG V20 smartphone)

It doesn't matter if you don't have a Google account on the phone.
Google will *create* that Google account if you use some of their apps.

In the test above, notice it doesn't matter that you wiped out every
vestige of the google account on your phone. Google will _create_ it.

Without even asking you.
Again, don't respond until you've tested it out.

I speak from real world experience.
You do not.

You're all just guessing.
And you're all guessing wrong.

And it's not just Google that does this as many apps have access to your
contacts. Any one of them can do this. Are you going to test every one?

The safest way to prevent your contacts from being uploaded to Internet
servers is simply to not store your contacts into the default database.

> You can store your contacts, and other info, anywhere on your phone, but
> they won't get sync'ed anywhere unless you added a sync account. That
> was the whole point of managing accounts in Android was to have one
> place to manage them. In fact, when you install or configure an app,
> you may be asked to select an account already defined. Instead of
> having to go through all the settings to get an app to connect online,
> you reuse an account already defined.

No wonder every statement from the three of you has been wrong on it.
Syncing isn't rocket science, Vanguard.

Syncing contacts is as simple as copying a file & merging contents.
There are plenty of apps which will sync & merge & clean your contacts.

That the three of you think it's complicated means that the three of you
don't have any clue how to use a file system, a file editor, or Android.

Each of you have these fundamental learning problems that are in common.
1. You don't understand what you're talking about because you're guessing
2. You're guessing wrong every time
3. You think copying a file is the most complicated thing in the world
> If you delete a sync account, no more sync'ing to it.

See above. If you use certain Google apps, then the account is created for
you even if you deleted it. Why don't you try this before guessing wrong?

> Most of mine are
> for e-mail accounts. However, that's a list of accounts, not what app
> or sync is involved with that account. My Hotmail account, for example,
> is used for: dropbox, Exchange and IMAP apps (e-mail), and OneDrive.
> Deleting a sync account, or not creating it, means no sync with that
> account. I have done this accidentally where I deleted an account for
> e-mail sync that I didn't realize that account was used for other
> purposes. Oops.

If it's a Google account on the phone (which is different from just having
a Google account that is not set up on the phone), and if you use certain
Google apps on Android (such as Google Voice or Google Maps with a login),
then guess what. You will have that Google account back on your phone.

You can't stop Google.
That you think you can is a problem.

Not because I can't.
But because you can't.

You can't stop what you don't even understand.
And you can't stop what you think is happening - but something else is.

All of you are uploading your contacts to Google every time you use their
apps (such as GMail, Google Voice, logging into Google Maps, etc).

The only way to stop it (if you use those apps) is to not put anything into
the Android default contacts database (because that's where they look).

Please do not respond until you've run the simple tests I ask of you above.
It's discouraging to hear people be as confident as you are in being wrong.

I will no longer respond in this thread until you've shown you ran the
tests asked of you because otherwise, everything you say, is dead wrong.

Worse, until you prove it to yourself, you'll guess that I'm dead wrong.
And we'll just go around in circles until you realize what I said is true.

Frank Slootweg wrote on 28 Jan 2024 15:52:21 GMT :

>> If you store your contacts in the default location, WhatsApp uploads them.
>
> Nope, as Carlos correctly said, WhatsApp does *not* upload your
> contacts! (Umpteenth repeat of clue-by-four: WhatsApp Legal)
>
> If you think otherwise, *prove* it, with a cite from a *reputable*
> source (complete with URL).

You're not as stupid as Carlos is so bear in mind I dumbed it down because
people like Carlos & Vanguard already told me a file copy is too hard.

If they can't handle how to copy a file, then they can't handle hashes.
Plus they can't handle common WhatsApp switches like "Contact Upload."

Since this was covered long ago (I think it may have even been you who
found all this out) so from my memory, this is how it works for WhatsApp.

When you use the built-in WhatsApp contact upload feature, for example,
WhatsApp will upload your phone numbers *daily* from your default contacts
database (frequency depends on how often you use the WhatsApp app).

They only save the hash of the phone numbers on their servers & they say
they will disregard the other data like real addresses and real names.
That's what they say so you have to just trust them on it.

Notice I said "all" your contacts and not just the ones that use WhatsApp.

I'm going to repeat this for effect because they say that they do save the
hash of *every* contact even *before* that contact has joined WhatsApp!

When they create a hash of each phone number in your address book, they say
they delete the original so the only thing they say they store is the hash.

Notice they link it to you. That is important. It's not wholly anonymous.
They do that to make it faster when that contact eventually joins WhatsApp.

So it's not a completely anonymous hash so much as every one of your
contacts is forever linked to you by an anonymous hash - which isn't the
same thing as being anonymous because they know who you are exactly.

All those phone-number hashes are stored on WhatsApp servers.
That is, you are linked, on WhatsApp servers, to everyone in your contacts.

They will even track what they call unusual changes in your address book.
So you have to wonder what kind of "activity" they consider suspicious.

