back
100 comments
The landing page may be a bit too minimal in giving overview of this cool project. I really liked the direction towards real-time P2P networking, based on Iroh [0]. See the blog post about this [1].

> After almost two years of collaboration with the wonderful Iroh team, and years of discussions with numerous experts in the decentralization space, we are happy to announce that Delta Chat 1.48 apps on all platforms contain state-of-the-art Peer-to-Peer networking support, including hole punching and forward-secret end-to-end encryption. Concretely, Delta Chat now establishes private Peer-to-Peer gossipping networks between users who start a webxdc app that uses the new joinRealtimeChannel() API.

[0] https://iroh.computer/

[1] https://delta.chat/en/2024-11-20-webxdc-realtime

I’ve been experimenting with Iroh over the past month. It’s been such a pleasant experience. Previously, I created a p2p connection with webrtc and had to create a layer on top of that to use request/response style communication between nodes. I can throw that all away with Iroh and focus on the product. It’s a relief.
There was a few talks about Delta Chat in FOSDEM'25. Seems it has come a long way since inception.

https://fosdem.org/2025/schedule/event/fosdem-2025-5853-delt...

https://fosdem.org/2025/schedule/event/fosdem-2025-5217-chat...

In a sensible world, we would be using this, instead of whatsapp. It is amazing that even really a vast majority of, even technical people, not once stopped and looked at whatsapp, and said "Wait, e-mail can do this, we just need a pretty UI".
>It is amazing that even really a vast majority of, even technical people, not once stopped and looked at whatsapp, and said "Wait, e-mail can do this, we just need a pretty UI".

WhatsApp lets people find each other with phone numbers instead email addresses. This has a profound difference in real-world usability because it decreases friction.

Before WhatsApp, people texted each other using cell companies' SMS service.

Why did Person A (who already had an email address) send a SMS text to Person B (who also already had an email address) to chat?!? Because both people already had each others' phone number in their smartphone's address books. Recording each other's email address is less likely so it won't be used as "ids" to chat -- especially between friends & family.

To wit, my mother has already memorized my brand new phone number that I've only had for a few years but she doesn't know my email address at all even though I've sent it and re-sent it to her multiple times. To normal people, the phone numbers are more sacred than email addresses. WhatsApp was a continuation of the conveniences of SMS -- without paying 10 cents per message to the mobile phone carriers.

Friction from cognitive overhead is a big deal in technology adoption.

To say nothing of the fact that most people are not running their own email servers so that messaging is going to reside in places they don't own and the fact that relays get to read about everything exacerbating that problem, so you cannot really expect forward secrecy:

Does this solve all the other problems with encrypted email, which is not widely used for a reason?

Here's a discussion

https://www.latacora.com/blog/2020/02/19/stop-using-encrypte...

No, if anything we'd be using XMPP or Matrix.

Email is the completely wrong protocol choice for instant messaging. It's just a completely different use case. You wouldn't send a letter to the fire department if your house is on fire either.

From the website:

> Reliable instant messaging

If it's based on e-mail, it's just not. (if we assume generally close-to-realtime delivery and not being blocked by random recipients)

I mean... WhatsApp is literally XMPP / Jabber... It's amazing that we didn't stop and said, wait, Jabber can do this, we just need a pretty UI...

Hell, Jabber can still do this. I'm not convinced of the other modern alternatives that don't have half the functional capabilities that Jabber do.

The only "downside" of Jabber is that it's XML based, but really if you think about it, that's a strength. Anyone here could probably parse the protocol effortlessly. There's also lots of fully functional clients out today, and servers that scale like nobody's business.

I'm more ashamed we don't invest more into XMPP: Google Talk, Facebook Chat and WhatsApp were built around it. These are companies with insane to scale userbases, tried and tested.

Here's a 2008 article from Facebook on using their chat with a Jabber client:

https://developers.facebook.com/blog/post/110/

> "Wait, e-mail can do this, we just need a pretty UI"

This reminds me on this nice comment thread: https://news.ycombinator.com/item?id=19217818

For those unaware, this was created by Holger Krekel, the brain behind pypy and pytest! Another great product.
didn't knew that!

Even though I am part of this secure messaging group chat on matrix thing and I had even created a whole tierlist of security of protocols etc. and saw delta chat & have it running and fiddled with it.

The fact that it is written by creator of pypy is wholesome!!

On the positive side, the use of P2P and IMAP makes censorship difficult, which is a strong advantage in authoritarian regimes.

However this comes with serious trade-offs. PGP lacks forward secrecy: if a key leaks, all past messages can be decrypted. Also IMAP offers no metadata privacy, anyone can see who you email and how often.

Signal and WhatsApp are likely a step ahead in terms of privacy with their double ratchet encryption (https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm).

> Signal and WhatsApp are likely a step ahead in terms of privacy

WhatsApp is closed source, so whatever they claim to can't be proven. And remember that both WhatsApp and Signal are legally required not to disclose to you whether they are spying on you or not.

