It's a little frustrating to see that the most secure (yet still usable) alternatives aren't the most popular (perhaps with the exception of iMessage, although 95% of the security of those messages is compromised anyway by the backup system that's enabled by default).
I like to tell myself that this is because the really good open source options don't have enough money or clout to make themselves popular, while apps like Whatsapp or Skype or Telegram do. It's just unfortunate that the least secure apps and services get pushed to the mainstream simply because of money.
I think the consensus here is that TextSecure (and whatever the iOS client is called) is the Right Thing.
Personally, I'm doing a last effort to use xmpp right now (just in the process to migrate to the unreleased prosody 0.10 for some features that I require) and otherwise Telegram looks like the 'sanest' option so far.
TextSecure doesn't work more than 50% of the time for me. Messages I send never get delivered, or they get delivered and replies disappear. Or they send and show up 2 days later. Or the client cannot cope with key changes and just fails to do anything whatsoever
Arguments as far as I'm aware (please correct me where I'm wrong):
- Crypto is 'home made' and - in spite of their crypto-challenges (or, as another school of thought states, related to the fact of trying to use these challenges to appear 'secure') unproven
While there seem to be "home made" elements, these are in how they are combining well-known cryptosystems.
So there may well be flaws in how they put it together or in the implementation, it doesn't appear to be a classic case of "home made" snake oil encryption. Also, it seems to be public, not the usual "trade secret" of snake oil.
So to me a 'cryptosystem' is the way the elements are combined.
Block ciphers are used in a selection of modes and when combined into a protocol with integrity and authentication catered for, we have a cryptosystem.
Constructing these is hard, even with well-known algorithms, and is the source of many sneaky attack vectors. The fact that they have effectively invented their own mode is suspect, and the cryptosystem as a whole is not really well-validated either.
Their "$300,000 if you break it" contest is seen as a trust-gimmick as it provides no cryptographical or mathematical guarantees, it simply shows that nobody has yet broken it for whom 300k is more important than access to the data.
"Hey look! We invented this novel cryptosystem and, despite it being unproven and not having it validated by anyone, we reckon it's the most secure thing ever!"
Telegram is not governed by VCs or large corporations with ambiguous ties to government. Its code is open-source. It hasn't needed to spend money to make itself popular...its users did it for them.
Which you could really say about all the services you mentioned.
The difference is in who's footing the bill for all the other costs.
The founder of Telegram is a privacy and civil liberties activist who has publicly committed to keeping Telegram as secure as possible, and that until a revenue model is determined that honors that standard, he'll continue funding it on his own (he's loaded from equity in VKontakte).
When security is important, users are far better off not using anything than they are using something that they have misunderstood to be secure.
So the share with server by default, brag about security approach is really bad, especially in the instances where the need for security is very clear.
It also seems to be the case that Telegram is not making users aware enough of the importance of verifying the keys used to establish the secret chats (see the link here https://news.ycombinator.com/item?id=9538879 , users are sharing channel keys over the channel they are trying to establish). So there is a second level of traps that a user has to avoid to even have a chance of using Telegram securely.
What's the popularity of 'WhatsApp' like at the moment?
IIRC the folks at Open Whisper Systems (TextSecure, Redphone and Signal) did some work with them to integrate the TextSecure protocol into that.
So while I use TextSecure with friends who are happy to use that, I'm not upset about using WhatsApp with others as it's more mainstream and friendly, but has decent security under the hood.
I think it's on by default. I could be wrong, it's worth checking now you mention it!
And I know they didn't implement it for group chats, only 1-1 so far.
And yes, you're correct, they could rip it out at any moment, in fact they could already have done so, and as a facebook subsidiary I'm not huge on the idea of trusting them.
OTOH getting the whisper systems folks in was positive and from reading what they wrote about it, it didn't seem they were just being used for a PR exercise.
WhatsApp only uses encryption if both people are using Android and if the server approves it. There's also no way to know whether you're using it or not.
I feel that Silent Text is omitted from these lists too frequently, unfortunately, as it's one of the most secure texting apps currently on the market (I would know, I work for SC).
SC's other big problem is your CEO making false or at least extremely exaggerated statements. Comes off as a sham. (I've met some of you at ClueCon and don't think it's trying to be like that, just the marketing isn't as truthful as it could be.) Encrypted PSTN calls? Please do tell how it's better than using a VPN then going to a big VoIP provider.
