Hacker News Reader

Comment by arximboldi | Hacker News Reader

As someone that does not have a smartphone, WhatsApp and Signal are really annoying because they are the two apps that can not be used without one (even though they have desktop apps). Telegram and FB Messenger and Hangouts at least can, but here in Europe WhatsApp is the default for everything and there are things for which it is becoming almost completely necessary.

But I simply find the whole chat ecosystem so depressing. A few years ago at least I could chat with Google Talk people via Jabber. It is really absurd that instant messaging is not federated like email. Of course there is one explanation: while Email was invented in the 70s at research institutions with goals beyond profit, IM already started in the 90s with companies trying to capitalize their user-base with vendor lock-in... (ICQ, MSN, etc.). Sad, sad, sad.

View on HN

Matrix[1] is trying to solve that issue, I'd highly recommend looking into it. I actually pipe most of my various "chat" networks (including WhatsApp) into it via bridges[2].

As you said, we in Europe are kind of forced to have WA installed, but at least you don't have to use it as your primary client if you don't want to. You can even deploy it to an Android VM and go completely headless, if you feel the need.

[1] https://matrix.org/

[2] https://matrix.org/bridges/

> As you said, we in Europe are kind of forced to have WA installed, but at least you don't have to use it as your primary client if you don't want to.

Haven't used WhatsApp for months and then only for a few days to talk to someone from US.

My friends were heavy WhatsApp users but we changed one group after another to Telegram after WhatsApp were brought.

Telegram is far from perfect though so I hope to move to Matrix within a few months.

I'm stepping out of my domain knowledge on this one to start a discussion, I hope to have my points corrected where I'm wrong. Another note, I'm not advocating for FB's methods I'm strictly interested in some cryptography aspects.

As I understand it, in order to have real end-to-end encryption (the real stuff, not some marketing term) each device has to generate a long set of keys and with each message sent, they cycle through to the next key. If WhatsApp is doing what it reports it's doing and it actually is end-to-end encrypted then the web application needs to use your phone because it needs that set of keys. I'm not sure if it specifically sends through your phone or if it sends via the webapp, but you have to use the keys in the correct order or the device you're contacting won't be able to decrypt the next message.

Yes, WhatsApp is doing encryption that is E2E between two devices. That's a good security model.

There's no particular reason that that has to be two phones though - could be desktop, wifi tablet etc.. That limitation is a result of a 'product' decision where your identity on WhatsApp is a mobile phone number. That decision was a big part of what allowed WhatsApp to scale quickly (people didn't need to create an account, just install the app and start messaging people whose numbers they had).

Exactly to the point: They can implement E2E encryption in-browser, on dedicated desktop apps, with supported routers, and basically anywhere. Even $5 microcontrollers can generate and use the same encryption protocol.

But they don't because modern phones have (semi-)secure enclaves that can hold encryption keys and protect them from most hacking attempts. Desktops and browsers lack this, so any conversation you have via these other platforms in the computing environments of 99.999% of the population (please spare me the 'I use qubes, so ha!' speech) has a much lower level of security/privacy. Since most people want conversation sync among the desktop and mobile versions this means your security drops to become the lowest common denominator among all platforms.

It can be done, but it shouldn't be done if you actually care about security or privacy.

There are valid arguments on all sides of this:

- That desktop browsers can be less secure

- That software can work around that

- That mobile can be more secure

- That mobile can also be false security as "0 days" are currently in the wild and mobile phones are typically always online

- Etc.

If you truly want security, there's a really compelling argument for live-booting a distro like https://tails.boum.org/ and then rebooting when you're done. On the other side there are compelling phones such as the Libre 5 (assuming there are no current 0 days).

Tails and purism phones are the same 'I run qubes' fantasy that I expressly ignored. No one uses these, and they are not going to ever use those systems. There are fewer 0-days and CVEs in the mobile environment and for at least the next five years or so the mobile environment will always be more secure than desktops. Right now the single biggest step any 'normal' person can take to secure their digital life is to throw out their desktop and live completely on mobile devices and consoles for gaming.

Unless you're buying a new flagship every 2 years you're probably not meaningfully more secure than you would be on a desktop. And buying a new flagship every two years is probably less realistic for most people than running purism or Tails. Those at least only will cost you time.

An additional product decision would be that I will assume headaches are caused if a user starts on desktop and then decides to move to mobile (Your PC must be on in order to use this mobile app!).

The real solution here is to generate a second key for (or securely transmit the original key to) the mobile device. Now the PC needs to be on to set up the second device. Once online they are completely independent.

However whatsapp currently assumes that each user has one (primary) device and only handles encryption and delivery to one device. It isn't impossible to fix (example Matrix) but it does require effort and slightly more server resources (you need to store messages for longer on average)

They could allow you to login without a smartphone using a SMS confirmation code, as many other services do. But I guess they consider dumbphone users with computers too much of a niche.

Everyone who uses WhatsApp has to have a phone. And so they can still receive and send SMS. That’s what I (in Germany) use for people who insist on using mobile-text communication.

Yes, same (also in Germany). I survive, can't complain too much, I prefer the advantages of not having a smartphone. But for example my neighbours have organized a WhatsApp group, which is nice, for stuff that goes on in the building and helping eachother out. There are lots of examples like that (parents groups at school, etc.) Another thing I'm noticing is that SMS is becoming less and less reliable, sometimes the messages not reaching the other part, particularly when changing country codes...

Can’t talk about unreliability, never had a problem with that. But for neighbors, a lot of people here (on average older and left-leaning) are on nebenan.de which is a nextdoor.com copycat. Unlike whatsapp it actually works on computers :)

Yes, I really like nebenan.de, and I have a monthly donation subscription :)

> It is really absurd that instant messaging is not federated like email.

The joke is that it used to be. FB Messanger and Google Chat had XMPP hooks so you could talk to whatever other platform, Slack used to have an IRC integration, MSN/AIM/ICQ never tried too hard to get stop reverse-engineers from putting their protocols into all-in-one messengers... Then businesses realized the value of locking in users and becoming walled gardens.

As far as I know, Facebook Messenger's XMPP support was only exposed to clients (c2s), not to other XMPP servers (s2s). Microsoft's Lync (now known as Skype for Business) supported XMPP federation until 2019. WhatsApp's client protocol was originally based on XMPP. I'm reasonably sure that both AIM and Yahoo had XMPP server-to-server support ready around 2008, but can offer no proof.

Reply on news.ycombinator.com