6 ms·

Use Signal: https://whispersystems.org/ https://whispersystems.org/ It uses the same crypto as WhatsApp (same developer), but values your privacy and has prope

by lima 10y ago

Use Signal: https://whispersystems.org/ https://whispersystems.org/ It uses the same crypto as WhatsApp (same developer), but values your privacy and has properly working audio calls - better than WhatsApp in my experience. It's essentially WhatsApp minus Facebook. And it's open source. The company (and person - Moxie) behind Signal, OpenWhispherSystems, worked with Google and Facebook to add end-to-end encryption to Facebook Messenger, Google Allo and WhatsApp. It's literally the same protocol and Moxie is a highly regarded cryptographer / security researcher. Telegram, which some are suggesting, has encryption as opt-in and their encryption scheme has been widely criticized for being dodgy (see: https://moxie.org/blog/telegram-crypto-challenge/ https://moxie.org/blog/telegram-crypto-challenge/).

gajjanag 10y ago
> Use Signal: https://whispersystems.org/ https://whispersystems.org/ I like the idea, but don't know of a good method to get my contacts to use Signal as well without making myself look extreme in my views. Any suggestions for this? For example, do you know of any short and crisp messages that get the point across, without getting into a never ending discussion of privacy and its value?
- newscracker 10y ago
  I would recommend that you try Signal, Wire and any other messaging platform with just one or two close people. Once you get a hang of the user experience and see any deficiencies and any annoyances first hand, you can decide whether it's even worth asking all your other contacts to try them. My advice: Except Telegram, none of the others (Signal or Wire) are ready as a replacement for WhatsApp in UX or speed as of this moment. But Telegram has end-to-end encryption only for device specific, one-to-one chats (called "Secret chat"). Normal chats are only encrypted during transport and are stored as plain text on the servers and on the devices to support quick searching and multi-device/multi-platform sync.
  - lima 10y ago
    What are you missing with Signal?
    - newscracker 10y ago
      Signal is quite slow at message delivery, to start with. It's not easy to know if a message was delivered at all. That's the main reason I almost stopped using it. Secondly, Signal does not have multi-device support and multi-device sync. Coming from Telegram, where I can catch up on messages on multiple devices and choose to switch to a computer keyboard to respond with longer messages, as opposed to a small touchscreen keyboard, I very much prefer having the ability to use different systems. Signal's desktop "app" is just with Chrome and AFAIK, it needs to be authenticated every time (with Telegram, I authenticate my desktop app once and it works fine across restarts). It's still tied to one device (the phone). Wire allows users to signup or find other people using phone number or email address. Even Telegram depends on a phone number as the sole identifier for a user. Overall, none of the current set of messaging apps or platforms are extremely appealing to me. All of them have some drawbacks. My dream platform would be a "decentralized and federated" system like email without having to be in individual walled gardens.
      - lima 10y ago
        > It's not easy to know if a message was delivered at all. One checkmark: delivered to server, two checkmarks: delivered to recipient. Works for me. > Secondly, Signal does not have multi-device support and multi-device sync. > Coming from Telegram Telegram has, to my knowledge, either end-to-end encryption or multi-device sync.
- lima 10y ago
  The main selling point apart from privacy is that the voice calls works really really well.
newscracker 10y ago
Or try Wire [1], which has a much richer feature set (voice calls, video calls, text chat and doodling) than Signal and is also slightly faster and more reliable in my experience. It's also multi-platform, provides multi-device sync and is end-to-end encrypted (although with a different custom protocol compared to Signal, albeit using the older and confusing name 'axolotl ratchet', which Signal no longer uses). There's a table comparing Wire and other systems here. [2] I still have Signal and update it whenever there are updates, mainly to see what's new or changed, but prefer Wire for the better feature set and UX. Telegram still remains my most used messaging client due to its UX and speed (even Wire is slow and lacks some basic features like message delivered and message read indicators). I've been waiting for a long time to switch to Signal (or to Wire), but the improvement seen is quite slow over time (just my experience). Telegram has been moving rapidly on feature addition. [1]: https://wire.com https://wire.com [2]: https://wire.com/privacy/ https://wire.com/privacy/
- kirkdouglas 10y ago
  I am not sure if Wire (another messaging app without clear monetization strategy) is better. We might end in the same situation in a few years.
  - lima 10y ago
    Exactly. The most important reason to use Signal is the trustworthiness of the developers. Moxie is a highly esteemed security researcher / public figure. I trust him to (1) implement the protocol properly (which is really hard) and (2) respect my privacy and (3) not sell out like WhatsApp did. The thing is, as long as we're using phone numbers as user handles, you have to trust the provider with your phone book. Signal tries as hard as possible to avoid it (all phone numbers are hashed), but if they wanted, they could simply brute force all the hashes since the search space is so small. There's no good solution to this.
    - vocatus_gate 10y ago
      Would salting the hashes be an improvement? I ask knowing very little about their security model.
Veratyr 10y ago
Has Signal fixed the multi-device issues (like not being able to use multiple Android devices)? Last I checked having multiple mobile devices was impossible.
- lima 10y ago
  No but neither does WhatsApp. The reason for this is that it's incredibly hard to properly do end-to-end encryption with multiple devices. It's a trade-off you have to accept if you want secure end-to-end encryption. The way it works with WhatsApp and Signal is that your key is generated on your phone and never ever leaves it. The web client actually establishes a connection to your phone and routes all messages over it. Now, the Axolotl ratchet protocol does support encrypting messages to multiple keys (it's what they use for group chats), but doing it properly requires time and effort in order to remain secure.
  - Veratyr 10y ago
    I know WhatsApp doesn't do it but proper multi-device support is something I require to move. At the moment I just use a private XMPP server so while it isn't technically "end-to-end", it's practically end-to-end as I control the server.
    - lima 10y ago
      I do that too, but it doesn't work outside of a close group of friends. For me, multi device support is not important since I have my phone with me all the time, and if I'm on my laptop there's the web client. Apparently XMPP with Conversations + OMEMO provides secure multi device support, haven't tried it though and I'm not sure if I could get any of my non-tech friends to use it.
  - Siimteller 10y ago
    We've solved the multi device issue at Wire (wire.com). Causes some challenges - larger payload, not super fast performance in browsers once you hit certain level of connections and messages, but very, very usable. wire.com/privacy for security whitepaper.

