8 ms·

Shame they went there instead of to Signal, but I guess it may still be a marginal improvement.

by etiam 11y ago

sultansaladin 11y ago
I have used both, but never heard of Signal I'll try it.
- alistair77 11y ago
  +1 for Signal (used to be TextSecure). They now have a desktop app in beta which synchronises perfectly with my mobile
  - julioneander 11y ago
    Installing Signal to try as well! Can Signal be taken down like WhatsApp if the same happens again in the future?
    - vincentkriek 11y ago
      Yes, Signal's advantage is the cryptographical security of the messages. It's NOT server independent.
      - etiam 11y ago
        I practice I agree, for now. In principle, since both the Signal client and server are FLOSS, it should be possible to resist a block in some ways that might not be so easy with for example Whatsapp, but as far as I can tell, as things stand right now there is no built-in way to switch server, and asking millions of regular people to make changes to the source code of their cellphone software, recompile and manually reinstall does not seem like a recipe for success. I wonder if one might sensibly work around these things by fallback/optional connection to the server through Tor if Tor is available on the device?
  - akerro 11y ago
    >They now have a desktop app It sit on the top of a close-source browser...
    - exo762 11y ago
      Chromium? No more closed source blobs [0] [0]: http://www.theregister.co.uk/2015/06/26/googles_not_listening_binary_blob_banished_from_chromium_build/ http://www.theregister.co.uk/2015/06/26/googles_not_listenin...
    - oceanofsolaris 11y ago
      You can also use it with chromium, which is open source.
      - akerro 11y ago
        Which downloads blobs from google when you're not looking...
    - sneak 11y ago
      No it doesn't. If you're going to wave this flag, you should be complaining about the management controller inside of your CPU (presuming you are already running an open source OS).
      - akerro 11y ago
        >you should be complaining about the management controller inside of your CPU And I am! I can't wait for Novena! Also notice a difference. Having a close-sourced CPU is different than having a close-source browser which has much more possibilities to compromise you. It can start camera, microphone, read disk files, locate you and transmit everything to "cloud".
- rmc 11y ago
  Edward Snowdon recommends Signal.
tazjin 11y ago
Signal, and in extension the other privacy-aware messengers (Threema etc), can not replace Telegram or iMessage because they lack basic features like multi-device sync. The hard problem of messaging has not been solved yet, what people should build is a service like iMessage but with the public key pool per account publicly auditable and verifiable.
- gtf21 11y ago
  Telegram has the same problem with "Secret Chats" which can only be read on the device from which they are initiated.
  - tazjin 11y ago
    Yes, but the amount of people who actually use secret chats is tiny. It reminds me a bit of the CAP-theorem: Security, Device Sync and Usability. Pick two. My personal preference is solving DU, because I can do security aware stuff with GPG.
  - izacus 11y ago
    People don't use Telegram (or whatsapp) for secret chats, but because it's a UX friendly messenger that replaces paid SMS services.
    - antocv 11y ago
      Well me and my friends use it for Secret Chats, so, you're wrong.
- Asmod4n 11y ago
  multi-device sync means you have to store the private key in the "cloud", or something else which could directly identify you.
  - tazjin 11y ago
    No, iMessage for example generates a unique key pair per device and submits your public key to the key pool for your account. Devices can then sync old history using each other's keys and new messages will be encrypted for all devices. The problem is that the key pool is in Apple's hands. You cannot guarantee that they don't go and add a key do the pool and get all your messages anyways.
Al-Khwarizmi 11y ago
For me it would be a huge improvement if this happened in my country. It would mean that if I'm sitting in front of a keyboard and a screen as I am most of the day, I would be able to reply to my friends comfortably using them. With that joke of an application called Whatsapp, I have to choose between replying from a tiny smartphone screen and on-screen keyboard, or going through a ludicrous ritual of photographing a QR code (which works only if my phone has wifi signal and enough battery). To be honest, privacy in a general-purpose messaging app is the least of my concerns, as I have other means of sending important messages to select people. What is really annoying about Whatsapp is its extreme device dependence* which forces me to depend on a single device for casual chat with friends, family and acquaintances (and not the most comfortable use one) when multi-device messenger apps have been around for more than a decade. Telegram is like a return to sanity in this respect, so any news about Telegram invading Whatsapp's space are great news to me. *I say "extreme" because Whatsapp doesn't even like if you switch your SIM card from one phone to another. It's insane. I used to have two phones (one for regular use and a cheap old one for activities where it could get damaged easily) and I had to give that up because Whatsapp would force me to re-register every time I made the swap.
- mahouse 11y ago
  >or going through a ludicrous ritual of photographing a QR code You know you have to do that only once yes?
  - emmet 11y ago
    You have to do it every time you use WhatsApp web. Not for each message, but it's an unwanted ceremony nonetheless.
    - mahouse 11y ago
      No. It's only the first time. Then the key is stored in the browser forever (or, at least, for a very long time)
      - 11y ago
chrisfarms 11y ago
I like how the Signal app (at least on Android) also works for insecure SMS to give me one place for messaging... well apart from everyone who uses WhatsApp at least. What I'd love is if they could also make it an email client too. Letting me send/receive insecure emails or (if the recipient has Signal) encrypted email using the same key management. I'd much prefur to give out an email address (totally in my control) than a phone number (could be taken away from me at any moment). One digital communication app please.
moxie 11y ago
Marginal improvement in what sense? When considering privacy, Telegram is by far the worst option. They store the plaintext message history on the server of every message that every user has ever sent or received. Even if WhatsApp weren't using end to end encryption by default, they would have no way of complying with government requests like this one, because they simply don't have the messages. Telegram, on the other hand, is a surveillance dream.
- etiam 11y ago
  Only in the limited sense that Telegram appears to at least have an intention of really providing private messaging and one might hope that they one day drop the delusions of grandeur and start to take seriously constructive criticism about how to do it right, as you and others have presented in other threads here. My understanding of the Whatsapp end-to-end-encryption is that the use of the term is completely misleading, as the "ends" they are referring to are the client and the Whatsapp server (https://www.whatsapp.com/faq/en/general/21864047 https://www.whatsapp.com/faq/en/general/21864047). Unless you know otherwise, I take that to mean the communications are in the clear at Facebook, and in my estimation that's tantamount to piping them straight into the US surveillance machinery through whatever they call PRISM these days, or some more or less distant relative of it. (This arrangement would still offer protection from bad actors that don't have some form of easy access to Facebook's internal information). Both seem like dreadful options in absolute terms, but if we're comparing I'd slightly rather have that user base in the hands of someone possibly sincere and incompetent than with someone competent but almost certainly treacherous. At least there is a sliver of hope for improvement and, who knows, maybe once they're off the paved road of Whatsapp they'll wobble their way though other alternatives to something like Signal eventually. Since we're fortunate enough to have you here anyway, would you mind commenting on how Signal would fare under a similar blockade? https://news.ycombinator.com/item?id=10750898 https://news.ycombinator.com/item?id=10750898 Would the service be taken down? Do you consider it a priority to try making it difficult to block in the default configuration?
  - moxie 11y ago
    It's actually the exact opposite. Telegram has made design decisions that prevent them from ever being able to provide private messaging by default without radically altering their design and re-writing all of their clients. The Telegram "client" is really the server -- everything happens there, and the client you use is just a view onto the server.

