[kalia35]

"ICQ New does not encrypt your communications. In addition, your communications may be routed through different countries - that is the nature of the Internet. ICQ New cannot accept any responsibility for any unauthorized access or loss of Data."

LOL

[rkagerer]

This is such a real shame. I miss ICQ; the original had features I really liked which I haven't found in dumbed-down, modern chat software. Examples:

- status and visibility could be controlled for each contact at a granular level

- locally-stored, fully searchable chat history that gave results in a sensible manner and which you could migrate to new computers

- notification intrusiveness (ding, flash, etc) could be adjusted with one or two clicks

- dense UI (less whitespace meant more information packed into a smaller window that took up less of my screen)

- hitting X actually exited the program

[alxlaz]

> - dense UI (less whitespace meant more information packed into a smaller window that took up less of my screen)

Yesterday's thread about DECUS and HP's OpenVMS hobbyist program opened a can of nostalgia worms so I remembered that my first laptop was a late-Digital era 11"-screen laptop with a pretty low-res screen (800x600, I think?).

I used ICQ on it and its interface was about as awkward as Skype's is today -- except today I'm running Skype on a laptop with about twice the screen estate. It's a little silly that all that research work in the industry -- and all that money I've paid -- went into screens that I now use just to display more whitespace.

I know it's supposed to help with touch screens but a) my laptop -- like most laptops currently in use -- doesn't have one and b) this isn't 1997 anymore, UI toolkits today make it trivial to adjust element sizes and paddings so that they're appropriate to whatever pointing device is currently in use.

[badsectoracula]

Which version of ICQ are you referring to? I was running ICQ on a 640x480 monitor back then and i remember it having a very compact window[0] which i always had it visible.

[0] https://pbs.twimg.com/media/DjOHmkFVAAUPzx6.jpg

[alxlaz]

It's been so long I really can't recall anymore. (Edit: but just like you, I do remember that I had the ICQ window visible at pretty much all times, and I could comfortably fit an Emacs window, the contact window a chat window on my desktop's 1024x768 screen.)

That being said, the window in that screenshot is about 200 x 320 px. It would have taken about a third of the horizontal space of the screen, and about 2/3rds of the vertical space of a 640x480 screen. It was certainly usable -- way, way more usable than Skype on a full HD monitor today -- but lots of stuff was claustrophobic in 640x480.

(Then again, most modern apps are practically unusable if you resize their window to 640x480...)

[badsectoracula]

Sadly Skype and similar programs tend to take more physical space on my monitor than ICQ (and MSN Messenger, especially the original versions like the one included in Windows XP) ever did :-/

[aeyes]

The latest version of ICQ was huge (think Windows XP skin), at this point I started using the QIP alternative client which was even more compact than the first version of the original client. When everybody started using Miranda, Pidgin file transfer pretty much broke due to client incompatibility. That was a sad moment, they had a nice product but stopped listening to the users.

[molticrystal]

Pidgin[0][1] supports a great deal of protocols and there is "End-to-end encryption, through Off-the-Record Messaging (OTR)" plugin you can install that can be used for just about everything it supports. If ICQ NEW still supports OSCAR it can probably used out of the box, there is also a plugin[2] for the newer WIM protocol.

[0] https://www.pidgin.im/

[1] https://en.wikipedia.org/wiki/Pidgin_(software)

[2] https://github.com/EionRobb/icyque

[giancarlostoro]

Pidgin feels like it's dated by now, doesn't support much, does it even support Matrix (out of the box)? I think it still lists some dead protocols last I looked at it too.

[Arathorn]

pidgin doesn’t support matrix out of the box; we did write a prpl a few years ago but it needs a maintainer to make it properly fit for purpose: https://github.com/matrix-org/purple-matrix

[51Cards]

I still use Trillian just for the UI. I can have several chat windows open along the top of my screen without taking up much of my working space. Since I work remotely from most of my colleagues this is priceless and I don't know what I'll do when I am forced to switch. I was also a heavy ICQ user from the 90's into the early 2000's for all the reasons you cited.

[flud]

Does Trillian support slack by any chance?