As a nefarious example, let's say you live in an non-abortion state and you
contact numerous abortion doctors - maybe they'd consider that suspicious.
I'm not accusing them of that. I'm just telling you what they say they do,
and from that, I'm surmising what they can do with the info that they have.

If you don't use "Contact Upload" then you'll have limited functionality.

Bear in mind, Frank, that I dumbed this down greatly for Carlos because he
already said that copying a file was too difficult for him so it wouldn't
have been worth my time to explain it with more than a single sentence.

Yet he immediately wrongly objected to my single sentence explanation.
So he wasn't worth even that much of my time trying to help him understand.

Let me know if you are.

VanguardLH wrote on Sun, 28 Jan 2024 15:01:52 -0600 :
>>>> How does WhatsApp know who in your contacts is a WhatsApp
>>>> subscriber?
>>>
>>> WhatsApp claims end-to-end encryption: from client to client, and
>>> what's on the server remains encrypted (in-situ on server).
>>
>> If you store your contacts in the default location, WhatsApp uploads
>> them.
>
> To where? Everything on the server is encrypted.

Encrypted or not, each contact is linked to you on WhatsApp servers.
(Specifically the hash of the phone number but I'm dumbing it down for you)

> I'd have to see a technical paper describing just where contacts are
> stored when using the WhatsApp service.

Start with this simple explanation first and then tell me I'm wrong.
https://faq.whatsapp.com/1191526044909364

>> As I understand how it works, unless you set the phone up like I do,
>> every time you run WhatsApp, it uploads your contacts to its servers.
>
> Not what I read on how the WhatsApp operates.

I'm going to stop this conversation soon becasue it's frustrating trying to
have a sensible conversation with people like you, Carlos & Frank because
you guess at everything. And you're constantly guessing wrong.

Look at the reference I just gave you.
They say they upload your contacts as frequently as daily.

Please stop guessing.
Every one of your guesses is dead wrong.

>
>> So not only are his arguments absurd. They're wrong.
>
> So far, I think you're wrong about how WhatsApp handles contacts.

I don't guess.
You do.

So I'm not wrong.
You may misunderstand me.
I might make a typo.
Or a mistake.

But if I say it, that's what is happening.

Did you look at the reference I gave you?
https://faq.whatsapp.com/1191526044909364

You tell me what you think it says.

And no, don't go down a million extra asinine needless hurdles that you did
when I told you how easy it was to NOT put your contracts into a database.

You spent ooodles of time telling me all about how much you hate email.
That had NOTHING to do with it. You were just desperate for an excuse.

You demanded I tell you what contacts app I use.
You demanded to know my MUA.
And you demanded to know my master editing tool (merging & unduplicating).
You demanded to know how I encrypted them in storage and transit.
And then you want on for multiple tirades about copying a simple file.
You threw in all sorts of absurd hurdles like losing the phone.
And on and on and on, you demanded information from me and I responded.

And then in the end you told me that thinking was too hard for you to do.
So did Carlos. He insulted me saying nobody uses Microsoft Excel on a PC.

WTF?

Stop that.
Assume I know what I'm talking about.

Not because I'm smart.
And not even because I'm not stupid.
But because I don't guess.
And because I've done it.

You guess.
And you've never done it.

So you guess wrong.
Every time.

> Uploading your contacts to WhatsApp is *optional* to have them validate
> your list against those who have registered with their service.

I never said it wasn't.
If you think I said that, then you guessed at that.

What I did say was that even WhatsApp will say that WhatsApp functionality
will be limited if you don't do that. So it's only optional if you don't
want full functionality (which makes it not really optional in my book).

BTW, this isn't a problem for me.
I'm not stupid. And I'm not lazy.

This is a problem for everyone else who is.

I've got nothing (that's real) in my contacts database.
So none of this applies to me.

But it applies to you (if you use WhatsApp).
And to Carlos (if he does).
And Frank too.

And to just about everyone else who uses WhatsApp.
Just not me.

Andrew <andrew@spam.net> wrote:

> VanguardLH wrote on Sun, 28 Jan 2024 15:10:31 -0600 :
>
>>> *Fact* is that *if* you choose to upload your contacts to 'Google', it
>>> only gets into *your* Google Account storage. Duh!
>>
>> Yep. If you do not create a Google account, or assign your phone to
>> one, then your phone has no Google account to which it can sync
>> anything.
>
> All three of you are always dead wrong because you've never tested it.
> I have.
>
> Try this simple test _before_ you respond and say Google doesn't get your
> contacts the very first time you log into your Google account to get email.
>
> 1. (Optional) Wipe out every vestige of your Google Account on your phone
> 2. Create a new contact "Frank Carlos Vanguard, +1-234-567-8910 & save it
> 3. Simply tap on the default GMail app, get your mail & close the app

How does the Gmail app on your phone know to what Google account to
connect to poll for e-mail or to synchronize its local data if there is
no Google account on your phone? The Gmail app does not store accounts.
It gets them from the account manager in Android.

