FYI, both WhatsApp and Telegram work the same way.
6,910 karma · joined March 12, 2010
Why would it be harder? Telegram has the entire plaintext message history for every message all of their users have ever sent, WhatsApp doesn't. It's much easier for Telegram to comply, not harder.
Here's the situation: people hem and haw about Telegram's cryptography, but what we should really be talking about is that Telegram is not using end to end encryption by default. Telegram stores your entire plaintext message history server-side. There is nothing worse when it comes to privacy, but it's very easy to write slick clients when they're just views onto the server and all the logic happens there.
This is the world we live in: people do most of their communication on mobile devices running iOS or Android, use Chrome on the desktop, and expect contact discovery to be automatic in their social apps. The browser has won the desktop, iOS and Android have won mobile, and the velocity of the ecosystem is unlikely to make "distributed" communication mechanisms possible for some time.
We're trying to make mass surveillance impossible within this world of ours. We want to produce technology that is privacy preserving but feels just like everything else people already use, not somehow convince everyone to fundamentally change their workflow and their expectations.
It'd be sweet if we lived in an alternate reality where everyone ran SailfishOS or something (and maybe this year will be the year of Linux on the desktop!), but we can't just pretend that's already the case.
1) Make mass surveillance impossible.
2) Stop targeted attacks against crypto nerds.
It's not that we don't find #2 laudable, but optimizing for #1 takes precedence when we're making decisions.
If you don't want to use your phone number, don't use it. You can register with any GV, Twilio, Voicepulse, or other throwaway VoIP number.
If you don't want to run Chrome, use Chromium instead.
If you don't want to use Google Play Services, use GcmCore.
The world you want this software for is not the world that everyone else lives in. You can certainly make it work in that world with a little effort, but because of how we've prioritized our objectives, that's not the default experience.
In the case of heartbleed, anyone who has ever spent more than 30 seconds looking at OpenSSL can tell you that it is not secure software and never will be. We can't identify and remedy every possible vulnerability, but we do have enough information to know that events like heartbleed will happen again and again.
There's a very small number of people who find this to be very important, and my experience has been that the strategy is to loudly complain whenever anything depends on play services. Just tactically speaking, I don't think this is going to work in the end, in the same sense that simply refusing to have a mobile phone won't work anymore -- slowly, the circumstances around this technology will make it impossible to refuse.
What I don't understand is why nobody just writes an API-compatible open source implementation of play services. Even if it only supported GCM and nothing else, that'd unlock an enormous swath of apps, and would only require writing a basic implementation of the GCM network protocol.
I'd love to know more if I'm misunderstanding the challenges around doing that. Right now it's part of the reason that I don't pay much attention to that crowd -- everyone seems very willing to complain, but nobody seems willing to do what seems like pretty straightforward work to solve their own problem.
1) Make mass surveillance impossible. 2) Stop targeted attacks against crypto nerds.
It's not that we don't find #2 laudable, but optimizing for #1 takes precedence when we're making decisions. It's totally possible for you to install Signal on an iPod touch with a VoIP number, for instance, but that takes more effort than the common case we're designing for.
Open Whisper Systems is making private communication simple. Our technology is used by hundreds of millions of people, and everything we produce is open source. What it's like to work with us: https://whispersystems.org/workworkwork/
• iOS Front End -- Someone intimately familiar with iOS development and internals, who has an appreciation for the craft of software development and experience with making decisions that result in great products. No experience with cryptography necessary, just solid experience developing for iOS and an eye for good design.
• Android Developer -- Is the pleasure center of your brain directly wired to the experience of a slick UX or a nice animation? Do you hunt down memory leaks and StrictMode violations for fun? We're looking for someone with deep knowledge of the Android framework and an equally strong intuition for pairing beautiful app experiences with beautiful code. You'll be the architect of major features, making your code available to the world. You don't need to be a security expert; it's knowing how to make complicated systems simple to use that's at the heart of what we do.
• Mobile UI / Product Designer -- We’re seeking an original thinker with strong visual design skills ready to help make private communication simple. You'll take on developing the look and feel of Signal on iOS, Android, and the desktop. You’ll be responsible for updating the visual design for the app and helping shape consistent guidelines to communicate a compelling user story across our products and other touchpoints. You’ll work closely with a team of engineers with a passion for making usable software. No experience with cryptography necessary, just intuition for what makes a great product and solid experience designing products that are a joy to use.
