5 ms·

Due to cutting ties with Google and Facebook as much as possible I don't use Signal nor WhatsApp. What alternatives are there? I have been using Tox (qTox on D

by madez 10y ago

Due to cutting ties with Google and Facebook as much as possible I don't use Signal nor WhatsApp. What alternatives are there? I have been using Tox (qTox on Desktop and Antox on phone) and XMPP (Conversations on phone). I also tried Ring (Desktop and phone) My observation is that there is a lot of user inertia to make people use another chat app, and none of which I tried is in good shape to compete right now with WhatsApp/Signal. XMPP and Ring share the problem that encryption was an afterthought. That alone is enough to stop widespread adoption. There must not be unencrypted chats nor different security levels. Encryption must be transparent to the user. Tox doesn't share that problem, and is what I have the highest hopes for. The clients are not yet able to compete with WhatsApp. Antox crashes sometimes, gets reaaaal slow, and doesn't send pseudo-offline messages reliably. Multi-Device support and real offline messaging is still lacking in the protocol. Multi-Device support is not needed, see WhatsApp, but real offline messaging is a must-have. Also, messages must be reliably delivered and in the order they are intended. Tests of mine between qTox and Antox showed problems in that regard.

akvadrako 10y ago
Maybe you have reasons, but your comment doesn't make it clear why cutting your ties with Google and Facebook means dropping Signal. Google and Facebook started using the same protocol as Signal in the latest versions of their messengers, but they don't interact in any way. By the same logic you should also stop using HN because it also uses HTTP, just like those big guys.
- madez 10y ago
  You can't use Signal without GCM or its siblings on other platforms. I don't have Google's Apps on my phone, so there is no GCM. Using GCM voids your contact privacy. So Signal right now is a no-go. I do care about whether Google knows who I contact and when. I don't want Google to know.
  - sliken 10y ago
    Moxie is open to someone writing an alternative to GCM, but nobody has stepped up and do it. It's much easier to complain about GCM, then to replace it. Signal's use of GCM does NOT reveal who you are sending signals to, or what is in the message.
    - mi100hael 10y ago
      Signal's use of GCM may not be particularly intrusive, but it still requires a phone with Google's services running. LibreSignal works on a Google-free phone, and Moxie told them to fuck off. https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
      - Techonomicon 10y ago
        Telling them to fuck off seems far far farrrrr from the truth. Moxie's points seem pretty fair all around. I urge people to read through these comments in the github issue yourselves versus believe the commenter here at face value.
        mi100hael 10y ago
        From Moxie: > If you think running servers is difficult and expensive (you're right), ask yourself why you feel entitled for us to run them for your product. Moxie knowingly and willingly runs a free service. Why should he feel entitled to tell people how they interact with his service? What's the point of publishing your source code under the GPL if no one can do anything with it? Keep in mind the phone server still isn't open source either, so the client source on its own is about as useful as a literal brick for phone calls.
        sliken 10y ago
        For a bunch of reasons: 1) he doesn't want the signal community to fracture with incompatibilities (like say XMPP) 2) he doesn't want the security of signal users compromised with less secure clients. Thus he's against SMS since it leaks metadata like crazy to 100s or 1000s of entities. 3) he doesn't particularly trust f-droid to distribute clients since they use a central key (an attractive target) instead of the developers key. 4) he wants to be able to quickly iterate improving the clients and server in sync, on his own schedule. So generally he wants to target a large number of users with a very secure client and doesn't want to sponsor anyone that takes his source with free server infrastructure. So he believes in audits, security, and opensource. He even will allow a GCM replacement, as long as it only runs when GCM is not available. He expects the battery life and user experience to be terrible. The main problem seems to be that google negotiates with cellular providers to not time out connections to GCM, but they silently do that (without an RST) to other connections. Thus any GCM replacement will have to spend much more power/battery maintaining a connection. Moxie specifically mentioned that even 50 seconds was too long and that some providers time out connections even quicker than that.
petre 10y ago
You can use Wire if you think you can trust a Swiss company morethan the Signal server operators. Also uses the Signal OTR protocol.
- Fundlab 10y ago
  I have tried Wire. It's very slick and loaded with features but I notice its a bit of a resource hog buy the potential is there. I would love to see a unbiased comparative review with other messaging apps
Veratyr 10y ago
I'm a fan of Matrix (matrix.im). Encrypted (recently), federated, multi device, multi platform, has message history, voice, attachments and push notifications. Pretty much everything I've wanted.

by madez 10y ago

akvadrako 10y ago

Maybe you have reasons, but your comment doesn't make it clear why cutting your ties with Google and Facebook means dropping Signal. Google and Facebook started using the same protocol as Signal in the latest versions of their messengers, but they don't interact in any way. By the same logic you should also stop using HN because it also uses HTTP, just like those big guys.

madez 10y ago
You can't use Signal without GCM or its siblings on other platforms. I don't have Google's Apps on my phone, so there is no GCM. Using GCM voids your contact privacy. So Signal right now is a no-go. I do care about whether Google knows who I contact and when. I don't want Google to know.
- sliken 10y ago
  Moxie is open to someone writing an alternative to GCM, but nobody has stepped up and do it. It's much easier to complain about GCM, then to replace it. Signal's use of GCM does NOT reveal who you are sending signals to, or what is in the message.
  - mi100hael 10y ago
    Signal's use of GCM may not be particularly intrusive, but it still requires a phone with Google's services running. LibreSignal works on a Google-free phone, and Moxie told them to fuck off. https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
    - Techonomicon 10y ago
      Telling them to fuck off seems far far farrrrr from the truth. Moxie's points seem pretty fair all around. I urge people to read through these comments in the github issue yourselves versus believe the commenter here at face value.
      - mi100hael 10y ago
        From Moxie: > If you think running servers is difficult and expensive (you're right), ask yourself why you feel entitled for us to run them for your product. Moxie knowingly and willingly runs a free service. Why should he feel entitled to tell people how they interact with his service? What's the point of publishing your source code under the GPL if no one can do anything with it? Keep in mind the phone server still isn't open source either, so the client source on its own is about as useful as a literal brick for phone calls.
        sliken 10y ago
        For a bunch of reasons: 1) he doesn't want the signal community to fracture with incompatibilities (like say XMPP) 2) he doesn't want the security of signal users compromised with less secure clients. Thus he's against SMS since it leaks metadata like crazy to 100s or 1000s of entities. 3) he doesn't particularly trust f-droid to distribute clients since they use a central key (an attractive target) instead of the developers key. 4) he wants to be able to quickly iterate improving the clients and server in sync, on his own schedule. So generally he wants to target a large number of users with a very secure client and doesn't want to sponsor anyone that takes his source with free server infrastructure. So he believes in audits, security, and opensource. He even will allow a GCM replacement, as long as it only runs when GCM is not available. He expects the battery life and user experience to be terrible. The main problem seems to be that google negotiates with cellular providers to not time out connections to GCM, but they silently do that (without an RST) to other connections. Thus any GCM replacement will have to spend much more power/battery maintaining a connection. Moxie specifically mentioned that even 50 seconds was too long and that some providers time out connections even quicker than that.

petre 10y ago

You can use Wire if you think you can trust a Swiss company morethan the Signal server operators. Also uses the Signal OTR protocol.

Fundlab 10y ago
I have tried Wire. It's very slick and loaded with features but I notice its a bit of a resource hog buy the potential is there. I would love to see a unbiased comparative review with other messaging apps

Veratyr 10y ago

I'm a fan of Matrix (matrix.im). Encrypted (recently), federated, multi device, multi platform, has message history, voice, attachments and push notifications. Pretty much everything I've wanted.