13 ms·
Open Whisper Systems Partners with Google on End-To-end Encryption for Allo
- tptacek 10y agoThis is fantastic news. The two largest messaging platforms on the Internet will both be using Signal protocol. I could ask for more: E2E could be the default for Allo, and it isn't. That's not great. But the E2E you get when you ask for it will apparently be best-in-class.
- nthitz 10y agoIs Allo one of the largest messaging platforms yet? Will take a bit of times for users to adopt to it I'd imagine. And while WhatsApp has E2E, no mention of it for FB's Messenger. Agreed big shame they will not enable it by default given how those default settings are usually untouched.
- abhinavk 10y agoIf Android starts including it by default instead of Hangouts, then sure.
- morgante 10y agoUh, where are you defining Allo as one of the largest messaging platforms on the internet? It literally just launched. It might do well, but it could also easily be a flop (as many other social initiatives from Google have been). Either way it's a long ways from catching up to WeChat, Viber, or even Facebook Messenger.
- flyt 10y agoIt hasn't even launched yet; won't be out until later this Summer.
- bad_user 10y agoIt's going to end up on a lot of Android phones. If it's any good, it will catch on. Hangouts hasn't caught on that much because, imho, it has bad UI.
- PuffinBlue 10y agoAgreed. Hangouts didn't catch on because it was delivered as a group video calling service that then also did (or perhaps became about?) text, even becoming the default SMS app on Android. It also hasn't caught on because it is overly complex. With any other video calling service you call a person and they have a conversation with you - of you initiate a group conference and off you go. Hangout needs you to invite someone, but then what - you're still having this video broadcast by yourself? Actually, is it a broadcast? Can other people just join in? Apparently they could depending on your settings (in the past), but not this seems to have been separated to 'Hangouts On Air'? Who knows, I don't see why I should bother looking into it when there are clearer options available. I love me some Google, so don't misunderstand me, and Duo is a big step in the right direction for the average users experience compared to Hangouts.
- mike_hearn 10y agoThe Hangouts mobile app is also incredibly buggy.
- Zigurd 10y agoI don't always agree something is "incredibly buggy" but when I do, it's because I experience multiple daily crashes on a Nexus 5X, which should be the most compatible and thoroughly tested platform it's running on. That qualifies as "incredible."
- hobarrera 10y agoThe UI is awful (even as a very tech-savvy person I find it confusing!), and the web version only work properly on chrome/chromium.
- Zigurd 10y ago"Allo" is just one aspect of IMS in Android. While it isn't certain that Allo as a product will succeed, Google's approach to IMS, carrier messaging, and basing products like Allo and Duo on those APIs and underlying networks means that this is more like adding the Signal protocol to an open IMS-based ecosystem of messaging than it is depending on Allo.
- deleted 10y ago[deleted]
- traspler 10y agoI guess it's not e2e in all chats for the @google assistant to be able to be part of the conversation. If it would be part of the e2e conversation you would be sharing all your messages with google anyways, kind of defeating the purpose. At least they offer "incognito" chats. I think that's a fair compromise in the light of Allo being focused on the Assistant & Smart Replies.
- ultramancool 10y agoThe smart replies thing creeps me out. I already take swiftkey suggestions on how I talk sometimes. This just takes it to a whole other level where it's not even you writing the suggestions anymore.
- akerro 10y ago>The two largest messaging platforms on the Internet Wait, what? What is Allo?
- mtgx 10y agoSkype is the last major messaging platform to not have end-to-end encryption in any way.
- mike_hearn 10y agoNo, only WhatsApp has it. Facebook Messenger doesn't, SMS doesn't.
- drdaeman 10y agoThere's an option for SMS: https://silence.im/ https://silence.im/ (Yup, that's a TextSecure fork before Moxie had dropped encrypted SMS support.)
- hobarrera 10y agoIs Skype actually still considered a "MAJOR messaging platform"?
