Hacker News Reader

Comment by est31 | Hacker News Reader

This is really big news. I use Threema because it is the only messenger out there that is:

a) always end to end encrypted (unlike Telegram)

b) supports account creation without any phone number (unlike Signal)

c) supports phones without google messaging service (unlike Signal, it formally supports it as well but in reality it's just a big battery drain)

It not being open source was always a bit sad for me, because most of the other apps on my phone are open source.

I'm curious about the multi device sync. I hope that it will be implemented in a way that doesn't use passwords but pair syncing. This is bad from a usability perspective (firefox abandoned it because of usability), but the only way I'm aware of how syncing can be made secure.

View on HN

Out of curiosity what does Threema do that Element[1] (née Riot.im) doesn't? It seems to tick those boxes, but admittedly is still in quite active development and may not be as polished.

[1]https://element.io/

It's more a question of "what does does Element do that Threema doesn't"?

Element is a Matrix client, so you connect to the global open Matrix decentralised network, rather than just closed-source servers run by a (newly-sold) company like Threema. Typical Matrix implementations are entirely Apache licensed open source, so you get full control and visibility both clientside and serverside. Matrix also already provides synchronised multi-device conversations, as well as more advanced cross-signing verification for E2EE key validation than Threema. Finally, Matrix is an open standard protocol maintained by the non-profit Matrix.org Foundation, that anyone can contribute to via the open governance process (https://matrix.org/foundation, https://matrix.org/docs/spec/proposals etc) - the Matrix standard gives developers full freedom to write their own clients/servers/bots/bridges/whatever.

Personally I'd say that Element & Threema have similar levels of UX polish these days (but I'm biased, working on Element). It's perhaps true that Threema's relatively limited featureset means that polish is easier to achieve.

I kinda forced a friend of mine into using element/riot. He mostly complained about the lack of "polish" (which I also feel, and I'm a rather "frugal" user). He proposed Threema as an alternative, so I guess that the polish is quite the missing box.

The box I'm missing in Threema (unless I'm wrong of course) is the "not centralized" one. If for some reason (and admittedly, there aren't many realistic ones), Threema's servers/organisation are corrupted, the whole networks falls, right?

Element is significantly worse. Threema feels polished and actually works, meanwhile Element's UX is so obviously designed by security engineers that it's incomprehensible and useless.

There are still major, glaring and game-breaking bugs and UX quirks in Element even after a full frontend rewrite (that, by the way, made security UX significantly worse).

It did these things years before Riot did for starters. It does less, but well-polished IMHO.

Right you are. I like to think that I'm fairly knowledgeable in this space, but Threema totally passed me by. Maybe it's more popular in german speaking communities (or I'm just more than I thought)?

Threema is a pay-to-play client on the App stores ($3 USD on Google Play, €4 on the Apple store), inhibiting it's adoption when the playing field is full of free clients. The inability to try-before-buy (regardless of technical merit) turns away casual users who might give it a shot "just because", myself included. (Theory: the world has been burnt a thousand times over by shitty ad-infested mobile apps and no longer trusts buying before trying. I sure don't.)

And of course, the world has been burned by shitty ad-infested apps because nobody wants to pay for apps... (not that I necessarily disagree with you - I only got Threema because of a trustworthy recommendation)

nod I have had others tell me Threema is good, but it's a "walled garden" until now; Signal has won over hearts and minds by being FOSS and having no cost-based barrier to entry even for casual users. As a FOSS advocate I went with Whisper from the start and recommend Signal to everyone (with a fairly high take rate, non tech worker friends and neighbors) with a simple text link to install and saying something like "it's free and encrypted so nobody can see us talk." (KISS explanation)

(this is a US-centric comment, as phone numbers are rather static here; unlike other countries, not having a number isn't really how it works for most people on the big 4 carriers and their secondary MVNOs)

The world has also been burned by paying for apps that turn out to be actually shitty and-or ad-infested.

48hour refunds on google play should have addressed this conundrum but it seems people just aren't aware of it :(

You can get a refund if you go to the play store and use the refund mechanism within a timeframe.

Technically true and only easy if done within the first 2 hours, after that it's cumbersome (requires a desktop browser to go into order history). I will posit that it takes longer than 48 hours to decide if you want to continue using a chat/messaging app - the dynamics require multiple live humans to interact on their timescales, it's not just playing a game or whatnot on your own.

Yeah, my German-speaking + privacy-minded friends usually have it. I would estimate I can reach about 30% of my German contacts on Threema (if they have any IM at all).

But there's not a single non-German contact on there.

Matrix is more of a chat protocol than a messaging app. I signed up once and had to agree to rules of behaviour and stuff like that. Threema is also more likely to be present on other people's phones.

> I use Threema because it is the only messenger out there that is:

> a) always end to end encrypted (unlike Telegram)

> b) supports account creation without any phone number (unlike Signal)

Wire (wire.com) has had these for a long time with multi-device sync and also being open source.

From what I saw, it doesn't meet c) though?

https://github.com/wireapp/wire-android/issues/1903

Looks like it does. On Android it has entry in menu "Maintaint connection to server" which creates persistent notification. Notifications worked on my un-googled phone.

I've had never problems with any battery drain with Signal on phone without gapps

much more annoying it's unreliable message delivery especially when your switch frequently between wifi and Mobile data, there are some other issues, but they killed it for me with PIN code nag

Are they opening up their servers as well? If I can not self host it may be as well as closed.

If the client app is open source and the messaging is end-to-end encrypted, I would say it's a lot better than being completely closed. The encryption, which you should now be able to verify, means you don't have to trust the server with your message data.

Though, sure, it would be better for the server software to be open source and rehostable too.

IDK for a messaging app it's not that important to me, because the main value it provides is that service itself to which my network is connected.

Also, the hardest part of such apps is the client component, not the server component. If need arises it shouldn't be hard to build one compatible to the clients.

It looks like they're open sourcing the apps only.

Reply on news.ycombinator.com