6 ms·

I just don't get it. What is so difficult about providing a one-time authentication through the user's phone? Just open Whatsapp on the smartphone, get a token,

by iagooar 12y ago

I just don't get it. What is so difficult about providing a one-time authentication through the user's phone? Just open Whatsapp on the smartphone, get a token, put your phone number and token and voilà! I mean, there have been web chats for decades now, so I don't understand why they invented such a messed up set of constraints. Besides, am I the only one who suspects that Whatsapp is boycotting Apple? They needed almost 2 months to get an iOS 8 update out, now they are limiting the "web" application to non-Apple users...

k-mcgrady 12y ago
>> "Besides, am I the only one who suspects that Whatsapp is boycotting Apple?" I understand the theory but all this does is hurt them. They need as many people as possible using there app for it be useful. They're also owned by Facebook who update all their apps weekly.
- venomsnake 12y ago
  Facebook made the "Brilliant" move to remove the chat functionality from their app. So I am forced to use the mobile site of facebook ...
  - ponyous 12y ago
    On what platform are you? Is there no Messenger for it? (Maybe I'm missing the point)
    - venomsnake 12y ago
      Why should I have 2 crippled apps than one functional. Also one that has degraded functionality. And until android has fake permissions I won't install messenger.
      - k-mcgrady 12y ago
        >> "Why should I have 2 crippled apps than one functional." I feel the opposite. Why should I have 1 slow, bogged down app when I can have two fast, functional ones?
      - lgeek 12y ago
        > And until android has fake permissions I won't install messenger. Cyanogenmod has Privacy Guard, which is pretty much that.
sschueller 12y ago
Exactly, Telegram figured it out and it works fine.
- ddeck 12y ago
  Telegram store your message and conversation history on their servers, whereas Whatsapp run somewhat like SMS - they pass your message on to the destination and then forget about it. Clearly every point in the chain matters, but it always surprised me that a company that puts so much emphasis on security and privacy thinks it's a good idea to keep your messages in the cloud: "Unlike WhatsApp, Telegram is cloud-based and heavily encrypted. As a result, you can access your messages from several devices at once"[1] [1] https://telegram.org/faq https://telegram.org/faq
  - TillE 12y ago
    There's absolutely nothing wrong with putting your encrypted data anywhere and everywhere, as long as you are the only one who has the encryption key. Unfortunately, it sounds like that's not what Telegram is doing with its non-"secret" messages.
    - ownagefool 12y ago
      Actually, you have to assume that any encryption is a temporary measure; it can and will be broken in the future. With that in mind, if something is worth encrypting, it's possible you don't want the service to store it after it's useful. Of course, whatsapp could register devices which are thrown away after x days without delivery then store the messages until delivered to all end devices but that's likely a core infrastructure update which would require them to store more data, not the same as just writing another client. Still, what they've created as a web client is a little batty; typically I'd want to use those when I can't find my phone.
      - NietTim 12y ago
        So instead the intelligence agencies intercept all whatsapp traffic and crack that. Not much difference
smurfpandey 12y ago
I think they are using web sockets or something which requires persistent connection between the phone and browser. Since on iOS, apps can't run in background this approach will not work on iOS.
smhenderson 12y ago
I would have thought the whole point of a web client was so that people who don't have a supported phone can get in on the fun. If I have to have WA on my phone to authenticate a web client then said client is just the useless toy described in the article. I confess, I've never used it and don't want to pass judgment without actually checking it out but if what the article describes is true than, yeah, they screwed this one up big time.
- SixSigma 12y ago
  I haven't used the Web service but I probably will. Not having to pick my phone up to use it will be a boon. I'm always logged in so this is a non-issue for me. I have cursed the lack of a desktop client often.
ddeck 12y ago
I believe the issue is that unlike web chats and apps like Telegram, Whatsapp doesn't store conversations on their servers beyond what is required to deliver messages to the required destination device(s). This presents obvious problems with having not just a web client, but any client other than the main device, since the main device is the only store of the existing conversations. New messages sent also need to be synchronized across devices, which I presume is why it's required to keep your phone connected to the Internet. Otherwise Whatsapp would need keep conversations on their servers until they could be synced, which is very much not their model. Details on their architecture: https://www.youtube.com/watch?v=c12cYAUTXXs https://www.youtube.com/watch?v=c12cYAUTXXs http://highscalability.com/blog/2014/2/26/the-whatsapp-architecture-facebook-bought-for-19-billion.html http://highscalability.com/blog/2014/2/26/the-whatsapp-archi...
- 72deluxe 12y ago
  Doesn't that sound like a poor architecture then? If the system is reliant on the main device, what happens if that gets run over or destroyed? WhatsApp have no control over the fate of the device. Why wouldn't they store the messages on the server and sync from that? WhatsApp have control of the fate of their own servers, which is far more reliable, SURELY. If I send a new message from a device, either the other devices can poll periodically for messages that I have sent, or they can use WebSockets and be notified when a new message is sent, or when the app opens it can fetch all the recent messages that I have sent from other devices. It isn't difficult with a fine grained timestamp, surely? That's what Google Talk does. You'd only need to order my messages by timestamp to get all messages that I had sent. It's a bit of a daft architecture if it is incapable of this basic mechanism, isn't it?
  - onion2k 12y ago
    If WhatsApp don't store the messages then they can't give them to any authorities if they're asked. That's a pretty big selling point for some users.
  - Igglyboo 12y ago
    It's actually a feature, not poor architecture. They're putting security and privacy above UX. This is especially important in this day and age with all of the NSA and related revelations. If you want a better UX there are hundreds of other options available.