[51Cards]

Pasting this reply I found elsewhere. Should be accurate to my knowledge.

Yes to Slack! Ask whoever manages your organization to enable XMPP or IRC gateway connection, then add the appropriate type of account to Trillian. You won't have access to rich cards or shared files from within Trillian, but you will be able to read and send messages to channels and individuals.

[thanatropism]

At one point ICQ had real time chat — you saw the keys the other person pressed as they typed.

[spuz]

Yes! I remember how incredible it was to actually see my friend typing in the same window as me way before Google docs. I miss that.

[sorenjan]

They also had floating contacts that was a lot like those chat heads some apps have now.

[ehsankia]

> - hitting X actually exited the program

How is that good UX for a chat app?

[betimsl]

Exactly: LOL.

Though it looks like exact copy of Telegram minus the core and most important feature. :D

[spxans]

Telegram is banned in Russia and this new ICQ is being launched by a russian company with strong ties to the russian government, so it could be their attempt at replacing somewhat private telegram with something they can openly monitor

[graynk]

They already tried that with TamTam (https://tamtam.chat/) which is also owned by Mail.ru Group. I don't know anyone who uses it though and ICQ had a huge userbase in early 2000's in Russia, so maybe that's the reason?

[andoriyu]

None of us used official client. Only reason it was popular is because protocol was reverse engineered and there were clients for everyone. This is just capitalizing on ICQ name that many of russians feel nostalgic about.

I still remember my 7 digit invisible vanity number.

[int_19h]

I think the point is that people still remember the ICQ brand. Whether they did or did not use the actual ICQ client 15 years ago is less important.

[misterbwong]

Sounds like Russia is trying to take a page out of China's playbook with TikTok

[thewinnie]

Just to make it clear, telegram also tied to the russian government, and they developed telegram based on the message protocol from website vk.com which also owned by mail group.

Its just propaganda move to ban Telegram to make it look independent

[efraim]

What are their strong ties to the russian government?

[spxans]

Mail.ru Group is controlled by Alisher Usmanov, an oligarch from the 90s and an old friend of Putin. Few years back Mail.ru group with the help of russian secret services staged a hostile takeover of VK, biggest social network in russia, essentially forcing the founder to leave the country. Since then VK data has been freely available to any russian enforcement agency, or even anyone pretending to be one. In russia there isn't even a pretense of privacy/independence from them, everyone knows FSB&Friends have unrestricted access to their stuff

[maqp]

Except Telegram also lacks the most important feature, ubiquitous E2EE. Russian state employs a lot of hackers and you're really fooling yourself if you think Pavel Durov can harden his infrastructure to protect from an entire state sponsored cyber army with its zero days. When they hack Telegram's servers, all messages are bound to leak.

[jhasse]

*nearly all messages

(not the E2E ones)

[maqp]

And those messages are the ones that reveal your intention to hide messages. That metadata is some of the most valuable.

Also, people don't really want to use secret chats because they aren't cross platform. Sure, some people only own phones, but those that switch to laptop/desktop computer don't want to whip out phone hundreds of times a day, but opt-in for the insecure cloud chats that are accessible with simple alt+tab.

So yeah. Sure, secret chats can be mostly secure, the problem is the E2EE isn't practical to any reasonable extent and again, using it leaks metadata.

[pedrocr]

Isn't Telegram the one with half-baked encryption that's not even used in group chats?

[tyrion]

No, your statement is misleading. If you are in good faith you can have a look at their FAQ, and the blog of Pavel Durov:

* https://telegram.org/faq#q-how-secure-is-telegram

* https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by...

* https://telegra.ph/Why-you-should-stop-reading-Gizmodo-right...

[hombre_fatal]

Almost nobody I know uses encrypted chat in Telegram because it has such terrible UX. I don't have a single encrypted convo either because when we try, we always go back to our unencrypted one.

For a good UX impl, check out Keybase. It's encrypted chat feels just as good as Telegram's unencrypted chat.

[nrdvana]

Chief, shouldn’t we be using the Cone of Silence for this?

https://youtu.be/vsNR9FnxOdY

[hombre_fatal]

I didn't know what to expect, but accurate depiction.