- upofadown 10y agoThe article didn't make it clear. Will the two systems be able to interoperate?
- uola 10y agoWhatsApp is pretty big, but I doubt Google is even now second before Facebook, WeChat or QQ. Unless you include e-mail, but that isn't being encrypted as I understand.
- sigmar 10y agoGreat news! Hopefully this also means that identity verification (through a key fingerprint) will be available in Allo (and in Duo?)
- chinathrow 10y agoThat is awesome - now we also need to kill metadata collection. Is this feasible? Oh and off-the-record was there on Hangouts/Gtalk before - I used it but the chats were replicated across clients (e.g. Pidgin vs gmail.com) - so not really off-the-record (i.e. they lied).
- akerro 10y agoOWS apparently partners with NSA with metadata collection :>
- ThatGeoGuy 10y agoIs this sarcasm of some kind? Is there some joke in here about Whisper Systems vs. Open Whisper Systems? This comment seems baseless and unfounded at best. Is there context I am missing?
- akerro 10y agoYes. Singal and RedPhone require google apps on android device or using browser that is spying on you all the time, eg. downloads binary blob that turns on microphones, even when feature is disabled. NSA needs only metadata to send drone strikes on a village and Singal provides only metadata to Google services.
- geofft 10y ago"Apparently partners with NSA" is very different from "for plausibly-legitimate reasons, runs only a platform that has an increased attack surface". That's like saying that Ubuntu partners with script kiddies because they're slow about fixing security bugs in LTSes. I understand the point you're trying to make, but no.
- orblivion 10y agoIt's "Off The Record" in that they claimed not to store history. As I understand this is completely unrelated to the OTR encryption system.
- p0ppe 10y agoWhy didn't Google just develop this in house? It almost feels like they're admitting to having no credibility on privacy without an external partner.
- dharma1 10y agoWhy bother if there is a ready solution, that's already got the trust of other market leaders?
- bad_user 10y agoThat's nonsense. In-house proprietary encryption is not peer reviewed and untrustworthy by definition and if you're going to work in the open, especially for a new proprietary chat app, it makes better sense to build on an open platform that's already proven and is handled by people that really know their stuff. More secure and probably cheaper as well.
- nxzero 10y agoBeing open source or closed source doesn't make code more secure. What make code more secure is making it more secure. Have you audited the code?
- zmanian 10y agoThe Signal protocol is for all intents asymptote the state of the art in the design of a secure messaging protocol. There doesn't seem to be any meaningful improvements to the design without changing the requirements. New requirements might be - Post Quantum forward secrecy - Groups messaging with transcript verification - Security weakness in x25519 or AES-CBC-HMAC or SHA256 primitives. If you don't have any new requirements, crypto protocol developer time is a scarce resource. Why reinvent the state of the art?
- Roritharr 10y agoI really wonder what the people of allo.im are thinking now.
- goda90 10y agoWhoa, I wonder what the story is there. Did Google know this allo.im existed before naming their thing?
- ocdtrekkie 10y agoI suspect they don't care. And I'm guessing allo.im will get booted from the Play Store for using the same name as a Google product.
- dave42 10y agoIt's not in the US playstore, so it obviously doesn't exist.
- beachwood23 10y agoThat app didn't exist until May 15th, and all the reviews for it are incredibly poor (as in, had zero functionality at all). I'd bet someone got an early leak of the name for Google's new messaging product, and tried to make a quick product and domain registration, so they can get tossed a few bucks when Google needs to buy the domain.
- Jarwain 10y agoWhat I'm curious about, and think would be really neat, is if one could take advantage of the shared Signal Protocol to send messages cross-platform. Specifically, sending an encrypted message to a Whatsapp user from Allo. Or to a Signal user from Whatsapp. Or any combination/permutation really.
