Or... you know... just use something like Telegram that isn't owned by Facebook. Their data-sharing / privacy policy is pretty simple https://telegram.org/privacy
1. Sharing data
We never share your data with anyone. No.
1. Sharing data
We never share your data with anyone. No.
Just use Signal Messager.
(Also, does Telegram have a version without Google Play Services?)
Correct me if I'm wrong, but I don't think that Signal supports this feature
Moxie Marlinspike asserts that federation needs standardization and that standardization inhibits changes. He also asserts that protocols have to change to keep up with changing requirements. His unspoken assumption is that it is impossible to create real-world forward-compatible protocols.
While I agree with the first assertion, I strongly disagree on the latter two. Consider that protocols and data formats that do not have to change exist. An encoding like UTF-8 will probably never have to change to keep up with new codepoints. Also consider that forward-compatible protocols and data formats exist. HTTP seems to be a very good example for that.
I believe with enough traction, we could get hedge funds to give money while shorting the publicly traded companies that operate walled-garden networks.
N.B. I read your link when it was written originally, and have not taken the time to go at the issues raised point-for-point, but I'd like to see more efforts made in the direction I mentioned above.
Edit: The protocol has to have federation built-in from the beginning, and the ability of any server to granularly discriminate against any given TLD at their operator's discretion.
Which is a legal right in the EU (and even allows you to reverse engineer proprietary code for the purpose of writing your own system that interoperates with a proprietary one), so this is very sketchy.
Moxie seems like a Google-employee.
Just use XMPP.
(^) Granted, moxie can be considered a crypto expert, and the design got some public auditing.
A novel crypto algorithm someone puts up on GitHub is "home-brewed." The Axolotl algorithm can no longer fairly be described as "home-brewed."
The Guardian Project writes a bunch of nice software https://en.wikipedia.org/wiki/The_Guardian_Project_(software...
It’s actually usable, supports a lot more encryption methods, is more up to date, and actually looks okay.
That sounds like an anti-feature.
At the end of the day, all these guys get enough users and then the users are just too tied to the platform to make an easy move.
Just to say this didn't happen with Telegram. Recovered everything smoothly with no errors.
The moment you switch phones, all the data is lost, because they do not have it in the cloud! This is the reason your phone needs to be connected to Internet when using whatsapp web or whatsapp desktop, because they literally stream your data i.e. chats from phone to desktop!
Telegram is a cloud messenger, data is stored in the cloud and loaded everytime in your devices, ironically this makes whatsapp better than telegram :D at least before facebook bought it.
Whatsapp never stores the chat history anywhere. All conversations are encrypted end to end.
It says on the Nokia C3 version of the app that Whatsapp won't support that device next year, possibly because of that.
I didn't say you can't, I said Whatsapp doesn't store it. I meant to say that it won't automatically backup and restore your stuff when you change phones.
You have to backup the data yourself in an sd card or a cloud service that you choose. It isn't stored in Facebook's servers.
https://en.wikipedia.org/wiki/Telegram_(software)#Usage_numb...
But you're right. At times I've had to search for information because I didn't remember which communication tool we used.
By the way, if you're using a Mac you might like 'Franz': http://meetfranz.com/
Live / phone call style voice messages no.
What Telegram should do to earn the trust of the technical community (specifically, the security savvy people who criticize it for unorthodox encryption methodologies), is contract a real audit from a leading security firm that specializes in cryptanalysis, like Riscure.
[1]: https://twitter.com/matthew_d_green/status/72642891296898252...
Suggestions like this do nothing to dispell the image that modern security firms are little more than a protection racket. If you don't pay for "an audit" from an "industry leading" firm, you'll be shunned by everyone.
Otherwise, you're just making claims that are unbacked by anything. Presumably only the fact that there hasn't, yet, been a public exploit. But that's not a useful metric.
At the end of the day, for many nerds looking at these two pieces of software and their developers-- Moxie comes out looking a lot more serious about privacy and more experienced with crypto than Nikolai and Pavel. To say nothing of Telegrams closed source cloud app model, questionable financing strategy or debatable ties to the Russian intelligence apparatus.
Soo you counter FUD with FUD. Great strategy!
The Telegram devs more or less said "f*ck you, we are programming world champions and PhDs".
Then, about 6 months after they were all cocky, a russian guy showed that the telegram server could mitm every secret chat by providing the client with shitty entropy. Either it was a back door, or the telegram devs showed that everyone else was right.
Don't use it for the crypto. If that is what you want, use something else.
Basically, it's about the cash. Signal's business model is to convince everyone that their protocol is the only secure one and charge everyone to licence it. If that means promoting non-E2E services that store and mine chat history, that's fine so long as they pay up.