I haven't heard the final word on that. For all we know Facebook could pull the plug on the "in-development E2E encryption" in the next few months and act like nothing changed. Whatsapp has never made a public statement about it so you can't trust that it uses "decent security under the hood" right now.
When they make a public statement about rolling out E2E encryption to all of its clients and change their Privacy Policy to reflect that change (since they aren't supposed to "get your data" with E2E encryption anymore - therefore if the Privacy Policy doesn't reflect it, that means they aren't using E2E encryption) then we can at least have a reasonable expectation of them committing to it (even if in theory they could still bypass it and we would never know, because it's a closed source app, but at least if we do find out about it, we can hold them to it - right now we can't hold them to anything because they've never said anything about the E2E encryption themselves).
I think a lot of it is timing and momentum. I just bought an Ubuntu phone only to discover there is no whatsapp on it. I am happy to use Telegram, but convincing friends is an uphill battle.
You got my upvote and I stated elsewhere in this thread that I'm currently upgrading my xmpp server (to the unreleased 0.10 version of prosody).
But let's be honest: xmpp is still not there. To have something comparable to what these clients offer you need a good number of extensions, notably (ymmv)
- Message carbons (i.e. a message reaches all online devices)
- Stream management (because without it, people are going to consider xmpp broken. "It loses my messages")
- MAM (for shared archives between clients/devices, the reason for me upgrading to an unstable server now)
Given that one of these isn't even (widely) available so far, I'd say xmpp is in a bad position. I love the idea. But it's hard to imagine that it can gain traction right now, given that the 'only' thing it has to offer against all the other systems is federation. I care about that. But .. most don't.
You know, I've always been planning to set up my own xmpp server, so I haven't looked to hard at the public offerings. Unfortunately there doesn't appear to be any good list over public service providers -- one that includes things like does the server support server side archiving etc.
I was hopeful when I saw that duckduckgo[ddg], fastmail[fm] and mailbox.org[m] had public chat services. But of the three, none support standard archiving [XEP-0136] and only fastmail supports a custom form of archiving (via special emails to your fastmail-account). The latter at least gives you an option to archive chats (for eg: search) -- but it appears there's a market for a good, public and full-featured xmpp/chat service.
Most of the other public servers appear to a) be free-only -- not a business -- and b) focused on privacy. I find it a bit surprising that noone has tried launching a free+paid option -- say reserving some features for paying users (and charge maybe 1 USD/month?).
Actually, I think duckduckgo.com would be happy to "host" a services free tier -- have a trial account mode, and point user that just want a free chat service to ddg. Ddg gets more registered users, more users of their services, and those that are willing to pay for some features (eg: server side archiving, server side notes... others?) can pay a small amount for the service.
Only draw back would be no seamless transition from one to the other (change of username/domain). On the plus side, all my trial accounts can talk to each other without problem (via server side federation) -- it just works.
[edit: And while mailbox.org has an interesting offering, like some kind of deal with yubikey -- they seem to have neglected their xmpp setup somewhat -- there are some issues with ssl certs. Pidigin can't seem to figure out that xmpp at fastmail is chat.messagingengine.com, nor that mailbox uses xmpp.mailbox.org. Both give additional certificate errors if not adjusted. I suppose fastmail hasn't set up srv-records/dns aliases for their vanity domains (I registered mm.st -- as it was the shortest). It'd be better if one could just type in <user>@mm.st and have everything work. The bug might be in Pidgin, but fm really needs to test things. Of the three, ddg was by far the easiest to get started with -- register right in the im client (which also generates an account that works for ddg); and go.]
Now, there are good and bad answers that I can provide here.
Bad: Lots of things you take for granted if you look into WhatsApp/Hangouts/Telegram et al are extensions, lots of these extensions are optional, lots of optional extensions are not supported in a coherent way.
Somewhat bad: Archives had a decent XEP, but it's not 136. It's 313 (which I mentioned above, MAM). You probably won't find any improvements in 136, it's - as far as I can tell - considered superseded, although 313 is still not really available (which is the reason for me listing this as 'bad').
Good: Running your own server is trivial. Really. People always say that running a mail server is hard and - maybe it is. It certainly has a number of issues you can run into. Running an XMPP server? Install, configure, done. Easy. Give it a try this weekend?