- pnathan 10y agoMoxie's on the record as being opposed to federated services. https://whispersystems.org/blog/the-ecosystem-is-moving/ https://whispersystems.org/blog/the-ecosystem-is-moving/
- deleted 10y ago[deleted]
- zellyn 10y agoI don't think I'd characterize his blog post that way. The last sentence captures what I got from reading it: "It may not be as beautiful as federation, but at this point it seems that it will have to do." Also, as djb points out: https://twitter.com/hashbreaker/status/732912508089032706 https://twitter.com/hashbreaker/status/732912508089032706
- mike_hearn 10y agoMoxie's essay is strong and djb's point is not: a "federated network" with a centrally controlled app that updates automatically might as well not be federated at all: at that point having multiple servers hardly matters. Who cares about running your own server if you can't run your own client? Moxie has put into words what I've been thinking myself for a long time - the old federated protocols from the 1990s have been slowly dying off (with email being the main holdout, unless you count gmail). And the reason is that they just don't evolve. There's no incentive to evolve them, there's no organisational structure to evolve them, creating them takes huge effort AND they suffer from all sort of hidden ideological constraints that would prevent them from e.g. doing a partnership with Uber beause Uber is a corporation and an open protocol isn't. But users don't care about that.
- robert_foss 10y agoTo me it seems like Open Whisper Systems are accepting a lot of concessions in order to have Signal included into products. The trust I once had for moxie is quickly dissipating. * Privacy is only provided in Allo in a secondary mode. Not by default. * Federation of the Signal protocol has been rejected for non-technical reasons. Also, on a personal note, the desktop client requiring chrome is pretty awful.
- zanny 10y agoMatrix uses the same encryption protocol but is also federated, which is nice.
- ThatGeoGuy 10y agoAnd interesting enough, Matrix faces a different problem than Signal: It doesn't have many good clients at all (at least, last I had checked a few months back). I will agree it would be very nice if Matrix was the dominant messaging protocol that everyone needed to speak with their friends. However, that's not feasible until somebody makes an easy-to-use, beautiful Android and iOS client that doesn't require the user to install multiple bridges or wrangle several accounts to chat with their friends.
- zanny 10y agoI have no experience with iOS anything, but at least the Matrix Console Android client is pretty good for what I use it for. It even supports multiple simultaneous accounts which I really appreciate. I believe the iOS version of it is very similar.
- anc84 10y agoVector and recently Tensor are pretty awesome.
- ryukafalz 10y agoVector is now out on both Android[1] and iOS[2], and the web version of Vector has improved significantly. It doesn't have end to end encryption support yet, but they're working on it. 1: https://play.google.com/store/apps/details?id=im.vector.alpha https://play.google.com/store/apps/details?id=im.vector.alph... 2: https://itunes.apple.com/us/app/vector.im/id1083446067 https://itunes.apple.com/us/app/vector.im/id1083446067
- cm3 10y agoHas anyone given this https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7 https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7 more thought and whether one should avoid Signal and work with a more friendly project that doesn't seemingly fail at its desire to have widespread use of the protocol and actually tried to sue WireApp? WireApp's now approved as a non-infringing implementation in Rust, so that's great for reliability. Edit: The suing part was initiated by Wire as a response to Moxie demanding GPL compliance over their claim Wire is infringing. I got that backwards.
- qznc 10y agoMoxie replied in this Forbes article: http://www.forbes.com/sites/thomasbrewster/2016/05/11/wire-skype-sued-moxie-marlinspike-extortion/#9dc5acd3ff59 http://www.forbes.com/sites/thomasbrewster/2016/05/11/wire-s...
- deleted 10y ago[deleted]
- mike_hearn 10y agoThat isn't quite a reply. It's a second hand account of Moxie denying that he asked for money. This story seems very troubling. The Wire guys made very specific claims (where did they get the >$2M figure from ... and why would they simply invent such a figure). If their implementation is in Rust then it cannot be the same as OWS' code. It would be good if OWS could publicly clarify that reimplementing the Signal Protocol/Axoltl does not trigger any copyright claims by OWS even if doing so involved reading the GPLd version.
