… and it will be used for spam.
1 Like
Yes, but I didn’t say there would be an open list of all users. You send the email address to the bot, and it sends back a card containing the key.
A VCard can be imported as a file attachment to any deltachat client, sent to self in pinned chats, then clicked to add a contact. Can you send him a VCard?
Tuta is considering adding Autocrypt support, and is a drop-in replacement for Protonmail.
All but spearphishing spam would probably not pay if you had to encrypt each message.
The introduction mechanism for joining groups makes diverse key exchange methods riskier.
Encryption is cheap these days.
IMHO what stopping spammers for now is small user base, and difficulty of invite links/vcards collection.
So these techniques are all obsolete?
The disposability of addresses would also reduce spam; especially with mutitransport, you could just swap out any address a spammer got hold of.
In the past, chatmail servers used to allow incoming unencrypted email, which would let you bootstrap the conversation in cases like this. Unfortunately this ability has been removed, which as you pointed out, moves away from compatibility with the wider email/PGP world. I think it struck the right balance before, and the new changes feel unnecessarily restrictive.
But we’re talking about security, and for security, it’s best
to use a chat mail relay without any problems or failures.
This is just factually incorrect.
WKD is awesome.
Also, email’s lack of a vendor lock-in is really important and
Delta Chat’s roots as an awesome email app is really precious and
valuable.
Messengers in their own eco system are a dime a dozen. We don’t
need worse-XMPP or slightly-more-nostalgic-Matrix or
Signal-but-you-need-ten-gigs. Starting your own closed messaging
bubble like ICQ or AIM or WhatsApp or Line did is, well, not
exactly easy but it’s been done. What hadn’t been done, and why
Delta Chat was such a gem, was a radically more comfortable UI
for email.
Email is not going away (hopefully) and having a good way to deal
with that is so nice.
I want encryption. This entire thread is about asking for
more ways to exchange keys robustly and seamlessly. Like WKD
which is already used by over 100 000 000 people.
I don’t consider sending the first message to establish
encryption between correspondents a problem,
It worked fine before chatmail which is what I said in my
previous post. (I also said that WKD is even better because you
don’t have to do.)
But what happened now was that a user on a chatmail server just
COULD NOT send that first message to me. Nor could I send to him;
my message to him bounced with a “523 Encryption Needed: Invalid
Unencrypted Mail” error. The normal vanilla traditional Autocrypt
approach had stopped working.
And in the end he sent a frickin’ link to Delta Chat’s
centralized server and if I opened Delta Chat specifically as
opposed to my other normal MUA (Emacs), only THEN could we start
the convo (and I could continue it in my normal MUA because then
I finally had some emails from him and I could extract his PGP
key from the autocrypt header.
That is a problem. That isn’t “more secure” in any way. It’s
getting in the way of exchanging keys.
and I prefer that approach over storing users’ public keys on
the server, even though that would indeed make it more convenient
to send initially encrypted files to a recipient’s public key if
they are offline.
Okay so it’s great that Autocrypt headers are so awesome and good
and I do send out Autocrypt headers with every single email I
send (I add them on the MUA level, not in Postfix) and I love how
Posteo if you turn on WKD (which is a little bit of schlep, you
have to upload your own key) they also additionally automatically
add Autocrypt serverside just as a service in addition to WKD.
Like it or not, we have Autocrypt and WKD, and while I think
WKD is way better than Autocrypt and you “prefer” having to send
emails around, I’m not proposing to remove Auotcrypt.
While Autocrypt is sending tons of climate-wrecking traffic
redundantly for no reason especially with the avatar also being
sent in the header (and no way in Delta Chat to set avatars for
your friends outside of them all being M M M M C A M M M if you
have lots of friends with M names that becomes pretty pointless),
and it has the first-message problem, and it has MITM issues
(that Delta Chat these days try to mitigate) that go beyond TOFU
into TOEU, trust on every use, I’ve been saying it’s all worth it
because the morth ways to exchange keys the better in this mad
upside down twisted Postel’s Law of a world, and Autocrypt does
have one single actual good advantage: it works with every mail
server. These days, Delta Chat itself doesn’t work with every
mail server because of Hotmail being hot garbage as per ushe (and
a few others like Hey being bad at interopt) but that
works-with-every-mail-server was the one good thing about
Autocrypt over WKD.