Well, the "bad" is still better than using WhatsApp (or whatnot) -- even if there's only one combination of foss-cross-platform-client-x and foss-server-y that work together to give what's needed -- the protocol(s) are documented, and the implementations are available.
Thanks for the reality-check on server-side archiving :-/
As for running the server being trivial: I can believe that (I do run my own mail). I'm not really in a hurry to set it up for myself -- I have most people I chat with on xmpp (still!) on fb -- and they won't be moving any time soon.
I'll set it up as I move into my new dedicated server. My current "main" vps is running Debian oldstable lts, and I really don't want to set up anything new on that box, as I'm transitioning away from it.
After playing with Pidgin on windows (for testing the above), I've been playing with the idea of forking it and ripping out all the non-xmpp stuff, and maybe trimming the (G)UI/UX a bit too.
I should perhaps mention that when I occasionally do chat with people it's usually over IRC w/IRSSI.
My server of choice would be prosody, and if you're willing to try the (unreleased) 0.10 you'd even get the archive options listed above.
Plus, it integrates rather cleanly with a good number of systems, in my case it's using dovecot as authentication agent for example (and therefor relies on virtual users specified ~elsewhere~).
It can work. And it's really not hard. It's just not seamless, unfortunately.
I don't really need a web client. At any rate, I have chatsecure for Android -- a good command-line client with a way to access logs would be nice -- but a GUI app would also work.
given federation is going the way off the dodo, if you do decide to set up a server, you are going to need people on that server to talk to. or else it's an echo chamber.
so while it may be that you have a client that you use for android, if you want to talk to other people, you are going to need a client that supports the features they want.
what i am telling you is, is that the clients are a crapshoot that all support their own subsections of features. finding clients that people will use, for every platform is a massive timesink.
I'm not sure what you mean. Sure facebook and to a lesser extent google are wilfully screwing their users for no good reason (well no good reason for the users). But mailbox.org, fastmail and duckduckgo all federate just fine with each other.
It's not like I'm expecting whatsapp to suddenly enable xmpp and server federation over ssl (does anyone know why google doesn't just turn on ssl for server federation? I could understand killing xmpp, but why keep federation, but refuse to use ssl, on this one service?).
Suprisingly, I can't seem to find anyone that both provides on-line registration, federation and a web client...
In my case, I assume the more pragmatic route would be to set up a gateway to gtalk and fb, leaving me to use whatever client(s) I enjoy. I suppose I might host a public web client as well... but I don't see who would use that, rather than just send me an email, sms or call.
well it was my assumption that the only people you wanted to talk to were on google/facebook. if you have people on other networks that support federation to talk to - fair enough. if you don't have people on those networks, you'll have to convince people to move. or harder again, you'll have to get them on to your server.
bluescat(probable google employee) says webRTC is the way things are going, so no further development on xmpp. so i think that's the explanation for no s2s tls.
I'm quite happy with chatsecure[1] on Android. It apparently even supports registering a new account (eg: via duckduckgo) -- but I only use it with chat.facebook.com for now. Used it a bit with google as well, but I don't have anyone I talk to there (or rather: I've not used, so no-one knows I'm still available via that channel...).
Not sure what you mean by "not a good platform". Compared to what?
My dad is still an "avid" Blackberry user (as much as anyone who uses a blackberry these days is avid) and I note Telegram does not have a Blackberry client. Until that changes, we're still on whatsapp.
I switched to Telegram with my fiancée because of troubles with migrating WhatsApp data when she bought a new phone. When we powered up the new phone we realized that WhatsApp message history hadn't been transferred in the device migration (Windows Phone here) and there was some data that we wanted to preserve. WhatsApp on the old phone stopped working because the account had been used on the new phone so we couldn't even look at the chat history without using the SIM card to reactivate it. Reactivating WhatsApp on the old phone involved some extra hassle because the two phones had different SIM card slot sizes. After reactivation we could look at the old messages before moving the SIM card back to the new phone but couldn't transfer them, since WhatsApp chat history transfer on WP requires that both phones have an SD card slot. Being pretty fed up with WhatsApp at that point I found Telegram and have used it ever since.
I've been trying to get friends and family to switch to Telegram from iMessage and WhatsApp. Their native apps are great platform, speed is awesome, and, above all, it's a platform-agnostic system. I highly recommend it.
