7 ms·

> Man, in my extended family SMS text group, this comes up once every couple weeks. One of us will note they aren't getting a random message, or someone will se

> Man, in my extended family SMS text group, this comes up once every couple weeks. One of us will note they aren't getting a random message, or someone will send a video and the quality will be crap, and the iPhone users will all mention how if we all had iPhones, this wouldn't be a problem. IMO a reasonable compromise is WhatsApp. Rich features like iMessage's but portable and lots of people already use it. I have never had a Facebook account and I've always been wary of them. I think it's fair to be concerned about privacy w/WhatsApp but I'm torn because it's a very practical solution.

gnusty_gnurc 7y ago
Telegram is the best compromise imo
- wyldfire 7y ago
  Yeah, Signal or Telegram might be a much better balance. But I don't want to be a salesman and try and push the technically superior choice on my friends and family. If I did, though, I would probably push one of those.
- heinrich5991 7y ago
  I don't like suggesting Telegram because it is not end-to-end encrypted. I prefer WhatsApp (where it's Facebook that has access to all the metadata like who speaks to whom, but not the message contents), or Signal (which is also end-to-end encrypted and doesn't have the "Facebook" problem).
  - wyldfire 7y ago
    Note that even though I advocate for WhatsApp I recognize that it's not really what I would call "end to end encrypted". Any time that you allow a broker to execute the initial key exchange, you're implicitly trusting the broker. And beyond that: if you let the broker re-exchange keys without even informing you (!!!) then it's a stretch to call it "end to end encrypted." But if the system re-transmits old messages encrypted with the new keys without user interaction then "end to end encrypted" has lost all meaning whatsoever. You can opt-in to at least be informed of new key exchanges, so at least I can tell myself that I took some precautions. But if I'm honest I know that it's not very effective.
    - deleted 7y ago
      [deleted]
    - ubercow13 7y ago
      You refute your main point in your second paragraph - they do inform you of key changes
      - wyldfire 7y ago
        It's a subtle point, but I would describe "end to end" as covering the humans on both ends. Your WhatsApp client on your phone participates in the key regeneration and/or key update without user interaction. WhatsApp's default UI configuration doesn't notify anyone about key changes. Defaults matter, defaults for secure software matters extra. Nearly no one enables this notification feature. And even if they did, the client helpfully sent old messages encrypted with the new key. Even when you are notified, you're notified after the fact.
        ubercow13 7y ago
        What do you mean regarding old messages? I thought whatsapp didn’t store any old messages and chat history only existed on your device?
        wyldfire 7y ago
        It does only exist on your device. Sadly, the WhatsApp client will receive a message from WhatsApp backend: "Fred Smith got a new phone and you should trust this new public key from Fred because I say so. Fred would love to have all the context so please re-send the old messages but encrypted with this new key." The WhatsApp client helpfully complies and hopes that Fred really did get a new phone and it's not Eve who somehow tricked WhatsApp into believing she was Fred. Or maybe WhatsApp was compelled by a lawful order to make it look as if Fred got a new phone. The WhatsApp client never requests or even informs the user that this event took place. Though it is possible to change the config opt-in to get informed whether this occurred, it is not possible to deny the request for old messages.
- dochtman 7y ago
  Please stop advocating for Telegram: https://gizmodo.com/why-you-should-stop-using-telegram-right-now-1782557415 https://gizmodo.com/why-you-should-stop-using-telegram-right... https://twitter.com/tqbf/status/987372998935105539 https://twitter.com/tqbf/status/987372998935105539 Signal is definitely the more secure choice, but Whatsapp is still king of the network effect at least in my neck of the woods.