So I was saying Delta Chat should on the lookup-side also look
up WKD, for those of us who are on homebrewed like me or on
Posteo, we would get automatic seamless compatibility with Proton
the way my normal email app has. (Proton themselves couldn’t use
Delta Chat because they have their dumb and bad bridge but they
could talk to Delta Chat users with their clunky
letters-in-a-mailbox metaphor UI and we could have our nice chat
UIand it’d be e2ee automatically all the way.)
And I’m still saying that but I then also was saying that now
that Delta Chat is doing their own servers, WKD also on the
“supply side” could be a thing. A very distant thing on the
roadmap since it’d require an entirely different port (access to
.well-known on the HTTPS port) and probably optional but very
possible.
More keys → more encryption → more security.
All that was me repeating myself and exeplicating what I already
said two posts ago and if you’re gonna gome at me a third time
with the same circular unlogic and I don’t respond it’s because I
died of disbelief. I just couldn’t disagree more strongly with
what you’re saying which is that it’s good that Delta Chat is
becoming less compatible with email, with other mail apps, with
IT’S OWN PAST USERBASE ON NORMAL AUTOCRYPT, and that it
definitively should not adopt the much more widely used and
adopted key exchange protocol WKD; I am not at all onboard with
any of that. For the record.
In DC, this is currently possible — if you share a contact
with someone, the .vcf file includes both the image in base64 and
the public key, which makes it possible to send encrypted
messages right away, even if the recipient is offline.
Sharing contacts with .vcf files?!? That is not something
everyone does. I don’t think I’ve ever done that.
Sending an email to someone and having it be encrypted right away
from the first message on without either person having to worry
about anything else than having that person’s email address? That
happens millions of times every day. It’s just not gonna happen
on Delta Chat anymore.
Actually chatmail is singularly bad even compared to other
non-mail messengers like XMPP/OMEMO, Matrix, IRC, or Signal. On
them you just give them your username. Which you can do with a
ballpoint pen on a post-it-note in three seconds or you can shout
it to them across a noisy room. You don’t need these terminally
online links and QR and VCF juggling.
No smartphones. No smiling fakery. Just a beautiful, crisp string
of ASCII-clean text. The address underneath:
sandra.snan@idiomdrottning.org. Period. Username at hostname.
Period. In Helvetica. Period. Any questions? Of course not. Email
address. Period. Simple.
1 Like
I get it — things got heated, and there is a real issue, but I haven’t experienced it myself, maybe because I moved away from classic email a long time ago. I just wanted to say that it’s like a slider: on one side you have privacy, and on the other convenience — you have to choose or find a balance. It’s always been that way, and always will be. Otherwise, we’ll just turn DC into another WhatsApp or Telegram — which is exactly what we don’t want. As 9er already pointed out, centralized data always belongs to and is controlled by someone, and that can open the door to spam attacks.
1 Like
Easy secure use of keys is a huge advantage of DC. I can quickly and reliably set up an encrypted connection with anyone if I am in their physical presence. I can also be reasonably confident that they won’t accidentally do anything bad. I can also reasonably trust that their contacts are who they say they are. Adding third parties to verification gives us a lot more ways to mess it up, and needs careful consideration.
Being able to connect to people if I am not in their physical presence is harder. Publishing a link or QR code is commonly done, but counterrecommended, and WKM is basically an organised server-centralized version of that.
We could mitigate spam risks by, say, using transient accounts.
The contact links are not really centralized, nor are they really links.
Sending VCards is not obvious in the UI but actually easy. See also r10’s “.asc to VCard” app.
