Hacker News Reader

Comment by iagooar | Hacker News Reader

I just don't get it. What is so difficult about providing a one-time authentication through the user's phone? Just open Whatsapp on the smartphone, get a token, put your phone number and token and voilà!

I mean, there have been web chats for decades now, so I don't understand why they invented such a messed up set of constraints.

Besides, am I the only one who suspects that Whatsapp is boycotting Apple? They needed almost 2 months to get an iOS 8 update out, now they are limiting the "web" application to non-Apple users...

View on HN

I believe the issue is that unlike web chats and apps like Telegram, Whatsapp doesn't store conversations on their servers beyond what is required to deliver messages to the required destination device(s).

This presents obvious problems with having not just a web client, but any client other than the main device, since the main device is the only store of the existing conversations. New messages sent also need to be synchronized across devices, which I presume is why it's required to keep your phone connected to the Internet. Otherwise Whatsapp would need keep conversations on their servers until they could be synced, which is very much not their model.

Details on their architecture:

https://www.youtube.com/watch?v=c12cYAUTXXs

http://highscalability.com/blog/2014/2/26/the-whatsapp-archi...

Doesn't that sound like a poor architecture then?

If the system is reliant on the main device, what happens if that gets run over or destroyed? WhatsApp have no control over the fate of the device. Why wouldn't they store the messages on the server and sync from that? WhatsApp have control of the fate of their own servers, which is far more reliable, SURELY.

If I send a new message from a device, either the other devices can poll periodically for messages that I have sent, or they can use WebSockets and be notified when a new message is sent, or when the app opens it can fetch all the recent messages that I have sent from other devices. It isn't difficult with a fine grained timestamp, surely? That's what Google Talk does.

You'd only need to order my messages by timestamp to get all messages that I had sent.

It's a bit of a daft architecture if it is incapable of this basic mechanism, isn't it?

If WhatsApp don't store the messages then they can't give them to any authorities if they're asked. That's a pretty big selling point for some users.

It's actually a feature, not poor architecture. They're putting security and privacy above UX. This is especially important in this day and age with all of the NSA and related revelations.

If you want a better UX there are hundreds of other options available.

WhatsApp operates at insane scale very cheaply. It's one reason they can charge $1 per year or less (lots of users don't seem to pay - they keep giving me free extensions for example). Not archiving all messages on their end keeps their costs in check, and is better for privacy.

I think they are using web sockets or something which requires persistent connection between the phone and browser. Since on iOS, apps can't run in background this approach will not work on iOS.

I would have thought the whole point of a web client was so that people who don't have a supported phone can get in on the fun. If I have to have WA on my phone to authenticate a web client then said client is just the useless toy described in the article.

I confess, I've never used it and don't want to pass judgment without actually checking it out but if what the article describes is true than, yeah, they screwed this one up big time.

I haven't used the Web service but I probably will. Not having to pick my phone up to use it will be a boon.

I'm always logged in so this is a non-issue for me.

I have cursed the lack of a desktop client often.

Exactly, Telegram figured it out and it works fine.

Telegram store your message and conversation history on their servers, whereas Whatsapp run somewhat like SMS - they pass your message on to the destination and then forget about it.

Clearly every point in the chain matters, but it always surprised me that a company that puts so much emphasis on security and privacy thinks it's a good idea to keep your messages in the cloud:

"Unlike WhatsApp, Telegram is cloud-based and heavily encrypted. As a result, you can access your messages from several devices at once"[1]

[1] https://telegram.org/faq

There's absolutely nothing wrong with putting your encrypted data anywhere and everywhere, as long as you are the only one who has the encryption key.

Unfortunately, it sounds like that's not what Telegram is doing with its non-"secret" messages.

Actually, you have to assume that any encryption is a temporary measure; it can and will be broken in the future. With that in mind, if something is worth encrypting, it's possible you don't want the service to store it after it's useful.

Of course, whatsapp could register devices which are thrown away after x days without delivery then store the messages until delivered to all end devices but that's likely a core infrastructure update which would require them to store more data, not the same as just writing another client.

Still, what they've created as a web client is a little batty; typically I'd want to use those when I can't find my phone.

So instead the intelligence agencies intercept all whatsapp traffic and crack that. Not much difference

I assume investors of telegram are Russian big dudes, and they use it to control people. Thats why they store it on their server.

I know, this is a wild guess. Id rather use whatsapp.

>> "Besides, am I the only one who suspects that Whatsapp is boycotting Apple?"

I understand the theory but all this does is hurt them. They need as many people as possible using there app for it be useful. They're also owned by Facebook who update all their apps weekly.

Facebook made the "Brilliant" move to remove the chat functionality from their app. So I am forced to use the mobile site of facebook ...

On what platform are you? Is there no Messenger for it? (Maybe I'm missing the point)

Why should I have 2 crippled apps than one functional. Also one that has degraded functionality. And until android has fake permissions I won't install messenger.

>> "Why should I have 2 crippled apps than one functional."

I feel the opposite. Why should I have 1 slow, bogged down app when I can have two fast, functional ones?

> And until android has fake permissions I won't install messenger.

Cyanogenmod has Privacy Guard, which is pretty much that.

Reply on news.ycombinator.com