Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reflections: The ecosystem is moving

whispersystems.org

Post reply on HN
Print view View original

91–100 of 103 posts

Re: Reflections: The ecosystem is moving

#91

Post by ashitlerferad »

marssaxman wrote: post #11
tprynn wrote: post #6

I'll add my thoughts here, since I think a number of people will be disappointed in this post. There are a number of competing goals when developing software that "the whole world can/will use". And it seems obvious to me that getting the whole world to use a secure, encrypted messenger like Signal (now, Whatsapp) is a noble goal. The obvious competing goal is federation, and the fact that we've failed at improving f…

It's precisely the fact that Moxie is so credible on this topic that makes his post so frustrating. I believe that he's telling the truth as he sees it, and I believe that he's as well-situated as anyone could be to pull off a white-hat secure messaging system, so if he says it can't be done with federation, it's awfully hard for me to assert that he's wrong. The problem is that I don't see the point of doing any of…

Centralisation and federation must die, bring on peer-to-peer networks.

Re: Reflections: The ecosystem is moving

#92

Post by ashitlerferad »

pdkl95 wrote: post #41
kkl wrote: post #38

Earlier quoted context omitted.

Signal does not require an Android device.

So how can I run it? Difficulty: the only hardware I own is my desktop that runs a custom Linux.

You aren't in the target audience; normal people who make up mainstream society.

Re: Reflections: The ecosystem is moving

#93

Post by bad_user »

CariadKeigher wrote: post #67
bad_user wrote: post #53

In general I agree with @moxie's arguments, however I've come to to be wary at his condescending attitude and discontent towards people disagreeing with his choices. Like there's a review on the Android Signal app complaining that it asks for too many permissions, and it does ask for an arm, a leg and your soul, with the reply being unprofessional imho. I understand that this is open-source, but if you publish it and…

> And I think that email is unbeatable, because it is federated, because it's governed by standards and because in spite of all constraints, it's quite adaptable, being the kind of platform supporting short term proprietary solutions because (and not in spite of) its client/server decoupling. E-mail's biggest problem is that many, many, many people get it wrong either through configuration snafus or a holier-than-tho…

First of all, I really respect Moxie's choices and am very grateful for his work. What he wants to do, it's entirely his choice. Never meant to imply otherwise.

> Those who favour convenience over security are part of a huge problem that faces the Internet.

I'm not necessarily in favor of convenience, the problem is I cannot trust a binary blob communicating with a proprietary server, even if I can trust some of the people that worked on it, at least for now. I cannot trust something like WhatsApp. Signal I can trust, because at least it is open-source and up for review, but Signal will not succeed in being popular. At least not when it makes the same design choices. You say they cater to different markets, but I don't see a difference. For example Signal considers the phone number as being the username, just as WhatsApp.

Hence I end up carrying more about freedom than security. When I changed my email provider from Google Apps to FastMail, nobody noticed and I value that a lot.

> If you work at any company that has credit card numbers being used for either expenses or customer details, you'll quickly find that with a search for 16-digit strings within e-mails will give results

That may happen, but we've got strict policies in place. Nothing over email is communicated that's more important than source code. And given that source code lives in a Git repository provided by a public service, it would be ridiculous to do encrypted email, but not have behind-the-vpn on-premises Git repositories. And I know mistakes are made, etc. I still want federation more than I want end-to-end encryption.

Re: Reflections: The ecosystem is moving

#94

Post by knevik »

Do we really want to support an ecosystem that relies on an identifier so easily controlled and identifiable as a phone number? Building systems around legacy systems such as PSTN, and newer proprietary ones such as Gapps may be in Moxie's words, "almost a sure recipe for a successful consumer product", but it also increases the number of actors you need to trust therefore making security more complex.

[0]http://www.theregister.co.uk/2016/05/10/ss7_mobile_chat_hack... [1]https://www.bellingcat.com/news/2016/04/30/russia-telegram-h...

Re: Reflections: The ecosystem is moving

#95

Post by pdkl95 »

ashitlerferad wrote: post #92
pdkl95 wrote: post #41

Earlier quoted context omitted.

So how can I run it? Difficulty: the only hardware I own is my desktop that runs a custom Linux.

You aren't in the target audience; normal people who make up mainstream society.

What does that have to do with Signal's dependency on a mobile number? Signal is not an option for everyone, while other tools that use a less myopic design don't have that restriction.

If the goal is to fight passive surveillance, it's a bad idea to artificially exclude minority groups. Cell phones may be popular, but they are not universal.

Re: Reflections: The ecosystem is moving

#96

Post by devishard »

bad_user wrote: post #79
devishard wrote: post #64

Earlier quoted context omitted.

I think you're really missing the point here. > Moxie says that email is frozen, being why it is unencrypted, blaming the lack of progress on it being federated. But you know, I'm willing to bet that in 10 years from now WhatsApp and Slack will be both dead, just like Yahoo Messenger and ICQ before them, while email and IRC will still be around. Yes, and email will still be unencrypted, while the WhatsApps and Slacks…

Slack isn't encrypted and it doesn't make sense to pretend that it is. Introducing encryption is actually difficult for them, since they rely on a web interface connecting to a central server. But anyway, email can support encryption if you want it, not by one, but two protocols. Email is actually the main channel that journalists and businesses are using for communicating actual secrets over the wire. It's actually…

> Slack isn't encrypted and it doesn't make sense to pretend that it is.

