The life-changing magic of WKD

[bencan]

@Sandra

Sending a message to someone when all you have their user name is
what’s NOT nerdy. It’s what you can do normally on OMEMO, Signal,
Proton, Matrix, all other apps I’ve ever heard of from ICQ to
SMTP to text messages and phone calls.

There are others who have made a similar point. In fact there is a discussion about this here:

Easily remembered usernames for chatmail

One issue that I commonly see brought up when I onboard people to Delta Chat is that it’s a bit cumbersome to share the links or QR Codes as the main and only supported way to make contacts, so I was thinking of some possible ways that “usernames” could be implemented on-top of existing chatmail infrastructure (notably NOT the underlying email address, as it’s only used for transport) starting simple, we could allow users to set usernames at a domain/website, by having the website serve a small…

Delta Chat developers often take design cues from other popular messaging apps like Signal and implement features from other apps at their discretion, so it’s reasonable to point to what other apps are doing while discussing the pros and cons of that approach.

It’s clear that there are situations where an “easily remembered username” could be very useful, and since we know there are some security drawbacks to that approach, perhaps that discussion can take place in the wider context of trust design.

@adbenitez

you don’t need our app to open the invite links they are just openpgp4fpr: supported by OpenKeychain (and hence k-9 mail) etc.

This is good to know. I think there is an opportunity here to improve and update the onboarding sections of the FAQ so people in Sandra’s situation are aware of all their options. I just took a look at the help section here and it doesn’t mention at all that you can use other clients to open the invite links. And there is another section of the FAQ which still says “If you create a chat profile with a classic e-mail address you may manually create a contact if you know their e-mail address”, but that’s no longer true if your contact uses chatmail.

@adbenitez

in fact the email compatibility only get us bad reviews “this app is insecure because you support email which is horrible”

There will always be ignorant people. We shouldn’t let their opinions affect us.

@adbenitez

we only got more users since we moved away from classic email

This makes sense due to the ease of instant onboarding and the added convenience like support for Apple/FCM push notifications.

@adbenitez

with Delta Chat’s invite links there is warrantied e2e encryption without MITM, and encryption can never drop or change in Delta Chat since v2, if someone write from a different encryption key, it will appear as a totally different/new contact request, so even if the email server tries to fake messages from a contact using a new key, they can’t take over the contact’s chat

Thanks for replying. I understand that Delta Chat’s current approach using SecureJoin with guaranteed E2EE prevetns MITM.

@adbenitez

using classic email to send unencrypted email and wait that the reply upgrades to encryption have the MITM problem and it is good we moved away from that approach, it was a plain vulnerability an source of criticism, what we have today might not be the easiest way to get on contact on earth but is a pretty good compromise between security, usability and independence of a central server

I understand that the old approach with Autocrypt has a MITM problem, but I assumed that was due to TOFU not TOEU like Sandra said and I am trying to understand why in that case it would be trust on every use instead of trust on first use. I’m just trying to understand this to have better knowledge about Autocrypt, even if Delta Chat doesn’t use it any more.