Hacker News Reader

Comment by XorNot | Hacker News Reader

A WhatsApp client with OTR would be sweet as well.

Technically there is no reason why it shouldn't have one.

If WhatsApp would just try to make their XMPP costumizations a standardized XMPP extension and enable federation on their service. Finally we have unified Instant Messanging.

dreams again

(btw there's nothing stopping you from adding OTR support to one of the open, reverse engineered, whatsapp clients)

> (btw there's nothing stopping you from adding OTR support to one of the open, reverse engineered, whatsapp clients)

Except, you know, DMCA notices: https://github.com/github/dmca/blob/master/2014-02-12-WhatsA....

Yes, this is complete bullshit. Especially how they try to use a DMCA notice for trademark infringement.

Why? I thought the selling point of this non-federated, proprietary jabber client was it's existing user base which would probably continue to use the official client. So what would be the benefit of an WhatsApp client with OTR?

Egzactly — the reason to use WhatsApp is that you’re pretty much guaranteed that the other side of the conversation sees your emoji, photos, videos and similar. The client-side unity is a feature.

We didn’t grow a standard on that side on our own, so it got done to us.

OTR for mobile chat messaging like WhatsApp was discussed several times. At least the former ones (do not know version 3) did not allow OTR because both clients have to be online for handshaking and exchanging keys which is very often not the case for two mobile phones.

Modified version of OTR (by Moxie) works around that restriction.

https://www.whispersystems.org/blog/asynchronous-security/

Doesn't this solution require trust in the server caching the pre-keys?

No, because you can still verify a user's fingerprint after the handshake has been completed. That's something that you'd want to do with traditional, non-asynchronous OTR as well.

And BTW. There is a solution also with group chat and encrypted (Android and iOS): https://threema.ch . Servers and company in Switzerland and only one small one time fee.

Threema seems nice. Too bad it's not free software, especially since it comes with security claims.

I think you meant "too bad the source isn't published" - one can security audit code that's published but copyrighted just as well as one can audit Free (as in speech) code.

If it's not free (as in freedom) software and I can't compile the version of the sources that the community inspected, then I don't really care that some source code is publicly shown. I can't verify that it's actually the code I run when downloading the precompiled app.

Thinking of it, it would be interesting to be able to display such proof…

If you can't ensure that the code you're running is compiled from the version of the sources that the community inspected, then yes, that isn't any useful version of "the source is published".

However, verification is a technical problem, not a licensing one. It's probably -easier- for free software, but that doesn't mean that's a necessary characteristic to be able to achive the goal of 'usefully aduited'.

https://telegram.org/

You have the option to use a second layer of encryption (via OTR), even without OTR it's encrypted... but it offers OTR for the more paranoid of folk.

It even advertises as a WhatsApp private alternative.

https://telegram.org/faq#q-why-not-open-source-everything

Reply on news.ycombinator.com