by lima 10y ago

gajjanag 10y ago

> Use Signal: https://whispersystems.org/ https://whispersystems.org/ I like the idea, but don't know of a good method to get my contacts to use Signal as well without making myself look extreme in my views. Any suggestions for this? For example, do you know of any short and crisp messages that get the point across, without getting into a never ending discussion of privacy and its value?

newscracker 10y ago
I would recommend that you try Signal, Wire and any other messaging platform with just one or two close people. Once you get a hang of the user experience and see any deficiencies and any annoyances first hand, you can decide whether it's even worth asking all your other contacts to try them. My advice: Except Telegram, none of the others (Signal or Wire) are ready as a replacement for WhatsApp in UX or speed as of this moment. But Telegram has end-to-end encryption only for device specific, one-to-one chats (called "Secret chat"). Normal chats are only encrypted during transport and are stored as plain text on the servers and on the devices to support quick searching and multi-device/multi-platform sync.
- lima 10y ago
  What are you missing with Signal?
  - newscracker 10y ago
    Signal is quite slow at message delivery, to start with. It's not easy to know if a message was delivered at all. That's the main reason I almost stopped using it. Secondly, Signal does not have multi-device support and multi-device sync. Coming from Telegram, where I can catch up on messages on multiple devices and choose to switch to a computer keyboard to respond with longer messages, as opposed to a small touchscreen keyboard, I very much prefer having the ability to use different systems. Signal's desktop "app" is just with Chrome and AFAIK, it needs to be authenticated every time (with Telegram, I authenticate my desktop app once and it works fine across restarts). It's still tied to one device (the phone). Wire allows users to signup or find other people using phone number or email address. Even Telegram depends on a phone number as the sole identifier for a user. Overall, none of the current set of messaging apps or platforms are extremely appealing to me. All of them have some drawbacks. My dream platform would be a "decentralized and federated" system like email without having to be in individual walled gardens.
    - lima 10y ago
      > It's not easy to know if a message was delivered at all. One checkmark: delivered to server, two checkmarks: delivered to recipient. Works for me. > Secondly, Signal does not have multi-device support and multi-device sync. > Coming from Telegram Telegram has, to my knowledge, either end-to-end encryption or multi-device sync.
lima 10y ago
The main selling point apart from privacy is that the voice calls works really really well.

