3 ms·

There still isn't a popular messaging and voice call platform that supports private end-to-end encryption by default. How terrible is this? I mean it would be s

There still isn't a popular messaging and voice call platform that supports private end-to-end encryption by default. How terrible is this? I mean it would be so trivial to establish a secure and private communications standard. Europe and North America has a population of almost a billion people combined. If 500 millions of those live in first-world conditions and only 1% cares about privacy, with $1/year worth of giving a fuck we could have a budget of $5M/year, or close to 50 top notch developers to pull this off. Obviously a lot more could be spend, but even with this minuscule spending we could still have a viable, standardized alternative to Facebook and Google. We literally had better privacy when we had analog phone lines that anyone could tap into. That's just terrible.

enitihas 8y ago
Doesn't WhatsApp do that? (https://faq.whatsapp.com/en/android/28030015/ https://faq.whatsapp.com/en/android/28030015/)
- codemusings 8y ago
  If I recall correctly Facebook has plans to end E2E encryption in order to serve personalized ads.
  - enitihas 8y ago
    Maybe, but at least currently it does support E2E.
  - fwn 8y ago
    Would be very interesting to read more about it. Do you recall where you've learned about it?
  - lozf 8y ago
    Even before then it's highly likely that they're gathering as much metadata as possible:- * who's chatting with whom, * via what means (text, audio, video), * conversation time and duration, * location of participants, * how much data transferred etc. There's a lot they can gather and imply from all that when WA users phone numbers will be known to FB, so they can graph connections via others' who run the FB app or previously shared their contact info. Also those who are perhaps logged in on, or simply visiting other sites they track via like/share buttons etc. Whilst what you say is encrypted, the circumstances around that conversation can be used, at least to advertise to you.
stephen_g 8y ago
Signal does voice calls and is all end to end by default. I guess 'popular' is the operative word here, but at least in tech circles it is...
lucideer 8y ago
WhatsApp does but the author of this sheet has chosen to list it as "claimed", despite other also-unverified clients like Telegram getting a "true" for their (non-default) e2e support. FWIW I believe Riot/Matrix are planning e2e by default as soon as their implementation stabilises. Theirs is more complex/powerful than WhatsApp's though since they have multidevice support (which WhatsApp lacks). They've avoided making it default sofar due to bad UX and the possibility of losing access to conversations across devices, but it's improving rapidly.
- amandine 8y ago
  Yup planning to get it on in the coming months. As a data point e2e by default is on for the French government deployment and we haven't seen huge drama, so we're mostly waiting to get the UX out. We'll be sharing our work for insights this week.
__david__ 8y ago
Someone will correct me if I'm won't but I believe Apple Messages are end to end encrypted by default. I'm not sure if FaceTime audio/video is encrypted.
- nothrabannosir 8y ago
  It is. https://security.stackexchange.com/questions/123693/how-secure-is-facetime-by-apple https://security.stackexchange.com/questions/123693/how-secu...
nothrabannosir 8y ago
What do you mean by “private” so as not to have WhatsApp and iMessage fit this description ? Because as far as I understand, they do. Especially the telephone lines bit; iMessage and WhatsApp offer more privacy than telephone lines did, already at the operator level, but definitely at the tapping level. Anonymous account creation? Open source? Audited?
upofadown 8y ago
Just pick an XMPP client that does: * https://omemo.top/ https://omemo.top/ There is no way that an open IM platform will be able to guarantee E2E by default on all clients simply because someone/somewhere will produce a client that doesn't or doesn't do it properly. It is probably better to start with the E2E encryption system (in my example OMEMO) and then see where you can get it.

enitihas 8y ago

Doesn't WhatsApp do that? (https://faq.whatsapp.com/en/android/28030015/ https://faq.whatsapp.com/en/android/28030015/)

codemusings 8y ago
If I recall correctly Facebook has plans to end E2E encryption in order to serve personalized ads.
- enitihas 8y ago
  Maybe, but at least currently it does support E2E.
- fwn 8y ago
  Would be very interesting to read more about it. Do you recall where you've learned about it?
- lozf 8y ago
  Even before then it's highly likely that they're gathering as much metadata as possible:- * who's chatting with whom, * via what means (text, audio, video), * conversation time and duration, * location of participants, * how much data transferred etc. There's a lot they can gather and imply from all that when WA users phone numbers will be known to FB, so they can graph connections via others' who run the FB app or previously shared their contact info. Also those who are perhaps logged in on, or simply visiting other sites they track via like/share buttons etc. Whilst what you say is encrypted, the circumstances around that conversation can be used, at least to advertise to you.

stephen_g 8y ago

Signal does voice calls and is all end to end by default. I guess 'popular' is the operative word here, but at least in tech circles it is...

lucideer 8y ago

WhatsApp does but the author of this sheet has chosen to list it as "claimed", despite other also-unverified clients like Telegram getting a "true" for their (non-default) e2e support. FWIW I believe Riot/Matrix are planning e2e by default as soon as their implementation stabilises. Theirs is more complex/powerful than WhatsApp's though since they have multidevice support (which WhatsApp lacks). They've avoided making it default sofar due to bad UX and the possibility of losing access to conversations across devices, but it's improving rapidly.

amandine 8y ago
Yup planning to get it on in the coming months. As a data point e2e by default is on for the French government deployment and we haven't seen huge drama, so we're mostly waiting to get the UX out. We'll be sharing our work for insights this week.

__david__ 8y ago

Someone will correct me if I'm won't but I believe Apple Messages are end to end encrypted by default. I'm not sure if FaceTime audio/video is encrypted.

nothrabannosir 8y ago
It is. https://security.stackexchange.com/questions/123693/how-secure-is-facetime-by-apple https://security.stackexchange.com/questions/123693/how-secu...

nothrabannosir 8y ago

What do you mean by “private” so as not to have WhatsApp and iMessage fit this description ? Because as far as I understand, they do. Especially the telephone lines bit; iMessage and WhatsApp offer more privacy than telephone lines did, already at the operator level, but definitely at the tapping level. Anonymous account creation? Open source? Audited?

upofadown 8y ago

Just pick an XMPP client that does: * https://omemo.top/ https://omemo.top/ There is no way that an open IM platform will be able to guarantee E2E by default on all clients simply because someone/somewhere will produce a client that doesn't or doesn't do it properly. It is probably better to start with the E2E encryption system (in my example OMEMO) and then see where you can get it.