5 ms·

It's frustrating that there are now so many "secure messengers" but none of them is so much better than the others to cause consolidation. I end up needing to

by rdl 9y ago

It's frustrating that there are now so many "secure messengers" but none of them is so much better than the others to cause consolidation. I end up needing to communicate over 20-30 of them with different people. Signal has the worst app (on iOS) and worst UX of anything I regularly use. There's unlikely to be a desktop client which is actually usable (doesn't depend on a phone, works on platforms I care about). The app is less buggy on iOS than it used to be, but it's still not great. Also doesn't work well with groups. And tied to PSTN identities, and the "talk to a new person on the street" interaction sucks. But, the most widely audited crypto, a good development model, and good adoption within some activist communities. Wire is great, although it's a little "game-like" vs. professional for certain UX. I know the developers and really like it, and it's great for group chat and desktop, but doesn't have much adoption. But, one big global system, too. Riot/Matrix and Mattermost are nice because you can run them on private networks. Nice apps. I've not seen as much analysis of their security as Signal. Whatsapp, Telegram, etc. have massive adoption. Whatsapp is now solid security for user to user. Apple's stuff is great but is Apple-only, and I'm wary, even if I trust the security model, to let a single company own my OS (and update whenever, without really auditing it) and my "end to end encrypted" apps -- way too easy to slip in any kind of backdoor there if they want. etc. I'd happily trade in 50 ok to good systems for one great standard and then OS/other-application integration -- but it seems like we don't do standards anymore.

amedvednikov 9y ago
> There's unlikely to be a desktop client which is actually usable Check out eul, it's a native desktop client for all major messaging platforms. Signal support is coming in October. It's only 4 MB, and it can handle thousands of messages without lag. https://eul.im https://eul.im
- faitswulff 9y ago
  This reminds me of when I used Trillian IM/Pidgin/Meebo back in the day. Everything old is new again!
  - amedvednikov 9y ago
    And Miranda!
    - Dolores12 9y ago
      still using miranda-ng with OTR plugin.
    - StavrosK 9y ago
      Man, Miranda was so fantastic. Miranda and Winamp are the only two programs I miss from my Windows days.
      - Toast_25 9y ago
        Music Bee is pretty good. Not sure if it's still around though, I mostly listen to music on my phone/youtube nowadays and work doesn't let me download music to my computer.
- anc84 9y ago
  How do you plan to maintain it? No ads, full privacy, how will you eat? Why is it not free and open-source?
  - dTal 9y ago
    Agreed. The polish, development schedule, and binary-only distribution all say "commercial software", but the lack of license or obvious commercial strategy say "what's going on here". Looking at your comment history (on both your accounts), you say you plan to open-source it, but you're not sure under what license, and you also hope to make money off it but you're not sure how - possibly through a "paid option"? I commend your effort, but until the exact nature of the project is settled, I would expect confusion and reluctance on the part of your potential users. Personally, I would never use a secure messenger I couldn't compile myself. Some previous threads: https://news.ycombinator.com/item?id=14778263 https://news.ycombinator.com/item?id=14778263 https://news.ycombinator.com/item?id=15209790 https://news.ycombinator.com/item?id=15209790 https://news.ycombinator.com/item?id=15081269 https://news.ycombinator.com/item?id=15081269
    - amedvednikov 9y ago
      Good points, I'll make the strategy more clear now that I also have a more clear picture.
  - amedvednikov 9y ago
    There is going to be a freemium model. I'm working on setting up a company, this should be done by the end of the month.
    - rdl 9y ago
      This sounds great; I'm sure people on HN would be happy to help out if you have any questions.
- superkuh 9y ago
  > all major platforms No IRC.
  - amedvednikov 9y ago
    Yes IRC! It's just not listed on the home page, I'll fix that.
- problems 9y ago
  Yeah, just go ahead and use some random closed-source IM tool for your secure messaging - seems like a great idea.
- StavrosK 9y ago
  Seems to only be 4 MB because it downloads 100 MB of "embedded browser" when you first run it. I smell an Electron.
  - mi100hael 9y ago
    "native" > doctor_evil_quote_fingers.jpg
  - amedvednikov 9y ago
    It's about 40 MB compressed, and it's only used for authentication. The app will work without it. I'm really sad it has to be downloaded, but there's no other way to do authentication. Will switch to Servo once it's ready, it's only ~20 MB.
blubb-fish 9y ago
> Whatsapp is now solid security for user to user. WA communicates your address book to Facebook.
- uoaei 9y ago
  WhatsApp also has the glaring vulnerability that Facebook could at any time reset your key to a compromised one without your knowledge, and WhatsApp will resend any hanging messages automatically upon the change, making any undelivered messages available to the one who has the decryption capability associated with that new key. It's possible they've put in a method to do this without notifying the user. Also, this "automatic resend" behavior means that a physical attack can be made simply by switching SIMs on the phone before the message is sent. It requires some careful timing to be a real vulnerability and anyone using a phone to communicate will certainly opt for a more secure platform for critical applications.
3pt14159 9y ago
> to let a single company own my OS (and update whenever, without really auditing it) and my "end to end encrypted" apps -- way too easy to slip in any kind of backdoor there if they want. Strange. We have opposite conclusions from the same data. I figure I need to minimize the amount of people that "have root" so to speak. If I can't trust Apple, it doesn't matter if I trust Signal. Apple controls what actually gets downloaded to my phone. I use signal for a different reason: mark certain conversations as "phone only" so notifications don't come up at inopportune times like when I'm at thanksgiving dinner with my extended family.
solarwind 9y ago
https://medium.freecodecamp.org/why-i-asked-my-friends-to-stop-using-whatsapp-and-telegram-e93346b3c1f0 https://medium.freecodecamp.org/why-i-asked-my-friends-to-st... This article explains a lot better than I can some of the security tradeoffs with Whatsapp, particularly in regard to metadata and data collection. Also, the worst UX? IMO Signal looks and feels much better and less cluttered than WhatsApp, Wire and Hangouts. Only Telegram has a superior UX (and a really nice QT native desktop app), IMO.