  - jquery 7y ago
    That Gizmodo article is 3 years old, is it still true?
    - Godel_unicode 7y ago
      The tptacek tweet is not, and yes.
  - wozniacki 7y ago
    Could you elaborate on why you single out Telegram as a privacy deal-breaker as opposed to other similar apps? If they all are just as bad, is there something coming up on the near horizon thats worth the wait?
    - Godel_unicode 7y ago
      They are replying to a comment about Telegram, and mention other messaging apps which are better. They also do not say that they're all just as bad, unclear where you got that from?
      - wozniacki 7y ago
        I just asked for elaboration. I don't get whats so confusing about that. The cited article is over 3 years old, from a site whose parent company's founder got sued out of existence for leaking private sex tapes.[1] Is that what we consider the standard bearer for technical opinions on apps? Or do you belong to some kind of voting ring that downvotes opinions on apps they don't like? [1] Gawker to Pay Hulk Hogan $31 Million to Settle Sex Tape Lawsuit https://www.hollywoodreporter.com/thr-esq/nick-denton-announces-gawker-settlement-hulk-hogan-943414 https://www.hollywoodreporter.com/thr-esq/nick-denton-announ... [2] Gawker.com to shut down next week https://www.politico.com/media/story/2016/08/gawkercom-to-shut-down-004724 https://www.politico.com/media/story/2016/08/gawkercom-to-sh...
inferiorhuman 7y ago
IMO a reasonable compromise is WhatsApp. I trust Apple a whole helluva lot more than Facebook or Google. I'll happily take iMessage + Signal over WhatsAp, Hangouts, or SMS any day.
- lern_too_spel 7y ago
  Apple handed over its iCloud encryption keys and iMessage keyserver for Chinese users to the PRC, enabling mass surveillance of communications where at least one party is Chinese. Facebook and Google have not. I trust Facebook very little, but I trust Apple even less.
kbenson 7y ago
> IMO a reasonable compromise is WhatsApp. Yeah, having thought about it when this comes up, there's a very real trade-off between what people are willing to use because they've heard of it or might actually have it, whether that app/service will stay around or keep similar features in the future, and whether it's associated with a large org that may farm the data for personal information about you in some way (even if that's just your location). Something like Signal seems good, but I imagine it may be a pain to get some of my extended family to adopt it (or to make sure things send using it). WhatsApp would be good in that people have heard of it, and if they have Facebook it's probably easy for them to integrate with, but people are much more likely to have relative's phone numbers than service profile links, meaning they might opt to not use it in many cases. Really, it needs to be ubiquitous on phones for it really to be a viable replacement that will be used 9 out of 10 times. That leaves RCS as an upgrade to SMS, but who knows if we'll ever get that. I know people complain about how it doesn't actually raise limits enough, but going from SMS to a limit fo 105 MB for videos and more features (even if not on parity with current systems) is a huge step, and I think the only one likely to achieve even close to the same deployment as SMS, and then only if Apple supports it too (assuming US networks actually get on board).
- Mindwipe 7y ago
  Err, WhatsApp does use phone numbers as identifiers rather than service profiles, which is why it is ubiquitous in most of the world (much more than iMessage).
  - kbenson 7y ago
    If you install WhatsApp and I don't, and you send a message to my number what happens? I know what happens with SMS and RCS (which falls back to SMS), which is that it works, because every phone has it. If WhatsApp doesn't just work, then it's at a severe disadvantage any way you look at it. Coordinating the 10 people in my family group to not only install a new app, but choose it the next time they want to send a message (especially if they add a new person) is not to going to be easy (and in some cases might be impossible if some people refuse).