See more at https://whispersystems.org/workworkwork/, or send us a note at workwithus@whispersystems.org
Open Whisper Systems is making private communication simple. Our technology is used by hundreds of millions of people, and everything we produce is open source. What it's like to work with us: https://whispersystems.org/workworkwork/
• iOS Front End -- Someone intimately familiar with iOS development and internals, who has an appreciation for the craft of software development and experience with making decisions that result in great products. No experience with cryptography necessary, just solid experience developing for iOS and an eye for good design.
• Android Developer -- Is the pleasure center of your brain directly wired to the experience of a slick UX or a nice animation? Do you hunt down memory leaks and StrictMode violations for fun? We're looking for someone with deep knowledge of the Android framework and an equally strong intuition for pairing beautiful app experiences with beautiful code. You'll be the architect of major features, making your code available to the world. You don't need to be a security expert; it's knowing how to make complicated systems simple to use that's at the heart of what we do.
• Mobile UI / Product Designer -- We’re seeking an original thinker with strong visual design skills ready to help make private communication simple. You'll take on developing the look and feel of Signal on iOS, Android, and the desktop. You’ll be responsible for updating the visual design for the app and helping shape consistent guidelines to communicate a compelling user story across our products and other touchpoints. You’ll work closely with a team of engineers with a passion for making usable software. No experience with cryptography necessary, just intuition for what makes a great product and solid experience designing products that are a joy to use.
See more at https://whispersystems.org/workworkwork/, or send us a note at workwithus@whispersystems.org
Open Whisper Systems is making private communication simple. Our technology is used by hundreds of millions of people, and everything we produce is open source. What it's like to work with us: https://whispersystems.org/workworkwork/
iOS Front End -- Someone intimately familiar with iOS development and internals, who has an appreciation for the craft of software development and experience with making decisions that result in great products. No experience with cryptography necessary, just solid experience developing for iOS and an eye for good design.
Android Developer -- Is the pleasure center of your brain directly wired to the experience of a slick UX or a nice animation? Do you hunt down memory leaks and StrictMode violations for fun? We're looking for someone with deep knowledge of the Android framework and an equally strong intuition for pairing beautiful app experiences with beautiful code. You'll be the architect of major features, making your code available to the world. You don't need to be a security expert; it's knowing how to make complicated systems simple to use that's at the heart of what we do.
Mobile UI / Product Designer -- We’re seeking an original thinker with strong visual design skills ready to help make private communication simple. You'll take on developing the look and feel of Signal on iOS, Android, and the desktop. You’ll be responsible for updating the visual design for the app and helping shape consistent guidelines to communicate a compelling user story across our products and other touchpoints. You’ll work closely with a team of engineers with a passion for making usable software. No experience with cryptography necessary, just intuition for what makes a great product and solid experience designing products that are a joy to use.
See more at https://whispersystems.org/workworkwork/, or send us a note at workwithus@whispersystems.org
TextSecure has delivery receipts so you can see when your messages aren't being delivered, and there's a web-based unregistration flow on the Open Whisper Systems website so that users can unregister their numbers if they've uninstalled.
Open Whisper Systems is making private communication simple. Our technology is used by hundreds of millions of people, and everything we produce is open source. What it's like to work with us: https://whispersystems.org/workworkwork/
★ iOS Lead -- Someone intimately familiar with iOS development and internals, who has an appreciation for the craft of software development and experience with making decisions that result in great products. No experience with cryptography necessary, just solid experience developing for iOS and an eye for good design.
★ Mobile UI / Product Designer -- We’re seeking an original thinker with strong visual design skills ready to help make private communication simple. You'll take on developing the look and feel of Signal on iOS, Android, and the desktop. You’ll be responsible for updating the visual design for the app and helping shape consistent guidelines to communicate a compelling user story across our products and other touchpoints. You’ll work closely with a team of engineers with a passion for making usable software. No experience with cryptography necessary, just intuition for what makes a great product and solid experience designing products that are a joy to use.
★ Product Support / Project Manager -- We're seeking someone with strong writing skills and a passion for collaboration. This is an integrated position that incorporates both supporting our users and project management of software development. You will be responsible for providing support for our users both directly and by distilling knowledge into appropriate documentation, surfacing user feedback to help make product decisions and define development priorities, and using those focus points to help drive sprint planning and coordinated development. No experience with cryptography necessary, just a solid technical background, strong writing skills, a large capacity for empathetic listening, time spent organizing and coordinating development, and the ability to juggle wheels within wheels.
