Hacker News Reader

Comment by NikolaNovak | Hacker News Reader

In fully recognizing that I am a minority case,I am sceptical signal and whatsapp will *ever have a fully untethered protocol with desktop as a first class device. My understanding is that it would require a complete rearchitecture... For no benefit other than to appease a few grouchy nerds :-)

Pity; even though all of my family use whatsapp and are unlikely to move, there's a fascinating look on their face when they first ponder the idea they could've picked up their conversation on their big tablet when at home. It just doesn't occur to them to expect / demand more :-/

View on HN

> I am sceptical signal and whatsapp will *ever have a fully untethered protocol

It sounds like they may want to do this eventually, but it requires some significant re-engineering of how users are identified on the network. This is mentioned near the end of the article:

>That feature might someday even allow Signal to ditch its current system of identifying users based on their phone numbers—a feature that many privacy advocates have criticized, since it forces anyone who wants to be contacted via Signal to hand out a cell phone number, often to strangers. Instead, it could store persistent identities for users securely on its servers. "I’ll just say, this is something we’re thinking about," says Marlinspike. Secure value recovery, he says, "would be the first step in resolving that."

My understanding is that it's not an architecture thing, but an authentication thing: SIM/# as ID is just too practical for both dev and user and they have no plans on changing that.

You're closest hope for a skype replacement that runs equally on all platforms is tox, which requires managing your key.

I don't believe it's "SIM as ID" - I believe it's SIM as complete authentication (i.e. userID+password in traditional systems).

(I have my thoughts on THAT as well, you'll be surprised, when it comes to security... we're nerding out about obtuse and obscure end-to-end encryption, meanwhile, majority of those 2bil users don't have a lock on their phone, and now they also have no protection on their messaging :-/ )

> majority of those 2bil users don't have a lock on their phone, and now they also have no protection on their messaging

They still have in-transit protection due to end-to-end encryption, so no protection isn't necessarily true.

>SIM/# as ID is just too practical for both dev and user

In what way is that practical for a user? Once i've chosen an ID and password for a service I can easily type that in using literally anything that can connect to the service and spew out some characters.

An id linked to a SIM/# is is a real pain in the ass when you need to change your SIM/#, hence why i've got a bunch of old contact numbers for people stored on my phone alongside new ones so I can talk to them on whatsapp or signal and have it show me their name still after they change numbers.

I've also got a bunch of whatsapp contacts that aren't even people I know any more because their numbers no longer belong to them. People who's pictures and updates I can see who I don't recognize or know.

SIM/#'s are ephemeral in a lot of places, I know people that change them fairly regularly, having that linked as some kind of identifier is not good for users.

In what way is that practical for a user?

This is just me making an assertion, so take it for what you will, but the typical user cares a lot more about contact discovery than everything you mentioned, so an authentication system that makes that work more goodly is quite practical for them.

>contact discovery

In both situations I have to have a contact's information already to find them. For a ID/password, you need your contact's ID to find them, for a SIM/# system, you need their phone number, every person I talk to on whatsapp or signal have given me their phone number, or vice versa, so we can communicate through those platforms.

I had some friends that used Kik before, they had to give me their username. These two scenarios are exactly the same, in both cases I still need info from my contact before finding them. Only, an ID is more secure, because it can be used only with one service if you so choose, with a SIM/# you have to give your contact your phone number, allowing them to contact you through any other service you use that number with, whether you like it or not.

I cannot see any benefits of that system for the user that you don't get from a ID/password and some cons that personally, I find unacceptable, such as the afore mentioned, seeing stranger's pictures and info just because they have a number my friend used to have, that's downright creepy and makes me wonder how many people who've saved my number can watch me on whatsapp and see when I'm online or check my profile out.

Even people I do know, I don't necessarily want to see on there, employers, numbers i've saved for looking at places to rent, my ex landlord, clients i've had for work i've done. I don't need or want to have all these people automatically added to every chat program I install they also happen to have.

>typical user

My argument isn't that you are wrong about your wants and needs, it's that you aren't a typical user.

Have you ever asked the average user how they feel about:

>seeing stranger's pictures and info just because they have a number my friend used to have, that's downright creepy and makes me wonder how many people who've saved my number can watch me on whatsapp and see when I'm online or check my profile out.

>Even people I do know, I don't necessarily want to see on there, employers, numbers i've saved for looking at places to rent, my ex landlord, clients i've had for work i've done. I don't need or want to have all these people automatically added to every chat program I install they also happen to have.

I have, it inspired them to clean up their contact list.

> they have no plans on changing that

I think you might be wrong on that, based some of the code changes made to Signal over the last few months. They are internally moving to have users be identified by a UUID and phone number. I suspect they will eliminate the requirement for phone number identifiers when they introduce other identifier options.