Somehow in your above test you are still connecting to a Google account
despite you claim you wiped it off your phone. Since the Google account
is gone, how is any app going to connect to a non-existing account? I
think your process is flawed, because once signed out of your Google
account, and with none available from the Android account manager, the
app doesn't know where to connect. You got prompted to re-add your
Google account, you did, so then the app knew where to connect. There
is no master directory with all our names, e-mail addresses, phone
numbers, and so on that the Gmail app could somehow detect who was using
the phone to then match up with a master directory.

You reveal the flaw in your above procedure with "get your mail". Not
possible without logging into your Google account, but you don't have
one defined anymore on your phone. To "get your mail" meant you
reauthorized the app to connect to your Google account, and that meant
you were prompt as to WHICH Google account your phone should connect.

Removing your Google account (and others) is what you do before gifting,
selling, or trading your phone. You don't want to grant access to
someone else to get into your accounts.

Removing a Google account from your phone signs you out of Google's
apps, like Gmail, Maps, and Calendar. Some Google apps still retain
some functionality, like Maps and Search, but they cannot use a Google
account that no longer exists on your phone.

No Google account on your phone. How does the phone know you are using
it, and what, if any, Google account is yours? It knows that by the
account you created in Android's account manager.

Even after deleting the Google account on your phone, or even resetting
it, there is still one place that retains records on which device you
used with Google: up in your online Google account. Go to Your Devices
to delete them. However, that is information in your Google account
that apps on your phone no longer know about because you deleted the
account on your phone. They don't know where to connect.

> Guess what.
> Google got your contacts.

And this is verified how? By going online into your Google account to
look at contacts?

>> Android settings -> General -> Accounts
>> (navpath on my LG V20 smartphone)
>
> It doesn't matter if you don't have a Google account on the phone.
> Google will *create* that Google account if you use some of their apps.

No, you get prompted to enter that information. Your choice to add the
account or not. You slipped up by re-entering the Google account on
your phone.

> In the test above, notice it doesn't matter that you wiped out every
> vestige of the google account on your phone. Google will _create_ it.

Only in your world. No accounts get created on your phone without your
say-so. Ignoring the prompts doesn't change you added the account. I
have never owned a phone where I wanted to do e-mail without having to
specify the account to poll. That could be Google, Microsoft, or
whomever is operating the e-mail service. At best, when setting up a
new app, I get prompted which account to reuse that is already defined;
else, I have to provide specifics on how to log into my account.

At this point, it's obvious you're just spreading FUD about Google's
control over Android phones. You gave them your account, so they knew
where to connect. Delete all accounts, and you go through the setup
again. And, yes, I have been through that scenario.

Andrew <andrew@spam.net> wrote:

> Start with this simple explanation first and then tell me I'm wrong.
> https://faq.whatsapp.com/1191526044909364

Start with the first sentence that reads "Contact upload is an optional
feature".

Frank Slootweg wrote on 28 Jan 2024 15:43:33 GMT :

>> WhatsApp claims end-to-end encryption: from client to client, and what's
>> on the server remains encrypted (in-situ on server). However, while
>> they do end-to-end encryption on messages, I cannot find specific
>> reference to encrypting contacts at the server.
>
> Probably because WhatsApp does not store "contacts at the server"! :-)

I drastically dumbed it down for Vanguard & Carlos, Frank. Remember, Carlos
said that Microsoft Excel was far too complicated for him, and in fact
Carlos even ridiculed the use of any Microsoft Office tool ever on a PC.

So it wouldn't have been worth any energy not to dumb it down for him.
Even so, he disputed what he doesn't even understand, as do you & Vanguard.

See this post to you which still dumbs it down for you, but not as much.
Message-ID: <up6th9$25lj$1@nnrp.usenet.blueworldhosting.com>

And if you go down the hole that it's optional if you are willing to put up
with loss of basic functionality, then you're missing what most people do.

> Sofar he's disparaged Google and WhatsApp without providing any
> substance, proof, etc.. Why should he stop there!?

This conversation is over until and unless you grow up and understand the
GMail example I gave to Vanguard is something you have never even tried.
Message-ID: <up6qig$2h2$1@nnrp.usenet.blueworldhosting.com>

Because you have never tried it, you're just guessing how it works.
And you're guessing wrong.

Stop that.
Try it.

Then tell me it doesn't work the way it works.
When you tell me it doesn't work the way it works, you sound no different
than Carlos when he ridiculed the use of Microsoft Office tools on a PC.

Who is that stupid, Frank?
Carlos is.

Don't you be that stupid.

When you tell me that WhatsApp doesn't save the hashes on their servers,
then you sound stupid Frank - just as stupid as Vanguard did when he
brought up a million desperate hurdles for why he can't copy a file.

He sounded stupid.
Because he vehemently complained about something as simple as s file copy.

He threw up inane hurdle after asinine hurdle, Frank.
Like what if he's on vacation or what happens if he loses his phone.
He demanded to know my MUA. And my contacts manager. And what encryption.

He went on and on about his last century sneaker net frustrations, Frank.
And then he complained endlessly about how much he hates mail servers.