I didn't say it was.

> But anyway, email can support encryption if you want it, not by one, but two protocols. Email is actually the main channel that journalists and businesses are using for communicating actual secrets over the wire.

Yes, but they're using GPG over email. Another example of a nesting protocols approach are plugins that support OTR over XMPP. Nesting protocols is a valid approach for technical users, but the user experience is such that it will never catch on with non-technical users. And, in context, providing e2e encryption that non-technical users will use is a big part of moxie's goals.

S/MIME can't be deployed meaningfully because major webmail providers will never support it; data-mining email is a huge part of their business model.

So no, email does not support encryption.

> And the reason for why encryption isn't popular with email is because people don't freaking care.

Nobody cares about encryption in the abstract, but a great many people care about privacy. Many people who care about privacy simply don't have the technical knowledge to know what encryption they need and use it, and can't give up the communication that email/chat/etc give them. My dad, who has trouble bolding text in Word, learned how to use Signal because he cares about encryption.

Re: Reflections: The ecosystem is moving

#97

Post by ashitlerferad »

pdkl95 wrote: post #95
ashitlerferad wrote: post #92

Earlier quoted context omitted.

You aren't in the target audience; normal people who make up mainstream society.

What does that have to do with Signal's dependency on a mobile number? Signal is not an option for everyone, while other tools that use a less myopic design don't have that restriction. If the goal is to fight passive surveillance, it's a bad idea to artificially exclude minority groups. Cell phones may be popular, but they are not universal.

I'm not moxie, but that is his stated goal; the majority not everyone. Especially not people who have heard of OpenPGP.

Re: Reflections: The ecosystem is moving

#98

Post by ashitlerferad »

ashitlerferad wrote: post #97
pdkl95 wrote: post #95

Earlier quoted context omitted.

What does that have to do with Signal's dependency on a mobile number? Signal is not an option for everyone, while other tools that use a less myopic design don't have that restriction. If the goal is to fight passive surveillance, it's a bad idea to artificially exclude minority groups. Cell phones may be popular, but they are not universal.

I'm not moxie, but that is his stated goal; the majority not everyone. Especially not people who have heard of OpenPGP.

Source for that last quip:

http://www.thoughtcrime.org/blog/gpg-and-me/

Re: Reflections: The ecosystem is moving

#99

Post by kerkeslager »

Zash wrote: post #86
kerkeslager wrote: post #70

Moxie: there's a third alternative to centralization and federation which nobody is talking about on this thread: P2P. I'd be interested to hear your thoughts on what pitfalls someone (me) might encounter trying to implement a peer-based messaging system. I've got a lot of learning to do before I feel qualified to actually write code for such a project, but it's something I'm actively working toward.

If federation is too hard then I don't think P2P, which is even harder, will be considered.

It's harder to deploy updatable encryption on a federated protocol than a centralized one, but as I see it, the difficulties are social rather than technical. Deploying updatable, usable encryption on P2P is technically more difficult than on federation or centralization, but I'm not convinced it's socially more difficult.

The core problem of updating federated systems is that big players can choose not to play. If Google or Yahoo decide not to support a change to email, the change is dead in the water. This isn't just hard, it's intractable.

But with P2P systems, non-reliance on peers doing anything in particular is built-in. For example, peers that don't support a change limit the size of the swarm you can peer with, but they don't inherently break the feature as long as there are some peers who support the change. Many Bittorrent clients support encryption and many don't, many bitcoin miners support alternate protocols to speed up pooled mining, and many don't.

I don't know what the implications of this would be for a system like Signal. It maybe that it doesn't solve anything; I'm just not ready to conclude that for myself yet and I'd be interested to hear Moxie's take.

Re: Reflections: The ecosystem is moving

#100

Post by dlmetcalf »

mbakke wrote: post #65
ngrilly wrote: post #24

Earlier quoted context omitted.

Interesting discussion.

I don't understand how Guardian were unable to obtain a license to use Signal/Axolotl in Chatsecure. The libraries on Github are GPL3, is there some missing IP I'm not aware of? Also it saddens me that LibreSignal is effectively dead now, along with any future third-party clients. I think forking the Signal server and (later) adding federation could spark a community of free and secure messenger apps for the 21st cen…

This is probably what made me double-take the most.

I don't understand why Guardian were denied permission to use the code. Sure, OWS aren't under any obligation to, but it doesn't really feel like it's in the spirit of openness at all.

The code might be 'open source', but it's neither free as in user freedom or beer, unless you're giving Facebook or Google your metadata now.

If the code can't be reused, it's pretty hard for users to move to something else. Unless that something else is totally starting over again from scratch.

It just feels weird that because of the Apple situation, in this case the GPL appears to work directly against user freedom.

I think a lot of people have been taken by surprise by that, to discover the platform is not what they thought it was.

Post reply on HN