Darpa wants to make a better, more secure, version of WhatsApp

This is probably the most elegant solution to achieve that functionality, but it still has a few security downgrades.

To back up the keys, you either need to manage a server yourself, or store them with a 3rd party that you trust.

To protect the backed up keys, you either need to manage another key, which just kicks the can down the road, or use a passphrase. If you give your users the option to protect their keys with a passphrase or with a mnemonic word list, a lot of them will pick the passphrase because it’s easier. It’s also less secure, especially if your users choose a weak passphrase, which a lot of them will.

I really like the whatsapp solution, because it has all the security under the hood and doesn’t let the users revert to less secure behaviour. It has an obvious UX tradeoff (with lost message history), but the alternative is to downgrade the key management UX to that of managing a cryptocurrency wallet.

For me, the problem is that it requires internet access. When I found that WhatsApp was deleting important messages and that the backups and exports that I was counting on were useless, as I mentioned in another comment[1], I found that the easiest way to save those messages was to scrape them from the web client. However, connecting the phone to the internet meant that it would receive more messages and hence delete more messages. I took screenshots manually of several days of the oldest available messages to avoid losing them, but it wouldn't have been necessary if the desktop client didn't require internet access.

[1] https://news.ycombinator.com/item?id=19669740

What if you left your phone at home and it's not connected to the Internet?.

I usually leave my phone at random places in my house and have to find it and 'wake it up' so that it connects to the wifi and I can use Whatsapp web.

no gif upload support

It is possible to do so, using third party applications. I've done it with the help of a friend, although it required using paid Windows apps that looked like there was no way they could possibly be legitimate and not a scam - they worked like a charm. the process involved an application downgrade, forcing the iPhone to make local backup instead of backing up to the cloud and a handful other things, all of which where automated.

they are not just cosmetic..

* no search (big one for me)

* no web client ( another big one)

* app gets stuck in "retrieving message..." if there is a poor signal like travelling under a tunnel

and there are many cosmetic ones like the ones you pointed out.

Note that the horse a buggy was wildly popular before the car came along, so as this follows Tesla would be find starting a horse and buggy company. I'm a bit exaggerated in my sarcasm here to really illustrate how arrogant it is to assume that features you don't value are 'cosmetic blemishes' when they really do fundamentally hinder the adoption of the product. While you may value security as a priority that overcomes all others, but most by network effect influence, do not. And if you really care about security, it follows that the 'cosmetics' matter as well.

You’re right and I agree with you, but as to point 1, they don’t really act like a proper open source project and it seems more like a “source dump” than anything. It’s hard to compile on your own and they don’t like forks connecting to official servers either.

> A 500 billion dollar corporation will always be able to beat nonprofits on usability.

You'd think. And this is often true, but not always. I am frequently surprised by how bad applications from major companies can be when it comes to usability.

Currently the answer is a definite no, but that may change in future.

In this Telegram made many nice choices. It can be end-to-end secure but it is also a viable Whatsapp alternative.

Sticker, channels, bots and supergroups are essential to attract communities.

>inverse relationship to usability and security

Not necessarily. You can easily have all kinds of shitty usability without it having anything to do with security.

Just a few things:

- Signal is a lot less "polished" - FB has spent tons more resources on making a slick streamlined easy to use interface. Even though signal looks similar its missing all the little things.

- there is no easy to use backup. Whatsapp can backup to google drive or icloud and restore it on another phone. Signal you have to figure out how to deal with and transfer your backup file[1]. This isn't easy for regular folks, Signal needs to be able to connect to cloud storage (preferably of your choice).

- Whatsapp deals with and displays media better/faster

- calling works better. last time I checked whatsapp has easy group video and audio calls, Signal had neither.

There is actually lots more. I prefer the idea of using Signal over whatsapp, but I found it not close enough yet. Especially for non-techy ppl.

[1]: https://support.signal.org/hc/en-us/articles/360007059752-Ba...

It feels much worse to use than both Telegram or WhatsApp, both on Android and on OSX. I had installed it on iOS and Android and uninstalled within 10 minutes of trying to use it. That is how bad my user experience was.

My main complain is that whenever I start the desktop client after few days, it takes forever to load the old messages. I'm not sure, but I think it tries to download all messages and attachments before showing the UI, which can be potentially made faster by first trying to get the messages from person I'm trying to talk to and downloading attachments after text messages (Not sure about implication to security protocol here).

I had issues with lag and dropped packets when I was calling from Europe to South America with Signal about 6 months ago. I was really cheering for Signal (still am) and had suggested we try it, but it failed quite quickly. We moved the call back to WhatsApp within a minute or two, and had no problems whatsoever. So at least in my mind WhatsApp is still much more reliable.

It has almost none of my contacts on them. Pretty useless as a messenger as such.

A lot of the issues can't be solved without relying on an authoritative 3rd party (which is what facebook, whatsapp, skype, etc do). For example, because all messages are p2p, you can't view conversation history that isn't stored locally or sent by the other party upon request (which may not include deleted messages, etc).