All because he's too lazy to think about how to copy & merge a file.
Don't be like that Frank.

You are smarter than Carlos & Vanguard combined and multiplied by ten.
Don't just guess.

Remember, I can use WhatsApp with a direct dialer.
They can't.
Can you?

I don't know, but most people are too stupid to understand the implications
of not feeding any app that asks for it their default Android contacts DB.

Until you understand the concepts, I've wasted already hours on you.
In your response, please don't refute what you are just guessing about.

For example, if you've never used the GMail app, then don't tell me it
doesn't create an Android account on your phone the moment you use it.

I'm trying to help you (and Vanguard and Carlos) understand what you don't.

I don't guess.
You shouldn't either.

I don't guess. I test.
You should too.

After you test what I've said, then YOU tell me that I was right all along.
Until then, good bye.

VanguardLH wrote on Sun, 28 Jan 2024 19:39:40 -0600 :

>> Start with this simple explanation first and then tell me I'm wrong.
>> https://faq.whatsapp.com/1191526044909364
>
> Start with the first sentence that reads "Contact upload is an optional
> feature".

I never said it wasn't and, let's be clear, I use the WhatsApp direct
dialer so they only get the contact that I'm communicating directly with.

And, let's end with the sentence that says something to the effect of if
you don't do this, you won't get the functionality that you expect of the
app (which you don't understand as you've probably never used the app).

With those two statements in mind, I expect an apology before I respond any
further because you wasted hours of my time when you were wrong all along.

VanguardLH wrote on Sun, 28 Jan 2024 19:36:15 -0600 :

> How does the Gmail app on your phone know to what Google account to
> connect to poll for e-mail or to synchronize its local data if there is
> no Google account on your phone?

Idiot. Now you're just wasting my time. I'm not reading further.

I was sincerely trying to help you understand what you just guess at.
I gave you a simple test case.
And you stubbornly refuse to test it.

You just want to guess.
And you always guess wrong.

Which is fine.
But don't tell me I'm wrong when you're only guessing that I'm wrong.

I'm completely different from you.
I don't guess.
I test.

Without even testing it for a single second, you throw up absurd hurdles
which show you didn't even read what I wrote, let alone understood it.

Until you test it, stop guessing that it doesn't work how it does.

Give me some credit.
Nothing I've ever said in this thread has been wrong.

Almost everything you said was.
Think about that.

If/when you apologize, I can teach you what you clearly do not know.

If you remain an obstinate idiot objecting to the simplest things like
Carlos did when he claimed nobody uses Microsoft Office on a PC (in effect,
because _he_ doesn't) then you're only proving to not be worth my energy.

Try it first.
Then respond.

Frank Slootweg wrote on 28 Jan 2024 15:16:29 GMT :

> For once, try to follow the discussion and try to read for
> comprehension!
>
> I don't have any problem. I was only giving information/suggestions to
> *VanguardLH*, for encrypting/decrypting a contacts file *if* he wanted
> to do that, which is *not* (yet) a given.

I was trying to help you Frank, because you typically choose dumb apps.

The apps I provided are (IMHO) much better for what _you_ said you wanted
to do than the apps you listed (I searched for them to help you, Frank).

In fact, I'd like to ask you what, of what you expressed you needed in this
thread, do you NOT get with that ZArchiver that I helpfully found for you?

As for Vanguard, simply copying a file he said is too much work for him.
I spent hours trying to address each and every one of his concerns.

And in the end, like Carlos when he ridiculed the use of Microsoft Office
on a PC, Vanguard ridiculed the concept of copying a file as a master db.

Who throws up so many hurdles such that their hurles are these two thing?
a. Who ridicules the use of Microsoft Office on a PC (but Carlos)?
b. Who ridicules copy & sync to maintain a Master DB (but Vanguard)?

The objections you three are throwing up are simply absurd.
I'm wasting my time trying to explain to you what you can't comprehend.

VanguardLH wrote on Sun, 28 Jan 2024 14:08:12 -0600 :

> I need to look further into closing both doors into the barn.

It's a simple file copy-&-merge process (removing dups) for Christ sake.

VanguardLH wrote on Sun, 28 Jan 2024 14:39:12 -0600 :

> From a screenshot (http://zdevs.ru/en/za/user_guide.html), looks
> like AES 256, but there is a down chevron indicating there are other
> choices; however, the other choices might only be ZipCrypto which is the
> old PKZIP encryption algorithm that has long been vulnerable, but is
> compatible across all Zip archivers.

I don't mention an app that I don't install unless it's to solve a problem
that you have which I don't have the energy or equipment or time to test.

I installed ZArchiver though, after spending my valuable time and energy to
find it to solve the problems that I thought that Frank & you wanted
solved.

If you can present to me a simple quick way to test ZArchiver for you, I
can do that, but if it's something you can test, you should do that first.

Keep in mind a thank you wouldn't be out of place given I listened to every
one of your objections (many of which were absurd) and I responded to every
one. Likewise with Frank. And Carlos (although CArlos' objection that using
Microsoft Office on a PC has to take the case as he ridiculed that and in
effect, he ridiculed me).

