131–140 of 152 posts
Earlier quoted context omitted.
> These apps are free to download Yes but you aren’t truly free to choose which app you download. You have to use the one being used by the people you want to message. That is of strong benefit to incumbents.
Has there been meaningful innovation in messaging? I had free AIM on $3 T-Zones in 2006. So I see no downsides to just forcing interoperability.
Earlier quoted context omitted.
As far as I can tell, "limit" will soon mean "disable". They just can't flip that switch yet given that legacy clients will not know what to do about "numberless contacts". > do not get my phone number period I'd also like that, but they apparently use phone numbers as a primary key for account recovery and identification (e.g. on a new device without the old one present), so that's probably very hard to change archi…
> There are some interesting concepts of "identityless messengers" Like... icq... yahoo messenger... old skype... ? And even some modern mobile chat apps i think.
What I mean is having an ad-hoc identifier per contact/group chat which doesn’t allow your various contacts to correlate that you are the same person.
Earlier quoted context omitted.
It's not specific to iCloud Keychain--it applies to on-device Keychain on iOS devices, too, even if you don't use iCloud. Any developer can store data there with no way for the user to know or see what it's saving, and it's shared among all apps from the same developer. Keychain is quite a misnomer here--it's really "store any (short) data you want on a user's device without them ever being able to see or remove it".…
This is also used heavily for abuse / spam / fraud prevention. If you detect that a user is abusing your service, the ability to put a permanent cookie on their device is very useful. This isn't effective against organized crime groups (they can just get Macs / use the web / whatever), but works well against your average troll or internet racist. Still tracking, but a very different kind of tracking.
Earlier quoted context omitted.
Actually I forgot about iMessage. It’s the only service where forced interoperability makes sense (because you can’t “just download an app”, you’re locked out of the service unless you buy an Apple device), and yet it was excluded. Hopefully the EU changes the law so it applies to iMessage.
in Europe very few people are using iMessage, most of them are using Whatsapp
Earlier quoted context omitted.
If you switch every month then you will have been present in the EU within any 60-day window?
Literally lawyering up the implementation
Earlier quoted context omitted.
I think it's quite fair to demand basic security compliance for implementing an E2EE messenger. That said, I'm sure we'll see open source libraries pop up everywhere to communicate with WhatsApp directly. There already are unofficial WhatsApp clients in various forms, but now they can use the protocol without risking breakage because they reverse engineered the contents of the protocol itself. I think there will be p…
> I'm sure we'll see open source libraries pop up everywhere to communicate with WhatsApp directly. How so? Each of them would need approval by Meta + signing an NDA, and I can easily see that ruling out open source libraries.
Earlier quoted context omitted.
You can't uninstall WhatsApp that way though. Not just the web client, but also the app on your phone, which the web client proxies everything through.
The Web client doesn't need the app anymore, at least it works without having your phone on. You have to relogin every once in a while though.
Earlier quoted context omitted.
You may dislike it, but EU law only applies in the EU; it sounds like full compliance to me, not "bad faith" compliance. Messaging-interoperability is the one aspect of the DMA I don't support. These apps are free to download; and if you care about security (and use Signal) you'll want to avoid cross-service messaging anyway.
Why don't you support it? There are government services that use whatsapp in my country. This argument "just don't use it" is very tired. Interoperability can be achieved with E2E encryption.
Gosh, all of this is so locked down. I've been waiting for this, and hoping I could "just" cook up some of my own code to use with WhatsApp, and/or integrate it with Pidgin or bridge to email or whatever. But the entire process is about as hostile as possible. For example "Partner shall have in place a dedicated security team" basically excludes most startups, or most smaller companies. It's not clear to me if this i…
I think it's quite fair to demand basic security compliance for implementing an E2EE messenger. That said, I'm sure we'll see open source libraries pop up everywhere to communicate with WhatsApp directly. There already are unofficial WhatsApp clients in various forms, but now they can use the protocol without risking breakage because they reverse engineered the contents of the protocol itself. I think there will be p…
That's really a decision you should make, and not WhatsApp – "do I trust this arp242 guy and his GitHub repo?"
And some auditing isn't necessarily too bad, I guess, but a lot of this goes far beyond "basic security"; it's the type of "corporate checkbox security" that we all know works so well.
Earlier quoted context omitted.
The preview sends a request to some server on a Facebook subdomain. I know because I was sniffing traffic on my phone without any Facebook app installed other than WhatsApp.
Okay, but do they actually use any data from that? What does the privacy policy say? Have any effects been observed beyond "uses a facebook domain" (e.g. you see ads on Facebook for a site you had in preview)? Is there functional reason for using that domain?
Because no one else can answer your questions.