Comment by sneak | Hacker News Reader

Comment by sneak | Hacker News Reader

> Messages on Wavelength are completely private and secure, using state of the art end-to-end encryption.

All of the state of the art end-to-end encryption in products I know of is free software.

Much more difficult to verify these claims otherwise.

Furthermore, the app privacy label on the App Store claims that this service collects your contacts. So much for privacy, then.

Any conversation that includes OpenAI's GPT also necessarily can't be "completely private" or end to end encrypted as the service must have a plaintext of the messages to proxy them (in cleartext from their view) to their OpenAI APIs. It also then, you know, uploads your messages to OpenAI.

What's the point of e2ee messaging if the service provider and OpenAI can read it all the moment you loop in the headline feature (GPT in your groupchat)?

Ultimately, threaded e2ee groupchat is a feature (ideally a feature added to Signal), not an app/company.

> Furthermore, the app privacy label on the App Store claims that this service collects your contacts. So much for privacy, then.

FWIW, it’s up to the user whether to allow that. I don’t recall the language the app uses to describe the contact request, it seemed reasonable but I didn’t allow it.

Correct. Sharing contact information is opt-in, and what gets stored on the server is only salted and hashed phone numbers, not even names. It’s just a way to find people on Wavelength whose phone numbers are in your contacts. Also, if you later choose to delete your contacts from Wavelength, everything stored on the server is deleted. The privacy policy makes this clear, I think.

Salting and hashing phone numbers doesn’t do much to obfuscate them because the whole range of phone numbers is brute-forcible. Wavelength (or any attacker who gains access to Wavelength’s database) effectively has all phone numbers users upload. To reverse the hashing, just compute 10 million hashes per valid US area code.

And it’s a tiny amount of work if you just want to know which users have a contact with one specific phone number.

Much better would be to store no contact information at all server-side.

Reply on news.ycombinator.com