Shame they went there instead of to Signal, but I guess it may still be a marginal improvement.

by etiam 11y ago

Shame they went there instead of to Signal, but I guess it may still be a marginal improvement.

sultansaladin 11y ago

I have used both, but never heard of Signal I'll try it.

alistair77 11y ago
+1 for Signal (used to be TextSecure). They now have a desktop app in beta which synchronises perfectly with my mobile
- julioneander 11y ago
  Installing Signal to try as well! Can Signal be taken down like WhatsApp if the same happens again in the future?
  - vincentkriek 11y ago
    Yes, Signal's advantage is the cryptographical security of the messages. It's NOT server independent.
    - etiam 11y ago
      I practice I agree, for now. In principle, since both the Signal client and server are FLOSS, it should be possible to resist a block in some ways that might not be so easy with for example Whatsapp, but as far as I can tell, as things stand right now there is no built-in way to switch server, and asking millions of regular people to make changes to the source code of their cellphone software, recompile and manually reinstall does not seem like a recipe for success. I wonder if one might sensibly work around these things by fallback/optional connection to the server through Tor if Tor is available on the device?
- akerro 11y ago
  >They now have a desktop app It sit on the top of a close-source browser...
  - exo762 11y ago
    Chromium? No more closed source blobs [0] [0]: http://www.theregister.co.uk/2015/06/26/googles_not_listening_binary_blob_banished_from_chromium_build/ http://www.theregister.co.uk/2015/06/26/googles_not_listenin...
  - oceanofsolaris 11y ago
    You can also use it with chromium, which is open source.
    - akerro 11y ago
      Which downloads blobs from google when you're not looking...
  - sneak 11y ago
    No it doesn't. If you're going to wave this flag, you should be complaining about the management controller inside of your CPU (presuming you are already running an open source OS).
    - akerro 11y ago
      >you should be complaining about the management controller inside of your CPU And I am! I can't wait for Novena! Also notice a difference. Having a close-sourced CPU is different than having a close-source browser which has much more possibilities to compromise you. It can start camera, microphone, read disk files, locate you and transmit everything to "cloud".
rmc 11y ago
Edward Snowdon recommends Signal.

tazjin 11y ago

Signal, and in extension the other privacy-aware messengers (Threema etc), can not replace Telegram or iMessage because they lack basic features like multi-device sync. The hard problem of messaging has not been solved yet, what people should build is a service like iMessage but with the public key pool per account publicly auditable and verifiable.

