whisperpush (Encrypted SMS)

answered 2014-01-08 22:08:45 +0200

jbrooks
2162 ●22 ●22 ●22

moderator

It's great technology. I'll ramble a bit here about my personal opinion (which, of course, represents nobody else):

Personally, I'd be more interested in seeing a third party effort (as a separate application - or, architecture permitting, a middleware feature). The method used by Cyanogenmod's integration has some downsides:

1. Discovering other encryption-enabled users works by comparing your contact list to users registered with a server (operated by Open Whispersystems, I believe). I'm not fond of that as a design (it seems like a great opportunity for a downgrade attack..), and I think it's irresponsible to have your platform depend on infrastructure you don't have a relationship with. See https://whispersystems.org/blog/contact-discovery/ for a discussion on the contact discovery problem.

2. The Whisperpush implementation used by Cyanogenmod uses Google's push notification architecture to send messages instead of SMS when possible (similar to iMessage). We have no equivalent, and it wouldn't be compatible. The encryption over SMS is useful, but certainly couldn't be enabled by default anywhere (due to compatibility/fallback issues, message overhead, etc).

It's a shame to see all of these new pro-privacy technologies (including iMessage, etc.) being implemented in a platform and vendor specific way. Companies like Apple and Google are using SMS replacements as an excuse to increase their own control over their users and platform. TextSecure is fantastic, and Cyanogenmod's integration by default is mostly a positive step, but it's not suitable - yet - to start acting as a true cross-platform and cross-vendor solution.

I would be thrilled if the community ported TextSecure.. ;)