Whatsapp: Video Calling
blog.whatsapp.com
blog.whatsapp.com
I know Facebook claims to use Whisper systems encryption but how can we blindly trust that this is actually implemented in a closed source system?
Stallman and others have been warning us for many years and we have been brushing it off. Now Snowden pretty much confirmed most of it but we keep going and entangling our wold more into these services.
1. In the UAE, where VoIP is illegal, the government was not able to selectively block voice traffic since it is indistinguishable from text traffic. So they had to ask WhatsApp to block voice functionality whenever a user is in the UAE.
2. If you lose your phone, you cannot recover your messages. Now, you may claim that they're just not providing a frontend option to do this, but would that make financial sense? You are potentially losing users who want their messages backed up so you can... falsely claim that you don't store messages?
3. Similar to 2), WhatsApp desktop cannot work without your phone being connected, again because that's the only way to access your messages.
source: erlang factory talk from 2015 I think...
Authorities can selectively block WhatsApp voice calls, it's been done in Oman where I used to live. If I leave Oman and use WhatsApp in an uncensored country, voice calls work just fine.
This is not the case where WhatsApp is registered via a UAE number; the blocks persist no matter where you connect from.
But they cannot do it without WhatsApp's help. My understanding is that WhatsApp will check the following at the server side:
1) User IP in UAE/Oman/etc.? Block voice.
2) User's number registered in UAE/Oman/etc.? Block voice.
This is different from UAE/Oman blocking voice traffic without coordination with WhatsApp.
The UAE (and Saudi Arabia) went through the extra step of asking WhatsApp to perform a block server side because of legal regulatory issues. Oman has made no such demand.
My family regularly makes WhatsApp calls to me from Oman; they just have to switch on a VPN to tunnel out of Oman's censorware.
i switched SIMcards recently (the number was migrated to the new card though) and flashed another ROM on my phone. It helpfully offered me to restore all messages and media from the server. (6+ months of history)
Sure it could use the IMEI for the encryption. But i'm unsure if it can access that datapoint from application context?
/edit: i just scrolled back to the first message i've got on my most messaged contact. its from 2014. i've switched devices and sim cards since then. The phone number is the only thing that stayed the same.
Once you activate a new phone, it will ask if you want to restore your messages from the latest backup. I guess it's using your Play Store account credentials to tie your SIM cards and phones together.
Something really bad needs to happen to move things in the right direction. Snowden was not enough, clearly.
We (people who work in tech) have a duty to fix these issues and to implement our products in ways that respect the privacy and security of the people who use what we build without passing the buck on to them. A Facebook user doesn't have to give a damn about encryption before Facebook put good encryption in place - the engineers at Facebook should just do it anyway, because it's the right thing to do.
If we build services that fail the user by allowing a malicious actor to violate their privacy then that is our fault. It is not the user's fault for not demanding we do our jobs properly. This is on us.
The maclicious actor is us. Don't work for shitty companies and implement stuff right for the companies you do work for.
Edit: Product owners give you jobs that are bad for the user/customer but they want it done ayways. Convince them why it's a bad idea and find another job if you can't.
If you think that being an engineer in tech is a job where you blindly implement someone else's will then you're failing to live up to both your potential and your responsibility.
There is no us. There's just hundreds of thousands of individuals, each doing their own thing. Some are angels, some are assholes, and a lot are in the middle. If you think that getting 500,000 people to make a pinky promise to be good is going to prevent shit from happening, that's just delusional thinking. No matter what you or I do, there will always be some asshole Investor/CEO/PM/programmer out there who will screw over people's privacy in order to make money, and you guilt-tripping the other 499,999 programmers is not going to change that.
If we want to stop shit from happening, we need systems in place to do that. Either regulatory, certification or market-based systems that catch and punish bad actors. In the absence of such systems, expect dysfunctional outcomes regularly.
I think we actually agree with one another, but I'm just coming at the argument from a slightly more positive position. We, as the engineers who build stuff, need to start making it clear that we don't like what the bad actors do, that we won't build it ourselves, and the "asshole Investor/CEO/PM/programmer" who does won't have a place in our industry. You're quite right that we need systems in place to stop this shit, but you're quite wrong if you think it's someone else's job to make that happen. We can build the certification or market-based systems right now.
Something really bad already happened: genocide. What else needs to happen?
The Netherlands (among others) required everybody to register their basic info, including religion, with local authorities. This made it very simple for the Germans to know whom to deport.
Your data can be used for other things than originally intended. But people do not learn.
So you may be right. More really bad things need to happen.
(FYI I'm german, I know what I'm talking about)
Fingers crossed that Trump's admin does something so terrible most people will want to use open source end-to-end encryption tools?
The government might read my WhatsApp messages - so what? They have been able to listen to my phone calls for ages. If there's something I want to keep private (and there is - it's not like "I have nothing to hide"), I will simply not use WhatsApp or any other communication channel I don't fully trust.