I get ridiculed for trying to help people, which is fine, but Carlos
ridiculed me for using Microsoft Office on a PC, which is absurd.

Don't you think?
That's what I'm dealing with here.

Until I get a thank you or an apology (actually both are due) I've wasted
my time trying to help you understand how Android & contacts work.

Andrew <andrew@spam.net> wrote:

> VanguardLH wrote on Sun, 28 Jan 2024 14:39:12 -0600 :
>
>> From a screenshot (http://zdevs.ru/en/za/user_guide.html), looks
>> like AES 256, but there is a down chevron indicating there are other
>> choices; however, the other choices might only be ZipCrypto which is the
>> old PKZIP encryption algorithm that has long been vulnerable, but is
>> compatible across all Zip archivers.
>
> I installed ZArchiver though, after spending my valuable time and energy to
> find it to solve the problems that I thought that Frank & you wanted
> solved.
>
> If you can present to me a simple quick way to test ZArchiver for you,
> I can do that, but if it's something you can test, you should do that
> first.

Zarchiver has no network access, so you'll need another way to test
across devices. My simple and most often scenario would be to encrypt a
file on my Windows host to transfer to my Android device (I tend to say
host for both since both are networked endpoints). On Windows, I use
Peazip, a variant of 7-zip (I started with that one before Peazip).
That's where I'd create the encrypt file, like one with my contact
records.

Then I transfer/transport the file to my Android phone where I need to
decrypt it. AxCrypt would work in that scenario on the Android phone
since it is an archive viewer/extractor, but I wanted the option to
encrypt on Android if I wanted to migrate data the other way back to my
Windows hosts. As long as Zarchive can encrypt and decrypt an AES 256
file then that covers the major scenario.

I installed Zarchive on my smartphone, and will go forward with that on
the Android end. However, OneNote gives me AES 128, too, and it has
apps for Windows, Android, and iOS. So, I have 2 choices. I do save
sensitive data in sections in my OneNote notebooks, and those sections
are encrypted, and a password is required to open those sections whether
it be on my Windows or Android hosts, or when using the MS web UI to my
OneNote account. I figured on adding Zarchiver on Android, and continue
using Peazip on Windows, for when I don't want to employ OneNote to do
both transport and encryption.

Andrew <andrew@spam.net> wrote:

> VanguardLH wrote on Sun, 28 Jan 2024 14:08:12 -0600 :
>
>> I need to look further into closing both doors into the barn.
>
> It's a simple file copy-&-merge process (removing dups) for Christ sake.

Don't know where you are going there. You argue that protecting the
contact records is better security. I agree, but that's only half the
protection. Not securing the e-mails with their contact info is the
other half. Once I figure out how to secure BOTH is when I'll bother to
implement both.

Think of the cops chasing a perp. The perp is dressed all in black, the
cops are chasing the perp at night, but the perp is wearing those
sneakers that light up at the heel with every step. He's hiding while
visually broadcasting his location. All the blackout clothes were a
waste with those blinking sneakers.

I think we've pretty much hashed out how to protect the contact records.
I've been hunting around for where the e-mails are protected not just
in-transit (end-to-end encryption), but also in-situ (residing on the
server). I found one solution, but it isn't free unless I restrict
myself to using only HTTPS to access my account. For cooperation with a
local IMAP client, I'd have to use a local proxy that decrypts the
e-mails on my end on incoming, and encrypts e-mails on my end for
outgoing. That's ProtonMail with their bridge (proxy). However, that
is about $48/year. A bit pricey for my low volume of e-mail.

I'm not talking about using PGP or x.509/SMIME certs and key pairs to
send encrypted e-mails. That encrypts the body, not the headers where
is the contact info. Used to be there were a few places you could get
free e-mail certificates. They're almost gone now. Comodo was the
last, but now they want $12/yr via their InstantSSL CA. The only one
I've found, so far, is at:

https://shop.actalis.com/store/it-en/certificati-s-mime

My local e-mail client also supports PGP, but the problem there is the
cert doesn't identify a CA server, and recipients have to guess which
PGP repository to query to verify a PGP cert. It was created as a free
alternative to using x.509 certs from CA (which required payment).
Sometimes you see someone here in Usenet adding their PGP signature as
though that really helps to secure their identity, but no one is going
to bother looking it up at various PGP repositories to find a match. I
use eM client which support X.509/SMIME and PGP encryption. They offer
their own key repository for others to look you up to verify your
identity with your public key, but, again, that's yet another PGP
repository to check. x.509/SMIME certs say who is the CA (Certificate
Authority) that issued the cert.

E-mail encryption doesn't cover encrypting the headers, so the contact
records are still vulnerable to breaches, hacking, theft, abuse, etc.
You're protecting the body of the message, not the headers (which are
required for routing and tracing). I'm checking where the e-mails
remain encrypted in-situ at the e-mail provider to ensure no one can get
at the contact headers in them. ProtonMail is too expensive for me. I
haven't yet found a cheaper or free alternative.

