Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

whispersystems.org

Post reply on HN
Print view View original

171–180 of 225 posts

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#171

Post by nothrabannosir »

nl wrote: post #152
ikeboy wrote: post #65

Earlier quoted context omitted.

But why not allow E2E without incognito? Have both as separate options.

What use-case does E2E without incognito address? * Sharing naked pics on a monitored work network? No - there is at least some chance that your company owns your device, so therefore you want it to disappear from that * Sharing politically outlawed content? No - you can be compelled to give up your device. Wanting it "just because" is fine, but simplifying the UI is a pretty valid counter argument too.

Protecting against dragnet surveillance. Which is what the encrypted-by-default in Whatsapp achieved over night.

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#172

Post by ComodoHacker »

tptacek wrote: post #91
nkobeissi wrote: post #89

Earlier quoted context omitted.

I am the original author of the software you refer to. Before its complete rewrite (released two months ago), Cryptocat was based on a codebase that I wrote starting in my early undergrad and that was notorious for containing many high-severity vulnerabilities. The most important was "Decryptocat", documented by Steve Thomas [0] but we also had: * AES-CTR counter-reuse (2012) * Biased Fortuna CSPRNG implementation [1…

For what it's worth, Steve Thomas's vulnerability was not the most important in that code. I think Steve Thomas (fair warning: a friend) might dispute the "full disclosure" comment you made, as well.

Thomas, aren't you trying to make security-related products and infosec in general too "reputation-based"? Do you really think that some bad code or design or lack of theoretical background during early career should be an "out-of-profession" sentence for lifetime? Hadn't you ever made such mistakes yourself?

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#173

Post by chinathrow »

orblivion wrote: post #13
chinathrow wrote: post #10

That is awesome - now we also need to kill metadata collection. Is this feasible? