Messages sent on the app are end-to-end encrypted and the key is not known to the server.
The only way anybody can read your messages is if you allow them physical access to your phone.
No, you really can’t. That’s a library for symmetric cryptography. The key distribution/exchange problem cannot be solved with symmetric cryptography alone - unless you are acting as a trusted party and conveying the symmetric key - in which case you are not implementing end-to-end cryptography.
P.S. Get a friend to download it as well as it requires both parties to have each other contacts saved and the app installed in order to send / receive messages.
Could you explain the difference, in your own words?
The most obvious way I see to support this feature is to build up a big table of contact connections, so that when I join and put in my phone number it can send up my list of contacts and find all the bidirectional connections to what's already in the database.
This means you're building up a big graph of how all your users are connected to each other, and to people who don't use Wave (yet). Is that not 'harvesting' the contacts? Do you do it a different way?
The app requires an active number in order to use the service. This number is submitted to the database during the verification process. To my knowledge, mthere is no way around this.
To send and receive messages, the app needs access to your contacts. When you tap 'send' for the first time, the app will ask you for permission to access your address book.