by iagooar 12y ago

k-mcgrady 12y ago

>> "Besides, am I the only one who suspects that Whatsapp is boycotting Apple?" I understand the theory but all this does is hurt them. They need as many people as possible using there app for it be useful. They're also owned by Facebook who update all their apps weekly.

venomsnake 12y ago
Facebook made the "Brilliant" move to remove the chat functionality from their app. So I am forced to use the mobile site of facebook ...
- ponyous 12y ago
  On what platform are you? Is there no Messenger for it? (Maybe I'm missing the point)
  - venomsnake 12y ago
    Why should I have 2 crippled apps than one functional. Also one that has degraded functionality. And until android has fake permissions I won't install messenger.
    - k-mcgrady 12y ago
      >> "Why should I have 2 crippled apps than one functional." I feel the opposite. Why should I have 1 slow, bogged down app when I can have two fast, functional ones?
    - lgeek 12y ago
      > And until android has fake permissions I won't install messenger. Cyanogenmod has Privacy Guard, which is pretty much that.

sschueller 12y ago

Exactly, Telegram figured it out and it works fine.

ddeck 12y ago
Telegram store your message and conversation history on their servers, whereas Whatsapp run somewhat like SMS - they pass your message on to the destination and then forget about it. Clearly every point in the chain matters, but it always surprised me that a company that puts so much emphasis on security and privacy thinks it's a good idea to keep your messages in the cloud: "Unlike WhatsApp, Telegram is cloud-based and heavily encrypted. As a result, you can access your messages from several devices at once"[1] [1] https://telegram.org/faq https://telegram.org/faq
- TillE 12y ago
  There's absolutely nothing wrong with putting your encrypted data anywhere and everywhere, as long as you are the only one who has the encryption key. Unfortunately, it sounds like that's not what Telegram is doing with its non-"secret" messages.
  - ownagefool 12y ago
    Actually, you have to assume that any encryption is a temporary measure; it can and will be broken in the future. With that in mind, if something is worth encrypting, it's possible you don't want the service to store it after it's useful. Of course, whatsapp could register devices which are thrown away after x days without delivery then store the messages until delivered to all end devices but that's likely a core infrastructure update which would require them to store more data, not the same as just writing another client. Still, what they've created as a web client is a little batty; typically I'd want to use those when I can't find my phone.
    - NietTim 12y ago
      So instead the intelligence agencies intercept all whatsapp traffic and crack that. Not much difference

smurfpandey 12y ago

I think they are using web sockets or something which requires persistent connection between the phone and browser. Since on iOS, apps can't run in background this approach will not work on iOS.

smhenderson 12y ago

I would have thought the whole point of a web client was so that people who don't have a supported phone can get in on the fun. If I have to have WA on my phone to authenticate a web client then said client is just the useless toy described in the article. I confess, I've never used it and don't want to pass judgment without actually checking it out but if what the article describes is true than, yeah, they screwed this one up big time.

SixSigma 12y ago
I haven't used the Web service but I probably will. Not having to pick my phone up to use it will be a boon. I'm always logged in so this is a non-issue for me. I have cursed the lack of a desktop client often.

ddeck 12y ago

I believe the issue is that unlike web chats and apps like Telegram, Whatsapp doesn't store conversations on their servers beyond what is required to deliver messages to the required destination device(s). This presents obvious problems with having not just a web client, but any client other than the main device, since the main device is the only store of the existing conversations. New messages sent also need to be synchronized across devices, which I presume is why it's required to keep your phone connected to the Internet. Otherwise Whatsapp would need keep conversations on their servers until they could be synced, which is very much not their model. Details on their architecture: https://www.youtube.com/watch?v=c12cYAUTXXs https://www.youtube.com/watch?v=c12cYAUTXXs http://highscalability.com/blog/2014/2/26/the-whatsapp-architecture-facebook-bought-for-19-billion.html http://highscalability.com/blog/2014/2/26/the-whatsapp-archi...

72deluxe 12y ago
Doesn't that sound like a poor architecture then? If the system is reliant on the main device, what happens if that gets run over or destroyed? WhatsApp have no control over the fate of the device. Why wouldn't they store the messages on the server and sync from that? WhatsApp have control of the fate of their own servers, which is far more reliable, SURELY. If I send a new message from a device, either the other devices can poll periodically for messages that I have sent, or they can use WebSockets and be notified when a new message is sent, or when the app opens it can fetch all the recent messages that I have sent from other devices. It isn't difficult with a fine grained timestamp, surely? That's what Google Talk does. You'd only need to order my messages by timestamp to get all messages that I had sent. It's a bit of a daft architecture if it is incapable of this basic mechanism, isn't it?
- onion2k 12y ago
  If WhatsApp don't store the messages then they can't give them to any authorities if they're asked. That's a pretty big selling point for some users.
- Igglyboo 12y ago
  It's actually a feature, not poor architecture. They're putting security and privacy above UX. This is especially important in this day and age with all of the NSA and related revelations. If you want a better UX there are hundreds of other options available.