Wire – modern, private messaging from Skype co-founder

by thomanq • 10 years ago

134 68 10 years ago

gtf21• 10 years ago

Does anyone know of an independent audit/confirmation of the robustness of their privacy / security? I don't really know enough about crypto or security to be able to tell.

giancarlostoro2• 10 years ago

I'm wondering the same, it is a shame there's not a whole lot of end to end encrypted applications, it's a conspiracy all of it's own or something? Maybe cryptologists are sparse or this is just not in their available time for the type of problems to tackle, not sure. The need is clearly there for more open source secure applications, hopefully we see more.

thepangolino• 10 years ago

My theory, as way out there as it might seem, is that there is hardly any interest for actual encryption. GPG's unique maintain was struggling to make ends meet until last year when he made it in the news.

I have yet to find someone, even among the "privacy aware" people to chat on Facebook using Pidgin's OTR plugin.

giancarlostoro2• 10 years ago

Previous discussion from over a year ago:

https://news.ycombinator.com/item?id=8692563

ConAntonakos• 10 years ago

Yeah, Wire has been out for a while.

tmikaeld2• 10 years ago

They just added encrypted voice and video calls (1to1) in the latest version (Guess that's why this is posted now).

Siimteller4• 10 years ago

So far only calls were E2EE. Video was added this Thursday and full E2EE switched on for all comms.

danpalmer4• 10 years ago

Wire launched at least a year ago, if not earlier, and I have the same question now that I had then: Why should I use it?

For good security, I have email/PGP which has few of my friends, but lots of usage for secure communication.

For secure chat I have Signal which some of my friends use, but not many.

For most of my chat I have WhatsApp which is relatively secure, and has a relatively good UI. Almost all my friends and family have this.

For the rest of my chat I have Facebook Messenger which isn't secure in the slightest, but it also has almost all of my friends and family on it. It has a very good UI, and lots of features that I make good use of.

Wire on the other hand has almost none of my friends, isn't open, so can't be any more secure than WhatsApp, and has a pretty but ultimately annoying UI, and very few features.

ukblewis2• 10 years ago

Hi Dan,

I'm not using Wire yet - so I'm just quoting their marketing material - but they directly address your comments: "Wire uses open-source cryptography to encrypt all content. We made the source code for data handling available to the public under the GPL License. This means that anybody can review the source code." "Only Wire offers fully encrypted calls, video and group chats available on all your devices, on any modern platform. Unlike niche security apps we do not sacrifice usability for security — Wire is simple and straightforward to use."

swiley• 10 years ago

It sounds like the app itself is closed though. Skype probably used openssl (open source crypto) on Linux but that didn't make it secure.

danpalmer4• 10 years ago

I looked for an obvious link to the code, I must have missed this.

Thanks for pointing it out!

JohnKacz• 10 years ago

isn't open

Their privacy page (in the comparison table) claims they are open source. I didn't see any links to their code however.

edit: Sorry, reading on mobile (after just waking up) and didn't see the link. Thanks @ukblewis

ukblewis2• 10 years ago

Dude, read the webpage before you comment, they link to it: https://github.com/wireapp

chrisxcross• 10 years ago

Well, they seem to have some opensourced some of their code. But they are far away form being free software although they claim to use the GPL. If I can't build the software myself, I won't use it.

zump• 10 years ago

Your kidding, right?

It's 2016, and technical people are still asking why people should use $SINGLE_APP instead of $COLLECTION_OF_OTHER_APPS_WITH_POOR_UI.

You'd think people would learn by now.

746F74752• 10 years ago

Which one of these are you using for VoIP on your computer?

danpalmer4• 10 years ago

I use Hangouts at work because it's easy to get it on the screens in our office. I don't use VoIP in my personal life much, and never on a computer, I'd rather use a phone (and therefore either a phone call, or Signal).

danpalmer4• 10 years ago

Ok, as several people have pointed out, there are portions that are open source. However, this doesn't help much.

It's better than iMessage, for example. With iMessage, the protocol is described, and we can confirm that it is a "secure" protocol, for some definition of secure, but we have no idea if that's what they actually use. With Wire, we can go a step further, the protocol is described in code, so we can verify that the code is correct, however we still cannot verify that this is indeed the code being used.

