I don’t understand why the article writes that iMessage is the only way for encrypted messaging between Android and iOS. I can thing of several off the top of my head:
Apple’s biggest crimes here are creating a proprietary platform with an exclusive protocol and making it the default messaging protocol on their devices. None of this is really new, though. All that shit is common. We need Signal or Matrix to improve in user-friendliness and even do some marketing to the point where they become viable solutions.
Android has an easy remote backup system built in. You can save a file to any location, including cloud locations, as long as the cloud service provider plugs into the API. Signal actively disables this feature because they would rather spite users than risk even the shadow of a chance that a user upload an encrytped backup to an internet service that could theoretically then be hacked and hypothetically maybe one day decrypted.
Matrix doesn’t have this issue, it just stores encrypted messages on servers.
I’m not sure about Signal being the one, then we just give the power from one company (Apple) to another (Signal). If we want to improve then we should push open protocols where people can host their own infrastructure.
Ideally, I agree. In practice, until federation / decentralization is completely transparent to the end user (unless they choose otherwise), it’ll never be adopted at a large scale. IMO that’s one of the main obstacles of Lemmy, Mastodon, and others.
Signal is only relatively popular among the privacy-respecting options because setting it up is as easy as setting up WhatsApp. Just by adding a “choose your instance” step, you can cut your user base by an order of magnitude. And that’s not mentioning the quality of service, which is much more achievable on a centralized platform, whether that’s in terms of feature parity, uptime, bug fixes, or cross-platform support.
Message works, it’s seamless and does a good job. Sure I’ll change to something else if I need to send images or group chat with Android uses, but in the UK that generally means WhatsApp, which I am definitely not keen on.
telegram is not encrypted by default, and does its best to make you forget to enable it for each individual contact. if you want to do a group chat, you’re out of luck.
Telegram is only (partially) secure for pedantic power users, which most people aren’t.
so, relative to pretty much all other messaging services, it might as well not be.
You’re saying “by default not everyone can read your messages, only you, the recipient, telegram themselves and anyone who they might decide to share them with, with neither your consent, nor knowledge”
When compared to “nobody except you and the recipient” that becomes effectively equivalent to “nothing”.
also, not end-to-end ever when it comes to group chats
Almost all services in that list are closed source, so even if they use end-to-end encryption nothing stops the client from sending all your messages to anyone they like after decrypting (in fact some of them already have it as a built-in feature in the form of backups).
that would be very quickly caught by a network sniffer, because it would have to be sent from your own device. Otherwise they’d just be sharing the undecryptable ciphertext you sent to their servers
Just encrypt it before sending it to their servers. How would you tell that apart from any other traffic it sends? (E.g. to check for new messages, to update who of your contacts is online, etc)
what does that have to do with anything? if you have to encrypt your messages manually yourself, that kind of proves the point that the service itself is not secure. And it’ll still show up on a network sniffer that they’re sending it to two places
Ok, let me break it down because clearly I didn’t explain it well.
What is supposed to happen, scenario 1: the client encrypts your messages with the public key of the recipient, sends it to the servers of WhatsApp (or whatever service) along with some encrypted metadata indicating the recipient, which then forward the message to the recipient.
What could happen, scenario 2: the client does the same, but also encrypts another copy of your message with a public key that belongs to WhatsApp, and send both versions to the WhatsApp servers. They decrypt and keep the second version while forwarding the first one to the recipient.
Or, scenario 3: they just never bother with end-to-end encryption, and always encrypt it with the WhatsApp key, still sending it to their servers which then reencrypt with the recipient’s key before forwarding.
In all cases, messages are sent only to the WhatsApp servers, not two places. The only visible difference is in scenario 2 where the communication is larger. You can’t inspect the metadata of the message with your network sniffer, because it is also encrypted, so there’s no way to rule out scenario 3.
If the protocol is designed to be transparent by not encrypting the entire payload sent to the servers, and you have access to the recipient’s private key (those are big ifs) then you could show that there is indeed an end-to-end encrypted message in there. But this is true for how many of these proprietary services? Maybe for WhatsApp.
I don’t understand why the article writes that iMessage is the only way for encrypted messaging between Android and iOS. I can thing of several off the top of my head:
And there are surly more …
cause of lazy iOS users that can’t be bothered to use anything else
Then why are we shaming Apple and not the iOS users? I think Apple is totally reasonable here.
Apple’s biggest crimes here are creating a proprietary platform with an exclusive protocol and making it the default messaging protocol on their devices. None of this is really new, though. All that shit is common. We need Signal or Matrix to improve in user-friendliness and even do some marketing to the point where they become viable solutions.