gnusty_gnurc 7y ago

Telegram is the best compromise imo

wyldfire 7y ago
Yeah, Signal or Telegram might be a much better balance. But I don't want to be a salesman and try and push the technically superior choice on my friends and family. If I did, though, I would probably push one of those.
heinrich5991 7y ago
I don't like suggesting Telegram because it is not end-to-end encrypted. I prefer WhatsApp (where it's Facebook that has access to all the metadata like who speaks to whom, but not the message contents), or Signal (which is also end-to-end encrypted and doesn't have the "Facebook" problem).
- wyldfire 7y ago
  Note that even though I advocate for WhatsApp I recognize that it's not really what I would call "end to end encrypted". Any time that you allow a broker to execute the initial key exchange, you're implicitly trusting the broker. And beyond that: if you let the broker re-exchange keys without even informing you (!!!) then it's a stretch to call it "end to end encrypted." But if the system re-transmits old messages encrypted with the new keys without user interaction then "end to end encrypted" has lost all meaning whatsoever. You can opt-in to at least be informed of new key exchanges, so at least I can tell myself that I took some precautions. But if I'm honest I know that it's not very effective.
  - deleted 7y ago
    [deleted]
  - ubercow13 7y ago
    You refute your main point in your second paragraph - they do inform you of key changes
    - wyldfire 7y ago
      It's a subtle point, but I would describe "end to end" as covering the humans on both ends. Your WhatsApp client on your phone participates in the key regeneration and/or key update without user interaction. WhatsApp's default UI configuration doesn't notify anyone about key changes. Defaults matter, defaults for secure software matters extra. Nearly no one enables this notification feature. And even if they did, the client helpfully sent old messages encrypted with the new key. Even when you are notified, you're notified after the fact.
      - ubercow13 7y ago
        What do you mean regarding old messages? I thought whatsapp didn’t store any old messages and chat history only existed on your device?
        wyldfire 7y ago
        It does only exist on your device. Sadly, the WhatsApp client will receive a message from WhatsApp backend: "Fred Smith got a new phone and you should trust this new public key from Fred because I say so. Fred would love to have all the context so please re-send the old messages but encrypted with this new key." The WhatsApp client helpfully complies and hopes that Fred really did get a new phone and it's not Eve who somehow tricked WhatsApp into believing she was Fred. Or maybe WhatsApp was compelled by a lawful order to make it look as if Fred got a new phone. The WhatsApp client never requests or even informs the user that this event took place. Though it is possible to change the config opt-in to get informed whether this occurred, it is not possible to deny the request for old messages.
dochtman 7y ago
Please stop advocating for Telegram: https://gizmodo.com/why-you-should-stop-using-telegram-right-now-1782557415 https://gizmodo.com/why-you-should-stop-using-telegram-right... https://twitter.com/tqbf/status/987372998935105539 https://twitter.com/tqbf/status/987372998935105539 Signal is definitely the more secure choice, but Whatsapp is still king of the network effect at least in my neck of the woods.
- jquery 7y ago
  That Gizmodo article is 3 years old, is it still true?
  - Godel_unicode 7y ago
    The tptacek tweet is not, and yes.
- wozniacki 7y ago
  Could you elaborate on why you single out Telegram as a privacy deal-breaker as opposed to other similar apps? If they all are just as bad, is there something coming up on the near horizon thats worth the wait?
  - Godel_unicode 7y ago
    They are replying to a comment about Telegram, and mention other messaging apps which are better. They also do not say that they're all just as bad, unclear where you got that from?
    - wozniacki 7y ago
      I just asked for elaboration. I don't get whats so confusing about that. The cited article is over 3 years old, from a site whose parent company's founder got sued out of existence for leaking private sex tapes.[1] Is that what we consider the standard bearer for technical opinions on apps? Or do you belong to some kind of voting ring that downvotes opinions on apps they don't like? [1] Gawker to Pay Hulk Hogan $31 Million to Settle Sex Tape Lawsuit https://www.hollywoodreporter.com/thr-esq/nick-denton-announces-gawker-settlement-hulk-hogan-943414 https://www.hollywoodreporter.com/thr-esq/nick-denton-announ... [2] Gawker.com to shut down next week https://www.politico.com/media/story/2016/08/gawkercom-to-shut-down-004724 https://www.politico.com/media/story/2016/08/gawkercom-to-sh...

inferiorhuman 7y ago

IMO a reasonable compromise is WhatsApp. I trust Apple a whole helluva lot more than Facebook or Google. I'll happily take iMessage + Signal over WhatsAp, Hangouts, or SMS any day.

lern_too_spel 7y ago
Apple handed over its iCloud encryption keys and iMessage keyserver for Chinese users to the PRC, enabling mass surveillance of communications where at least one party is Chinese. Facebook and Google have not. I trust Facebook very little, but I trust Apple even less.

kbenson 7y ago

> IMO a reasonable compromise is WhatsApp. Yeah, having thought about it when this comes up, there's a very real trade-off between what people are willing to use because they've heard of it or might actually have it, whether that app/service will stay around or keep similar features in the future, and whether it's associated with a large org that may farm the data for personal information about you in some way (even if that's just your location). Something like Signal seems good, but I imagine it may be a pain to get some of my extended family to adopt it (or to make sure things send using it). WhatsApp would be good in that people have heard of it, and if they have Facebook it's probably easy for them to integrate with, but people are much more likely to have relative's phone numbers than service profile links, meaning they might opt to not use it in many cases. Really, it needs to be ubiquitous on phones for it really to be a viable replacement that will be used 9 out of 10 times. That leaves RCS as an upgrade to SMS, but who knows if we'll ever get that. I know people complain about how it doesn't actually raise limits enough, but going from SMS to a limit fo 105 MB for videos and more features (even if not on parity with current systems) is a huge step, and I think the only one likely to achieve even close to the same deployment as SMS, and then only if Apple supports it too (assuming US networks actually get on board).

Mindwipe 7y ago
Err, WhatsApp does use phone numbers as identifiers rather than service profiles, which is why it is ubiquitous in most of the world (much more than iMessage).
- kbenson 7y ago
  If you install WhatsApp and I don't, and you send a message to my number what happens? I know what happens with SMS and RCS (which falls back to SMS), which is that it works, because every phone has it. If WhatsApp doesn't just work, then it's at a severe disadvantage any way you look at it. Coordinating the 10 people in my family group to not only install a new app, but choose it the next time they want to send a message (especially if they add a new person) is not to going to be easy (and in some cases might be impossible if some people refuse).