News for hackers. Stuff that matters.
Re:Darpa wants to make a better, more secure, version of Wha... by YeahSureWhyNot on Monday April 15, 2019 @03:56PM (#19668363)
Aside from the typical encryption worries here are some features I would love to see being offered on a alternative messenger app

-ability to give out your alias or username to people to reach you on whatsapp instead of a phone number, something you can change later after banning the contact.

-transcribe voice messages to enable search among them.

-ability to hide the fact that i have listened to their voice message.

-ability to hide the fact that i am on whatsapp network and receive 'add to contact' requests from people where i can accept or reject without them knowing i actually rejected.

-hide the 'online' in conversation window when im reading the message.

-save my chat history in the cloud so that i dont lose everything when i move from iOS to Android or vise versa.

-ability to save incoming and outgoing media attachments to the cloud for access later

-full desktop support for video and voice calls

-ability to record the calls, and have their transcribed texts easily searchable.

-ability to ignore certain kind of messages from certain people such as 'allow text messages only, no calls, no pictures, no videos.' etc.

Re:Darpa wants to make a better, more secure, version of Wha... by jolmg on Monday April 15, 2019 @07:19PM (#19669740)
- user accessible backups. WhatsApp backs up to your Google Drive account but you can't access it directly. Only WhatsApp may do that (f_ck you Google for contributing to WhatsApp's lock-in). Local backups are encrypted so you can't read them. Exports are incomplete (for example, on one chat it would give me the last month or so when I could scroll back more than a year). WhatsApp discards old messages at its discretion without letting you configure otherwise. I lost a ton of very important texts from the last months of my now-deceased mother. I f_cking had to scrape what was left from WhatsApp Web.

- open protocol and open source clients and servers, with network working independent of any particular provider to be able to ditch any misbehaving one.

- no expiration on software versions. Why are we being forced to update versions to view old messages?

Damn is software becoming user hostile.

Re:Darpa wants to make a better, more secure, version of Wha... by AmericanChopper on Monday April 15, 2019 @04:34PM (#19668675)
>save my chat history in the cloud so that i dont lose everything when i move from iOS to Android or vise versa.

Implementing this could make key management either less secure, or more difficult for users. If the user still had access to both devices, it wouldn’t be too bad. But if you want the users to be able to ‘recover’ their message history on any device, then you’d need to use something like the mnemonic seed phrase, which isn’t an improvement in UX, or security.

The audio transcribing sounds difficult too, as you’d have to do it all client side if you wanted to preserve the security model.

Re:Darpa wants to make a better, more secure, version of Wha... by meruru on Monday April 15, 2019 @04:46PM (#19668754)
Is there any issue with the Automatic Key Backup feature in Riot?

>Once enabled, your device will maintain a secure copy of its keys on your server. To ensure those keys can only ever be accessed by you, they are encrypted on your device, with a key that you either store yourself or secure with a passphrase and upload to your server. It is important to understand that to protect your privacy your keys will never touch the servers unencrypted. https://medium.com/@RiotChat/the-big-1-0-68fa7c6050be

Re:Darpa wants to make a better, more secure, version of Wha... by AmericanChopper on Monday April 15, 2019 @05:01PM (#19668876)
This is probably the most elegant solution to achieve that functionality, but it still has a few security downgrades.

To back up the keys, you either need to manage a server yourself, or store them with a 3rd party that you trust.

To protect the backed up keys, you either need to manage another key, which just kicks the can down the road, or use a passphrase. If you give your users the option to protect their keys with a passphrase or with a mnemonic word list, a lot of them will pick the passphrase because it’s easier. It’s also less secure, especially if your users choose a weak passphrase, which a lot of them will.

I really like the whatsapp solution, because it has all the security under the hood and doesn’t let the users revert to less secure behaviour. It has an obvious UX tradeoff (with lost message history), but the alternative is to downgrade the key management UX to that of managing a cryptocurrency wallet.

Re:Darpa wants to make a better, more secure, version of Wha... by nsuser3 on Monday April 15, 2019 @05:35PM (#19669141)
> -full desktop support for video and voice calls

Any desktop support would be nice. WhatsApp web is not a real solution.

