WhatsApp alternatives that respect privacy | Hacker News Reader

WhatsApp alternatives that respect privacy

protonmail.com

I’m still hoping that Element (of the Matrix network) would gain more users and become as popular as email is, with several providers around the world that make it easy to sign up and use.

Funding for the infrastructure and running costs is going to be an issue for all these platforms. Only donations and grants seem to be viable to some extent (and maybe ads again), not payments or subscriptions from end users.

I think we need different app/server as matrix servers depend on one software ig., matrix engine. Imagine if theres vulnerability it will affect all matrix servers.

While synapse is the main reference implementation, there is also dendrite (getting very close) and at least 4 other actively developed Matrix homeserver implementations.

Matrix is a protocol, so there can be multiple Matrix home server implementations.

There's already three: Synapse (python, main implementation with full support), Dendrite (golang, beta level feature support), and Construct (C++, alpha/beta feature support, fully third party).

There's also a Rust homeserver called Conduit (https://conduit.rs)

It's odd that they recommend Signal, when their own chart shows that Element is the superior option.

I would also recommend Signal over Element to everybody who is not a full blown techie (so most people I interact with in my daily life).

This is because Element has some needlessly rough edges that even I as a battle-worn programmer/media tech person had a hard time with. Until this improves I cannot recommend it to friends unless I want to become "the guy that always recommends stuff that is impossible for normal people to understand".

You struggled to make a user name and password? Did someone help you sign up to HN?

Forgive me if I am doubtful.

I would recommend signal simply because Element’s UX/UI and branding (which is more important than tech people usually admit) is bad.

I’ve had the element app on my iPhone sitting unused for a long time, and sometimes I scroll by it and forget what it is. When I launch it, the first thing I see is a loading spinner thing on top of my chat rooms and contacts. What is it loading? I don’t know, and I probably don’t care enough to want to wait for it.

Element is superior to Signal in technical aspects, but crappy in the parts that matter most for a social/chat application. Luckily, Signal is a decent alternative.

As you say, Element is superior technically and in my experience has a better UX/UI (simple sign up, no need for phone numbers, and straightforward chat app).

I don't recommend Signal due to the, as you say, inferior technical aspects, the phone number dependency security issues, and the centralized single point of failure (recall the huge, day long outage they had a few weeks ago)

I use Element as my primary chat application, across platforms like iOS, web and android, and I've never seen it load. I use it with friends, colleagues and with my 73 year old mum.

Bonus points because it's in F-Droid, too!

Basically, it's just great, in my opinion!

It loads when you are in a large number of rooms and it has to pull and decrypt large amounts of backlog. But its really not that long.

You are really great at just assuming things it seems. Not so great at plain old reading tho.

1. You have no idea what my problems were (because I never said so), yet you still assumed I am stupid — something that tells more about you than about me.

2. I never said I didn't manage to use it. I said I cannot recommend it to my friends yet. In fact I use Element daily, which makes me confident in the judgment I communicated here.

All in all you probably should form the habit of pausing for a moment before hitting the post button, let the emotions cool down and wonder whether you really understood the other person right or whether you fell victim to what you wanted to see.

Hey, I'd like to apologize for the tone that I took to your reply. I'm sorry. I hope I didn't cause you much grief.

No worries I am pretty stoic when it comes to such things, great to see you made the best of it. Gives me a little hope for humanity and it's experiment with the internet : )

Is it? Alternatives that the average person can adopt might be ranked in a different order.

Protons customer base is likely people who want to be more secure.

...but are not techie enough to want to set up PGP themselves. Therefore usability should be a concern.

Signal is the most similar to Whatsapp and easily the best alternative if you mostly just care about not replacing Facebook by a more trustworthy party.

Element provides better privacy in theory but to get most out of it you'll need to set up your own server, which isn't for everyone. Otherwise it's really more of a question whether you trust the Signal foundation or any of the public Matrix instances.

> to get most out of it you'll need to set up your own server, which isn't for everyone.

This also destroys Don't Stand Out. Conspirators using Signal to plan don't stand out from people talking about their Buffy re-watch party, discussing what sort of fast food to order, complaining about their jobs... it's all just encrypted flows to and from Signal's servers. Whereas once you deploy your super secret server for a federated service you actually just flag all the users of that server for attention.

I don't think that's entirely a dealbreaker. If all you want is a completely private homeserver then you can set one up and disable federation and if you want to not stand out then you can use the matrix.org homeserver and set up private chats on that.

The reason people recommend a private homeserver is that Matrix will end up knowing a bunch of metadata, so the thinking is we'll put the server on this Raspberry Pi in my spare room, now the Secret Police can't get it.