A step further, which as far as I can tell doesn't exist, would be to provide a bare-bones client (maybe a command line interface) that can be reproducibly built, so that people can interact with other Wire users, using code they built themselves, this would show that the protocol that the open source code describes is being used, however there's still the possibility of the closed-source Wire app subverting it in some way, perhaps with decreased entropy in random numbers, for example.

I apologise for not reading closely enough to see the GitHub link, but I also don't think this gets Wire anywhere near the level of Signal for example, which I have compiled and run myself in the past (and contributed to).

pmontra2• 10 years ago

The app is free. What do they make money from, do they have ads?

ycmbntrthrwaway3• 10 years ago

They say "No advertising" on the front page.

pmontra2• 10 years ago

So, philanthropy?

Siimteller4• 10 years ago

Currently VC backed (Iconical, Skype co-founder Janus Friis), premium services in the future.

r3bl2• 10 years ago

I really don't get this. What's their advantage over using this over... well, anything else?

They seem like a complete copy of Signal to me: they're a centralized service with open source clients that promises end-to-end encrypted communication. I see no difference between them. It's like re-inventing the wheel. Honestly, I don't see a single reason why I should use this.

nailer• 10 years ago

Does Signal do video now?

reidflix3• 10 years ago

No, I think it's in the roadmap though.

detaro• 10 years ago

The list of secure messengers that run on mobile and desktop is already pretty short. Add voice and video chat to the requirements...

I'm kind of skeptical if this is the solution, but it checks a lot of boxes I want.

ycmbntrthrwaway3• 10 years ago

They have comparison table on "Privacy" page: https://wire.com/privacy/#table-competition

andreyf3• 10 years ago

How does e2ee group video work?

dontscale2• 10 years ago

Why... can't there be alternatives?

r3bl2• 10 years ago

Of course they can.

But, I feel like that the tools that promise to solve the same problem should at least have one drastic difference between them.

Kind of like social networks. Even though they all tackle the same problem (trying to keep us connected) each of them does it in its own distinct way.

I don't see any such feature here. They're tackling the very same problem in a very similar way. A bit too similar for me in fact. And since their target is a niche audience, I only see us having even more difficulties if Signal gets more and more alternatives.

kitsunesoba• 10 years ago

The problem with Signal (at least for me) is that its desktop client relies on your phone's Signal app, which feels weird and "duct tape-ish". I've been spoiled by the ease of using iMessage with multiple devices (phone, tablet, desktop, or otherwise): just sign in and it works, no janky-feeling interdevice communication necessary, and I've come to expect that from any messaging service I use.

Signal is great for those who confine their instant-message-like communication to their phones, since desktops being treated as second class citizens isn't an issue for them. I am not one of those individuals. I want to be able to read and reply to messages on whichever device I'm using at the moment without having to think about my phone's presence at all.

cyphar• 10 years ago

Well, when you consider that the keys are ethereal, it makes it clear why it's "duct tape-ish". You could argue they should have a syncing protocol but now you need to come up with a secure syncing protocol.

DavidNielsen• 10 years ago

Signal is great in principle but:

1. Their desktop support isn't provided by a native app but rather ducktaped onto Chrome, which in turn forces me to have that pole of junk installed.

2. There's no iPad app, granted you can run the iPhone app in compatibility mode but that's just feels wrong in 2016.

3. Their support for multiple devices using one account can at best considered an afterthought attached to their mobile apps with gum. When I checked last it only worked with their Android and their Chrome clients so no love for iOS users.

Wire provides all of this, wrapped in beautifully designed apps (if currently a touch unstable)

ycmbntrthrwaway3• 10 years ago

Well, some source code is on https://github.com/wireapp

But it seems that only some crypto libraries are opensourced, no frontend and things like that.

hofmannsthal• 10 years ago

A new messaging app each week.

andreyf3• 10 years ago

all your data is protected by European privacy laws.

Interesting to note that "American" is implicitly synonymous with "insecure".

ekianjo• 10 years ago

Well it's not really a major difference since the US has major intelligence agreements with other countries.

LamaOfRuin• 10 years ago

Also interesting to note that, despite this claim on their front page, the Terms of Use specifies that for American users it is interpreted by / subject to California law and SF courts.