Moxie said at his C63C talk that they were planning on getting rid of it as soon as a practical solution was found.

Facebook claim [1] they're working on making Facebook Messenger and Whatsapp interoperable. And obviously messenger works fine in a desktop browser.

[1] https://www.engadget.com/2019/04/30/facebook-will-let-users-...

I'm surprised nobody has mentioned https://web.whatsapp.com/ yet. You need to log in by scanning a QR code with your phone, but once you do, you can use your full-size keyboard to chat!

I know it doesn't check all the boxes for you, but hopefully it can improve your quality of life while talking to your family :)

I mean you can do the same thing with Signal. The issue other commenters have had is that it is fundamentally tethered to a phone still.

See the right side here: https://signal.org/download/

Signal's desktop app does not tether to the phone permanently. After connecting the desktop client, youc can use it fully independent ly from the mobile phone. WhatsApp doesn't allow that.

You cannot create an account or sign up via web app. But let's put that aside.

You can ONLY sign up / register / add one device.

Not "at a time", even. At all.

You use your tablet, your phone disconnects.

You use your computer, your laptop disconnects.

You switch from laptop to desktop a few times, and now it's suspicious and gives you additional difficulties or bans you outright (that may or may not still be the case, but was when I tried this nightmare of an app a year ago or so).

You can only have ONE mobile and ONE computer device, at best, if you're lucky, and stars align, and it's second Tuesday of the month and the moon is full and you sing praises to Garmunklee the demon of impractical communication methods. Trying to access it on work and personal laptop; work and personal phone; or on phone and tablet; all is completely outside the supported use case and is for all intents and purposes impossible.

Compare to old-school ICQ, AIM, any XMPP, or Hangouts or indeed email etc, where you can seamlessly transition communication from device to device - and even check your messages on trusted public or 3rd party device such as friend's computer - and it's like waking up in a twilight zone.

It is pretty much the most architecturally user-hostile system I've encountered in my life, but again - I'm clearly in 2,000,000,000 vs 1 minority here :D

I feel like this is a very long way of saying that in WhatsApp there is a single private key which is stored on the device that you register.

You're not supposed to be switching between devices like that. You're supposed to be proxying your messages through your primary device (i.e. cell phone) using the web interface.

Like the UX is bad for people with two phones and the mobile experience of WhatsApp web is nonexistent so that kinda sucks but "having one phone, and sometimes a tablet/laptop with the web interface" covers a lot of people.

E2E is hard when you have to route messages to multiple devices, aren't storing messages in a central server, and those devices can be unavailable for indeterminate amounts of time and no guarantee that a subset of devices having the complete chat history will ever be on at the same time to sync.

>E2E is hard when you have to route messages to multiple devices, ...

OpenPGP has been dealing with multiple recipients since forever with no back channel even.

> ...aren't storing messages in a central server,...

Who cares if we are doing E2E?

> ...and those devices can be unavailable for indeterminate amounts of time and no guarantee that a subset of devices having the complete chat history will ever be on at the same time to sync.

You only have to store the encrypted messages for each individual client until they connect again. If you are doing perfect forward secrecy then the client has to keep the decryption key around until the next connection so the server stored messages can be decoded. Then the key is destroyed.

Why is it hard? Group chats are E2E (in WA/Signal) and solve this problem.

It's not that far fetched to make every conversation a implicit group conversation with n devices on both sides.

>>You're not supposed to be switching between devices like that.

That's the Apple "You're not supposed to use our device that way" approach, and again, while it works for a huge swath of users and I am completely cognizant I'm in a tiny contrarian minority, it still and nevertheless feels like a hostile user experience.

Note that "Switching devices like that" is ever so tiny a misnomer; I am "Using multiple devices" (not replacing my phones permanently etc, which I get is a more difficult scenario... and one that Whatsapp historically deals with in the most insecure fashion imaginable; until recently their FAQ held explanations that you may get somebody else's messages if you get their phone number; or that if you switch your own phone number you need to email support and wait; it really feels they focused on the E2E encryption, important to tiny proportion of their userbase, over any other security consideration; but again... I get I'm alone in this perception :)

My problems with WhatsApp desktop isn't that I can't use multiple phones, it's the various issues that don't affect Signal desktop. (Can only have one desktop/laptop, no iPadOS, messages randomly won't send/receive if phone is in too deep a sleep mode.)

None of those are problems affecting Signal.

You need an untethered protocol to support chatbots and other applications. And desktop as a first class device falls out of that. And mobile users benefit too, now no longer having to distribute their phone number. I feel that they had started with untethered, then Signal would be a lot father along the road to its goals.

Reply on news.ycombinator.com