Hacker News Reader

Comment by arianvanp | Hacker News Reader

The fact that content sent to signal and Whatsapp resides unencrypted at the matrix homeserver makes this product completely useless to me.

I don't think I want to sacrifice the security for having all my chats in one place.

If they can fix that I might reconsider.

They already reverse engineered the Whatsapp protocol. I see little reason why it can't live in the client? I don't really follow why they move the bridge to the homeserver.

View on HN

> They already reverse engineered the Whatsapp protocol. I see little reason why it can't live in the client ?

Because Whatsapp crushes any client other than their official client. Everyone else is confined to scraping Whatsapp Web.

At least it's better than getting zero-clicked.

> They already reverse engineered the Whatsapp protocol. I see little reason why it can't live in the client? I don't really follow why they move the bridge to the homeserver.

Matrix bridges are rather complex. They rely on a combination of private APIs (WhatsApp), Chrome extension scraping (LINE), bots (Telegram), mobile clients (Android SMS), and jailbroken iPhones (iMessage).

This is all very interesting from a technological perspective but it sounds incredible brittle. Do I break any terms with these 3rd parties by paying Matrix to scrape them?

I've been using Beeper.com for a while and it's surprisingly stable despite how brittle one would expect these bridges to be.

Given that puppeteering should be indistinguishable from real application usage and that $5/month/user should be more than enough to diversify IP addresses, I suspect the model can actually be sustainable in the long term.

I'm kind of curious how Beeper will handle some of these - they claim to soon support WeChat, and emulating WeChat is a bit insane, because it collects so much data that it's a walking GDPR violation, there's no way to stop it, and we are talking things like "please repeat the numbers in chinese, then english, while looking straight into your phone" at login.

Uff, that sounds insane. I suppose they released those "features" gradually and people just went along.

It's a Chinese chat app (that is also used for payments, thus linked to bank accounts). Getting an account more or less requires ID or similar. They go to extraordinary lengths, similar to Tiktok, to block automation, bot accounts, etc.

No one knows about detection or enforcement, but almost certainly yes.

WhatsApp's backups are already stored unencrypted* on Google Drive if you use that feature.

* Encrypted with a private key which Google have access to.

So the encryption is there so that you can't access your own data (and migrate to a competing app/service), rather than to protect your privacy. I kind of ran into this issue myself when I was helping a family member move to iPhone. Since Whatsapp uses Drive on Android and iCloud on iOS, there was no way to transfer the data.

I wonder if you can get them via one of those data access requests?

Data does not _reside_ unencrypted with End to Bridge Encryption : https://docs.mau.fi/bridges/general/end-to-bridge-encryption...

But the bridge is not hosted by me but by them. I need to trust matrix not to MITM me

Yes, in the same way that you need to trust Whatsapp not to MITM you. What's your perceived difference between these trust levels, other than one is something you pay for with money, and the other doesn't require money?

The Signal protocol (which WhatsApp still uses, I presume) is very good. WhatsApp can't MITM it.

Element, on the other hand, is MITM by design.

THIS "in the same way that you need to trust Whatsapp not to MITM"

And on top of that Google or Apple or whoever you "trust" with your mobile operating system of choice.

Speaking of mobile OS, Element will likely run fine on mobile Linux whereas you can be sure Whatsapp will never release a Linux client

they haven't, they simply host a VM with Whatsapp and connect to it via Whatsapp Web

Why don't you encrypt your hard drive?

What problem do you feel this would solve?

I don't follow. What does my hard drive have to do with plaintext messages on Element's servers?

As far as I can tell, the messages don't live in plaintext on Element's servers - they are bridged in plaintext to Matrix, which is end to end encrypted.

Aj, my bad. I skimmed over the part where it says they are hosting the bridge for you. Since matrix is focused on privacy etc I assumed this is available as a container/VM I can run at home or on a VPS.

Indeed then very weird why I should trust them more with my personal data than anybody else.

> Since matrix is focused on privacy etc I assumed this is available as a container/VM I can run at home or on a VPS.

All bridges, and the matrix homeserver itself have been open source and self-hostable for years. I host a homeserver + some bridges myself.

This is just the sugar-coated SaaS for people who dont want to do it themselves.

> Since matrix is focused on privacy etc I assumed this is available as a container/VM I can run at home or on a VPS.

It is! https://matrix.org/bridges/

Reply on news.ycombinator.com