Paradox2 Web Client, Yann's report – part 1

An alternative tool to access your SLOWLY letters

SLOWLY like many other applications we use daily is based on the 'Client-Server' model. Two devices are involved, communicate and each does its part.

Server side is controlled by the service provider, in this case Slowly Communications. The machines are industrial grade, heavy duty, and located in data centers somewhere. In our case, most of them are hosted with Amazon Web Services, the major part of which are located in the USA.

Update: Paradox2 Web Client, Yann's report – Part 2 is also online.

The 'Client' is on the user's side.

It is the app you use in your Android or iOS mobile, or the Web Client that runs in any browser, making it available on a PC, laptop or desktop.

The server side is tightly controlled by the owners, and we do not have access to their source code or documentation.

Clients for SLOWLY have been around for a few years now – the first ones appearing in early 2017, for iOS only. In May 2018, the company debuted their first Android version, which opened the app to many more people.

The versatile and powerful Web Client arrived in mid September, 2019 – I remember it clearly, as I started using Slowly in June of that year, and was dismayed that there was NO desktop version until then. (a feature that had been promised and on the works since mid 2017 or so)

A new Web Client option now exists

One that was independently created, by one single programmer, a brilliant one. WithParadox2 did it, for his own use and later shared it with a few friends who appreciated and encouraged him.

For simplicity and to save space, I will refer to the author as WP2 from this point on. Similarly, I refer to his client as 'the Paradox2 client'.

Lacking access to ANY internal source code or API (Application Programming Interface) documentation, WP2 had to figure out on his own all the communication processes between the client and Slowly's company servers. He got no info or help from the company, which has always been tight lipped about internal matters, however nice they are with us, their fan and users base.

Reverse Engineering required

WP2 observed and studied what was happening when the official mobile client communicated with the servers, he used a packet inspector to log and analyze all the traffic – a process called 'Reverse Engineering', which he explained in detail in his Blog. (a very technical post, but you can get the idea of the work involved.)

Painstaking is a good word to describe it – it's like learning a new foreign language, by just listening to two speakers. And at some point, attempting to understand the vocabulary, the syntax, the grammar – and then trying to communicate with one of them, the server, directly.

And he succeeded

Which is wonderful, a triumph of talent, stamina and competence.

Thanks to his work, we had an extra option to use since mid 2020 or so. WP2's client is hosted in his own webserver, but like other Web Clients, the processing happens at the user's side – in your own browser of choice.

It has many, most of the basic Slowly client functions; not all of them, as I will detail here. But it also has EXTRAS which the company's own clients do not offer even to this day, more than a year after WP2's client became public knowledge after he created a Topic about it on Reddit.

And started being reported on – I wrote about it here, and later here too with more details and screenshots. This Blog post will compile all of that info and update it.

Security Concerns?

Anytime we use software we have to trust the provider of that code, and this is no exception. WP2 is a random person from somewhere in the Internet, and his client has open source, all of it is hosted on his GitHub here.

Keep in mind that there's a risk, and using this alternative client should only be done if you understand and accept the risks. (data leakage, credentials being copied, your letters being copied behind the scenes could all happen, for example.)

With that in mind, the best we can do is analyze the situation.

An inquiry with the Support team

Message sent to Slowly Team regarding the Unofficial Slowly client website – and a request for comments.

Hello J., good morning ! 🙂

Hope all is well with you and the other team members. I wanted to touch base and ask if you have seen this post on Reddit ? A user created an unofficial web client for Slowly, and posted about it on our Reddit sub, about 5 days ago.

He has some really interesting extra features – – detailed Stats on number of letters, word count, as well as an Export function that allows saving all letters with a certain pen pal to a text file, to be saved at user's device.

These are something I would really like to see in Slowly.

I just passed my one year anniversary of joining the app, and wrote hundreds of letters, which I have no backup or recourse to if the slowly servers went offline. Have you all seen this ?

I have mentioned to other users the risk in using an unknown website and logging into an account where we have so much personal information, letters, sometimes things we haven't mentioned to anyone else.

I am thinking of writing a Blog post about it, and would like to ask if you have an official team statement regarding this. Thank you! 🙂

Sent via Twitter Direct Message to SLOWLYapp corporate account, June 20, 2020

And the Slowly Team responded

Hello Yann, Good evening.

Yes, I saw that post and I understand why users like it.

Just like what I mentioned before, my team does not recommend users to use unofficial clients to log in Slowly because of possible data leakage.

It is an interesting topic though. Looking forward to your new blog post. Best regards, J.

Received the next day, also via Twitter DM.

Yann's comments on safety of using it

As noted in notes and comments on my very first report on the Paradox2 client project:

This is cutting edge software, and there are some risks involved.

So I have to be careful on posting in the open at the Slowly app sub itself. Any mentions there must include some warnings and disclaimers, so people DO know about them.

And further down the comments in that topic, a response to Russian Cousin's questions.

Possible risks?

Is there a risk of my account being deactivated by these very hidden developers,

or is there no such risk right now?

Yes, there is a couple of risks involved with using this or any other third party client.

but I feel sorry for my account with stamps obtained in a hard struggle.

That is very true.

All the stamps you have in a collection. All the contacts the account has. And also — any coins balance in the account could be at risk.

That is why I do use this client only with secondary, test accounts for now at least.

Not even a coin balance at risk, although it's a pity to not be able to see the real stats on my full account.

Or to back up my letters. Maybe someday. 🙂

Why is it worth considering?

Because some of the added new functions in the Paradox2 client are sadly missing in SLOWLY. in Mid 2020, WP2's client already included these functions, all unsupported by the official company software:

That is a LOT – and here, 16 months later, we still do not have any Data export or Backup in the official client. If the company servers went offline for whatever reasons, our data, hundreds of letters and hundreds of hours of writing, would be lost in a blip.

Backing up one's Data is important

So, it's time we start asking for some form of Export, backup of user data — I am not sure, but under European Union legislation, there might be an obligation of a company providing a user's data upon request.

Facebook recently implemented a user Data Export Function that can Very Easily export all of a user's Photos, albums, including the original comments posted with each photo. I have used this, and was amazed how well it works — exported hundreds of albums, thousands of photos, all painlessly, all preserved in folders, with each album's original name.

Really impressed! Find out more about this new Facebook Export here.

Detailed Report on Paradox2 Client

We are already at 1,800 words, so I will split this post in two parts.

While this Part 1 is text heavy, as needed for proper disclosure, Part 2 will be lighter and with many illustrations, concentrating on the features, screenshots and my impressions.

Paradox2 Web Client, Yann's report – Part 2 is also online.

Please send any comments or questions – they are important and add value. You can reach me via a direct message to my Twitter account – or the Reddit one. Or comment in public on the Reddit topic here.

Famous Last Words

Big thank you to WithParadox2, your talent and dedication are inspiring. I wish you the best, and that you have much success in your professional life.

Special Thank You to the folks behind this wonderful app — all the hard working people at Slowly Communications.

Letters we share, with pen pals all over the World, via the magic of the Slowly App. A modern day take in the traditional penpal experience.

Come and join us, if you are not yet using Slowly.

Follow Blog via your Fediverse/Mastodon account :

@friends-near-and-afar-letters-we-share@wordsmith.social

This page created entirely in MarkDown language. Thank you for reading, feel free to comment, via a direct message to my Twitter account – or the Reddit one.

You can also post a public comment in the Reddit thread for it here.

@yann2@koyu.space Top ▲