This is a huge hurdle in my opinion. Most of my friends own an iPhone and since I also own one, we group message on iMessage. If I wanted to switch to an Android, I would have to either convince them to switch to WhatsApp, Telegram etc etc or stop being part of that group chat, I think they call this FOMO. So having a bunch of friends with an iPhone that I regularly communicate with is a big pressure to continue buying Apple products.
Isn't WhatsApp more secure than telegram now that it implements the textsecure protocol? I guess the biggest hurdle with whatsapp now is what to do when the public key for a user changes...
WhatsApp is still a complete pain to use once you are used to Telegram. Wanna switch phones? Better get ready to backup all your messages by hand. Want to use something other than a phone? Here, use our shitty web app. Your phone is out of battery? sucks for you i guess!
>> Your phone is out of battery? sucks for you i guess!
??
Can you use telegram from another device? I think WhatsApp now has a windows client, maybe macos as well, recently announced.
No idea what the security is like though.
--edit-- Erm, I'm confused at the downvote, the parent raised a series of objections to WhatsApp and I asked for clarification of what they meant and suggested a non-phone client was available.
I've done the research now and it turns out to be utterly useless if your phone's out of batteries as it does some sort of sync'ing and relies on the phone being on, so it's not fit for the purpose.
People will probably continue downvoting you as long as you continue to complain about downvotes. Downvotes happen, whether randomly or because someone is having a bad day. Making a fuss out of it is counterproductive.
I upvoted you. Last time I tried it, using Whatsapp on your computer requires you to have the phone on. I think this is because the app on the phone holds your private key. I imagine this is also the reason why you can't use your whatsapp on a tablet or on multiple phones.
You can use Telegram on any device you want at same time. PC, Phone, tablet, you name it.
WhatsApp on the other hand only works in one device (your phone). They released a webchat, that just works as a proxy to connect to your phone. So in order to use the WhatsApp web, you need your phone on and with internet connection.
They say they have done it for Android, but as far as I know there hasn't been any similar announcement for iOS. There doesn't seem to be a way to verify public keys either like how Threema does.
I wonder whether telegram could offer a bridge service to proxy WhatsApp accounts, meaning you could switch to WhatsApp without losing any contacts...
Alternatively, perhaps the API can be glued to WhatsApp somehow.
I think it's not end-to-end encrypted by default; for "private" chats they claim to use end-to-end encryption, but use some homebew cryptographic protocol of dubious security.
There are varying degrees of what "encrypted by default" means.
WhatsApp used port 443 but sent plain text messages for years. Only fairly recently they switched around to actual encryption.
Telegram messages have never been readable across the network and they claim that they also can't read the messages themselves. This is due to storing the encryption key in a different data center, but that begs for the question of how they deliver my phone the message if they don't have the decryption key. (Answering "incorrectly" that they can read my messages was how I didn't make it on the support team.)
Then there is MTProto which everyone is buzzing about but which isn't even supported in all clients. This is the "secret chat" feature you see here and there, and it is actually encrypted end to end (and verifyably so). Clients are all open source so we can check that they are end to end encrypted -- WhatsApp or Facebook can ship you a backdoored version and you'd never be the wiser.
Saying Telegram is "not encrypted by default" is like saying "https is not encrypted by default" because the server software can read the private messages you send to other people.
They claim in their FAQ that messages are encrypted during transport and at rest - by default.
End to end encryption isn't enabled by default though, the argument being that this way you lose some features (like a shared history on their servers..).
The last time I read about Telegram people on HN were upset about it's security competition or something like that. IIRC, the gist of it was akin to this:
T: "Our security system is so secure that we'll give you a prize if you manage to break in through the front door"
HN: "But real criminals won't necessarily use the front door. What about other potential points of entry?"
T: "We won't confirm or deny the existence of any other point of entry, and to be clear, the competition is strictly about the security that our front door provides"
Telegram is fantastic with the glaring exception of mandatory read receipts.
Am I the only one that can't stand having people know when I've read their messages? It seems like every major chat platform (except for iMessage) has read receipts enabled without any option to disable them. Why has this become so popular?
I'm more than happy to show "delivered reciepts" since that covers the question of whether the message arrived.
I prefer to be able to read and reply later if I want to without feeling guilty that it'll look like I just couldn't be bothered. I mean, it's true, I couldn't be bothered, I just don't want to broadcast that fact :p
If you're on android, read the messages in the popup status window, it'll leave it "unread" until you open the conversation. You might need to enable the preview function for popups and/or popups for out to work. Kind of works unless someone sends a massive amount of messages/text.