Andrew <andrew@spam.net> wrote:

> VanguardLH wrote on Sun, 28 Jan 2024 19:36:15 -0600 :
>
>> How does the Gmail app on your phone know to what Google account to
>> connect to poll for e-mail or to synchronize its local data if there
>> is no Google account on your phone?
>
> Idiot. Now you're just wasting my time. I'm not reading further.

Everyone else knows who is the idiot here. You have been deemed a
troll. Not the obnoxious and obvious type, but the original type that
was subtle.

No app can connect to an account it is not told about. No phone is sold
that comes pre-bundled with YOUR Google account defined on it.

Andrew <andrew@spam.net> wrote:

> VanguardLH wrote on Sun, 28 Jan 2024 19:39:40 -0600 :
>
>>> Start with this simple explanation first and then tell me I'm wrong.
>>> https://faq.whatsapp.com/1191526044909364
>>
>> Start with the first sentence that reads "Contact upload is an optional
>> feature".
>
> I never said it wasn't and, let's be clear, I use the WhatsApp direct
> dialer so they only get the contact that I'm communicating directly with.
>
> And, let's end with the sentence that says something to the effect of if
> you don't do this, you won't get the functionality that you expect of the
> app (which you don't understand as you've probably never used the app).

Yep, not uploading your contacts doesn't let others see your online
status (online, away, offline, whatever) same as when others don't
upload their contacts then you don't get to see their status. For me,
and I'm probably not typical, I don't give a gnat's fart about someone's
status with a service. When I call them, and there is no answer, I call
back. I don't need to be told they are on the phone, taking a dump, out
at a restaurant, or anything why they didn't answer the call. They
didn't answer, I'll try later.

I'm sure there other features available with WhatsApp when you upload
your contacts, but WhatsApp still works in its basic mode when you keep
private your contacts (don't let WhatsApp app read your phone's address
book). Often lots of glitz gets added to a product or service that I
don't care about.

> With those two statements in mind, I expect an apology before I
> respond any further because you wasted hours of my time when you were
> wrong all along.

And I say you were wrong, so you apologize first. This is Usenet, not
some uber-friends club where Mom tells us to play nice together. We
don't learn by agreeing to what we think we already know. We learn
through contrast or contention.

Andrew <andrew@spam.net> wrote:

> Frank Slootweg wrote on 28 Jan 2024 15:43:33 GMT :
>
>>> WhatsApp claims end-to-end encryption: from client to client, and what's
>>> on the server remains encrypted (in-situ on server). However, while
>>> they do end-to-end encryption on messages, I cannot find specific
>>> reference to encrypting contacts at the server.
>>
>> Probably because WhatsApp does not store "contacts at the server"! :-)
>
> I drastically dumbed it down for Vanguard & Carlos, Frank. Remember, Carlos
> said that Microsoft Excel was far too complicated for him, and in fact
> Carlos even ridiculed the use of any Microsoft Office tool ever on a PC.
>
> So it wouldn't have been worth any energy not to dumb it down for him.
> Even so, he disputed what he doesn't even understand, as do you & Vanguard.
>
> See this post to you which still dumbs it down for you, but not as much.
> Message-ID: <up6th9$25lj$1@nnrp.usenet.blueworldhosting.com>
>
> And if you go down the hole that it's optional if you are willing to put up
> with loss of basic functionality, then you're missing what most people do.
>
>> Sofar he's disparaged Google and WhatsApp without providing any
>> substance, proof, etc.. Why should he stop there!?
>
> This conversation is over until and unless you grow up and understand the
> GMail example I gave to Vanguard is something you have never even tried.
> Message-ID: <up6qig$2h2$1@nnrp.usenet.blueworldhosting.com>
>
> Because you have never tried it, you're just guessing how it works.
> And you're guessing wrong.
>
> Stop that.
> Try it.
>
> Then tell me it doesn't work the way it works.
> When you tell me it doesn't work the way it works, you sound no different
> than Carlos when he ridiculed the use of Microsoft Office tools on a PC.
>
> Who is that stupid, Frank?
> Carlos is.
>
> Don't you be that stupid.
>
> When you tell me that WhatsApp doesn't save the hashes on their servers,
> then you sound stupid Frank - just as stupid as Vanguard did when he
> brought up a million desperate hurdles for why he can't copy a file.
>
> He sounded stupid.
> Because he vehemently complained about something as simple as s file copy.
>
> He threw up inane hurdle after asinine hurdle, Frank.
> Like what if he's on vacation or what happens if he loses his phone.
> He demanded to know my MUA. And my contacts manager. And what encryption.
>
> He went on and on about his last century sneaker net frustrations, Frank.
> And then he complained endlessly about how much he hates mail servers.
>
> All because he's too lazy to think about how to copy & merge a file.
> Don't be like that Frank.
>
> You are smarter than Carlos & Vanguard combined and multiplied by ten.
> Don't just guess.
>
> Remember, I can use WhatsApp with a direct dialer.
> They can't.
> Can you?
>
> I don't know, but most people are too stupid to understand the implications
> of not feeding any app that asks for it their default Android contacts DB.
>
> Until you understand the concepts, I've wasted already hours on you.
> In your response, please don't refute what you are just guessing about.
>
> For example, if you've never used the GMail app, then don't tell me it
> doesn't create an Android account on your phone the moment you use it.
>
> I'm trying to help you (and Vanguard and Carlos) understand what you don't.
>
> I don't guess.
> You shouldn't either.
>
> I don't guess. I test.
> You should too.
>
> After you test what I've said, then YOU tell me that I was right all along.
> Until then, good bye.