Joining the same public group would also give you a contact. Obvious risks, though.
Minim writes:
So these techniques are all obsolete?
Arguably yes actually. Also they’re bad for the environment since
energy is so undercosted.
Roman writes:
I just wanted to say that it’s like a slider: on one side you
have privacy, and on the other convenience — you have to choose
or find a balance.
There are systems that give up both security and convenience
through bad design; inconvenient doesn’t automatically create
more security. If I make my door super hard to lock (without
changing how easy it is to unlock) I have not made it more
convenient. Not to come across as patronizing because I know you
know that; I’m building up to saying that this is what’s going on
here with the Chatmail initiative and ongoing lack of
compatibility with other key distruibution protocols.
Otherwise, we’ll just turn DC into another WhatsApp or Telegram
— which is exactly what we don’t want.
It’s great that we agree that that would be very bad.
What I’ve been saying is that if Delta Chat were to become
chatmail only (and don’t worry, I remember one of the devs saying
upthread that that was not going to happen), it wouldn’t really
have any advantages (yeah yeah small niceties like stickers or
webxdc) over other messaging systems like OMEMO or Matrix.
“Hey you need to get on this specific app–Snikket/Element/Delta
Chat—because I want to talk to you on it”. What Delta Chat had
before (“had” is technically incorrect since it’s all still
possible since chatmail serves are optional and the key import
issue—easily my biggest remaining problem with Delta Chat—has
always been there) was a compatibily with a ginormous install
base.
It’s great to be able to chat with anyone without them having to
install some special app. That is an unprecedented killer feature.
Without it, we’re back to the “‘Can I add you on ICQ?’ ‘No I have
AIM’” hell.
If Delta Chat becomes its own only-talk-to-other-Delta-Chat users
closed loop, it would actually be way way worse than other modern
options since most other chat apps these days like OMEMO or
Matrix have forward security. And even OMEMO in all its badness
have more client options and more platforms than Delta Chat.
As 9er already pointed out, centralized data always belongs to
and is controlled by someone, and that can open the door to spam
attacks.
Yes.
Which is why I have been complaining that chatmail’s new Error
523 bootstrapping/first-message problem that we, not knowing
about the “solution” of “figure out a way to send stuff to each
other that is not Delta Chat so that we can then send a VCF file
to each other and then not use that other way anymore” ended up
“solving” by the guy sending me an URL to a centralized Delta
Chat central server (even though he’s running his own chatmail
relay and I’m running my own vanilla Postfix). We’re basically
Signal at that point!
That’s why WKD is great because it’s not centralized.
You can use the URL even if your net connection is down or the delta.chat domain is blocked. Just paste it into the client instead of a browser.
SELF-CORRECTION EDIT: The URL format is not a workaround for Android’s restrictions; the URL format is a convenience, giving the perplexed instructions. The URL has to be a domain the app authors control due to Android’s restrictions:
1 Like
https://i.delta.chat/ is not contacted when invite links are used inside of Delta Chat. The reason we switched from extended OPENPGP4FPR: to https://i.delta.chat/ is that such URLs provide a fallback for the case when the user does not have Delta Chat installed. Invite links can be opened in the browser and then the user will see the page with a link to Delta Chat download page.
The reason for URL format is not Android restrictions. That was the answer to your question for why the domain name in the URL cannot be the domain of the chatmail server. Any Android app can open OPENPGP4FPR: and Delta Chat even still opens OPENPGP4FPR: links. If you go to i.delta.chat link you will actually see OPENPGP4FPR: in the second step which has the same data as the invite link but using OPENPGP4FPR:. The reason we use https://i.delta.chat/ is to have a fallback for the case when Delta Chat is not installed.
Contacting WKD means you have to do an HTTPS request directly to the server of the recipient, which can log your IP address and the time when you requested the key. WKD requires that public keys are stored on the server and are available to the server. With Autocrypt and header protection the server will not see any public keys. Practical result of this is that if you migrate from one server to another while keeping your key the server will not be able to tell that you are still the same user.