gtf21 11y ago
Telegram has the same problem with "Secret Chats" which can only be read on the device from which they are initiated.
- tazjin 11y ago
  Yes, but the amount of people who actually use secret chats is tiny. It reminds me a bit of the CAP-theorem: Security, Device Sync and Usability. Pick two. My personal preference is solving DU, because I can do security aware stuff with GPG.
- izacus 11y ago
  People don't use Telegram (or whatsapp) for secret chats, but because it's a UX friendly messenger that replaces paid SMS services.
  - antocv 11y ago
    Well me and my friends use it for Secret Chats, so, you're wrong.
Asmod4n 11y ago
multi-device sync means you have to store the private key in the "cloud", or something else which could directly identify you.
- tazjin 11y ago
  No, iMessage for example generates a unique key pair per device and submits your public key to the key pool for your account. Devices can then sync old history using each other's keys and new messages will be encrypted for all devices. The problem is that the key pool is in Apple's hands. You cannot guarantee that they don't go and add a key do the pool and get all your messages anyways.

Al-Khwarizmi 11y ago

For me it would be a huge improvement if this happened in my country. It would mean that if I'm sitting in front of a keyboard and a screen as I am most of the day, I would be able to reply to my friends comfortably using them. With that joke of an application called Whatsapp, I have to choose between replying from a tiny smartphone screen and on-screen keyboard, or going through a ludicrous ritual of photographing a QR code (which works only if my phone has wifi signal and enough battery). To be honest, privacy in a general-purpose messaging app is the least of my concerns, as I have other means of sending important messages to select people. What is really annoying about Whatsapp is its extreme device dependence* which forces me to depend on a single device for casual chat with friends, family and acquaintances (and not the most comfortable use one) when multi-device messenger apps have been around for more than a decade. Telegram is like a return to sanity in this respect, so any news about Telegram invading Whatsapp's space are great news to me. *I say "extreme" because Whatsapp doesn't even like if you switch your SIM card from one phone to another. It's insane. I used to have two phones (one for regular use and a cheap old one for activities where it could get damaged easily) and I had to give that up because Whatsapp would force me to re-register every time I made the swap.

mahouse 11y ago
>or going through a ludicrous ritual of photographing a QR code You know you have to do that only once yes?
- emmet 11y ago
  You have to do it every time you use WhatsApp web. Not for each message, but it's an unwanted ceremony nonetheless.
  - mahouse 11y ago
    No. It's only the first time. Then the key is stored in the browser forever (or, at least, for a very long time)
    - 11y ago

chrisfarms 11y ago

I like how the Signal app (at least on Android) also works for insecure SMS to give me one place for messaging... well apart from everyone who uses WhatsApp at least. What I'd love is if they could also make it an email client too. Letting me send/receive insecure emails or (if the recipient has Signal) encrypted email using the same key management. I'd much prefur to give out an email address (totally in my control) than a phone number (could be taken away from me at any moment). One digital communication app please.

moxie 11y ago

Marginal improvement in what sense? When considering privacy, Telegram is by far the worst option. They store the plaintext message history on the server of every message that every user has ever sent or received. Even if WhatsApp weren't using end to end encryption by default, they would have no way of complying with government requests like this one, because they simply don't have the messages. Telegram, on the other hand, is a surveillance dream.

etiam 11y ago
Only in the limited sense that Telegram appears to at least have an intention of really providing private messaging and one might hope that they one day drop the delusions of grandeur and start to take seriously constructive criticism about how to do it right, as you and others have presented in other threads here. My understanding of the Whatsapp end-to-end-encryption is that the use of the term is completely misleading, as the "ends" they are referring to are the client and the Whatsapp server (https://www.whatsapp.com/faq/en/general/21864047 https://www.whatsapp.com/faq/en/general/21864047). Unless you know otherwise, I take that to mean the communications are in the clear at Facebook, and in my estimation that's tantamount to piping them straight into the US surveillance machinery through whatever they call PRISM these days, or some more or less distant relative of it. (This arrangement would still offer protection from bad actors that don't have some form of easy access to Facebook's internal information). Both seem like dreadful options in absolute terms, but if we're comparing I'd slightly rather have that user base in the hands of someone possibly sincere and incompetent than with someone competent but almost certainly treacherous. At least there is a sliver of hope for improvement and, who knows, maybe once they're off the paved road of Whatsapp they'll wobble their way though other alternatives to something like Signal eventually. Since we're fortunate enough to have you here anyway, would you mind commenting on how Signal would fare under a similar blockade? https://news.ycombinator.com/item?id=10750898 https://news.ycombinator.com/item?id=10750898 Would the service be taken down? Do you consider it a priority to try making it difficult to block in the default configuration?
- moxie 11y ago
  It's actually the exact opposite. Telegram has made design decisions that prevent them from ever being able to provide private messaging by default without radically altering their design and re-writing all of their clients. The Telegram "client" is really the server -- everything happens there, and the client you use is just a view onto the server.