Why does this guy remind me of Alan Connor?

On 2024-01-29 03:06, Andrew wrote:
> Frank Slootweg wrote on 28 Jan 2024 15:16:29 GMT :
>
>> For once, try to follow the discussion and try to read for
>> comprehension!
>>
>> I don't have any problem. I was only giving information/suggestions to
>> *VanguardLH*, for encrypting/decrypting a contacts file *if* he wanted
>> to do that, which is *not* (yet) a given.
>
> I was trying to help you Frank, because you typically choose dumb apps.
>
> The apps I provided are (IMHO) much better for what _you_ said you wanted
> to do than the apps you listed (I searched for them to help you, Frank).
>
> In fact, I'd like to ask you what, of what you expressed you needed in this
> thread, do you NOT get with that ZArchiver that I helpfully found for you?
>
> As for Vanguard, simply copying a file he said is too much work for him.
> I spent hours trying to address each and every one of his concerns.
>
> And in the end, like Carlos when he ridiculed the use of Microsoft Office
> on a PC, Vanguard ridiculed the concept of copying a file as a master db.
>
> Who throws up so many hurdles such that their hurles are these two thing?
> a. Who ridicules the use of Microsoft Office on a PC (but Carlos)?

Hi, Arlen!

I did not ridicule the use of Microsoft Office.

I simply said I never use it, in decades.

> b. Who ridicules copy & sync to maintain a Master DB (but Vanguard)?
>
> The objections you three are throwing up are simply absurd.
> I'm wasting my time trying to explain to you what you can't comprehend.

I'm not throwing objections. You can do what you please, and I will keep
doing what I please, in this case, using the Android default Address
Book. To each his own.

Don't try to teach me how to sync things differently. I know how to sync
things since computers came with RS232 ports.

--
Cheers, Carlos.

On 2024-01-29 06:36, VanguardLH wrote:
> Andrew <andrew@spam.net> wrote:
>
>> VanguardLH wrote on Sun, 28 Jan 2024 14:08:12 -0600 :

....

> E-mail encryption doesn't cover encrypting the headers, so the contact
> records are still vulnerable to breaches, hacking, theft, abuse, etc.
> You're protecting the body of the message, not the headers (which are
> required for routing and tracing). I'm checking where the e-mails
> remain encrypted in-situ at the e-mail provider to ensure no one can get
> at the contact headers in them. ProtonMail is too expensive for me. I
> haven't yet found a cheaper or free alternative.

Contact information in email can not be encrypted: the software server
needs to be able to read it in order to route the email to the proper
destination.

Once archived, the storage might be encrypted in full, but you probably
will not be able to get this for free.

And this means that further processing is not possible. Email would be
impossible to display on webmail or available via imap, so the server
needs to have the key.

--
Cheers, Carlos.

On 2024-01-29 06:45, VanguardLH wrote:
> Andrew <andrew@spam.net> wrote:
>
>> Frank Slootweg wrote on 28 Jan 2024 15:43:33 GMT :

....

>> After you test what I've said, then YOU tell me that I was right all along.
>> Until then, good bye.
>
> Why does this guy remind me of Alan Connor?

Who is that one? Another name of Arlen, perhaps?

--
Cheers, Carlos.

Andrew <andrew@spam.net> wrote:
> Frank Slootweg wrote on 28 Jan 2024 15:52:21 GMT :
>
> >> If you store your contacts in the default location, WhatsApp uploads them.
> >
> > Nope, as Carlos correctly said, WhatsApp does *not* upload your
> > contacts! (Umpteenth repeat of clue-by-four: WhatsApp Legal)
> >
> > If you think otherwise, *prove* it, with a cite from a *reputable*
> > source (complete with URL).
>
> You're not as stupid as Carlos is so bear in mind I dumbed it down because
> people like Carlos & Vanguard already told me a file copy is too hard.
>
> If they can't handle how to copy a file, then they can't handle hashes.
> Plus they can't handle common WhatsApp switches like "Contact Upload."
>
> Since this was covered long ago (I think it may have even been you who
> found all this out)

Yes, I pointed to this information several times.

> so from my memory, this is how it works for WhatsApp.
>
> When you use the built-in WhatsApp contact upload feature, for example,
> WhatsApp will upload your phone numbers *daily* from your default contacts
> database (frequency depends on how often you use the WhatsApp app).
>
> They only save the hash of the phone numbers on their servers & they say
> they will disregard the other data like real addresses and real names.
> That's what they say so you have to just trust them on it.