I don't care as long as the owner of the coffee shop I'm currently I cannot read my messages.
I think the problem is that security is an ongoing conversation between the government and the people. My guess is that most people, if pushed to a firm position, would probably agree with:
a) The government should have the right to look at communication to stop bad things.
b) The government should have to individually prove before an independent court that any one use of that power is justified.
The difficulty is that the government unilaterally broke (b) by having a rubberstamp court and a policy that let them collect everything and choose when to look at it.
And the response to the government's action is to start looking to redress this privately. I.e. a market solution to a perceived deficit of privacy. I suspect that if they had kept (b) intact, there would be much less call for absolute security, and much less of a solid argument for it.
For instance, something that really gets on my nerves is when I search for something on amazon and when I am reading a blog post about something completely unrelated to my amazon search, I see an advert related to my search.
This is just really annoying, its not like I want to hide the fact I am looking for a new TV its just that its really annoying and its an invasion of my privacy. Its just like having a helpful but nosy neighbor who gets the mail for you.
Also, just like you said, if someone has something to hide they will find alternatives to hide it, but why inconvenience us, the law abiding citizens, why invade whats our own business?
Threema implements validation mode, something similar can be done for other closed source messagers: https://threema.ch/validation/
But nobody can guarantee that encryption works when validation mode is disabled.
Wouldn't it be nice if we could use an open, standard protocol and network so I don't need 5 apps installed to communicate with various circles of friends over different mediums.
Ideally, federation. But bar that, this is better than having everything in one app.
Bonus: this puts the pain in the front, where it should be. If there was ever a chance of getting back to an open protocol, this will be the best way to get there: make the proprietary universe annoying for users.
https://whispersystems.org/blog/the-ecosystem-is-moving/
tl;dr: features features features
I'd glady give up all these gimmick features, like stickers and so on, to have some proper standardization.
I mean audio messages and gif seem revolutionary to some, but in reality it's just a file being sent from one device to another. And in the end it's these end clients interpreting the data.
If email hadn't had become dominant so early, you'd also have companies trying to split and isolate communication, claiming features but actually only going after profits and monopolising.
You have that option available to you already. XMPP is here to stay. Unfortunately, network effects being what they are, you may or may not have many people to talk to.
Meanwhile, people continue to flock to
* Slack (deliberately putting this at the top, given the audience) * Signal * Whatsapp * Line * WeChat * Facebook Messenger * Viber
> If email hadn't had become dominant so early, you'd also have companies trying to split and isolate communication, claiming features but actually only going after profits and monopolising.
If you've tried running your own email servers recently, you may have noticed that emails going into the big providers (Google, Microsoft, Yahoo) doesn't always get there. Despite the open platform and open standard, with the majority of mail flowing through those gate keepers, the barrier to entry has gotten higher than it should.
Unless you're pushing pharmaceuticals or fake designer products. Then that seems to make it through all the time.
>Meanwhile, people continue to flock to >* Slack (deliberately putting this at the top, given the audience) >* Signal >* Whatsapp >* Line >* WeChat >* Facebook Messenger >* Viber
is lacking consciousness for the effects. It is a comfortable illusion to ignore the fact that these are all (or at least predominantly) run by private companies, whose interest is not offering a through and through good service, but rather a profitable. Ostensibly, it might seem good/fast/better but that's by far not everything.
As others have mentioned, it is partly our "social/moral responsibility" (hope this wont provocate anyone) to educate people on the pitfalls and problems we and will be encountering with these services.
And regarding your second point, that also expands to the consciousness of decentralisation/federalisation/distribution. Centralize network is a special kind of distributed network with only one server. But that's not to point of people like me who are trying to promote these kinds of systems. And partially thats also blamable on the people who made the system (but to be fair, there were quite a few, and it wasn't that coordinated).
I can send an email with a binary attached and UTF-8 text through a protocol designed to only send ASCII text.
The coolest thing: someone from the 70s could receive it and it would mostly be OK.
Are you serious there? There were billion different apps doing text messaging too before Whatsapp. I don't see any point in dismissing the video chat on the basis that it is not the very first app.
- Ease to install
- Beautiful, intuitive GUI
- Always works and looks the same
- Keeps backups
- Zero cost
- Allows over-IP phone calls, now also with video
- Integrates well with phone
Ideally I wish the world used FaceTime/Messaging, since it integrates so nicely with everything Mac related. Also, BY FAR the best quality, and performance.
XMPP is the closest we've gotten (to my knowledge) to a standard protocol that was adopted (at least partially). But it's never really kicked off.
I guess I was thinking more about IM protocols rather than VOIP.
It's an extra link in the chain, meaning another potential bottleneck and added latency.
EUROPE TO US, EUROPE TO LATIN AMERICA, LATIN AMERICA - EUROPE ASIA TO EUROPE
All without latency.
