How Signal Beats WhatsApp

https://theintercept.com/2016/06/22/battle-of-the-secure-messaging-apps-how-signal-beats-whatsapp/

by kushti • 10 years ago

51 41 10 years ago

theintercept.com

Bromskloss• 10 years ago

I'm trying to figure out what chat method is considered superior. What about Matrix? Should I use that or Signal?

NobleSir2• 10 years ago

Would also love to hear a point-by-point comparison of the two..

CiPHPerCoder5• 10 years ago

It looks like it uses Olm, which aspired to be an early implementation of the Signal protocol (when it was called Axolotl):

https://matrix.org/git/olm/about/

I've not audited their implementation, but at least that one design choice is sane.

IIRC there were some design changes between the early Axolotl ratchet and the Signal Protocol. If you're interested in using Olm, I would make "find out what the differences are and why" my first priority.

tptacek• 10 years ago

The premise of the article --- and it's a good premise --- is that the secure chat applications you should consider are those that implement Signal Protocol. Matrix does not.

vonklaus3• 10 years ago

do you have any resources for building a secure chat application, or maybe more accurately, implementing secure chat as a feature of an application?

Arathorn• 10 years ago

correct; Matrix doesn't implement Signal Protocol. We use the Olm ratchet as a 1:1 ratchet which is an independent implementation of the Double Ratchet (aka the Ratchet formally known as Axolotl), and have added our own group ratchet called Megolm to handle the semantics required for Matrix.

In terms of how it compares to Signal: we are still in alpha (although Olm now ships on the develop branch of matrix-js-sdk and dependencies), and so obviously Signal is infinitely more mature. However, we are getting the core ratchet publicly audited during July before we push all the E2E formally live, which should give a better idea of how reputable to consider it.

sbank• 10 years ago

Does anyone have thoughts on Wickr? It comes with extra features like expiring messages/media.

teaneedz• 10 years ago

Though the argument is that it's closed source, there's a level of trust I have for Wickr and team. There's even less meta involved with Wickr since no phone number is collected and the app forensically deletes messages. Nico Sell has a pretty awesome reputation of standing up for privacy.

amelius• 10 years ago

No messaging service is going to beat another messaging service purely on technological grounds. The "network-effect" is just too strong.

gajjanag• 10 years ago

Exactly. I have Signal installed, but none of my contacts have it installed on their phones.

And Signal's "helpful" banner at the top that allows easy invitation of contacts will (rightly) be treated as spam by most of my contacts - these secure/encrypted chat apps keep coming and going, with some people saying "just use Whatsapp, it is now encrypted", others complaining that it is closed source, etc. I can't keep changing my recommendations every few months and expect my contacts to do the same. In fact, it is only through hn that I even heard of yet another protocol: https://matrix.org/.

Practically speaking, WhatsApp works best wrt security for me due to these network issues - essentially all of my Indian contacts have it for some reason, likely again some positive feedback loop due to network effects in India. And there is no such dominant app among my US contacts, hence I fall back to plain old SMS.

arjie4• 10 years ago

Personally, I only want to send messages regarding harmless stuff. Being able to send my location in-line (or even share live like WeChat) is a feature I'd drop any privacy protection for.

On top of that, I'm not going to get my parents to switch to the messaging app du jour. I'm going to hope that the one I use adopts good technology.

Maybe Signal is awesome. But privacy from law enforcement is not a killer feature. The US Government has substantial leverage over me in other ways. If it's come to the point that they want my communications, I've already lost.

CiPHPerCoder5• 10 years ago

Maybe Signal is awesome. But privacy from law enforcement is not a killer feature. The US Government has substantial leverage over me in other ways.

What about the UK government? The GCHQ is one of the most aggressive and sophisticated signals intelligence agencies in the world.

What about the RU government? Or the Chinese government?

The reason most security folks speak of "nation state actors" in aggregate isn't to be euphemistic (initials: NSA), it's because "the only threat you might encounter online is your local government" isn't necessarily true.

To be clear, I don't want to turn this into a political discussion. I just wanted to point out that the scope is wider than your comment implied.

arjie4• 10 years ago

This is true, but what are they going to do to me? The threat is not clear to me.

moxie4• 10 years ago

This is why the Signal team spends time working with other messengers. We want to help enable Signal Protocol in the products that everyone is already using (like WhatsApp), rather than expecting everyone to switch to our app.

arjie4• 10 years ago

And thank you for that.

aftbit3• 10 years ago

Has anyone tried running a "private" Signal cluster? I'm sad that Signal is so centralized. I wish they had built a federated protocol instead. :(

iaml• 10 years ago

At this point why not jabber?

joeyspn• 10 years ago

At this point why not Matrix?

aftbit3• 10 years ago

It looks like Conversations has implemented the Axolotl ratchet for XMPP as "OMEMO". I need to do more research to see how I can get support for that on all of my devices.