Almost certainly because it increases engagement. By optimizing purely on metrics, psychologically undesirable effects creep in (guilt, in this case). c.f. online gaming apps and their addiction inducing behaviour.
I am really happy to see Telegram growing. I am one of those people who deleted Whatsapp (and lost touch with 30-40 people and several groups) when Facebook bought it.
So far I have been happy with it, even though only like 5 of my friends use it. Yeah, it may (or may not) have security flaws like many on HN complain, but I would take it anyday over FB owned give-us-all-your-data product.
Same here, except the people I wanted to communicate with are either the same or kind enough to install it also. If they don't care about WhatsApp already why should they care about installing Telegram next to it? Doesn't make a difference (to them anyway).
Not the person you're asking, but for me personally I never wanted it. I installed it because a group in school wanted to kick me from the project because I'm "unreachable" (which meant I had no WhatsApp -- email, telegram, IRC, sms, calling, anything would have worked, but no WhatsApp was a reason to make me fail my year). I was sad that I couldn't uninstall it before Facebook bought it.
If you'd want to believe their promise [2] they do plan to open up everything, but at the moment they're a closed source IM provider.
But that's irrelevant. The GP hijacked a thread about Telegram with Threema, with a three letter acronym and nothing else. For me, Telegram and Threema have the same flaw (not open). If I'd have to pick one of the two, I'd go with Telegram I guess - it's free (as in beer) and offers clients for nearly every platform I could care about.
So 'Telegram isn't open either' is correct, but misses the point: Given 'Threema FTW' my reaction was 'Why'?
1: When I wrote Why is another closed source/paid product better than this one? I tried to say (not my native language) Why is Threema, a closed source/paid product, better than this (closed source) one?
I wonder why isn't there a "text messaging mobile app" out there which just uses openPGP signed and encrypted email as the backend. Email is not that far from text messaging anyway.
If an attacker were to record all of a target’s ciphertext traffic over some extended period of time, and then compromise that one key at any point in the future (perhaps by seizing the device it’s on), they would have the ability to decrypt all of the previously recorded ciphertext traffic belonging to the target.
110 comments
[ 3.2 ms ] story [ 110 ms ] threadI like to tell myself that this is because the really good open source options don't have enough money or clout to make themselves popular, while apps like Whatsapp or Skype or Telegram do. It's just unfortunate that the least secure apps and services get pushed to the mainstream simply because of money.
Personally, I'm doing a last effort to use xmpp right now (just in the process to migrate to the unreleased prosody 0.10 for some features that I require) and otherwise Telegram looks like the 'sanest' option so far.
Doesn't require a phone number as identifier
Clients for ~all~ platforms that I care about
[0]: https://core.telegram.org/techfaq#q-why-did-you-go-for-a-cus...
- Crypto is 'home made' and - in spite of their crypto-challenges (or, as another school of thought states, related to the fact of trying to use these challenges to appear 'secure') unproven
- End to end encryption isn't the default
While there seem to be "home made" elements, these are in how they are combining well-known cryptosystems.
So there may well be flaws in how they put it together or in the implementation, it doesn't appear to be a classic case of "home made" snake oil encryption. Also, it seems to be public, not the usual "trade secret" of snake oil.
Block ciphers are used in a selection of modes and when combined into a protocol with integrity and authentication catered for, we have a cryptosystem.
Constructing these is hard, even with well-known algorithms, and is the source of many sneaky attack vectors. The fact that they have effectively invented their own mode is suspect, and the cryptosystem as a whole is not really well-validated either.
Their "$300,000 if you break it" contest is seen as a trust-gimmick as it provides no cryptographical or mathematical guarantees, it simply shows that nobody has yet broken it for whom 300k is more important than access to the data.
"Hey look! We invented this novel cryptosystem and, despite it being unproven and not having it validated by anyone, we reckon it's the most secure thing ever!"
Which you could really say about all the services you mentioned.
The difference is in who's footing the bill for all the other costs.
The founder of Telegram is a privacy and civil liberties activist who has publicly committed to keeping Telegram as secure as possible, and that until a revenue model is determined that honors that standard, he'll continue funding it on his own (he's loaded from equity in VKontakte).