WhatsApp obviously cannot be trusted for message privacy for the simple reason that Meta paid gazillion bucks for it. I don't understand why people need more evidence beyond that.
If your device is confiscated your entire history is in the clear. Forward secrecy doesn't magically solve problems, it's useful if you use ephemeral messages. In DC if there's a window of time where you want messages to not be traceable you just create a new email adress (which is just one click in DC thanks to chatmail) and delete that address after, that's it.
> if a key leaks, all past messages can be decrypted

Not to mention, if you revoke a key (maybe because you lost your laptop and want to be proactive about security), without any authenticated timestamping service in the mix, all past messages and signatures can no longer be trusted, regardless of the revocation date. That's why when you revoke a key on github, all your previous commits' signatures turn red.

I've never understood why no one's succeeded in doing anything about this after all these years.

edit: I was wrong, Delta Chat now has forward secrecy from v1.48: https://delta.chat/en/2024-11-20-webxdc-realtime

Furthermore metadata transparency can be made less problematic by using email aliases.

Previous discussions:

24-jan-2021 https://news.ycombinator.com/item?id=25893626 148 comments

07-jan-2021 https://news.ycombinator.com/item?id=25674894 4 commments

27-feb-2019 https://news.ycombinator.com/item?id=19263357 11 comments

21-feb-2019 https://news.ycombinator.com/item?id=19216827 56 comments

03-feb-2017 https://news.ycombinator.com/item?id=13560279 1 comment

Several years ago I tried DeltaChat and it caused an insurmountable problem: my mail provider kept locking me out of my account. Almost certainly it was because DeltaChat's suspiciously ciphertext-filled messages were triggering the abuse lockdown.

The provider was GMX and it was their fault, not DeltaChat's. But I had to call off the experiment.

> The provider was GMX and it was their fault, not DeltaChat's.

Noting that the team have put together "Chatmail" a minimal email suite designed for speed, security and convenience.

Also helps with the whole "onboarding to chat" and multiple identities not linked to existing accounts.

https://delta.chat/en/chatmail

There are multiple public servers which may be an option, instead of using an existing email account at provider X.

The most important factor with email, is that your inbox is encrypted at rest at all times... and cannot be bruteforced.

The chances of your email messages being 'man in the middled' are almost non-existent. Its a micro-percent of live investigations that does this.

The police RELY ON finding messages in either your inbox or the recipients. It doesnt matter if they are encrypted or not in reality. Of course they'd like to read them and if they are this deep into you. Its likely they still will (probably from the recipients lesser password hygiene than yours).

Almost no evidence is every 'plucked' out of the air and read. It just doesnt work that way.

However, software like Delta is better than nothing esp for normies. Its just limited in use for people who really need ways to frustrate LE.

Source: Ive been under NCA and FBI investigation before. Protonmail with the two password method stopped them every time. Memorise the 2nd password and password manager the first.

> Ive been under NCA and FBI investigation before. Protonmail with the two password method stopped them every time. Memorise the 2nd password and password manager the first.

Unless you exclusively use proton-bridge and disabled auto-update, then proton controls all endpoints in which your passwords live.

So what is preventing the FBI from forcing Proton to serve a special UI just to you that will be used to exfiltrate your second password?

You have? Why?
I wish I could send a one-time link to my father where we could play chess against each other by re-visiting the same link.

The e-mail part made me think of this. I have no use for an e-mail based chat but an online chess game that's easy to use without registration would be cool. He's 82 and he can't use complex sites.

> an online chess game that's easy to use without registration would be cool

Lichess lets you play without registration, I believe (or at least one player; not sure if both sides can be anonymous).

well then deltachat is exactly what you want because it supports webxdc apps which can run in the deltachat client. here is the chess app: https://webxdc.org/apps/#arcanecircle-chess
My first question on this sort of thing was how well does it work with GMail. And they have an FAQ entry on it: https://providers.delta.chat/gmail
I'm pretty sure you would be quickly rate limited, especially if you participate in a few large group chats.
Would love to know if someone actually runs it reliably. Especially with a Workspace email address.
The whole purpose of using a distributed IM like Delta Chat is to break free from big data leeches like Google. If you're just using Delta Chat with a centralized Gmail server as the backend, doesn’t that defeat the point?
Reminds me of Topicbox (by Fastmail).

https://www.topicbox.com/

I tried to use it, liked the concept, but the way it handles email is a mess, making it unusable for my use case of trying to use it as an alternative mail client for my normal mail account.
I tried it a couple years ago and it sorted everything neatly into a Deltachat folder. But a friend of mine also complained abut too many mails
"I used a hammer to make orange juice and it made a mess! Unusable!"
would be nice if all the "no, no, this can't work! email is slow! blah blah" guys once and for all actually give it a try to the app and realize IT WORKS AND IT IS BLAZING FAST! I have been using it since years with my family and some friends without any problems, it is the best I could find after trying Matrix, XMPP, etc.
Does it means the delta chat messages appears in the regular mail inbox?
Ah the famously friendly UX of PGP combined with the solid reliability of email. This is trying to get two drunks to stand up straight by leaning them against each other.
> This is trying to get two drunks to stand up straight by leaning them against each other.

Thank you for painting this beautiful picture.

Presumably they have chosen and standardized a particular subset of PGP for their product, making it fully reliable and user-friendly.
They've actually cracked PGP, and email is fine, especially between self hosters and anyone using chatmail. I've been using it for years: Delta really, really works.
You should really try the thing in question before commenting
Have you used it?
Slap AI, blockchain and electron on it and ship it, stat.