They will not "disregard the other data ...", they will not retrieve
it in the first place! "disregard" is already misleading and FUD.

> Notice I said "all" your contacts and not just the ones that use WhatsApp.
>
> I'm going to repeat this for effect because they say that they do save the
> hash of *every* contact even *before* that contact has joined WhatsApp!

Now - and later - you're mixing up "contact" and "phone number". They
do *not* retrieve, upload, collect, store, save, <whatever> "contact"s.
They only retrieve/store *phone number*s. And for non WhatsApp users,
they store only a cryptographic hash value, not the phone number itself.

And *because* they only store *phone numbers*, not contacts, they
*can not* do the dreadful things which you and others say/imply do /
might do.

So now try to remember the difference between a phone number and a
contact, so we will not have to do this silly dance over and over again.

[...]

VanguardLH <V@nguard.lh> wrote:
> Andrew <andrew@spam.net> wrote:
>
> > Start with this simple explanation first and then tell me I'm wrong.
> > https://faq.whatsapp.com/1191526044909364
>
> Start with the first sentence that reads "Contact upload is an optional
> feature".

The main problem, is that "Contact upload" is a misnomer. WhatsApp
does *not* upload your "contact"s. What they do and do not do, I have
explained in the response to 'Arlen', which I posted a little while ago.

VanguardLH <V@nguard.lh> wrote:
[...]

> Why does this guy remind me of Alan Connor?

You asked yourself that in December 2021 as well about 'Joel' in the
Windows 10/11 groups.

This was my response:

Message-ID: <sqn87q.qgg.1@ID-201911.user.individual.net>

Can't be bothered to back-track that to see if 'Joel' was 'Arlen'.

Andrew <andrew@spam.net> wrote:
> Frank Slootweg wrote on 28 Jan 2024 15:16:29 GMT :
>
> > For once, try to follow the discussion and try to read for
> > comprehension!
> >
> > I don't have any problem. I was only giving information/suggestions to
> > *VanguardLH*, for encrypting/decrypting a contacts file *if* he wanted
> > to do that, which is *not* (yet) a given.
>
> I was trying to help you Frank, because you typically choose dumb apps.

<barf!>

> The apps I provided are (IMHO) much better for what _you_ said you wanted
> to do than the apps you listed (I searched for them to help you, Frank).
>
> In fact, I'd like to ask you what, of what you expressed you needed in this
> thread, do you NOT get with that ZArchiver that I helpfully found for you?

FX File Explorer is - as the name says - a file explorer *and* it has
*integrated* *selective* archive (decryption and) extraction
functionality. *That* suits *my* needs better than any standalone
archiver/extractor.

Moral: Try to learn the difference between people asking for help and
people trying to help/advise other people.

[...]

VanguardLH <V@nguard.lh> wrote:
> Andrew <andrew@spam.net> wrote:
>
> > VanguardLH wrote on Sun, 28 Jan 2024 15:10:31 -0600 :
> >
> >>> *Fact* is that *if* you choose to upload your contacts to 'Google', it
> >>> only gets into *your* Google Account storage. Duh!
> >>
> >> Yep. If you do not create a Google account, or assign your phone to
> >> one, then your phone has no Google account to which it can sync
> >> anything.
> >
> > All three of you are always dead wrong because you've never tested it.
> > I have.
> >
> > Try this simple test _before_ you respond and say Google doesn't get your
> > contacts the very first time you log into your Google account to get email.
> >
> > 1. (Optional) Wipe out every vestige of your Google Account on your phone
> > 2. Create a new contact "Frank Carlos Vanguard, +1-234-567-8910 & save it
> > 3. Simply tap on the default GMail app, get your mail & close the app
>
> How does the Gmail app on your phone know to what Google account to
> connect to poll for e-mail or to synchronize its local data if there is
> no Google account on your phone? The Gmail app does not store accounts.
> It gets them from the account manager in Android.
>
> Somehow in your above test you are still connecting to a Google account
> despite you claim you wiped it off your phone. Since the Google account
> is gone, how is any app going to connect to a non-existing account? I
> think your process is flawed, because once signed out of your Google
> account, and with none available from the Android account manager, the
> app doesn't know where to connect.
[...]
> > Guess what.
> > Google got your contacts.

His flaw is that he says "Wipe out every vestige of your Google
Account on your phone", but that does not delete the Google Account
*itself*, it only wipes out *references (from the phone) to* the Google
Account. The Google Account still lives happily ever after and the 'Your
devices' list is still there and kept for 28 days, so also logging out
on your Android device probably still allows Google to re-connect your
Android device to your (non-deleted) Google Account.

So 'Arlen' hasn't actually proven anything.

As to "Guess what. Google got your contacts.", as I said, it's not
"Google" - i.e. FUD - which got your contacts, but <FS>"*your* Google
Account storage"</FS> has got your contacts. Duh!

[...]