sorted by: new top controversial old
-12
[Dev] FlickerTalk: a messenger with no account and no phone number. History only on your phone (lemmy.world)
 

I'm the developer, so take this as self-promotion; one post, and I'll answer questions here.

What it does: messages, pictures, files and voice notes, plus voice and video calls, always one to one. There is no sign-up. You meet someone, scan their QR code (or open the link they send you), and that's the contact. There is no directory, so nobody can look you up.

Where things live: the conversation is stored on the two phones and nowhere else. When both phones are reachable, a message goes directly from one to the other, end-to-end encrypted. When the other phone is off, a mailbox on our server keeps the encrypted blob until it is collected, seven days at most; you can switch the mailbox off in Settings if you prefer messages to wait on your own phone.

Inside a chat there is an Apps tab: a document scanner, a shared list, a whiteboard you can draw on during a call, a translator that runs on the phone, and a few two-player games such as chess.

Known limits, so nobody is surprised: with a direct connection the other phone can see your public IP, and the wake-up push goes through Google (it carries no content). It only works if the other person also has it. iPhone is coming soon.

Play Store: https://play.google.com/store/apps/details?id=com.flickertalk.app Source (AGPL-3.0): https://github.com/FlickerTalk

I'd like to hear what was confusing the first time you opened it, and which tool or game you'd want next.

FlickerTalk chat screen on Android: a short conversation planning a Saturday hike, with a photo in the chat
Tools inside the chat vs. a simple messenger: privacy win or bigger attack surface? (developer asking, limits first) in c/privacy@lemmy.world
[–] [S] -1 points 3 weeks ago* (last edited 3 weeks ago) (1 child)

Fair points, and thanks for reading the README closely; that is what I asked for.

Encryption. Messages are end-to-end encrypted with Olm (Double Ratchet) through the vodozemac Rust library. It is in the README's third bullet, but it should have been in this post; that is on me. Transport is a WebRTC data channel between the two phones, and the DTLS fingerprint is tied to the contact's identity key through the signalling, which is Olm-encrypted too.

The README. I don't think it contradicts itself: those are two different things. "No history on a server" is about your conversations, which only ever live on the two phones. The mailbox is a separate, optional feature for a message that could not be delivered because the other phone was off. I agree the first sentence was too short to make that clear, so I have tightened it to "the server keeps no history"; a README can lag behind the app, and the app is what counts, so install it and check for yourself. The two options the user has:

  • Mailbox on (the default): if the other phone is off, the message waits on our server end-to-end encrypted, with no sender attached, until it is picked up or seven days pass; it is deleted the moment it is picked up. We cannot read it and we keep no history.
  • Mailbox off: either side can switch it off in the settings. A message only goes to the mailbox if both people have it on; otherwise it waits on the sender's phone until both are online, and nothing of yours is stored on our server at all. The server keeps no preference either: each request carries the flag.

Files and calls never go through the mailbox in either mode. The full list of what the server keeps is on the site under "how it works".

Why not build on the app you mention. It is a good project and its email-based model is a solid choice. Honest answer, in two parts. First, FlickerTalk started as a personal project where I needed to learn, Rust and WebRTC mostly, and it grew from there. Second, I could not find a messenger that was both private and modular: one where the core stays small and you extend it with isolated tools, each seeing only what you hand it, instead of every feature being baked in. That is the gap I am trying to fill, and it is also what this post is about. The itch behind it is personal: I used to spend hours on the phone playing chess with my father, and I wanted that right inside the chat, along with the small utilities I use every day, without the ad-filled apps you end up installing on Android for each of them. Along the way I wanted two things the email model does not aim for: delivery straight from phone to phone when both are online, and no account of any kind, not even an email one, plus voice and video calls. Different trade-offs, not a claim of being better.

  • permalink
  • fedilink
  • source
  • parent
  • context
    • -5
    Tools inside the chat vs. a simple messenger: privacy win or bigger attack surface? (developer asking, limits first) (lemmy.world)
     

    I build a small messenger and I'd like opinions, not installs. Disclosure up front: I'm the developer of FlickerTalk (Android, AGPL-3.0, no account, no phone number). Limits first, since this is a privacy community: it only works when the other person has it; 1:1 and small circles, no large groups; on a direct connection the other phone can see your public IP; Google delivers the wake-up push and sees that one arrived, not what it says.

    The design decision I keep second-guessing: instead of adding features to the messenger, I put them in an "Apps" tab as small sandboxed web packages you open inside a conversation. Each tool sees only what you hand it, and nothing leaves the phone until you tap send. Today: a document scanner, signing a PDF together, a shared list, split expenses, a poll, a whiteboard during calls, a few two-player games.

    Questions for people who think about this more than I do:

    1. Is "tools inside the chat" a privacy win (less data sent to third-party apps) or a bigger attack surface, in your view?
    2. Which everyday task would you actually want to do without leaving a conversation?
    3. What should a messenger refuse to bundle, no matter how convenient?

    I'll answer every reply and I'm fine with "none of this, keep it simple" as an answer.

    How do you deal with WhatsApp monopoly? in c/degoogle@lemmy.ml
    [–] 1 point 3 weeks ago

    I'm the developer of a small messenger, so take this with that in mind. The honest answer from the other side of the fence: there is no trick. A messenger only works when the other person has it, and most people won't install a second app for one contact.

    What has worked for me, a little: not asking people to "switch", but to keep one conversation somewhere else. One person, one thread (a partner, a sibling, a friend you talk to daily). If that one thread is pleasant, the second one follows on its own. Asking a whole family group to move at once fails almost every time.

    The other thing that helps is removing the sign-up cost entirely. My app (FlickerTalk, Android, AGPL) has no account and no phone number: you open it, show a QR code, done. Chat history stays on the phone, and if the other phone is off a mailbox holds the message end-to-end encrypted until it's picked up; we can't read it. Limits, since this is a privacy community: it's 1:1 and small circles only, no large groups; on a direct connection the other phone can see your public IP; and Google delivers the wake-up notification (not the content). Not a WhatsApp replacement for a 60-person family group. For the one person you actually want to talk to privately, it's enough.

  • permalink
  • fedilink
  • source
    •