What else are you looking for?
https://telegram.org/faq#q-how-secure-is-telegram
That is clearly prioritizing user convenience over "as secure as possible".
Yes, it could be better, but it's still better than whatsapp, facebook messenger and sms
(I'm a telegram user, and wouldn't be if it didn't sync across devices)
So the share with server by default, brag about security approach is really bad, especially in the instances where the need for security is very clear.
It also seems to be the case that Telegram is not making users aware enough of the importance of verifying the keys used to establish the secret chats (see the link here https://news.ycombinator.com/item?id=9538879 , users are sharing channel keys over the channel they are trying to establish). So there is a second level of traps that a user has to avoid to even have a chance of using Telegram securely.
IIRC the folks at Open Whisper Systems (TextSecure, Redphone and Signal) did some work with them to integrate the TextSecure protocol into that.
So while I use TextSecure with friends who are happy to use that, I'm not upset about using WhatsApp with others as it's more mainstream and friendly, but has decent security under the hood.
- Your WhatsApp messages don't use that 'security' by default (or do they?)
- That thing isn't open source and they could rip or swap out any encryption support they offer
And I know they didn't implement it for group chats, only 1-1 so far.
And yes, you're correct, they could rip it out at any moment, in fact they could already have done so, and as a facebook subsidiary I'm not huge on the idea of trusting them.
OTOH getting the whisper systems folks in was positive and from reading what they wrote about it, it didn't seem they were just being used for a PR exercise.
I feel that Silent Text is omitted from these lists too frequently, unfortunately, as it's one of the most secure texting apps currently on the market (I would know, I work for SC).
http://blogs.wsj.com/digits/2015/04/17/whatsapp-hits-800000-...
I haven't heard the final word on that. For all we know Facebook could pull the plug on the "in-development E2E encryption" in the next few months and act like nothing changed. Whatsapp has never made a public statement about it so you can't trust that it uses "decent security under the hood" right now.
When they make a public statement about rolling out E2E encryption to all of its clients and change their Privacy Policy to reflect that change (since they aren't supposed to "get your data" with E2E encryption anymore - therefore if the Privacy Policy doesn't reflect it, that means they aren't using E2E encryption) then we can at least have a reasonable expectation of them committing to it (even if in theory they could still bypass it and we would never know, because it's a closed source app, but at least if we do find out about it, we can hold them to it - right now we can't hold them to anything because they've never said anything about the E2E encryption themselves).
I tried to get my friends on Tox, but ultimately had to get them on Telegram because it was the only app that was truly 100% cross-platform.
But let's be honest: xmpp is still not there. To have something comparable to what these clients offer you need a good number of extensions, notably (ymmv)
- Message carbons (i.e. a message reaches all online devices)
- Stream management (because without it, people are going to consider xmpp broken. "It loses my messages")
- MAM (for shared archives between clients/devices, the reason for me upgrading to an unstable server now)
Given that one of these isn't even (widely) available so far, I'd say xmpp is in a bad position. I love the idea. But it's hard to imagine that it can gain traction right now, given that the 'only' thing it has to offer against all the other systems is federation. I care about that. But .. most don't.
I was hopeful when I saw that duckduckgo[ddg], fastmail[fm] and mailbox.org[m] had public chat services. But of the three, none support standard archiving [XEP-0136] and only fastmail supports a custom form of archiving (via special emails to your fastmail-account). The latter at least gives you an option to archive chats (for eg: search) -- but it appears there's a market for a good, public and full-featured xmpp/chat service.
Most of the other public servers appear to a) be free-only -- not a business -- and b) focused on privacy. I find it a bit surprising that noone has tried launching a free+paid option -- say reserving some features for paying users (and charge maybe 1 USD/month?).
Actually, I think duckduckgo.com would be happy to "host" a services free tier -- have a trial account mode, and point user that just want a free chat service to ddg. Ddg gets more registered users, more users of their services, and those that are willing to pay for some features (eg: server side archiving, server side notes... others?) can pay a small amount for the service.
Only draw back would be no seamless transition from one to the other (change of username/domain). On the plus side, all my trial accounts can talk to each other without problem (via server side federation) -- it just works.
[ddg] https://duck.co/blog/using-pidgin-with-xmpp-jabber
[fm] https://www.fastmail.com/help/clients/chat.html
[m] https://mailbox.org/en/mailbox-org-launched-secure-instant-m...