With the Signal protocol this isn't a thing. Where metadata has to live on Signal's servers (e.g. "new-style" groups where you can have moderators) it's encrypted and the servers can do operations on the metadata without understanding what it means in a human sense. They go to considerable lengths to ensure they have no idea who their users are, who they talk to, or what about.

With Matrix you have to choose, Stand Out by setting up the private server which may attract problems, or Don't Stand Out but give away your metadata to the big public servers and assume the Secret Police have it.

I dont get this "its based in Switzerland so its secure" thing..

https://en.m.wikipedia.org/wiki/Crypto_AG

I hate how the plot reveals itself after only 2 or 3 sentences on the wikipedia article.

The real problem is almost nobody cares and those who care, might end up giving up.

A messaging app is not like a personal app that you use on your own. Its value is not only in the software itself but also in the number of users. It took Telegram years to get 500 million users. Now people are being told, "switch to this other app, it's better", "look how many alternatives". How long would it take Signal to be an alternative to Telegram user-wise? And once they get there, some problem will pop up and then what? Do we migrate to a new app and wait 10 years to have almost all our friends there?

It's pretty straight forward to have both Whatsapp and [alternative messaging app] installed on your phone. You still have an SMS app on your phone, which was the primary messaging application prior to Whatsapp. A lot of people migrated to Whatsapp because it was more secure and private than SMS. Now that advantage is being questioned, I think it's logical to see a migration to something more secure or private.

Most people migrated to WhatsApp because it was free, not because it was more secure and private, for a long time it wasn't: https://en.wikipedia.org/wiki/Reception_and_criticism_of_Wha...

"A lot of people" is a bit different to "most people". SMS is free in the same sense that Whatsapp is free and you need a phone contract to use either when you're not in a wifi network. In fact there was a period where adding 3G to your phone contract was noticeably more expensive.

Regardless, my point is that there is a logical path that some people will take to move to more private options. I'm doing exactly what I described in my comment, a bunch of my friends are doing it and I don't think we're that exceptional.

I remember people installing WhatsApp because it was the easiest inter device chat other than sms. It was BBM for the masses.

I don't think many people migrated to Whatsapp because it's more secure and private than SMS. I think people migrated because it was free and it had better functionality than SMS. If they did migrate because of privacy and sercurity, how come they don't migrate to apps with better privacy right now?

> how come they don't migrate to apps with better privacy right now?

They are. https://twitter.com/signalapp/status/1349577579091566592

People migrated to whatsapp because you could talk for free over your internet connection at home. At least in poorer countries.

With that approach, people will end up with 5 messaging apps installed because the friend circles don't perfectly overlap with their app selection.

Isn't this already normal?

How is the inherently bad? With most people having phones as powerful as computers, there aren't any technical limitations to this.

My phone may be able to handle running a thousand messaging apps at once, but my brain can handle at most one or two before it melts from the sheer ridiculousness of having to deal with the different user interfaces, privacy policies, compatibility issues, etc. of a zillion companies just for something so bizarrely simple as sending a message to a friend.

Yeh I think having 5 messaging apps on your phone is fairly normal already.

Everyone used to have only 1 email address. Nowadays, most people have multiple email addresses for different use cases (work, spam, personal). I think this will be the norm for messaging apps as well.

If you have only five you are already lucky.

The solution is to use interoperable messengers, like Element which works with all other matrix servers and clients.

People care so little that I've had to disable the "X is now on Signal" notifications because dozens of people I used to know (school, uni, hobbies) who aren't on the tech spectrum have been installing it.

It's quite sad that Wire never made it mainstream and then was sold to a third party that isn't as trustworthy. They had great UX/UI both on mobile and on desktop early on. Used the same signal double ratchet and were originally owned by a Swiss entity. A real shame they didn't get the momentum they needed.

Wire is good because it syncs conversations across devices and allows one to sign up without a phone number. But its sluggish client apps (especially on desktop, where I guess it’s an Electron app) have been a bane for a long time.

Why is signing up with a mobile number an issue? Where I live, you can buy cards freely l, so I could just use a throwaway card to sign up, and use it only when I need to sign in/restore account.

Now imagine if you could do that without having to “use a throwaway card to sign up, and use it only when I need to sign in/restore account”

In most countries (eg Europe, US, Brazil, China, etc.) it's not the case and you have to give your ID (or some sort of identifier linked to your real identity) to get a SIM card or any internet service

There's also Session, which runs their own p2p network of onion routers as a part of their blockchain initiative [1].

Status is another, which runs p2p waku nodes and is heavily connected to Ethereum [2].

Neither of them requires a phone number, plus both are open-source and p2p.

[1] https://getsession.org/

[2] https://status.im/

I'm confused, it says that Threema costs $3/month, but as far as I can tell it's a one-time $3 cost on the apple app store. Am I missing something?