"GPG isn't that hard! You see, you just..."

[hiq]

The FAQ item you mentioned is in direct contradiction with cybersecurity experts who have been saying for years that WhatsApp is more secure than Telegram.

This debate has taken place over and over again on HN, there's nothing new here.

[kelvich]

Well, now about a half of decade passed since that expert opinions were raised. And no data-breaching bugs were found in Telegram, but there were plenty of them in WhatApp.

Surely, that doesn't mean that expert were wrong, but at least mentioning that in Telegram vs WhatsApp debate doesn't look like a strong point.

[maqp]

Its funny and sad that telegram developers at the same time dismiss their own past history of security vulnerabilities with "all programs have bugs", but then they attack an app with superior encryption protocol by complaining about those same bugs that get patched when they are found. Pathetic.

And like heinrich5991 said, there's no need for backdoor or vulnerability when the data leaks by design to the server.

And no secret chats aren't an option. E2EE needs to be cross-platform and enabled by default. Signal can do it, Wire can do it. Telegram can't, because the developers are completely incompetent.

[heinrich5991]

The WhatsApp data breaches disclosed data that is available to Telegram by design, right now.

[pedrocr]

Pointing to Telegram's own claims to say that they are secure seems strange. I tried reading anyway. When it started claiming that Signal didn't allow for backups I gave up.

[maqp]

This is misleading propaganda that ignores proper cryptographic design. It relies strongly on whataboutism and dismisses properly designed protocols as niche without really arguing from any other viewpoint as appeal to popularity. Furthermore, Durov employs backwards logic, circular reasoning, and double standards. There's no room for good faith when Durov intentionally ignores concerns of the entire infosec community. When Bruce Schneier and Matt Green tell people to avoid your product, that's when you look in the mirror and ask "what am I doing with my life".

[godzillabrennus]

The encryption works as designed so Telegram and governments can see whatever they want.

[rekabis]

Wow, that is an instant choice-killer for me.

E2E encryption is _practically required_ if you want to build an app that doesn’t get bad press from security professionals. Just look at Zoom.

[Andrew_nenakhov]

Not really. E2EE imposes severe limitations on user experience:

Want a fast server-side archive search? Forget it, you're using e2ee.

Want to add a new device and load all your chat history? Forget it, you're using e2ee.

[maqp]

The first case might be true (at least until homomorphic encryption matures), but client-side encrypted cloud backups are already a thing, e.g. Signal is working on it: https://signal.org/blog/secure-value-recovery/

[Andrew_nenakhov]

Just stop and think about it for a second. End to End Encryption means that the data is encrypted between TWO ends, your device and the device of your chat partner.

Now, by downloading and decrypting it on another device, you are adding a THIRD end where is is accessible. To achieve that, you have basically two options: one is to pass over decryption keys to a new device (potentially breaking E2EE security model for another guy who does not expect you to use 2 devices without his explicit authorization), and another approach is to do an own encrypted archive to store data and sync between your devices. You basically encrypt data and store it on a server, decrypting it with your password or certificate or something that you share between devices. It's not E2EE at all, actually, cause you'll be breaking the security model for some convenience, because the idea of e2ee is to communicate only with devices, each and every one of which were authorized by you. If you don't follow this rule, you make a travesty out of E2EE, basically stating that all you really need is a nice and cozy feeling of being secure, not true security.

You have to face it: true E2EE is not achievable without significant sacrifices of user experience.

[maqp]

>Now, by downloading and decrypting it on another device, you are adding a THIRD end where is is accessible

You're not thinking straight. End-to-end encryption does not refer to two devices, it refers to two parties. If you have two devices that can receive the message, that's still only accessible to you.

>one is to pass over decryption keys to a new device (potentially breaking E2EE security model

That's just stupid, you can scan e.g. public key of the other device and then have your device send packets to that

>and another approach is to do an own encrypted archive to store data and sync between your devices.

Which is perfectly valid provided the user has to create sufficiently secure password.

> It's not E2EE at all

The reasoning how you came to claim this is beyond moronic.

>actually, cause you'll be breaking the security model for some convenience

You aren't breaking anything. Claiming things without reason is moronic.

