News for hackers. Stuff that matters.
Re:There is no WhatsApp 'backdoor' by sschueller on Saturday January 14, 2017 @08:22AM (#13398257)
Wire uses the signal protocol. [1] I am not sure if they require google play services but I thought saw something a while back on their github regarding a fallback if google services was not installed and battery consumption.

[1] https://wire.com/download/

Re:There is no WhatsApp 'backdoor' by zedred on Saturday January 14, 2017 @12:10PM (#13399332)
They don't use the signal protocol, they don't even use X3DH or Double Ratchet. That citation of yours is just a download link, not an actual reference to your point.

The project is also kind of a mess. Check out their privacy policy, Wire maintains a server side copy of your entire contact list, all the groups that you're in, the plaintext metadata for your groups (membership, plaintext group title, plaintext group avatar).

Check out some of the code. They have broken voice encryption, and leak enough data to reconstruct the audio of your calls. They leak tons of plaintext directly back to themselves, like searches, and rolled their own messaging crypto.

They have been caught lying about what kind of encryption they provide[1], they lied about being open source for years, they lied about being based in switzerland. From what I can tell, the only people promoting Wire are usually on Wire's marketing team.

1: http://www.pcworld.com/article/2855745/new-communications-ap...

Re:There is no WhatsApp 'backdoor' by FabHK on Saturday January 14, 2017 @02:46PM (#13400184)
I'm surprised at your negative take. The article you link is from 2014. They do encrypt chats now, and group chats, and voice, and video, all e2e, as far as I can tell.

My understanding is that the developers sit in Berlin, but the legal entity is in Switzerland.

Their privacy policy [1] states that they retain logs for 72h, and not much else. Only hashed contact info (emails/phone numbers) are uploaded, after opt-in. It all sounds very reasonable.

Your argument seems to be that they're an untrustworthy mess - but I don't see much evidence of that, except for possibly some braggadocio in that old article.

> Check out some of the code.

Yes, it is on github [2], so you can do that, which is nice.

[1] https://medium.com/wire-news/simple-privacy-policy-72-hour-l...

[2] https://github.com/wireapp

Re:There is no WhatsApp 'backdoor' by sschueller on Saturday January 14, 2017 @01:42PM (#13399833)
According to wikipedia "its instant messages with Proteus, a protocol that Wire Swiss developed based on the Signal Protocol" [1] so I guess it is just based on it.

[1] https://en.wikipedia.org/wiki/Wire_Swiss

Re:There is no WhatsApp 'backdoor' by ycmbntrthrwaway on Saturday January 14, 2017 @10:52AM (#13398914)
Wire uses Firebase Cloud Messaging (former Google Cloud Messaging) by default as it is the Google requirement. If you, as a developer, roll out your own solution, you simply get banned on Google Play. Claimed reason is that FCM/GCM delivers all your messages in batch, so it saves your phone power [0]. It is doubtful because your phone may enter Discontinuous Reception (DRX) state, so your cellular operator will deliver messages in batch anyway, but whatever. I think it is Google pushing developers to use their push servers while avoiding antitrust laws.

GitHub message about fallback to WebSocket you are referring to is here: [1]. So you can remove all Google services from your phone and install APK, it will still work, but now Wire server pings your phone whenever it wants. TLDR on the thread is that APK is not uploaded to F-Droid due to dependency (not really) on Google services.

[0] https://developer.android.com/training/monitoring-device-sta...

[1] https://github.com/wireapp/wire-android/issues/5#issuecommen...