[l] https://list.jabber.at/
[edit: And while mailbox.org has an interesting offering, like some kind of deal with yubikey -- they seem to have neglected their xmpp setup somewhat -- there are some issues with ssl certs. Pidigin can't seem to figure out that xmpp at fastmail is chat.messagingengine.com, nor that mailbox uses xmpp.mailbox.org. Both give additional certificate errors if not adjusted. I suppose fastmail hasn't set up srv-records/dns aliases for their vanity domains (I registered mm.st -- as it was the shortest). It'd be better if one could just type in <user>@mm.st and have everything work. The bug might be in Pidgin, but fm really needs to test things. Of the three, ddg was by far the easiest to get started with -- register right in the im client (which also generates an account that works for ddg); and go.]
Bad: Lots of things you take for granted if you look into WhatsApp/Hangouts/Telegram et al are extensions, lots of these extensions are optional, lots of optional extensions are not supported in a coherent way.
Somewhat bad: Archives had a decent XEP, but it's not 136. It's 313 (which I mentioned above, MAM). You probably won't find any improvements in 136, it's - as far as I can tell - considered superseded, although 313 is still not really available (which is the reason for me listing this as 'bad').
Good: Running your own server is trivial. Really. People always say that running a mail server is hard and - maybe it is. It certainly has a number of issues you can run into. Running an XMPP server? Install, configure, done. Easy. Give it a try this weekend?
Thanks for the reality-check on server-side archiving :-/
As for running the server being trivial: I can believe that (I do run my own mail). I'm not really in a hurry to set it up for myself -- I have most people I chat with on xmpp (still!) on fb -- and they won't be moving any time soon.
I'll set it up as I move into my new dedicated server. My current "main" vps is running Debian oldstable lts, and I really don't want to set up anything new on that box, as I'm transitioning away from it.
After playing with Pidgin on windows (for testing the above), I've been playing with the idea of forking it and ripping out all the non-xmpp stuff, and maybe trimming the (G)UI/UX a bit too.
I should perhaps mention that when I occasionally do chat with people it's usually over IRC w/IRSSI.
Plus, it integrates rather cleanly with a good number of systems, in my case it's using dovecot as authentication agent for example (and therefor relies on virtual users specified ~elsewhere~).
It can work. And it's really not hard. It's just not seamless, unfortunately.
the clients are categorically awful :)
re forking:pidgin and libpurple are huge. focussing on webclients first and pidgin gajim etc afterwards is a better bet.
so while it may be that you have a client that you use for android, if you want to talk to other people, you are going to need a client that supports the features they want.
what i am telling you is, is that the clients are a crapshoot that all support their own subsections of features. finding clients that people will use, for every platform is a massive timesink.
my advice therefore, is to pick a nice webclient.
I'm not sure what you mean. Sure facebook and to a lesser extent google are wilfully screwing their users for no good reason (well no good reason for the users). But mailbox.org, fastmail and duckduckgo all federate just fine with each other.
It's not like I'm expecting whatsapp to suddenly enable xmpp and server federation over ssl (does anyone know why google doesn't just turn on ssl for server federation? I could understand killing xmpp, but why keep federation, but refuse to use ssl, on this one service?).
Suprisingly, I can't seem to find anyone that both provides on-line registration, federation and a web client...
In my case, I assume the more pragmatic route would be to set up a gateway to gtalk and fb, leaving me to use whatever client(s) I enjoy. I suppose I might host a public web client as well... but I don't see who would use that, rather than just send me an email, sms or call.
bluescat(probable google employee) says webRTC is the way things are going, so no further development on xmpp. so i think that's the explanation for no s2s tls.
https://productforums.google.com/forum/#!topic/hangouts/T2t1...
xep-0136 is regarded as an overreaching fuckup that nobody will ever get right and 313 is the heir apparent, and it's yet to be delivered.
having been through a lot of this, the issue is not the servers or the features thereof, but cross platform clients which support all the features.
main piece of advice is to settle on a webclient.
Not sure what you mean by "not a good platform". Compared to what?
[1] https://play.google.com/store/apps/details?id=info.guardianp...
EDIT: I want a polished official product, not something put together in a hackathon: https://telegram.org/blog/bb-results
??
Can you use telegram from another device? I think WhatsApp now has a windows client, maybe macos as well, recently announced.
