It is worth noting that this venture features an open sourced, Haskell implementation of a messaging server and Rust implementations of the underlying secure messaging protocol, Axolotl
"Wire" is a secure messaging app. When I saw "wire server" I immediately though "wire protocol" which is a networking term and also something completely different.
If you're worried about supporting Facebook, use Wire. Facebook can't read WhatsApp messages, which are E2E encrypted (unlike Telegram's default). But it's a legit concern, and one that Wire addresses nicely.
You should be extremely suspicious of any messaging company that advertises client-server encryption as a privacy feature. It obviously is not.
The fact that WhatsApp is non-free and backdoored <https://news.ycombinator.com/item?id=13389935> is a good enough reason not to use it instead of telegram (or wire or signal or tox or most e2e programs).
Well, if "snakeanus" on Hacker News says so, why would I believe Matthew D. Green, Bruce Schneier, Avi Rubin, Steve Bellovin, Emin Gün Sirer, and Paulo Barreto when they cosign a letter saying that report was horseshit? Tough call, I guess!
It is indeed, isn't it? I'm actually underselling it, using principally names that I think everyone on HN knows. But if you know anything about cryptography, the repudiation of that "backdoor" story is even more devastating. Look at the list at the bottom of this post:
I am more interested in actual arguments instead of just names. That being said, since you are so interested in names, here is a list by the FSF that includes whatsapp https://www.gnu.org/proprietary/proprietary-back-doors.en.ht... (I am sure that everyone here has heard of the FSF).
> This is the overwhelming consensus of the cryptography and security community
Yeah, having your client (automatically and without a warning to the user first) let a "trusted" 3rd party make it re-send and re-encrypt a message with another unverified public key is the "overwhelming consensus of the cryptography and security community".
This article did not try to debunk what the original article said at all. Instead its main argument seems to be "Sure, whatsapp resends a message encrypted with a different key when the server demands it without even informing the user but this is not bad (because of "usability concerns") and damn you for even daring to inform the users about it!". Its secondary argument seems to be "b-but users will switch away to less safe applications if you inform them about how much whatsapp sucks - even if you suggest signal afterwards!".
> Here’s a difficult attack that could allow a sophisticated, resourceful adversary willing to invest a good deal of effort, some components of which have never been demonstrated in practice, to read a few messages that had been sent but have not yet been read after events like the intended recipient changing phones or SIM cards
It's not a "difficult attack" if the trusted third party (or anyone who can compromise their servers or force them) can perform it at will.
In any case, even if this backdoor did not exist it would not make whatsapp any better as it still is a proprietary software that might perform shady things in the background (or might be updated at any time to do so).
I'm confident I understand the intent and implications of the open letter I've cited. People can decide for themselves how persuasive they think either of us are here.
you need only one reason to use app - your contacts there
if I will find only one my contact on Wire, it can be amazing as much they want, but it's useless, reason why I switched today from Hangouts to Facebook Whatsapp as my secondary messenger (primary is Signal), which I really don't like (especially bloated UI with 2 unnecessary tabs out of 4), but there is not really any other option, since nobody use Allo, Skype has horrible UI, and very few people use Telegram or Viber
telegram, wire or signal are fine for people working in IT, but if you have contacts outside your work circle they are pretty much useless
I haven't used Wire [1] in a long time because it didn't have a way to backup and restore conversations when switching devices (Signal behaves the same way too). But I do look at the release notes whenever the client is updated. Recently I was happy to see that Wire allowed up to three accounts to be configured in the client!
I also like the fact that Wire doesn't need a phone number (unlike Telegram, Signal, WhatsApp and similar applications). You can sign up with an email address and use it. Of course, Wire is end-to-end encrypted, syncs across devices (unlike Signal) and has native^ multi-platform/multi-OS support where each device is independent and doesn't need the phone to be around (unlike Signal or WhatsApp).
On the topic of open sourcing the server, it's a good move from the security audit point of view. But until any of these new age apps/platforms support federation and decentralized communication, there's not much use for the masses to look for servers run by specific people.
^: As mentioned in a comment below, it's an Electron app, but I meant to indicate that there's an app that you can install for each platform without having more prerequisites (unlike Signal that requires Chrome/Chromium to be installed first).
I can't do it on my phone though. And that's the device that might change after some time (years). AFAIK, Signal is coded explicitly to disallow backups of the data on iOS. Can't back it up with iTunes backup or on iCloud. I believe security was a reason (sacrificing UX deeply, IMO). I don't use Signal because of its comparatively poorer UX and feature set (the others I consider are Telegram and Wire). And without being able to backup conversations from an existing/old phone and restore them on a new phone, I'll never use it. I learned about this behavior the hard way during a previous switch and lost all my conversations (for some I had the patience to take screenshots).
> But until any of these new age apps/platforms support federation and decentralized communication, there's not much use for the masses to look for servers run by specific people.
Federation of self-hosted servers and the "official cloud" seems to be on Wire's road-map, cf:
>But until any of these new age apps/platforms support federation and decentralized communication, there's not much use for the masses to look for servers run by specific people.
What's the use case for self hosting ? Since it's supposed to be e2e, does self-hosting buy you anything ?
It’s a requirement many organizations have - government institutions are a good example. Some might want to not leak any data to the outside world, run it only for internal use, etc.
> But until any of these new age apps/platforms support federation and decentralized communication, there's not much use for the masses to look for servers run by specific people.