2 Likes
I sent a long reply over Discourse’s email interface but it hasn’t shown up yet but I managed to take someone’s key public key from my gpg keyring and make a vcf for them that I could import into Delta Chat!
So now I can start a new chat with them with the dorky default “Meddelande från Sandra Snan” subject line and that got sent encryptedly but replying to them in existing threads does not get encrypted 
So the dream of someone not on autocrypt but on PGP sending me an encrypted message and I can reply encryptedly from Delta Chat is still not reality it seems.
Maybe the next step is to write a milter that does key lookup and adds autocrypt headers to the incoming messages from them to deal with Delta Chat’s limitations but that really feels like not where that stuff should live.
I’ll paste in the messge that didn’t get through:
Contacting WKD means you have to do an HTTPS request directly
to the server of the recipient, which can log your IP address and
the time when you requested the key.
True. That is another drawback of WKD.
WKD requires that public keys are stored on the server and are
available to the server.
This is a good thing. I wnat my key out there.
With Autocrypt and header
protection the server
will not see any public keys. Practical result of this is that if
you migrate from one server to another while keeping your key the
server will not be able to tell that you are still the same user.
True. But that’s a bootstrapping nightmare (“first message
problem”) where the converation needs to have been initiated
out-of-band. The only people who can have any benefit of those
header-protected public keys are the ones who have already given
their own public key to that sender. That’s why I’ve wanted
out-of-band key import for a long time, and WKD is a very widely
deployed out-of-band key distribution method. The amount of WKD
keys out there is mindblowingly staggering.
Link2xt, you bring up correct and true drawbacks and I really
appreciate that (so thank you so much for that, I was getting
really mad) but I still want to get keys from people into Delta
Chat even when they don’t have Autocrypt on because that lack of
Autocrypt is the case for the majority of my contacts. I think
that value is worth those extra requests but those requests
should be opt-out, not mandatory.
By the way, if I have someone’s elses public key (recieved,
perhaps, through a WKD request on another computer), can I
construct a faux .vcf file for them and import them that way?
That’s something I would immediately do for a couple of dozen
contacts right away; do y’all think that’s possible? And I can
also set avatars for people this way (whether or not they’re
PGP’d up)? This would solve two of my most long standing hopes
for Delta Chat for my own use; I still advocate for and recommend
adoption of WKD (while keeping Autocrypt support) for ease of use
and increased compatibility with the wider PGP email landscape.
Actually if the .vcf solution does work, that solution would be
perfectly satisfactory to me would be an external
.vcf-conversion/import self-hostable app, site, or bot. That’d
keep Delta Chat’s own internal workings lean and uncomplicated
and we’d have a “contact importer” where you’d put someone who is
on WKD, HPKS, or you have an .asc file, and get them back as a
contact. Bots and apps don’t pop out of the sky fully made, I get
that, but speaking design-wise that’d be a very satisfying
compromise for me.
There is a webxdc app that does it: webxdc apps (r10s/asc-to-vcard: Create VCards from classic PGP .asc public key files. - Codeberg.org)
It was mentioned above:
There is also a bot that looks up keys on keyserver and WKDs by email address and sends back vCards:
1 Like
Contacting WKD means you have to do an HTTPS request directly
to the server of the recipient, which can log your IP address and
the time when you requested the key.
True. That is another drawback of WKD.
WKD requires that public keys are stored on the server and are
available to the server.
This is a good thing. I wnat my key out there.
With Autocrypt and header
protection the server
will not see any public keys. Practical result of this is that if
you migrate from one server to another while keeping your key the
server will not be able to tell that you are still the same user.