No idea what the security is like though.
--edit-- Erm, I'm confused at the downvote, the parent raised a series of objections to WhatsApp and I asked for clarification of what they meant and suggested a non-phone client was available.
I've done the research now and it turns out to be utterly useless if your phone's out of batteries as it does some sort of sync'ing and relies on the phone being on, so it's not fit for the purpose.
But I'm still mystified at the downvote...
--edit 2-- More downvotes! Yay! Wtf?
Because yes, you can.
WhatsApp on the other hand only works in one device (your phone). They released a webchat, that just works as a proxy to connect to your phone. So in order to use the WhatsApp web, you need your phone on and with internet connection.
http://www.alexrad.me/discourse/a-264-attack-on-telegram-and...
WhatsApp used port 443 but sent plain text messages for years. Only fairly recently they switched around to actual encryption.
Telegram messages have never been readable across the network and they claim that they also can't read the messages themselves. This is due to storing the encryption key in a different data center, but that begs for the question of how they deliver my phone the message if they don't have the decryption key. (Answering "incorrectly" that they can read my messages was how I didn't make it on the support team.)
Then there is MTProto which everyone is buzzing about but which isn't even supported in all clients. This is the "secret chat" feature you see here and there, and it is actually encrypted end to end (and verifyably so). Clients are all open source so we can check that they are end to end encrypted -- WhatsApp or Facebook can ship you a backdoored version and you'd never be the wiser.
Saying Telegram is "not encrypted by default" is like saying "https is not encrypted by default" because the server software can read the private messages you send to other people.
End to end encryption isn't enabled by default though, the argument being that this way you lose some features (like a shared history on their servers..).
T: "Our security system is so secure that we'll give you a prize if you manage to break in through the front door"
HN: "But real criminals won't necessarily use the front door. What about other potential points of entry?"
T: "We won't confirm or deny the existence of any other point of entry, and to be clear, the competition is strictly about the security that our front door provides"
Is this still the case?
Am I the only one that can't stand having people know when I've read their messages? It seems like every major chat platform (except for iMessage) has read receipts enabled without any option to disable them. Why has this become so popular?
It settles the age old question of "Hey, did you get my message?". Many people like this functionality.
I prefer to be able to read and reply later if I want to without feeling guilty that it'll look like I just couldn't be bothered. I mean, it's true, I couldn't be bothered, I just don't want to broadcast that fact :p
Having said that I really like it and am encouraging my group to switch to test it out.
I wonder how effective that will be: "The Inertia ... the inertia" (said in full-on Marlon Brando Apocalypse Now voice)
So far I have been happy with it, even though only like 5 of my friends use it. Yeah, it may (or may not) have security flaws like many on HN complain, but I would take it anyday over FB owned give-us-all-your-data product.
I'm okay with a price for something that I might use every day, but if I'm accepting closed source solutions - what's the benefit of Threema here?
If you'd want to believe their promise [2] they do plan to open up everything, but at the moment they're a closed source IM provider.
But that's irrelevant. The GP hijacked a thread about Telegram with Threema, with a three letter acronym and nothing else. For me, Telegram and Threema have the same flaw (not open). If I'd have to pick one of the two, I'd go with Telegram I guess - it's free (as in beer) and offers clients for nearly every platform I could care about.
So 'Telegram isn't open either' is correct, but misses the point: Given 'Threema FTW' my reaction was 'Why'?
1: When I wrote Why is another closed source/paid product better than this one? I tried to say (not my native language) Why is Threema, a closed source/paid product, better than this (closed source) one?
2: https://telegram.org/faq#q-why-not-open-source-everything
And if you want to build an app using the telegram system it's basically using their cloud servers.
Does anyone know what their tech stack is?
If an attacker were to record all of a target’s ciphertext traffic over some extended period of time, and then compromise that one key at any point in the future (perhaps by seizing the device it’s on), they would have the ability to decrypt all of the previously recorded ciphertext traffic belonging to the target.
https://whispersystems.org/blog/asynchronous-security/
Telegram hit 1 billion messages in December 2014, and had 50 million active users at that time[1].
So, is it reasonable to assume that WhatsApp sends around 16 billion messages every day?
[1] https://telegram.org/blog/billion
How is that sustainable?
My only guess is that they are planning to charge for their api when they hit scale.