by rdl 9y ago

amedvednikov 9y ago

> There's unlikely to be a desktop client which is actually usable Check out eul, it's a native desktop client for all major messaging platforms. Signal support is coming in October. It's only 4 MB, and it can handle thousands of messages without lag. https://eul.im https://eul.im

faitswulff 9y ago
This reminds me of when I used Trillian IM/Pidgin/Meebo back in the day. Everything old is new again!
- amedvednikov 9y ago
  And Miranda!
  - Dolores12 9y ago
    still using miranda-ng with OTR plugin.
  - StavrosK 9y ago
    Man, Miranda was so fantastic. Miranda and Winamp are the only two programs I miss from my Windows days.
    - Toast_25 9y ago
      Music Bee is pretty good. Not sure if it's still around though, I mostly listen to music on my phone/youtube nowadays and work doesn't let me download music to my computer.
anc84 9y ago
How do you plan to maintain it? No ads, full privacy, how will you eat? Why is it not free and open-source?
- dTal 9y ago
  Agreed. The polish, development schedule, and binary-only distribution all say "commercial software", but the lack of license or obvious commercial strategy say "what's going on here". Looking at your comment history (on both your accounts), you say you plan to open-source it, but you're not sure under what license, and you also hope to make money off it but you're not sure how - possibly through a "paid option"? I commend your effort, but until the exact nature of the project is settled, I would expect confusion and reluctance on the part of your potential users. Personally, I would never use a secure messenger I couldn't compile myself. Some previous threads: https://news.ycombinator.com/item?id=14778263 https://news.ycombinator.com/item?id=14778263 https://news.ycombinator.com/item?id=15209790 https://news.ycombinator.com/item?id=15209790 https://news.ycombinator.com/item?id=15081269 https://news.ycombinator.com/item?id=15081269
  - amedvednikov 9y ago
    Good points, I'll make the strategy more clear now that I also have a more clear picture.
- amedvednikov 9y ago
  There is going to be a freemium model. I'm working on setting up a company, this should be done by the end of the month.
  - rdl 9y ago
    This sounds great; I'm sure people on HN would be happy to help out if you have any questions.
superkuh 9y ago
> all major platforms No IRC.
- amedvednikov 9y ago
  Yes IRC! It's just not listed on the home page, I'll fix that.
problems 9y ago
Yeah, just go ahead and use some random closed-source IM tool for your secure messaging - seems like a great idea.
StavrosK 9y ago
Seems to only be 4 MB because it downloads 100 MB of "embedded browser" when you first run it. I smell an Electron.
- mi100hael 9y ago
  "native" > doctor_evil_quote_fingers.jpg
- amedvednikov 9y ago
  It's about 40 MB compressed, and it's only used for authentication. The app will work without it. I'm really sad it has to be downloaded, but there's no other way to do authentication. Will switch to Servo once it's ready, it's only ~20 MB.

blubb-fish 9y ago

> Whatsapp is now solid security for user to user. WA communicates your address book to Facebook.

uoaei 9y ago
WhatsApp also has the glaring vulnerability that Facebook could at any time reset your key to a compromised one without your knowledge, and WhatsApp will resend any hanging messages automatically upon the change, making any undelivered messages available to the one who has the decryption capability associated with that new key. It's possible they've put in a method to do this without notifying the user. Also, this "automatic resend" behavior means that a physical attack can be made simply by switching SIMs on the phone before the message is sent. It requires some careful timing to be a real vulnerability and anyone using a phone to communicate will certainly opt for a more secure platform for critical applications.

3pt14159 9y ago

> to let a single company own my OS (and update whenever, without really auditing it) and my "end to end encrypted" apps -- way too easy to slip in any kind of backdoor there if they want. Strange. We have opposite conclusions from the same data. I figure I need to minimize the amount of people that "have root" so to speak. If I can't trust Apple, it doesn't matter if I trust Signal. Apple controls what actually gets downloaded to my phone. I use signal for a different reason: mark certain conversations as "phone only" so notifications don't come up at inopportune times like when I'm at thanksgiving dinner with my extended family.

solarwind 9y ago

https://medium.freecodecamp.org/why-i-asked-my-friends-to-stop-using-whatsapp-and-telegram-e93346b3c1f0 https://medium.freecodecamp.org/why-i-asked-my-friends-to-st... This article explains a lot better than I can some of the security tradeoffs with Whatsapp, particularly in regard to metadata and data collection. Also, the worst UX? IMO Signal looks and feels much better and less cluttered than WhatsApp, Wire and Hangouts. Only Telegram has a superior UX (and a really nice QT native desktop app), IMO.