The default messaging protocol is SMS. Unless you are talking with another Apple user
in other words: the default messaging protocol is imessage, unless that’s impossible, in which case it falls back to sms.
More marketing would be nice
As for features, an easy remote backup solution (similar to be bettet than WhatsApp) is the big one for me. Especially on iOS
Android has an easy remote backup system built in. You can save a file to any location, including cloud locations, as long as the cloud service provider plugs into the API. Signal actively disables this feature because they would rather spite users than risk even the shadow of a chance that a user upload an encrytped backup to an internet service that could theoretically then be hacked and hypothetically maybe one day decrypted.
Matrix doesn’t have this issue, it just stores encrypted messages on servers.
I’m not sure about Signal being the one, then we just give the power from one company (Apple) to another (Signal). If we want to improve then we should push open protocols where people can host their own infrastructure.
Ideally, I agree. In practice, until federation / decentralization is completely transparent to the end user (unless they choose otherwise), it’ll never be adopted at a large scale. IMO that’s one of the main obstacles of Lemmy, Mastodon, and others.
Signal is only relatively popular among the privacy-respecting options because setting it up is as easy as setting up WhatsApp. Just by adding a “choose your instance” step, you can cut your user base by an order of magnitude. And that’s not mentioning the quality of service, which is much more achievable on a centralized platform, whether that’s in terms of feature parity, uptime, bug fixes, or cross-platform support.
Message works, it’s seamless and does a good job. Sure I’ll change to something else if I need to send images or group chat with Android uses, but in the UK that generally means WhatsApp, which I am definitely not keen on.
There is absolutely nothing reasonable with using an inferior and outdated standard compared to what literally everybody else uses.
Most of those are proprietary. My list:
telegram is not encrypted by default, and does its best to make you forget to enable it for each individual contact. if you want to do a group chat, you’re out of luck.
Telegram is only (partially) secure for pedantic power users, which most people aren’t.
telegram is encrypted, but not end to end encrypted by default
so, relative to pretty much all other messaging services, it might as well not be.
You’re saying “by default not everyone can read your messages, only you, the recipient, telegram themselves and anyone who they might decide to share them with, with neither your consent, nor knowledge”
When compared to “nobody except you and the recipient” that becomes effectively equivalent to “nothing”.
also, not end-to-end ever when it comes to group chats
Almost all services in that list are closed source, so even if they use end-to-end encryption nothing stops the client from sending all your messages to anyone they like after decrypting (in fact some of them already have it as a built-in feature in the form of backups).
that would be very quickly caught by a network sniffer, because it would have to be sent from your own device. Otherwise they’d just be sharing the undecryptable ciphertext you sent to their servers
Just encrypt it before sending it to their servers. How would you tell that apart from any other traffic it sends? (E.g. to check for new messages, to update who of your contacts is online, etc)
what does that have to do with anything? if you have to encrypt your messages manually yourself, that kind of proves the point that the service itself is not secure. And it’ll still show up on a network sniffer that they’re sending it to two places
Ok, let me break it down because clearly I didn’t explain it well.
What is supposed to happen, scenario 1: the client encrypts your messages with the public key of the recipient, sends it to the servers of WhatsApp (or whatever service) along with some encrypted metadata indicating the recipient, which then forward the message to the recipient.
What could happen, scenario 2: the client does the same, but also encrypts another copy of your message with a public key that belongs to WhatsApp, and send both versions to the WhatsApp servers. They decrypt and keep the second version while forwarding the first one to the recipient.
Or, scenario 3: they just never bother with end-to-end encryption, and always encrypt it with the WhatsApp key, still sending it to their servers which then reencrypt with the recipient’s key before forwarding.
In all cases, messages are sent only to the WhatsApp servers, not two places. The only visible difference is in scenario 2 where the communication is larger. You can’t inspect the metadata of the message with your network sniffer, because it is also encrypted, so there’s no way to rule out scenario 3.
If the protocol is designed to be transparent by not encrypting the entire payload sent to the servers, and you have access to the recipient’s private key (those are big ifs) then you could show that there is indeed an end-to-end encrypted message in there. But this is true for how many of these proprietary services? Maybe for WhatsApp.
Technically, yes, this is a solution.
Socially, no. This is not a solution. People are just too lazy.
I assume that if people are too lazy to switch to a solution which works for every one then they are not very interested in talking to you anyway.
Except it’s not a solution that works for everyone. It’s 9 solutions. If it were one it would be a lot easier.
7 once you take out the ones owned by Facebook.