Veratyr4• 10 years ago

There are two things I'll note:

- As a non-American, I see America as one of the least safe places to store my information. The Snowden leaks showed that the US government has zero respect for the privacy of non-Citizens.

- As someone who's lived both inside and outside America, I've noticed that privacy laws in the US are weak relative to other countries (much of Europe, Australia) that I've been in. Europeans have things like Right to be Forgotten. Americans have companies that have refused to remove my personal information after I terminated my account with them.

awqrre• 10 years ago

America doesn't appear to respect it's Citizen's data privacy either, they just have to collect the data indirectly from other countries (I'm not sure how they can avoid respecting the laws by doing it this way though...)

technion2• 10 years ago

As an Australian, I would argue the metadata retention laws leave us just as weak as the US - if not, worse. I'd be surprised if the US equivalent of Greyhound Racing Australia had legally mandated, warrantless access to every ISP's metadata.

andreyf3• 10 years ago

Safari unsupported for web version:

Download the latest version of Google Chrome, Mozilla Firefox, Opera or MS Edge to use Wire for Web.

Siimteller4• 10 years ago

Safari lacks WebRTC support in a manner that would play nice with Wire features. Thus no support for now.

dingdingdang• 10 years ago

I think this looks good - whether long term use is sustainable is dependent on whether they open up their protocol to interoperability via some sort of consortium. Email rules, not because of its brilliance, but because of its level of standardisation and ubiquity. The trick will be to provide a transparent P2P solution that can somehow be boosted by leaving nodes online.. now provide pay for service that can run the nodes for people - business plan (tm).

On second thought this kind of thing is already done around the torrent sub-culture with regards to seed boxes..

shmerl• 10 years ago

All modern platforms? I don't see the Linux version.

Plus, for any such application to have trust these days, it should be open source both for clients and servers. Enough of this walled garden closed instant messaging.

mchahn2• 10 years ago

I don't see the Linux version.

It runs in the browser so technically it runs on Linux.

tyfon• 10 years ago

I just tested the video call with my parents that still have an old adsl link to their home, it was crystal clear. Both skype and hangouts struggle when doing the same. Hangouts actually makes the audio choppy.

I'm a bit worried about using something that is free and has no ads while maintaining central servers though..

degenerate• 10 years ago

I just gave it a shot too, and it works well. I deleted my account though, because I only need voice chat with my team and Discord has this app beat hands down for collaboration and team rooms.

tmikaeld2• 10 years ago

Discord isn't encrypted (Only client-to-server) and it's not open source at all.

It's too bad though - as you say - it is very nice for collaboration and teams (It's geared exclusively towards gamers).

andrey_utkin• 10 years ago

Enough of fenced services owning the users. I'm fed up with carouselle of new services for same features. I'm going to stick with XMPP, which is openly federated and free as in freedom. It is now technically capable of chat sync, sent messages editing, end to end encryption (there are alternative modes to fit different usecases), videocalls, and many more things. There are working gateways to many other networks, including Skype (not fully, but mostly enough to start transition away from skype).

Veratyr4• 10 years ago

XMPP could be a fantastic option but it's missing push notifications, which are an absolute killer these days. You either don't use XMPP on mobile or take a massive hit to your battery.

ChatSecure has a nice writeup about this: https://chatsecure.org/blog/fixing-the-xmpp-push-problem/

edhelas2• 10 years ago

Conversations have Push Notification support https://github.com/siacs/Conversations/issues/1171. There is a standard and it's implemented in some XMPP servers as well.

mickael• 10 years ago

XMPP strong selling point is federation. You can run your own private server and it does encryption. There is plenty of implementations from servers to clients, most being open source. It seems to me just one of the Zillion messaging alternative available.

reustle• 10 years ago

Why hasn't there been a beautiful XMPP apps created? A company could come in and provide effortless XMPP server setup for a monthly price, and provide great apps for all to use, no?

edhelas2• 10 years ago

There is. You can have a look at Conversations for Android https://play.google.com/store/apps/details?id=eu.siacs.conve... and I'm also working on Movim https://movim.eu/ ;)

zaro• 10 years ago

Yet another WhatsApp, Messenger, Viber, Line, WeChat, Skype ,<Insert your own closed protocol, walled garden, messaging app here>.

So innovation, much technology ...

Wire – modern, private messaging from Skype co-founder

Related Stories