True. But that’s a bootstrapping nightmare (“first message
problem”) where the converation needs to have been initiated
out-of-band. The only people who can have any benefit of those
header-protected public keys are the ones who have already given
their own public key to that sender. That’s why I’ve wanted
out-of-band key import for a long time, and WKD is a very widely
deployed out-of-band key distribution method. The amount of WKD
keys out there is mindblowingly staggering.
Link2xt, you bring up correct and true drawbacks and I really
appreciate that (so thank you so much for that, I was getting
really mad) but I still want to get keys from people into Delta
Chat even when they don’t have Autocrypt on because that lack of
Autocrypt is the case for the majority of my contacts. I think
that value is worth those extra requests but those requests
should be opt-out, not mandatory.
By the way, if I have someone’s elses public key (recieved,
perhaps, through a WKD request on another computer), can I
construct a faux .vcf file for them and import them that way?
That’s something I would immediately do for a couple of dozen
contacts right away; do y’all think that’s possible? And I can
also set avatars for people this way (whether or not they’re
PGP’d up)? This would solve two of my most long standing hopes
for Delta Chat for my own use; I still advocate for and recommend
adoption of WKD (while keeping Autocrypt support) for ease of use
and increased compatibility with the wider PGP email landscape.
Actually if the .vcf solution does work, that solution would be
perfectly satisfactory to me would be an external
.vcf-conversion/import self-hostable app, site, or bot. That’d
keep Delta Chat’s own internal workings lean and uncomplicated
and we’d have a “contact importer” where you’d put someone who is
on WKD, HPKS, or you have an .asc file, and get them back as a
contact. Bots and apps don’t pop out of the sky fully made, I get
that, but speaking design-wise that’d be a very satisfying
compromise for me.
the hoops because you are not actually using Delta Chat??? because scanning each other’s link or opening the link (which doesn’t involve any server, you can even send it to your Saved Messages chat and click it) is straightforward, of course if you do nerdy stuff you are going to need to do more involved things
there is no autocrypt problem or whatsoever, people just scan/click their invite links and call it a day
I think WKD is not ever going to come to Delta Chat, the whole anti-spam measure of chatmail relays is that people need to know your encryption public key to write to you, if now people can just discover the key of any email address they can do spam
the effort of supporting WKD is “life-changing magic” in Delta Chat is ultimately not worthy wrt end result and UX (user suddenly need to get asked if they want to publish their crypto identity, memorizing email addresses that can be multiple with upcoming multi-transport and are random addresses, accidents writing to the wrong address, like it happened with the Signal scandal where a random person got added to a gov chat, etc)
final note: we work for people that want to use Delta Chat, and that is our priority, we don’t have lots of time and resources to spend in making it nice to chat between Delta Chat and Emacs (which is already possible, we just can’t afford the luxury to keep busy working on making it super-duper zero-effort for some nerds)
1 Like
Asiel Díaz Benítez wrote:
the hoops because you are not actually using Delta Chat???
We were both using Delta Chat!!! We were messaging each other and
getting errors and not getting through and messages were
bouncing. The way Delta Chat to Delta Chat always worked in the
past for many many years was that one person would send one
unencrypted message and then from then on messages both ways
(including thwe immediet reply) would be encrypted and that
suddenly didn’t work and luckily the guy found out about sending
the link thing instead of giving up which I’m sure many people
would’ve done!!! I sure was ready to before he found that
solution.
of course if you do nerdy stuff you are going to need to do
more involved things
Sending a message to someone when all you have their user name is
what’s NOT nerdy. It’s what you can do normally on OMEMO, Signal,
Proton, Matrix, all other apps I’ve ever heard of from ICQ to
SMTP to text messages and phone calls.
final note: we work for people that want to use Delta Chat, and
that is our priority, we don’t have lots of time and resources to
spend in making it nice to chat between Delta Chat and Emacs
You have it completely backwards.
It’s not “Ooooh I really love using Emacs to email it’s so great
I wish it was easier to email to Delta Chat people”. That always
works without a hitch.
It’s actually the other way around. When ever Delta Chat can’t do
something properly I have to use Emacs as a fallback in order to
be able to do it. And that happens many many many times a week.