>because the idea of e2ee is to communicate only with devices

No the idea is only you and your peer have access to the data. You can't be serious.

>each and every one of which were authorized by you

Yeah that is kind of what happens with proper E2EE, only you have access to your data on devices you've authorized by e.g. scanning the QR code of the trusted instance.

> basically stating that all you really need is a nice and cozy feeling of being secure, not true security.

Geez, maybe start by learning how cryptographic protocols work before making such claims.

>You have to face it: true E2EE is not achievable without significant sacrifices of user experience.

Majority of them are with smart cryptographic design. The claims you made were more hand waving than I've ever seen before. Incredible.

[jonny_eh]

Keep in mind it's owned by Russia too.

[thomascgalvin]

Zoom: has massive fallout from lax security posture

ICQ New: has entered the chat

[heyoni]

Seriously. What a fucking joke.

Good opportunity for Apple to step in and open up the message/facetime platform imo.

[kingofpandora]

At least they are honest (ahem, Zoom).

[maqp]

That only helps if you know you're not discussing anything sensitive. The problem is, people often do discuss sensitive matters. I don't think I even need to quote Cardinal Richelieu here, this is hacker news, no need to preach to the choir.

People can't threat model because they don't really know what the governments consider interesting and a threat to their exercise of power.

So always use E2EE.

[lukifer]

I think the point is that they're upfront about it, so you can treat the communication as though it were public (which is a pretty good default assumption for communicating on the internet in general).

I'm one of those people that refuses to accept that "privacy is dead"; but there's also a lot of casual/low-stakes communication that I treat like a personal conversation in an IRL public setting, operating on the assumption that a stranger can/will overhear it.

[maqp]

I just explained, people don't know how to threat model. An average Joe doesn't think "Whoa Ok, so this is TLS only, that means I should assume the server has access to content that might have implications depending on policy, level of government collaboration, and that foreign actors might also have access if they hack the server. Therefore, I should evaluate in real time my conversation, constantly thinking how an outsider might perceive it, and if the other peer starts talking about something private, pack my bags and move abroad".

>I'm one of those people that refuses to accept that "privacy is dead

I never claimed it was. I was making the point that you should protect everything so you don't leak metadata about when you're having private conversation. That's exactly what happens when you e.g. enable secret chats in Telegram. You're telling the company "I'm now talking to Bob, and I'm intentionally making the decision to not share that data with YOU". That's really, really valuable metadata to governments.

[spxans]

It's owned by Alisher Usmanov (Putin's oligarch friend), all their other products (VK, Odnoklassniki) send all the data straight to the russian secret services, of course there isn't and won't ever be any encryption

[buboard]

it makes the job of the KGB easier and conserves CPU cycles. i like that they re honest about it

[mister_hn]

Just like in the past

[ryanisnan]

Big fat honkin' nope. Also, why? Why did ICQ feel like it all of a sudden now wanted to be a thing again? Who was asking for it?

[maqp]

Lots of people working remotely. In Russia foreign companies that won't share keys with government are banned so domestic market has room for insecure apps.

[ryanisnan]

It's owned by a domestic company, though. Not sure if you meant "In Russia companies that won't share keys with government are banned".

[maqp]

All companies that use strong encryption are banned. Domestic companies can't use proper encryption so they aren't really banned, lest they go under very fast.

[ryanisnan]

Tough situation. More power to companies that keep fighting the good fight.

[njitram]

Weirdly enough, they also have a European version of the privacy policy, at https://privacy.icq.com/legal/privacypolicy/eu which is quite different (but no word on encryption), and on https://icq.com/security-calls/en it states that video calls ARE e2e encrypted, its a weird mix of parts encrypted, parts not, part GDPR, some not it seems.

[axegon_]

I had to re-read those two sentences several times cause I was sure I misread them... Apparently not.

[black_puppydog]

how is this shit even legal? I mean, assuming there are laws enforcing any semblance of "best practice" in a country? where are they incorporated?!

[ForHackernews]

At least they're honest! Better this than lying about what security you offer, like Zoom.

[anoraca]

Uh oh!