newscracker 10y ago

Or try Wire [1], which has a much richer feature set (voice calls, video calls, text chat and doodling) than Signal and is also slightly faster and more reliable in my experience. It's also multi-platform, provides multi-device sync and is end-to-end encrypted (although with a different custom protocol compared to Signal, albeit using the older and confusing name 'axolotl ratchet', which Signal no longer uses). There's a table comparing Wire and other systems here. [2] I still have Signal and update it whenever there are updates, mainly to see what's new or changed, but prefer Wire for the better feature set and UX. Telegram still remains my most used messaging client due to its UX and speed (even Wire is slow and lacks some basic features like message delivered and message read indicators). I've been waiting for a long time to switch to Signal (or to Wire), but the improvement seen is quite slow over time (just my experience). Telegram has been moving rapidly on feature addition. [1]: https://wire.com https://wire.com [2]: https://wire.com/privacy/ https://wire.com/privacy/

kirkdouglas 10y ago
I am not sure if Wire (another messaging app without clear monetization strategy) is better. We might end in the same situation in a few years.
- lima 10y ago
  Exactly. The most important reason to use Signal is the trustworthiness of the developers. Moxie is a highly esteemed security researcher / public figure. I trust him to (1) implement the protocol properly (which is really hard) and (2) respect my privacy and (3) not sell out like WhatsApp did. The thing is, as long as we're using phone numbers as user handles, you have to trust the provider with your phone book. Signal tries as hard as possible to avoid it (all phone numbers are hashed), but if they wanted, they could simply brute force all the hashes since the search space is so small. There's no good solution to this.
  - vocatus_gate 10y ago
    Would salting the hashes be an improvement? I ask knowing very little about their security model.

Veratyr 10y ago

Has Signal fixed the multi-device issues (like not being able to use multiple Android devices)? Last I checked having multiple mobile devices was impossible.

lima 10y ago
No but neither does WhatsApp. The reason for this is that it's incredibly hard to properly do end-to-end encryption with multiple devices. It's a trade-off you have to accept if you want secure end-to-end encryption. The way it works with WhatsApp and Signal is that your key is generated on your phone and never ever leaves it. The web client actually establishes a connection to your phone and routes all messages over it. Now, the Axolotl ratchet protocol does support encrypting messages to multiple keys (it's what they use for group chats), but doing it properly requires time and effort in order to remain secure.
- Veratyr 10y ago
  I know WhatsApp doesn't do it but proper multi-device support is something I require to move. At the moment I just use a private XMPP server so while it isn't technically "end-to-end", it's practically end-to-end as I control the server.
  - lima 10y ago
    I do that too, but it doesn't work outside of a close group of friends. For me, multi device support is not important since I have my phone with me all the time, and if I'm on my laptop there's the web client. Apparently XMPP with Conversations + OMEMO provides secure multi device support, haven't tried it though and I'm not sure if I could get any of my non-tech friends to use it.
- Siimteller 10y ago
  We've solved the multi device issue at Wire (wire.com). Causes some challenges - larger payload, not super fast performance in browsers once you hit certain level of connections and messages, but very, very usable. wire.com/privacy for security whitepaper.