4 ms·

As someone that does not have a smartphone, WhatsApp and Signal are really annoying because they are the two apps that can not be used without one (even though

As someone that does not have a smartphone, WhatsApp and Signal are really annoying because they are the two apps that can not be used without one (even though they have desktop apps). Telegram and FB Messenger and Hangouts at least can, but here in Europe WhatsApp is the default for everything and there are things for which it is becoming almost completely necessary. But I simply find the whole chat ecosystem so depressing. A few years ago at least I could chat with Google Talk people via Jabber. It is really absurd that instant messaging is not federated like email. Of course there is one explanation: while Email was invented in the 70s at research institutions with goals beyond profit, IM already started in the 90s with companies trying to capitalize their user-base with vendor lock-in... (ICQ, MSN, etc.). Sad, sad, sad.

Timpy 6y ago
I'm stepping out of my domain knowledge on this one to start a discussion, I hope to have my points corrected where I'm wrong. Another note, I'm not advocating for FB's methods I'm strictly interested in some cryptography aspects. As I understand it, in order to have real end-to-end encryption (the real stuff, not some marketing term) each device has to generate a long set of keys and with each message sent, they cycle through to the next key. If WhatsApp is doing what it reports it's doing and it actually is end-to-end encrypted then the web application needs to use your phone because it needs that set of keys. I'm not sure if it specifically sends through your phone or if it sends via the webapp, but you have to use the keys in the correct order or the device you're contacting won't be able to decrypt the next message.
- rkangel 6y ago
  Yes, WhatsApp is doing encryption that is E2E between two devices. That's a good security model. There's no particular reason that that has to be two phones though - could be desktop, wifi tablet etc.. That limitation is a result of a 'product' decision where your identity on WhatsApp is a mobile phone number. That decision was a big part of what allowed WhatsApp to scale quickly (people didn't need to create an account, just install the app and start messaging people whose numbers they had).
  - joshspankit 6y ago
    Exactly to the point: They can implement E2E encryption in-browser, on dedicated desktop apps, with supported routers, and basically anywhere. Even $5 microcontrollers can generate and use the same encryption protocol.
    - evgen 6y ago
      But they don't because modern phones have (semi-)secure enclaves that can hold encryption keys and protect them from most hacking attempts. Desktops and browsers lack this, so any conversation you have via these other platforms in the computing environments of 99.999% of the population (please spare me the 'I use qubes, so ha!' speech) has a much lower level of security/privacy. Since most people want conversation sync among the desktop and mobile versions this means your security drops to become the lowest common denominator among all platforms. It can be done, but it shouldn't be done if you actually care about security or privacy.
      - joshspankit 6y ago
        There are valid arguments on all sides of this: - That desktop browsers can be less secure - That software can work around that - That mobile can be more secure - That mobile can also be false security as "0 days" are currently in the wild and mobile phones are typically always online - Etc. If you truly want security, there's a really compelling argument for live-booting a distro like https://tails.boum.org/ https://tails.boum.org/ and then rebooting when you're done. On the other side there are compelling phones such as the Libre 5 (assuming there are no current 0 days).
        evgen 6y ago
        Tails and purism phones are the same 'I run qubes' fantasy that I expressly ignored. No one uses these, and they are not going to ever use those systems. There are fewer 0-days and CVEs in the mobile environment and for at least the next five years or so the mobile environment will always be more secure than desktops. Right now the single biggest step any 'normal' person can take to secure their digital life is to throw out their desktop and live completely on mobile devices and consoles for gaming.
Semaphor 6y ago
Everyone who uses WhatsApp has to have a phone. And so they can still receive and send SMS. That’s what I (in Germany) use for people who insist on using mobile-text communication.
- arximboldi 6y ago
  Yes, same (also in Germany). I survive, can't complain too much, I prefer the advantages of not having a smartphone. But for example my neighbours have organized a WhatsApp group, which is nice, for stuff that goes on in the building and helping eachother out. There are lots of examples like that (parents groups at school, etc.) Another thing I'm noticing is that SMS is becoming less and less reliable, sometimes the messages not reaching the other part, particularly when changing country codes...
  - Semaphor 6y ago
    Can’t talk about unreliability, never had a problem with that. But for neighbors, a lot of people here (on average older and left-leaning) are on nebenan.de which is a nextdoor.com copycat. Unlike whatsapp it actually works on computers :)
    - arximboldi 6y ago
      Yes, I really like nebenan.de, and I have a monthly donation subscription :)
derin 6y ago
Matrix[1] is trying to solve that issue, I'd highly recommend looking into it. I actually pipe most of my various "chat" networks (including WhatsApp) into it via bridges[2]. As you said, we in Europe are kind of forced to have WA installed, but at least you don't have to use it as your primary client if you don't want to. You can even deploy it to an Android VM and go completely headless, if you feel the need. [1] https://matrix.org/ https://matrix.org/ [2] https://matrix.org/bridges/ https://matrix.org/bridges/
- eitland 6y ago
  > As you said, we in Europe are kind of forced to have WA installed, but at least you don't have to use it as your primary client if you don't want to. Haven't used WhatsApp for months and then only for a few days to talk to someone from US. My friends were heavy WhatsApp users but we changed one group after another to Telegram after WhatsApp were brought. Telegram is far from perfect though so I hope to move to Matrix within a few months.
parliament32 6y ago
> It is really absurd that instant messaging is not federated like email. The joke is that it used to be. FB Messanger and Google Chat had XMPP hooks so you could talk to whatever other platform, Slack used to have an IRC integration, MSN/AIM/ICQ never tried too hard to get stop reverse-engineers from putting their protocols into all-in-one messengers... Then businesses realized the value of locking in users and becoming walled gardens.
- ralphm 6y ago
  As far as I know, Facebook Messenger's XMPP support was only exposed to clients (c2s), not to other XMPP servers (s2s). Microsoft's Lync (now known as Skype for Business) supported XMPP federation until 2019. WhatsApp's client protocol was originally based on XMPP. I'm reasonably sure that both AIM and Yahoo had XMPP server-to-server support ready around 2008, but can offer no proof.