See more at https://whispersystems.org/workworkwork/, or send us a note at workwithus@whispersystems.org
We have a few bots in production that use libtextsecure and have been running fine for almost a year without any maintenance.
Open Whisper Systems is making private communication simple. Our technology is used by hundreds of millions of people, and everything we produce is open source.
What it's like to work with us: https://whispersystems.org/workworkwork/
★ iOS Lead -- Someone intimately familiar with iOS development and internals, who has an appreciation for the craft of software development and experience with making decisions that result in great products. No experience with cryptography necessary, just solid experience developing for iOS and an eye for good design.
★ Mobile UI / Product Designer -- We’re seeking an original thinker with strong visual design skills ready to help make private communication simple. You'll take on developing the look and feel of Signal on iOS, Android, and the desktop. You’ll be responsible for updating the visual design for the app and helping shape consistent guidelines to communicate a compelling user story across our products and other touchpoints. You’ll work closely with a team of engineers with a passion for making usable software. No experience with cryptography necessary, just intuition for what makes a great product and solid experience designing products that are a joy to use.
★ Product Support / Project Manager -- We're seeking someone with strong writing skills and a passion for collaboration. This is an integrated position that incorporates both supporting our users and project management of software development. You will be responsible for providing support for our users both directly and by distilling knowledge into appropriate documentation, surfacing user feedback to help make product decisions and define development priorities, and using those focus points to help drive sprint planning and coordinated development. No experience with cryptography necessary, just a solid technical background, strong writing skills, a large capacity for empathetic listening, time spent organizing and coordinating development, and the ability to juggle wheels within wheels.
See more at the link above, or send us a note at workwithus@whispersystems.org
Open Whisper Systems is making private communication simple. Our technology is used by hundreds of millions of people, and everything we produce is open source.
★ Design Lead -- Help us shape the look, feel, and branding of all our applications across iOS, Android, and the web. Help us simplify and effectively communicate otherwise complex ideas about privacy and security.
★ iOS Lead Developer -- Help us build a beautiful messaging app that is a joy to use.
Substantial experience in the domain of iOS development or design is a must, but experience with security or cryptography is not necessary or desired. Send us an email if this sounds interesting: workwithus@whispersystems.org
I think projects like this one are great. I have no idea if the people behind it know what they're doing or can write secure software, but we've always wanted some place where the people who want to import their GPG key, manually select their underlying block cipher, or support WoT style key signatures can go. Projects like these might be a better fit for those users.
It's straightforward and effective when password hashing happens client-side (like local encryption for a bitcoin wallet), but using scrypt or bcrypt server-side at effective difficulty levels will either destroy your L1/L2 cache or exceed your CPU budget.
In practice, from what I've seen, this means scrypt is never used, and bcrypt is used with a work factor that's tuned low. I think this is just a fundamental asymmetry, and that at the end of the day people use bcrypt so that they can say "we used bcrypt!" and get a nod when their entire user database is compromised, even though it provides very little value the way it's deployed.
Open Whisper Systems is making private communication simple. Our technology is used by hundreds of millions of people, and everything we produce is open source.
★ Design Lead -- Help us shape the look, feel, and branding of all our applications across iOS, Android, and the web. Help us simplify and effectively communicate otherwise complex ideas about privacy and security.
★ iOS Lead Developer -- Help us build a beautiful messaging app that is a joy to use.
Substantial experience in the domain of iOS development or design is a must, but experience with security or cryptography is not necessary or desired. Send us an email if this sounds interesting: workwithus@whispersystems.org
Beyond doubts with the protocol itself, I think the more important consideration is that most people never use it. Telegram is not encrypted by default. Users have to create a special "secret chat" with contacts that is ephemeral, and some Telegram clients don't even support that mode. Last I checked, there was no way to have group "secret chats" in any client at all.
The result is an unfortunate situation where many users seem to think that Telegram is somehow secure by default, when it definitely isn't. Telegram even stores plaintext copies of everyone's entire message history on the server for multi-device sync.
Open Whisper Systems is focused on making private communication simple. Our technology is used by hundreds of millions of people, and everything we produce is open source.
★ Design Lead -- Help us shape the look, feel, and branding of all our applications across iOS, Android, and the web. Help us simplify and effectively communicate otherwise complex ideas about privacy and security.
★ iOS Lead Developer -- Help us build a beautiful messaging app that is a joy to use.
Substantial experience in the domain of iOS development or design is a must, but experience with security or cryptography is not necessary or desired.
Send us an email if this sounds interesting: workwithus@whispersystems.org