Hacker News Reader

Comment by lima | Hacker News Reader

It uses the same crypto as WhatsApp (same developer), but values your privacy and has properly working audio calls - better than WhatsApp in my experience.

It's essentially WhatsApp minus Facebook. And it's open source.

The company (and person - Moxie) behind Signal, OpenWhispherSystems, worked with Google and Facebook to add end-to-end encryption to Facebook Messenger, Google Allo and WhatsApp. It's literally the same protocol and Moxie is a highly regarded cryptographer / security researcher.

Telegram, which some are suggesting, has encryption as opt-in and their encryption scheme has been widely criticized for being dodgy (see: https://moxie.org/blog/telegram-crypto-challenge/).

View on HN

Or try Wire [1], which has a much richer feature set (voice calls, video calls, text chat and doodling) than Signal and is also slightly faster and more reliable in my experience. It's also multi-platform, provides multi-device sync and is end-to-end encrypted (although with a different custom protocol compared to Signal, albeit using the older and confusing name 'axolotl ratchet', which Signal no longer uses).

There's a table comparing Wire and other systems here. [2]

I still have Signal and update it whenever there are updates, mainly to see what's new or changed, but prefer Wire for the better feature set and UX. Telegram still remains my most used messaging client due to its UX and speed (even Wire is slow and lacks some basic features like message delivered and message read indicators).

I've been waiting for a long time to switch to Signal (or to Wire), but the improvement seen is quite slow over time (just my experience). Telegram has been moving rapidly on feature addition.

[1]: https://wire.com

[2]: https://wire.com/privacy/

I am not sure if Wire (another messaging app without clear monetization strategy) is better. We might end in the same situation in a few years.

Exactly. The most important reason to use Signal is the trustworthiness of the developers. Moxie is a highly esteemed security researcher / public figure. I trust him to (1) implement the protocol properly (which is really hard) and (2) respect my privacy and (3) not sell out like WhatsApp did.

The thing is, as long as we're using phone numbers as user handles, you have to trust the provider with your phone book. Signal tries as hard as possible to avoid it (all phone numbers are hashed), but if they wanted, they could simply brute force all the hashes since the search space is so small. There's no good solution to this.

Would salting the hashes be an improvement?

I ask knowing very little about their security model.

No, they're doing that already. The issue is that phone numbers are so short that you can just calculate the salted hash for all of them. You don't need any rainbow tables for that.

I agree on that point and would rather prefer something that is a viable business. But it doesn't seem feasible to implement because most people wouldn't pay for messaging anymore. As another data point, Signal doesn't have a monetization strategy either.

It seems like we (most humans who use communication devices) are doomed to be stuck in advertising-based-single-corporate-walled-garden solutions.

> Signal doesn't have a monetization strategy either

They don't have to - Open Whisper Systems is a non-profit with strong community support. It works out so well that they actually pay any contributor a few dollars per commit. That's the best monetization there is for an organization which serves the community.

Wire is VC funded by Iconical/Janus Friis (Skype co-founder who is also the co-founder of Wire) and will monetize with premium features. Can't share more at this point, I'm afraid.

Some of the "basic" stuff is actually surprisingly complex to do without compromising some other aspect IF we at Wire were to stick to always-E2EE-everything mantra. Case in point - delivery notifications. We're actually looking into them now.

Great. I understand that basic stuff could be complex, and I do prefer end-to-end encryption. I can't wait for these (and newer) features to be available so I can move out of Telegram. :)

> Use Signal: https://whispersystems.org/

I like the idea, but don't know of a good method to get my contacts to use Signal as well without making myself look extreme in my views. Any suggestions for this? For example, do you know of any short and crisp messages that get the point across, without getting into a never ending discussion of privacy and its value?

I would recommend that you try Signal, Wire and any other messaging platform with just one or two close people. Once you get a hang of the user experience and see any deficiencies and any annoyances first hand, you can decide whether it's even worth asking all your other contacts to try them.

My advice: Except Telegram, none of the others (Signal or Wire) are ready as a replacement for WhatsApp in UX or speed as of this moment. But Telegram has end-to-end encryption only for device specific, one-to-one chats (called "Secret chat"). Normal chats are only encrypted during transport and are stored as plain text on the servers and on the devices to support quick searching and multi-device/multi-platform sync.

What are you missing with Signal?

Signal is quite slow at message delivery, to start with. It's not easy to know if a message was delivered at all. That's the main reason I almost stopped using it.

Secondly, Signal does not have multi-device support and multi-device sync. Coming from Telegram, where I can catch up on messages on multiple devices and choose to switch to a computer keyboard to respond with longer messages, as opposed to a small touchscreen keyboard, I very much prefer having the ability to use different systems. Signal's desktop "app" is just with Chrome and AFAIK, it needs to be authenticated every time (with Telegram, I authenticate my desktop app once and it works fine across restarts). It's still tied to one device (the phone).

Wire allows users to signup or find other people using phone number or email address. Even Telegram depends on a phone number as the sole identifier for a user.

Overall, none of the current set of messaging apps or platforms are extremely appealing to me. All of them have some drawbacks. My dream platform would be a "decentralized and federated" system like email without having to be in individual walled gardens.

> It's not easy to know if a message was delivered at all.

One checkmark: delivered to server, two checkmarks: delivered to recipient. Works for me.

> Secondly, Signal does not have multi-device support and multi-device sync. > Coming from Telegram

Telegram has, to my knowledge, either end-to-end encryption or multi-device sync.

The main selling point apart from privacy is that the voice calls works really really well.

Has Signal fixed the multi-device issues (like not being able to use multiple Android devices)? Last I checked having multiple mobile devices was impossible.

No but neither does WhatsApp. The reason for this is that it's incredibly hard to properly do end-to-end encryption with multiple devices. It's a trade-off you have to accept if you want secure end-to-end encryption.

The way it works with WhatsApp and Signal is that your key is generated on your phone and never ever leaves it. The web client actually establishes a connection to your phone and routes all messages over it.

Now, the Axolotl ratchet protocol does support encrypting messages to multiple keys (it's what they use for group chats), but doing it properly requires time and effort in order to remain secure.

I know WhatsApp doesn't do it but proper multi-device support is something I require to move. At the moment I just use a private XMPP server so while it isn't technically "end-to-end", it's practically end-to-end as I control the server.

I do that too, but it doesn't work outside of a close group of friends.

For me, multi device support is not important since I have my phone with me all the time, and if I'm on my laptop there's the web client.

Apparently XMPP with Conversations + OMEMO provides secure multi device support, haven't tried it though and I'm not sure if I could get any of my non-tech friends to use it.

We've solved the multi device issue at Wire (wire.com). Causes some challenges - larger payload, not super fast performance in browsers once you hit certain level of connections and messages, but very, very usable.

wire.com/privacy for security whitepaper.

Reply on news.ycombinator.com