100% open source server + client(s), decentralized, federated, easy to stand up your own server, end-to-end encryption, bridges to tons of other networks (IRC, telegram, slack, mattermost, etc), full history sync even when you log in from new devices, read receipts (even for individual users in group chats). They're by far (in my opinion) the most feature-rich of the "new-age" communication systems. I've been running my own homeserver for over a year now and I can't recommend it highly enough.
Thanks for the mention and the description of the features and benefits of Matrix. It sounds like music to my ears! I did hear about Matrix probably a year or two ago, but didn't think much of it at that time. I tend to look these up once every several months or so to see what's available and what improvements have happened. I'll have to check this out again.
Wire is really, really exciting. I don't know if I trust its crypto anywhere near as much as I trust Signal's, and I don't know if I trust its business model as much, but featurewise it seems a healthy competitor.
Multi-device. Email-address-based. Federated [soon]. What's not to like?
Crypto - Wire’s Proteus is an independent implementation of Axolotl that was later renamed to Signal Protocol. There’s also an external audit available - info and links from Wire.com/privacy.
As to business model, Wire is VC funded by Iconical.com /Janus Friis (co-founder of Skype) and announced the first paid product in July - wire.com/teams.
37 comments
[ 3.5 ms ] story [ 26.1 ms ] thread"Wire" is a secure messaging app. When I saw "wire server" I immediately though "wire protocol" which is a networking term and also something completely different.
i would hope the "not being owned by a datamining advertising giant" of wire or telegram would be a good reason to use them instead of whatsapp.
You should be extremely suspicious of any messaging company that advertises client-server encryption as a privacy feature. It obviously is not.
http://technosociology.org/?page_id=1687
> This is the overwhelming consensus of the cryptography and security community
Yeah, having your client (automatically and without a warning to the user first) let a "trusted" 3rd party make it re-send and re-encrypt a message with another unverified public key is the "overwhelming consensus of the cryptography and security community".
This article did not try to debunk what the original article said at all. Instead its main argument seems to be "Sure, whatsapp resends a message encrypted with a different key when the server demands it without even informing the user but this is not bad (because of "usability concerns") and damn you for even daring to inform the users about it!". Its secondary argument seems to be "b-but users will switch away to less safe applications if you inform them about how much whatsapp sucks - even if you suggest signal afterwards!".
> Here’s a difficult attack that could allow a sophisticated, resourceful adversary willing to invest a good deal of effort, some components of which have never been demonstrated in practice, to read a few messages that had been sent but have not yet been read after events like the intended recipient changing phones or SIM cards
It's not a "difficult attack" if the trusted third party (or anyone who can compromise their servers or force them) can perform it at will.
In any case, even if this backdoor did not exist it would not make whatsapp any better as it still is a proprietary software that might perform shady things in the background (or might be updated at any time to do so).
For anyone else seeing this and wants to read more about the story see https://news.ycombinator.com/item?id=13389935 and https://news.ycombinator.com/item?id=13394900
if I will find only one my contact on Wire, it can be amazing as much they want, but it's useless, reason why I switched today from Hangouts to Facebook Whatsapp as my secondary messenger (primary is Signal), which I really don't like (especially bloated UI with 2 unnecessary tabs out of 4), but there is not really any other option, since nobody use Allo, Skype has horrible UI, and very few people use Telegram or Viber
telegram, wire or signal are fine for people working in IT, but if you have contacts outside your work circle they are pretty much useless
I also like the fact that Wire doesn't need a phone number (unlike Telegram, Signal, WhatsApp and similar applications). You can sign up with an email address and use it. Of course, Wire is end-to-end encrypted, syncs across devices (unlike Signal) and has native^ multi-platform/multi-OS support where each device is independent and doesn't need the phone to be around (unlike Signal or WhatsApp).
On the topic of open sourcing the server, it's a good move from the security audit point of view. But until any of these new age apps/platforms support federation and decentralized communication, there's not much use for the masses to look for servers run by specific people.
^: As mentioned in a comment below, it's an Electron app, but I meant to indicate that there's an app that you can install for each platform without having more prerequisites (unlike Signal that requires Chrome/Chromium to be installed first).
[1]: https://wire.com
Nope, just Electron.
Some people use it that way sure, but they're wrong. You can either help point it out when they make the claim or you can be a part of the problem.
`Whisper.Backup.backupToDirectory()`
`Whisper.Backup.importFromDirectory()`
Federation of self-hosted servers and the "official cloud" seems to be on Wire's road-map, cf:
* Third paragraph of OP
* https://www.reddit.com/r/selfhosted/comments/5vylls/wire_end...
* Last sentence on https://medium.com/@wireapp/open-sourcing-wire-server-code-e...
What's the use case for self hosting ? Since it's supposed to be e2e, does self-hosting buy you anything ?
Have you not heard of https://matrix.org?
100% open source server + client(s), decentralized, federated, easy to stand up your own server, end-to-end encryption, bridges to tons of other networks (IRC, telegram, slack, mattermost, etc), full history sync even when you log in from new devices, read receipts (even for individual users in group chats). They're by far (in my opinion) the most feature-rich of the "new-age" communication systems. I've been running my own homeserver for over a year now and I can't recommend it highly enough.
Multi-device. Email-address-based. Federated [soon]. What's not to like?
As to business model, Wire is VC funded by Iconical.com /Janus Friis (co-founder of Skype) and announced the first paid product in July - wire.com/teams.
Full disclosure: I work at Wire.
They're aware of it but no fix as yet.