- cm3 10y agoSo, https://github.com/WhisperSystems/libsignal-protocol-c https://github.com/WhisperSystems/libsignal-protocol-c is GPL3. If I implement haskell-signal and consult documentation and the code to understand the protocol but do not copy code, it's not clean room, but Open Whisper wants to see the protocol spread, so it's in their interest to more clearly state how someone is allowed to reimplement Signal in Common Lisp or FORTH, if one were so inclined, and release it under MIT.
- NN88 10y agoGoogle? LOL
- JeremyBanks 10y agoThank you for your contribution to this thread.
- dang 10y agoPlease don't do this here.
- superkuh 10y agoDoes this require a phone number like the rest of Open Whisper Systems products?
- ocdtrekkie 10y agoAllo was announced at I/O to use your phone number as your identifier. It's a mobile-only app.
- kevincox 10y agoUgh, I hate this phone number as identify business. My pone number changes every time I move and I have to keep paying to have it. I see the benefit to a number that I can easily share but I don't like tying it to the telephone system. I'll keep using something like hangouts that allows me to keep my contacts when I move as well as a number of other benefits.
- superuser2 10y agoWhy does it change? In my experience most people keep their first cell phone number for their entire lives. Area codes are indicative of nothing, except where you lived in 2005 [1]. [1] https://xkcd.com/1129/ https://xkcd.com/1129/
- GeneralTspoon 10y agoIf you move internally within a country, sure. But when you actually move country, you'll need to get a new sim (or be charged roaming fees). I live in Europe, and I've had 4 different phone numbers in the past 3 years.
- dr_hooo 10y agoChanging counties comes to mind.
- detaro 10y agoOver here (Germany) it commonly costs 30 bucks to transfer a phone number to another provider, at least if you are on cheap plans.
- mahyarm 10y agoI wonder how many other signal protocol integrations are in progress...
- lawnchair_larry 10y agoFor someone concerned about privacy, it's baffling to me that we'd be forced into sharing our phone number in order to communicate.
- azet 10y agoCome on Nadim. Just shut up. seriously. go whining about ptacek treating you badly again.. because your behaviour isn't any better: You've been bashing on TextSecure/Signal and it's authors on Twitter and other mediums since you started your own, insecure, javascript IM a few years back. Always promoting your own product along some rather dubious arguments. There has even been a best-of on tumblr of your self-righteous flood of twitter messages, unfortunately it was taken down. Please leave people that are busy working on securing strong crypto-systems alone with your idiot-commentary. This is getting annoying (for a lot of people). Ignoring you on twitter doesn't seem to be enough. I'd never work on nor recommend crypto.cat, but if you feel your time is spent well coding on that crap, please do so instead of spreading accusations on twitter on OWS and others all of the time.
- nkobeissi 10y agoWow.
- deleted 10y ago[deleted]
- dang 10y agoPlease don't do this. Personal attacks are not ok on HN, regardless of how wrong or annoying someone is. We detached this subthread from https://news.ycombinator.com/item?id=11728339 https://news.ycombinator.com/item?id=11728339 and marked it off-topic.
- NetStrikeForce 10y agoI'm not sure I got it right. Is Google going to be scanning all my conversations to give me suggestions on what to say next? Really? I understand the price of things like Gmail, where I get a robust email system in exchange of scanning my emails and mining my data. I got something very good from Google, they got my data. Not the best of the deals I ever made, but it has (had?) a strong appeal. On the other hand I don't understand this Allo thing: There's no appeal in the smart assistant, it doesn't bring anything I want to have.
- ComodoHacker 10y agoSaving time and hand movement typing "LOL=)" could be quite an appeal, depending on how many times a day you're doing it.
- tdkl 10y ago"What if surveillance looked cute and lovable?" [1] ~Aral Balkan [1] https://www.youtube.com/watch?v=jh8supIUj6c https://www.youtube.com/watch?v=jh8supIUj6c