Most often when I want to start a chat with someone without the
embarrassing “Meddelande från Sandra Snan” subject line. I have
to send the first message from a normal mail app. Any normal mail
app—mine just happens to be Emacs because it works over SSH.
Including this time with the chatmail onboarding process because
one of the things he tried was that he tried the “new mail”
thread but all our messages in there kept on being unencrypted.
Until I went and replied from Emacs which solved it. But that
wasn’t on his chatmail server which he then wanted to change to
so that’s when we had to go with the link solution.
All of my “I wish Delta Chat could do this or that” (like import
non-autocrypt PGP keys like any other mail app can this side of
junk like Hey) is because I want to use Delta Chat. Every
single one of my problems are all as a Delta Chat user from
within Delta Chat.
And, not only that, another reason I sometimes have to use Emacs
is when Delta Chat just crashes and can’t run, like on this
InkPalm that I bought to have as a Delta Chat device and it can’t
even run Delta Chat because two GIGA bytes of ram isn’t even
ough, it’s been great to have Emacs as a fallback so I don’t
suddenly lose all my contacts. But here the link solution to
start talking to someone on Chatmail, that solution requires
literally Delta Chat and me having to go get another tablet that
can actually run Delta Chat just to talk to him. (If he sends a
vcard, that’s fine, but neither of us realized that solution).
That is vendor lock-in and creating an app that can only talk
to itself and we already have too many of those messenger apps.
XKCD standards 
Embrace—“hey, we use email!”
Extend—“hey, now you can quickly create accounts easily!”
Extinguish—“hey, now you need specifically our app, we’re closing
the ecosystem, you need to use the one appthat can open these
specific links”
Like when Google Talk was XMPP until it wasn’t.
(which is already possible, we just can’t afford the luxury to
keep busy working on making it super-duper zero-effort for some
nerds)
I’m not happy being called some nerds as an insult, I’m not
asking for it to be super-duper zero-effort, I only want it to
EVEN BE POSSIBLE, and some of y’all sure are keeping me busy
fielding grief and scolding and having my head bitten off as
punishment for taking my time out describing what happens in
practice when I am trying to use the app.
That was the biggest mindblow when I had a dayjob in 2021. “We…
Wait, we pay people to test the app and say what part of it
doesn’t work?! And they get appreciated and that’s their actual
job and it’s called testers?!? And we have an entire other
department twho can’t code either but their job is to come up
with how the app can be improved or be used more easily and
they’re called designers?! In the FOSS world where I grew up and
have spent all my time since the nineties, people get hated for
that! Devs hate it when someone says that something doesn’t work
or could be made easier or you describe ways you work or what
you’re trying to do. That’s called being an entitled nerd who
only wants luxury. So wow this is an actual job here?!?” and I
felt so sad and I wanted a redo of the past 20 years. Not that I
agree with dev shops or “enerprise” but I felt that this was the
one thing they did get right: Not hating and bullying the people
who were struggling with the app.
And as I’ve said many times; this isn’t out of entitledness or
expectation or demands. If the reply ever is “okay that would be
great but we just can’t right now” that would be 1000000%
understandable and I’d even feel guilty for even bringing it up.
It’s been years since I started this pair of threads and I’ve
been in no hurry. I’ve not been like “aw c’mon when is this
feature coming already!!”. But when the reply is “no you nerd
don’t you understand that it’s good that your messages to each
other don’t get through and that you can’t talk to your friends
and that we’re creating a closed ecosystem and we don’t want
anyone to advocate for normal SMTP email anymore because we have
abandoned email a long time ago”, that’s not so easy to deal with.
God the emotional toll on me (and probably some of y’all too
because I’ve been giving as good as I’ve been getting) this
thread has taken on me is insane. I can’t breathe it feels like.