Threema is free after you purchase the app unless you are using the business services.

Ya I noticed that too and I think it's a mistake. It's a one off purchase for non business use at least.

It also says that telegram is hosted on AWS, which is false. telegram has their own network with 4 ASNs.

https://bgp.he.net/search?search[search]=telegram

It does not.

It does not what? From the article:

> Cons - Hosted on Amazon Web Services (AWS)

That is on the Signal segment, not on the Telegram segment.

If it doesn't inter-operate, it's not really an alternative.

Chrome, Firefox, Edge are all alternative web browsers, you can drop-in replace them when visiting websites. But none of these can be drop-in replaced when talking with your friends who are using WhatsApp.

WhatsApp is the de-facto messaging standard throughout South America, Africa, and half of Europe. That's a lot of inertia to overcome.

Matrix fits the bill. It's federated - you can have rooms and conversations across homservers seamlessly today. There are several implementations for both server and client.

It's still a way to go to be 100% though; for example portable identities - right now your user account is tied to a specific homeserver, yours or somebody elses. And first class tor (or i2p?) support with enough federation over either. Performance of synapse and elemnt, spoecifically, are also pretty poor.

I really think it's on the right track though - all my reservations for matrix in its current state have been recognized by the maintainers and are on the roadmap.

That's what I thought as a european in the beginning of this year.

But in a matter of weeks, all of my closest friends and family members downloaded Signal. I was able to convert some people by myself by just deleting my WhatsApp account.

Last year I had a phase where I wanted to ungoogle/uncloud my life. I never thought that I would be able to delete WhatsApp for the same reasons you mentioned. Turns out, most people don't really care about installing another messenger, if they do, I just write them via SMS.

I now chat 90% on Signal, the other 10% are split between Threema, Telegram, SMS and Discord.

One thing that might be hard to overcome here in SA (Peru) is that many providers seem to have data caps, but will provide whatsapp (and facebook) access for “free”, even if you are out of data (the services seem to still work exclusively). I’m not sure what deal was made (or if the providers are doing this out of the goodness of their hearts..?)- but the same would probably need to happen before you see a migration.

There is also:

  - Jami (https://jami.net/)
  - Briar (https://briarproject.org/)

Genuine question because I can't think of a good answer - why is iMessage (Apple's messaging service) not on the list. It looks like it would have a good few green ticks on the chart.

Because the privacy benefits are only present for Apple users, for others it's just SMS.

Ah yes of course, they need to release a Windows and Android app. How very apple-centric of me. Sorry about that.

Most of the other apps are available on multiple platforms. I'm not saying that Apple is bad or wrong for only developing iMessage for iPhones, but it explains why no one mentions it when they discuss messaging apps for EVERYONE.

Apple may have a huge market share in the US, worldwide they "only" account for roughly 27% of the devices, compared to Android with around 70%.

Maybe try to think for yourself why the article wouldn't mention it, instead of writing such a snarky response towards me. Cheers.

It shocks me that non-open-source or non-e2e-encrypted options are included in this list.

Listing Telegram (effectively not encrypted) in a list next to Signal/Threema makes no sense to me.

TBH Telegram makes the right kind of tradeoffs for me - I like having cloud based chat sync between devices way more than I care about someone reading my shopping discussions with my wife or my friend group chats.

And then if I need to make something private I can start a private chat.

And the interface is easy to sell to non-techies, especially compared to Signal.

This is all in theory anyway - it's entirely possible that Telegram sends everything to some government entity somewhere even for private chats - but frankly I don't care that much so I'll trust the claims and audits.

> And the interface is easy to sell to non-techies, especially compared to Signal.

Could you elaborate on this? I personally find that Signal's interface couldn't be simpler, and have on-boarded hundreds of "non-techies" without support or explanation beyond "download an app called Signal and message me on the same number, but on there".

> TBH Telegram makes the right kind of tradeoffs for me

Given those tradeoffs, Facebook Messenger or Whatsapp is probably a way better choice than Telegram.

>Could you elaborate on this? I personally find that Signal's interface couldn't be simpler, and have on-boarded hundreds of "non-techies" without support or explanation beyond "download an app called Signal and message me on the same number, but on there".

Telegram feels more polished and distinct, for example it has very nice animated emojis. Signal looks like programmer art and a random system SMS app - it's hard to convince people to use it, I started using Telegram with my wife just for the animojis and stuck with it because of a nice desktop app. I got my entire family and some friends on it eventually.

>Given those tradeoffs, Facebook Messenger or Whatsapp is probably a way better choice than Telegram.

I actually like Telegram as a chat app more than those two - Messenger is bloated garbage tied into Facebook which is another bloated garbage platform so I avoid those if I can.