Timpy 6y ago

I'm stepping out of my domain knowledge on this one to start a discussion, I hope to have my points corrected where I'm wrong. Another note, I'm not advocating for FB's methods I'm strictly interested in some cryptography aspects. As I understand it, in order to have real end-to-end encryption (the real stuff, not some marketing term) each device has to generate a long set of keys and with each message sent, they cycle through to the next key. If WhatsApp is doing what it reports it's doing and it actually is end-to-end encrypted then the web application needs to use your phone because it needs that set of keys. I'm not sure if it specifically sends through your phone or if it sends via the webapp, but you have to use the keys in the correct order or the device you're contacting won't be able to decrypt the next message.

rkangel 6y ago
Yes, WhatsApp is doing encryption that is E2E between two devices. That's a good security model. There's no particular reason that that has to be two phones though - could be desktop, wifi tablet etc.. That limitation is a result of a 'product' decision where your identity on WhatsApp is a mobile phone number. That decision was a big part of what allowed WhatsApp to scale quickly (people didn't need to create an account, just install the app and start messaging people whose numbers they had).
- joshspankit 6y ago
  Exactly to the point: They can implement E2E encryption in-browser, on dedicated desktop apps, with supported routers, and basically anywhere. Even $5 microcontrollers can generate and use the same encryption protocol.
  - evgen 6y ago
    But they don't because modern phones have (semi-)secure enclaves that can hold encryption keys and protect them from most hacking attempts. Desktops and browsers lack this, so any conversation you have via these other platforms in the computing environments of 99.999% of the population (please spare me the 'I use qubes, so ha!' speech) has a much lower level of security/privacy. Since most people want conversation sync among the desktop and mobile versions this means your security drops to become the lowest common denominator among all platforms. It can be done, but it shouldn't be done if you actually care about security or privacy.
    - joshspankit 6y ago
      There are valid arguments on all sides of this: - That desktop browsers can be less secure - That software can work around that - That mobile can be more secure - That mobile can also be false security as "0 days" are currently in the wild and mobile phones are typically always online - Etc. If you truly want security, there's a really compelling argument for live-booting a distro like https://tails.boum.org/ https://tails.boum.org/ and then rebooting when you're done. On the other side there are compelling phones such as the Libre 5 (assuming there are no current 0 days).
      - evgen 6y ago
        Tails and purism phones are the same 'I run qubes' fantasy that I expressly ignored. No one uses these, and they are not going to ever use those systems. There are fewer 0-days and CVEs in the mobile environment and for at least the next five years or so the mobile environment will always be more secure than desktops. Right now the single biggest step any 'normal' person can take to secure their digital life is to throw out their desktop and live completely on mobile devices and consoles for gaming.

Semaphor 6y ago

Everyone who uses WhatsApp has to have a phone. And so they can still receive and send SMS. That’s what I (in Germany) use for people who insist on using mobile-text communication.

arximboldi 6y ago
Yes, same (also in Germany). I survive, can't complain too much, I prefer the advantages of not having a smartphone. But for example my neighbours have organized a WhatsApp group, which is nice, for stuff that goes on in the building and helping eachother out. There are lots of examples like that (parents groups at school, etc.) Another thing I'm noticing is that SMS is becoming less and less reliable, sometimes the messages not reaching the other part, particularly when changing country codes...
- Semaphor 6y ago
  Can’t talk about unreliability, never had a problem with that. But for neighbors, a lot of people here (on average older and left-leaning) are on nebenan.de which is a nextdoor.com copycat. Unlike whatsapp it actually works on computers :)
  - arximboldi 6y ago
    Yes, I really like nebenan.de, and I have a monthly donation subscription :)

derin 6y ago

Matrix[1] is trying to solve that issue, I'd highly recommend looking into it. I actually pipe most of my various "chat" networks (including WhatsApp) into it via bridges[2]. As you said, we in Europe are kind of forced to have WA installed, but at least you don't have to use it as your primary client if you don't want to. You can even deploy it to an Android VM and go completely headless, if you feel the need. [1] https://matrix.org/ https://matrix.org/ [2] https://matrix.org/bridges/ https://matrix.org/bridges/

eitland 6y ago
> As you said, we in Europe are kind of forced to have WA installed, but at least you don't have to use it as your primary client if you don't want to. Haven't used WhatsApp for months and then only for a few days to talk to someone from US. My friends were heavy WhatsApp users but we changed one group after another to Telegram after WhatsApp were brought. Telegram is far from perfect though so I hope to move to Matrix within a few months.

parliament32 6y ago

> It is really absurd that instant messaging is not federated like email. The joke is that it used to be. FB Messanger and Google Chat had XMPP hooks so you could talk to whatever other platform, Slack used to have an IRC integration, MSN/AIM/ICQ never tried too hard to get stop reverse-engineers from putting their protocols into all-in-one messengers... Then businesses realized the value of locking in users and becoming walled gardens.

ralphm 6y ago
As far as I know, Facebook Messenger's XMPP support was only exposed to clients (c2s), not to other XMPP servers (s2s). Microsoft's Lync (now known as Skype for Business) supported XMPP federation until 2019. WhatsApp's client protocol was originally based on XMPP. I'm reasonably sure that both AIM and Yahoo had XMPP server-to-server support ready around 2008, but can offer no proof.