It hurts so much to have to butt heads about every little thing
frow what started about a thread about “hey it would be neat to
be able to import keys (and here’s why) and maybe get compatible
with WKD (and here’s why)” that now years later is this flamewar
that’s killing me.
And it also hurts to see Delta Chat head down this road. It’s not
all the way at the end of that road yet thankfully but it’s
heading there a lot faster than I had feared. What started as
such a fast and efficient way to do emails where I didn’t have to
click click click open every email individually but could instead
just shoot off replies as quickly as an IRC session is throwing
all that out the window. And I don’t want to go back to the
normal mail app interface. Even Emacs. It’s so tedious to have to
actually “open” the mails. Delta Chat was so breezy, so
delightful. Before it became Error 523 and flamewars.
Link2xt writes:
There is a webxdc app that does it:
There is also a bot that looks up keys on keyserver and WKDs by
email address and sends back vCards:
Yes, this is good; this (+ I through a li’l something to gether
on my own since I didn’t know about those) would solve the number
one problem I’ve had with Delta Chat since day one many many
years ago, importing keys, once the vcard stuff starts working
well.
As it is it, I made a key from one of my friend’s PGP keys (not
the same person with whom I had the chatmail problems) and
imported it. But my replies to him still didn’t become encrypted.
Delta Chat started a new chat with him setting the subject
“Meddelande från Sandra Snan”. I feel so out of place sending a
subject line like that, it’s like wearing a t-shirt with my own
face, I’d never do that. But replies in the existing chat with
him didn’t become encrypted. And his replies to that new
encrypted chat arrived in the other chat unencryptedly actually.
So the vcard experience has been a huge letdown so far. Also not
sure how to change or update a contact if his key changes.
The traffic might be redundant but in a world of AI data centers, I feel that we need to keep things in perspective about major drivers of climate change. (I agree that redundant traffic is not ideal and I hope I don’t sound patronizing but the UK government’s recent advice to delete old emails to save water has helped me to appreciate the importance of quantifying the environmental impact of technologies such as email.)
I always assumed (wrongly it seems) that Autocypt was trust on first use, so I would like to correct my understanding and learn more about this. How is it trust on every use? Does the client not warn you when the key changes?
I agree that Delta Chat should not become a closed loop, and I think nobody here wants to see that happen, but to consider even a closed loop Delta Chat “way worse” than Matrix assumes the need to prioritize forward secrecy above preventing metadata leaks and making sure everything is actually encrypted including profile names, avatars, reactions, group descriptions, and group membership, which Matrix does not do. While some people might prioritize forward secrecy above all of this, it is a bit subjective because other people might find that is more important to prevent metadata leaks and make sure everything is encrypted.
1 Like
yeah that was the past, that is not the normal workflow anymore, people don’t send each other an unencrypted first message and hope things upgrade from there, now the approach is the invite link and conversation starts encrypted up-front, chatmail doesn’t allow to send unencrypted at all, your friend directly gets an error message when trying to send an unencrypted message
then use those
it is the other way around, we tried to use classic email providers, they were not open to collaboration or to improve their servers to make it easier for people to chat. Besides we still use email, you don’t need our app to open the invite links they are just openpgp4fpr: supported by OpenKeychain (and hence k-9 mail) etc.
we are not absorbing the email community, people at large keep using email as usual and most people don’t even know Delta Chat exist while they use their classic email clients.
But we are a chat app, not an email client, and even if we completely become incompatible with classic email clients, that doesn’t matter because the use case was always chatting, in fact the email compatibility only get us bad reviews “this app is insecure because you support email which is horrible” we only got more users since we moved away from classic email, it is not that we got many users because of using classic email and then tried to “extinguish”
hey it was not an insult, I am also a nerd 
and I appreciate you take the time to give feedback and write your opinion, I was thinking you were using emacs and that was part of the problem, but lets focus on the main topic and not get too meta, I already explained enough reasons why going for WKD seems very unlikely:
sorry I can’t keep replying to all your points, it was a too long post