I doubt that adding video calls to a chat app requires a featuritis diagnosis.
Email likely won't be an eventuality in this case.
They were (are) some of the best at working with WebRTC.
Edit: I would put more stock on Appear.in. They also have some of the best people, and they have recently launched a monetization plan (I was worried about that part)
Fines due to VirNetX from Apple following iMessage / VPN On Demand / FaceTime patent case: $625 million
Apple current liquidity: c . $180 billion
I see a straightforward solution. Stock buy-out, reclaim fines, shut-down. Apple would actually save money plus own all the patents.
People started using WhatsApp before it was acquired by FB inc. A fair share of these might just leave WhatsApp if were to be merged completely with FB messenger.
There are plenty of alterantives out there.
They promoted their end to end encryption promise for messages, so I think they would've promoted it again if it still were true for the video call feature.
edit:
Google, for example, promised their video calls to be encrypted with Duo. https://blog.google/products/duo/meet-google-duo-simple-1-to...
Is it, if it's WebRTC, only in-transit encryption or would that mean that the calls content isn't visible for WhatsApp/Facebook at all?
However, it's still possible to put a server between two participants so that instead of communicating directly, they would be communicating through this intermediate endpoint which would have access to call content - without call participants even knowing. So ultimately it's a question of trusting a particular service, not the protocol used.
It's a surprise since it comes from Google. Hangouts has worked more or less OK for me.
Let's see how WhatsApp compares.
What is the point? Isn't this just hangouts all over again?
I can't understand why these companies keep rolling and re-rolling the same apps over and over.
But please add bots, unless FB decided that their Messenger is the only platform to survive in the long run and WhatsApp has to die. WhatsApp is still the number one chat in most of Europe and every developer here would like to write bots for it instead of for Messenger and Telegram. It's where our customers and our customers' customers are. Messenger is going to take over if bots get mainstream and you don't support them. My bet is that it will happen next year or never so you're running out of time (or not at all). We'll see.
And if you do implement bot, please copy Messenger: exactly the same API and the same or a very similar UI. That will give you all the Messenger bots from day 1 and developers will love you.
So yes I would prefer to have the option of adding contacts separately.
We could use something like ENUM mapping [1] on the device and there would be one single set of data that the user is in control. Even better, it would mean that I can choose the granularity of access to different communication channels, so if someone has my phone number they wouldn't be able to know my other messaging handles unless I make it public.
I mean, I just love having huge installs for features I don't use.
It's of course possibly to deal with encryption and ephemerality as separate concerns but this doesn't seem to be a priority at all for the Telegram team. I feel like the team has the best intentions but it doesn't provide better security and privacy than Signal, Wire, or even Whatsapp when it comes to day-to-day chats with regular people in your life. As far as I recall there isn't even a way to verify key fingerprints.
on what basis is this statement made? Isn't whatsapp going to use your data for ads on FB? I have had people tell me that their whatsapp contacts are popping up on facebook as "people you may know". This isn't just the end of it.
>believe that the standard chats are encrypted
One just has to read their website, it is clear that only secret chats are end to end encrypted. This is the problem with people, not their team. Tesla faced the same problem with their auto pilot feature.
I think that, from a design perspective, this is not a really good concept. If your defaults incentivize behaviour antagonistic to your users interest, you are still to blame for this effect.
I need support for bots.
WhatsApp doesn't have it. Meanwhile, Skype, Telegram, Facebook Messenger and Google are where the action is, building great bot support. I want to use WhatsApp, but am using Skype and Telegram now to build a bot.
Bot support could also make WhatsApp viable as a business in the long run as an independent, secure service. Simply make businesses pay for bot accounts.
WhatsApp has always been the worst among the major messengers (Hangouts, Telegram, Line, WeChat all have this) but the sad thing is they can do what they want. They have the network effect on their side, the masses use it, so they can get away with being light-years away from the others in features...
Audio Calls on Whatsapp are already bad, not only is there no way to turn them off, the quality just sucks compared to the local mobile network.
I guess same goes to the Video Calls... and honestly, who does video calls from their phone?
A lot of people, specifically FaceTime users. I would probably be safe in saying the vast majority of smartphone users, especially iPhone.
http://www.pewresearch.org/fact-tank/2015/04/01/6-facts-abou...
If your job depends on not understanding something you wont so it's easy to brush away surveillance issues just like those whose livelihood is impacted by global warming find it easy to brush away those issues.
There is the old trope about I don't care or have nothing to hide which is self servingly obtuse because surveillance is not about you the individual, its about the health of your society. And the tired cliche about people not caring, well if people get impacted and begin to draw the dots they will care very much. So this just rests on a fleeting ignorance of the scope of surveillance.
Whisper systems uses your phone number which directly ties to your identity when any privacy conscious service that is half sincere will do everything in its power to avoid such gratuitous tie-ins.