Comment by y0ghur7_xxx | Hacker News Reader

Comment by y0ghur7_xxx | Hacker News Reader

I am happy that XMPP gets some love. Centralised messengers are a real problem now. People on whatsapp are only reachable on whatsapp, same for viber, messenger, skype, ... We are in a really stupid situation. XMPP works now, is decentralised, has secure E2E encryption, is not controlled by a single entity, and has good clients for android and desktop (iOS is unfortunately missing).

I am rooting for an XMPP comeback.

What people seem to value is inline media, being able to vomit emojis everywhere, and chat syncs across multiple devices/OSs.

Sync is possible in xmpp with the carbon copies extension. for the rest, we have unicode.

WhatsApp, the most popular messenger, does not allow chat sync. It's single device even. I don't think that's part of the features the average user values.

Not true in all cases. They have a wonderful backdoor into your the phone app so you can use the webchat/desktop app. You scan a code and it will allow the website to connect to your phone and download all your messages/photos/etc and talk real time to friends.. Funcionally identical to telegrams desktop app (except, obviously, using your phone as a gateway of some kind).

This functionality makes me nervous honestly, because if the app allowed connections like this silently and downloads your details then wouldn't it be possible to just bypass the QR code for WhatsApp's server team?

(Also, when I point this out I always get downvotes, so, maybe a response this time?)

Out of curiosity why do you think this is a backdoor and not a valid cryptographic connection via your phone?

More likely - app is relatively secure but it collects and stores all that private info, then they need to work in some dictatorship or paranoid country (essentially a majority of all countries) and then those governments require storing info on their own local servers with which they can either comply or be banned, and then either government misuses this info or it gets hacked and malicious 3rd party misuses this info.

How is this different from e.g Telegram web client? I don't see a reason why this couldn't be done safely. I wonder if it's possible to prevent Whatsapp from serving some people a modified web client though.

Anyway, as much as I dislike Telegram, their desktop client is UX-wise miles ahead of web clients or electron trash.

Secret chats never leave the device basically.

The problem I have with telegram is that /by default/ it's security is very poor. It's stored and relayed by their servers so you can have a unified chat history.

However, if you hit the secret chat button I don't see a reason to think that this is stored in any way by them (and auditing the client I use confirms this for Qt linux desktop/iOS)

Your running into exactly the problem that Signal faced when people asked for a web client. It can't really be done securely unless you're willing to put ultimate trust in Signal's servers and the CA system.

Btw, the web app knows when the phone battery is low and warns about it. IMHO it's too much information going from my phone to WhatsApp and I don't know what's the real reason they need it. It's not like the phone doesn't have its own battery warning. Anything else going from the app to their servers?

You do know that the connection between the web app and the phone is E2E encrypted, right? You're doing a key exchange when you scan the QR code.

Unless you think FB is intentionally poisioning their web interface and serving malicious clients that break their own security you've got nothing to worry about with respect to these features.

Being able to know that the phone my chat is proxying through is about to die is pretty valuable.

Isn't a lot of it's popularity among users who only have one device? I've only met one person who I know used WhatsApp, and that was just to talk to his parents in India.

WhatsApp isn't really single device in practice; sure all the messages are routed through (usually) your phone but there's very little friction to using n devices. I'm logged in from 4 different machines right now.

Chat sync really isn't the best statement of the problem because the feature that people want is that all clients see the entire authoritative chat history. WhatsApp solves this problem in a way that is largely invisible to the user without relying on a central message store.

Fortunately none of that can't be done in a decentralized fashion. :) I think there's one big advantage for "people" in it too - being able to use your favorite client, whatever it is.

But I think the major hurdle in this situation is (as usual?) not about an well organized colorful emoji library, but offering something that is clearly better than what we have now in order to disrupt the status quo. :(

The major hurdle in this situation is that most XMPP clients are developed by FOSS volunteers or small underfunded developer groups. There is no VC monetization concept to be built on top of federated messaging, and there is no benevolent billionaire spending 50M USD for the development of awesome XMPP clients.

Matrix has created great clients for the major platforms with a dozen paid developers; Signal had a handful of developers as well. Conversations[0] on Android is a proof that a single dedicated developer can create a great and standards-compliant XMPP messenger.

[0] https://conversations.im/

Conversations has had frequent complaints about battery life issues, which to my knowledge have always been closed with some variation of "just ask about this on the chat" and/or "this is not something that can be fixed". In the past, I've noticed it doesn't work well for my battery life personally as well (so it's not just rumour).

For something that needs to run on a phone, battery life is one of the most important factors to make something actually useful. While the GUI looks great and I don't remember any usability warts, I don't think it's fair to recommend something with an issue this big.

Conversations is keeping its own TCP connection to the server. Battery usage depends on how many XMPP contacts you have, which modules your server has enables and whether you have the F-Droid or the Google Play version of the app. Come to the chat to find out what it is in your case ;-)

Disdain for the desires of the user is a quick way to ensure that a platform won't meet their needs.

Reply on news.ycombinator.com