WhatsApp doesn't do cloud sync well actually, my phone needs to be active for webapp to work and when I switched from iPhone to Android and back I would lose history between the two.

I would say non-techies won't even notice the difference between WA, Telegram or Signal. I'm not sure which differences you mean. PS: oops I found a difference: in Signal you need about 7 clicks to send a local picture.

>it's entirely possible that Telegram sends everything to some government entity somewhere even for private chats

No, private chats use end-to-end encryption, and unlike WhatsApp the Telegram client is open source so this can actually be verified.

Unless I spend time to look into who verified it and decide if I trust them - this doesn't mean much - for eg. the article above claims their crypto is criticised - since it's their own implementation it could be intentionally weakened for all I know, even with a review it's possible to sneak by a backdoor vulnerability - security projects with a lot more users had major flaws discovered well into the project lifetime (eg. OpenSSL heartbleed).

Telegram private chats are not end-to-end encrypted. They are opt-in, in the name of "secret chats". If that's not done, chats are stored on their cloud in plain view. While Signal can offer synced end-to-end encrypted messaging, I wonder why Telegram cannot. Probably comes with a few tradeoffs like slowness and loss of features?

I used to like Telegram for their cloud sync as well, but Signal does an equally nice job (at least for me!) in syncing my chats across all devices. The messages are end-to-end encrypted too, unlike Telegram. It has become the standard for me.

I wish the comparison could also include "message sync across devices". Currently Signal requires one to export past messages in a file (that can be unencrypted). This means that to be sure to keep their messages if they use new devices or lose their old one, one has to use a cloud storage, an area where privacy violating providers are still prevalent.

Note that WhatsApp was doing exactly that (with an opt in IIRC) with google drive sync on android and I guess iCloud on iOS, so I always found even their e2ee claim dubious.

At least Signal doesn't make it easy to use unencrypted cloud storage but I wish to see more services with message persistance. On the other hand, it certainly has a much higher server cost.

This never ending attempt to affect systems by ignoring systems and changing individual behaviour instead has always struck me as a fool's errand.

Nevertheless, I predict it'll continue, perhaps until the end of time.

Whatever happened to Tox project?

I find it odd the only accusation they list against Whatsapp is it was sending metadata, then list a group of alternatives who largely use the same metadata.

I understand the hate for Facebook and why people are obviously skeptical. But is there something more I'm missing here around what whatsapp/facebook are accused of? It seems like it was just timestamps and public profile information.

As far as I can tell, Element does _not_ actually support E2EE group video, or any kind of group video at all? At most, you can install a Jitsi plugin? Also, even though Matrix is technically superior, Element the defacto client is so buggy and full of UX issues that it's nowhere near as user-friendly as Signal, especially to e.g. my mother.

I wish more people knew about DeltaChat. It has WhatsApp's UI, but the transport is email.

They make slow progress towards greatness.

Delta chat now supports some group chats, but it still has ux challenges explaining that you just login with your email address on the app and that you are not giving a server somewhere your email login credentials.

They are also still working on multi account logins and per conversation outbound email aliases, but I'm watching them very closely because like you I wish more people would use this.

> Delta chat now supports some group chats, but it still has ux challenges explaining that you just login with your email address on the app and that you are not giving a server somewhere your email login credentials.

Yes, I've encountered precisely this with some of my friends.

a couple more alternatives:

https://mega.io/

https://tox.chat/

Mega has a chat, phone and video calls

Tox is actually quite decentralized (I think you cannot be more decentralized than p2p), but has many inconveniences of not being cloud based

EDIT: readability

> Cons: Requires a valid phone number to register, Hosted on Amazon Web Services (AWS)

I like how using AWS is a con. They should be avoided after their deplatforming of Parler. Cant be trusted

Court documents show FBI may have tool to access private Signal messages on locked iPhones

https://www.foxbusiness.com/technology/fbi-tool-access-priva...

I don't think most users expect their chat app to be protected if the police seize their phone.

The main concern is about intercepting messages between 2 parties or mass exploiting the history stored by the provider.

Sure, for some case, it can be important, but that's a much more difficult and rare threat model to address.

>The court documents, filed by the Justice Department and obtained by Forbes, showed screenshots of Signal messages between men allegedly discussing an illegal weapons trade and attempted murder.

I translate that to 'an FBI informant involved in the criminal conspiracy saved screenshots of the messages'

This title in this article is aimed at generating clicks. The flaw that's described here applies to all other apps, including Google Chrome, Telegram, WhatsApp, literally any app on your phone.

Probably not offline stuff like encrypted mail. That tends to be protected separately from the phone stuff.

Reply on news.ycombinator.com