What?
The protocol is publicly described. They've blogged about it. I can imagine people being able to reconstruct it from memory.
The first Google result for "signal protocol license" is https://whispersystems.org/blog/license-update/ , clarifying that it's under GPLv3 (i.e., patent grant) with an exception for the App Store. Has anyone paid money to license the protocol? Has Signal asked for money? Is it even possible to give them money for the protocol?
This is basically why Google could be sued by Oracle, because Dalvik and their class library based on Apache Harmony were not a fork of OpenJDK.
Of course I cannot speak for Signal's protocol. Maybe it has no traps. I'm just commenting on that license. It's a strong license that makes some demands: good fit open source but bad for Google.
Which brings me back to the original question—why do we think that OWS's pushing of Signal Protocol is about money? Yes, I expect that for Allo they got paid by Google to write and maintain some code. But I don't think that their general claim "Signal Protocol is good crypto for everyone solving this problem" is motivated by money, because so many people solving this problem could use the GPLv3 version.
As Allo is not GPLv3, they obviously got it under another license.
(And it's not so obvious to me. The thing I linked is licensed under GPLv3 + MPL if used on the App Store. You can totally ship an Android app that runs a separate GPLv3 subprocess, and an iOS app that uses it under the terms of the MPL. The GPLv3-subprocess thing is what JuiceSSH does for running Mosh.)
Q: So how do you encrypt data?
We support two layers of secure encryption. Server-client encryption is used in Cloud Chats (private and group chats), Secret Chats use an additional layer of client-client encryption. All data, regardless of type, is encrypted in the same way — be it text, media or files.
Our encryption is based on 256-bit symmetric AES encryption, RSA 2048 encryption, and Diffie–Hellman secure key exchange. You can find more info in the Advanced FAQ.
Wire [1] (which I discovered a few months ago) is a platform that has end-to-end encryption, multi-platform support and multi-device sync. It also has text chats, voice calls, video calls, doodling, etc. The UX still needs a lot of improvement (compared to Telegram).
[1]: https://wire.com
Seems to me though that if you're willing to use telegram you might as well just use iMessage or What's App though?
Not necessarily. Wire has shown that a Telegram like UX is possible with end-to-end encryption, multi-device sync and multi-platform support. It's just that Wire and Signal are slow in catching up and seem like they need a slightly larger team and/or better management of the development.
> didn't know things were that much better in the Telegram world.
I keep trying any new messaging platform like this, especially if it promises privacy and better security. So I'd recommend you try Telegram and see for yourself what it provides. I'm heavily impressed by what it offers and use it as my primary messaging client, but don't like the crypto and the fact that normal chats are not end-to-end encrypted.
> Seems to me though that if you're willing to use telegram you might as well just use iMessage or What's App though?
That depends on which company one is more comfortable with on the privacy front. I don't consider iMessage to be equivalent to Telegram in features or UX (it's actually inferior and has issues with handling SMS as a backup option). WhatsApp being connected to Facebook is a no-no from the privacy point of view.
To clarify not that it's a fundamental tradeoff that you can't have end to end encryption with good UX, but that the current choice between Signal and Telegram is a choice between security (Signal) and UX (Telegram).
From everything I've read you'd probably be better off trusting iMessage or WhatsApp over Telegram.
And on push notifications, the app only receives a signal that there's fresh content to be requested. There shouldn't be any metadata leaked. Source?
If you had actually used both, it would be clear why people use Telegram over Signal.
Signal doesn't even have a desktop client for any OS!
So yeah, the statement from parent still stands.
There is basically one person writing the app[1], and given the company has just a few[2] people _volunteering_[3] for them, you cannot expect them to release a large amount of code across so many devices. They prioritized the highest volume first.
Open Whisper Systems primarily develops a strong encryption protocol (Moxie's efforts). If you didn't realize, this protocol was adopted by WhatsApp[4] and also Facebook Messenger[5]. So, the developers of those other applications needn't spend time/resources on the encryption, but can release Desktop clients for people like yourself to enjoy.
People who use Signal trust Moxie. People who dislike Signal _may_ care more about features than the security properties of the software (note, WhatsApp doesn't open-source their software[6], and Telegram instead bets people cannot break their encryption[7]).
Also, their app will supposedly run on any OS that Chrome runs. I'm sure that was the intention.
[1] https://github.com/WhisperSystems/Signal-Desktop/commits/mas...
[2] https://whispersystems.org/#team
[3] https://whispersystems.org/workworkwork/
[4] https://www.whatsapp.com/security/WhatsApp-Security-Whitepap...
[5] https://whispersystems.org/blog/facebook-messenger/
- https://telegram.org/faq#q-how-are-you-going-to-make-money-o...