Re:Darpa wants to make a better, more secure, version of Wha... by tehlike on Monday April 15, 2019 @05:48PM (#19669232)
It kind of is, at least it is 80% there. What is your problem eith it? Having to handshake almost everytime?
Re:Darpa wants to make a better, more secure, version of Wha... by jolmg on Monday April 15, 2019 @07:48PM (#19669889)
For me, the problem is that it requires internet access. When I found that WhatsApp was deleting important messages and that the backups and exports that I was counting on were useless, as I mentioned in another comment[1], I found that the easiest way to save those messages was to scrape them from the web client. However, connecting the phone to the internet meant that it would receive more messages and hence delete more messages. I took screenshots manually of several days of the oldest available messages to avoid losing them, but it wouldn't have been necessary if the desktop client didn't require internet access.

[1] https://news.ycombinator.com/item?id=19669740

Re:Darpa wants to make a better, more secure, version of Wha... by sandov on Monday April 15, 2019 @06:11PM (#19669374)
What if you left your phone at home and it's not connected to the Internet?.

I usually leave my phone at random places in my house and have to find it and 'wake it up' so that it connects to the wifi and I can use Whatsapp web.

Re:Darpa wants to make a better, more secure, version of Wha... by gsich on Monday April 15, 2019 @06:23PM (#19669435)
no gif upload support
Re:Darpa wants to make a better, more secure, version of Wha... by nabla9 on Monday April 15, 2019 @05:58PM (#19669290)
Re:Darpa wants to make a better, more secure, version of Wha... by meruru on Monday April 15, 2019 @04:32PM (#19668654)
I think most if not all of that is possible with matrix.org.
Re:Darpa wants to make a better, more secure, version of Wha... by TypingStuff on Monday April 15, 2019 @05:14PM (#19668985)
Matrix should have improved XMPP rather than added yet more fragmentation.
Re:Darpa wants to make a better, more secure, version of Wha... by afiori on Tuesday April 16, 2019 @05:22AM (#19672234)
> -transcribe voice messages to enable search among them.

> -[..] video [..] calls

> -ability to record the calls, and have their transcribed texts easily searchable.

> -ability to ignore certain kind of messages from certain people such as 'allow text messages only, no calls, no pictures, no videos.' etc.

Apart from these I believe Telegram offers already the other features (voice desktop calls are a bit unreliable often)

Re:Darpa wants to make a better, more secure, version of Wha... by waplot on Tuesday April 16, 2019 @02:07PM (#19675858)
>-save my chat history in the cloud so that i dont lose everything when i move from iOS to Android or vise versa.

the key is that the data has to be encrypted. currently i think whatsapp uploads your chat history as plaintext. this basically allows the corps. to get your data.

Re:Darpa wants to make a better, more secure, version of Wha... by williamscales on Monday April 15, 2019 @07:15PM (#19669712)
> -save my chat history in the cloud so that i dont lose everything when i move from iOS to Android or vise versa.

Is there something in the existing WhatsApp cloud backup feature that prevents you from bringing those backups between iPhone and Android?

Re:Darpa wants to make a better, more secure, version of Wha... by YeahSureWhyNot on Monday April 15, 2019 @07:21PM (#19669753)
I did a lot of research and apparently its impossible because if different database formats the messages are saved on two platforms. At least that's what I understood on some random forum.
Re:Darpa wants to make a better, more secure, version of Wha... by kace91 on Monday April 15, 2019 @07:37PM (#19669835)
It is possible to do so, using third party applications. I've done it with the help of a friend, although it required using paid Windows apps that looked like there was no way they could possibly be legitimate and not a scam - they worked like a charm. the process involved an application downgrade, forcing the iPhone to make local backup instead of backing up to the cloud and a handful other things, all of which where automated.
Re:Darpa wants to make a better, more secure, version of Wha... by YeahSureWhyNot on Monday April 15, 2019 @08:10PM (#19669976)
yeah I saw those and to your point I thought there is no way these are legit and I thought it's definitely a scam
Re:Darpa wants to make a better, more secure, version of Wha... by amelius on Monday April 15, 2019 @04:28PM (#19668625)
- ability to add custom emoticons to your library, and ability to share them