Hacker News Reader

Comment by nothrabannosir | Hacker News Reader

Google would be insane to not offer some version of end-to-end encryption in a chat app in 2016, when all of its biggest competitors have it enabled by default.

Who are all of its biggest competitors? Messenger sure doesn't do this (does it even have E2E at all?), Skype doesn't, either. Telegram, even if you considered it a big competitor, did they finally enable E2E by default? Or do you still have to open a "secure chat" for e2e? Kakao, WeChat, ... who else?

Honestly, aside from WhatsApp, I can't even think of one which anybody would consider "big".

That's indefensibly different from "All".

EDIT: Cool, I just learned iMessage is encrypted e2e! That's "Two" :)

View on HN

I think this is the most important to me. On Android, this is only the second app that is likely to have a large userbase and e2e encryption for chats. The fact that its opt-in is a non issue to me.

Didn't know WhatsApp had default e2e encryption. Might install it and check it out. I imagine it sends some sort of personal information back to the facebook mothership, though.

WhatsApp doesn't just have e2e encryption by default; they actually hired (or just contracted?) Moxie to implement the signal protocol:

Over the past year, we've been progressively rolling out Signal Protocol support for all WhatsApp communication across all WhatsApp clients. This includes chats, group chats, attachments, voice notes, and voice calls across Android, iPhone, Windows Phone, Nokia S40, Nokia S60, Blackberry, and BB10.

As of today [2016/4/5], the integration is fully complete.

- https://whispersystems.org/blog/whatsapp-complete/

So did Google for Allo.

e2e encryption, meaning all data is "safe while transferred".

The client (Whatsapp) can obviously read the data on both sides - and perhaps sent it to Whatsapp servers with e2e as well, so the data is transferred safely to Whatsapp/Facebook, without other eavesdroppers being able to see it :-)

My point is, if you don't trust the company that created it, it doesn't matter what technology is uses.

So who trusts Whatsapp/Facebook with their private data...?

It doesn't send any personal data back to WhatsApp/Facebook, all it needs to work is a phone number.

Except… WhatsApp definitely gets a copy of your address book: https://www.whatsapp.com/faq/en/general/20971813 “During this entire process, only phone numbers are sent to WhatsApp for lookup, securely, over an encrypted connection.”

Whatsapp also gets the metadata about the message: sender, receiver, time and probably location.

As of last January, WhatsApp handled ~30b messages a day [0]. As of this January, WhatsApp has 1b users [1]. iMessage has ~300m and "several billion" messages per day (hard to get stats unfortunately).

Telegram has 100m users and handles ~15b messages per day [2] but, similar to Google, is not e2e encrypted.

As of last month [3], Facebook Messenger and WhatsApp combined had 60b messages per day. Assuming WhatsApp daily messages grew roughly linearly with users, their increase from 700m to 1b users would put them at ~42b out of that 60, leaving 18b for Facebook.

So there are at least ~40b e2e encrypted messages flying around thanks to WhatsApp, with likely at least 20b (assuming iMessage is bigger than Telegram, which seems reasonable) more from iMessage, putting the e2e encrypted count around the ~60b ballpark.

Telegram and Facebook together would be ~30b and I seriously doubt Skype IM is competitive but KakaoTalk is ~150m users, around the same size as Telegram and WeChat is around 600m users [5].

So the unencrypted messages definitely have far more volume and users than encrypted but the encrypted platforms are still the largest around. The article said "all of its biggest competitors" and given that Google doesn't operate in China (ruling out WeChat), I think that's a reasonable choice of words, although it's really hard to say thanks to iMessage's lack of transparency.

[0]: http://venturebeat.com/2015/01/06/whatsapp-now-has-700m-user...

[1]: http://www.statista.com/statistics/260819/number-of-monthly-...

[2]: https://telegram.org/blog/100-million

[3]: http://www.theverge.com/2016/4/12/11415198/facebook-messenge...

[4]: http://www.statista.com/statistics/248863/number-of-register...

[5]: http://www.statista.com/statistics/255778/number-of-active-w...

I dug into iMessage a bit a while back, and it appeared that Apple held the keys for encrypted chats to allow messages to be sent to multiple devices that a person owns (laptop, iPad, iPhone), insulating the sender from having to know about each possible destination device. If the server has access to the keys, or can add their own key to a set of keys handed to clients during encryption, that fails to meet some definitions of 'end to end' encryption, since a server compromise will also compromise messages. Has the implementation changed in this regard?

The injection of extra keys to your set of public keys on apple's servers is an issue. The counterpoint is you are (supposed) to get a notification on every time a new device/public key is added.

Most users won't have a clue what that even means.

Reply on news.ycombinator.com