[1] https://conversations.im/omemo/

moxie4• 10 years ago

I agree that it's sad. However, here's some rationale as to why we feel that it's the appropriate choice for the project: https://whispersystems.org/blog/the-ecosystem-is-moving/

aftbit3• 10 years ago

Thanks for the well-reasoned and well-explained post. I still instinctively disagree, but I need to go make a cup of tea and ruminate a bit before I can fully explain why.

My biggest concern is that centralization necessarily leads to a central point of failure. While someone might be able to run their own fork of Signal in that case (kudos for making the server open source as well as the client!), nobody seems to be trying right now. Contrast that with email, XMPP, or HTTP, where millions of people have developed the operational skills necessary to do a modern deployment.

Your point about people moving between services instead of between providers seems true enough, in every space except for chat. People choose their chat provider based almost entirely on what their friends and colleagues use. Look at Facebook Messenger, Google Talk/Hangouts, even the ancient Yahoo Instant Messenger - all have significant user bases, despite not being number 1 technically in basically any category.

As for a truly federated applications protocol (with no implicit centralization), HTTP springs to mind. Despite your argument about HTTP being stuck in the 90s, a number of significant changes have occurred in this century. WebSockets, HTTP/2, and nearly ubiquitous TLS, among others, not to mention all the improvements in the browser space now that we finally have a sane standards process. And all of this is possible despite the fact that no single company has a majority of either server or client implementations. More importantly, HTTP is used in a far different way today than it ever was in the past. Instead of delivering pages of content over fast pipes to desktops, HTTP delivers rich web apps over flaky wireless connections to handheld computers - and the same protocol developed in the 80s has evolved nicely to serve both of these purposes.

Federation may not be the best answer for OWS, and it might not even be the best answer for the Signal community (today), but it is not necessarily the kiss of death for a project either.

wraith69• 10 years ago

I'm disappointed that telegram wasn't on this list!

I'm curious about signal but their with service just seems to hang for me.

pfg2• 10 years ago

Telegram uses homegrown crypto with known weaknesses[1] and doesn't do end-to-end encryption by default (your messages are stored on their server in plain text).

[1] https://news.ycombinator.com/item?id=10713064

pfg2• 10 years ago

I feel like the metadata collection argument is overrated here. It's a nice promise, and it's not that I don't believe them, but at the end of the day it's just that: a promise. We've got messengers with E2E crypto because we don't want to just take someone's word that messages won't be read/intercepted, so the same logic should be applied to metadata: Either the protocol guarantees that metadata cannot be collected, or we should assume that it's being done.

Signal being open source is still a very good argument in favour of it. It's also great that they're careful about not including features that could make it easy to shoot yourself in the foot (online backups). We can do without the whole "just trust them" dance.

themartorana• 10 years ago

I think this is an important point. The article says WhatsApp doesn't collect metadata as normal course, but it can and will where legally required.

Then it says Signal doesn't collect metadata, and stops there. I'm pretty willing to bet they're just as governed by NSLs as WhatsApp, and if legally required, can and will collect said metadata and hand it over.

The only way to not do so is to go the Lavabit route.

newman3142• 10 years ago

The article says that Signal hashes contacts etc.

I was under the impression that this had been reverted because it is "hard". Has that decision changed?

https://whispersystems.org/blog/contact-discovery/

moxie4• 10 years ago

Nothing has changed. The premise of that blog post is that we'd like to do better than ephemeral intersection requests using truncated hashes of contact identifiers, but that we don't believe it's currently possible to do better.

newman3142• 10 years ago

So to confirm, the current version of Signal now transmits contact data in the clear.

anexprogrammer• 10 years ago

I love Signal and they're responsive to requests or bug reports in a way that Google or Whatsapp can never be, and it seems, don't want to. I don't care if it's missing a few features. Most of the features added to messaging are pointless fluff anyway. So what they're 3 people, when I reported an unusual bug it was fixed in a couple of days. Try that with Google.

What does impact me is the userbase. I've tried, and generally failed, to get lots of friends using Signal. I get to use it with just the small subset that are privacy aware and techie.

Given they use the same protocol, it's a shame we can't message whatsapp or allo users. Yes it compromises my privacy compared to staying native, but less than having to install their whole app.

na85• 10 years ago

As a counterpoint: I reported an unusual bug months ago and it still isn't fixed. Instead they gave me the usual "try turning it on and off again" baloney and then began ignoring the issue.

nextos• 10 years ago

I dislike a bit how they have ignored community requests to support alternative transport systems to Google Cloud Messaging [1]. This has even led to a fork [2].

It'd be also great to have a desktop client for Linux. Even a simple CLI would do.

If those 2 things were fixed, it'd be an awesome messaging platform.

[1] https://github.com/WhisperSystems/Signal-Android/issues/1000

[2] https://fdroid.eutopia.cz/

legulere• 10 years ago

How WhatsApp beats Signal: Almost everyone I know uses WhatsApp, I don't know of anyone that uses Signal.

How Signal Beats WhatsApp

Related Stories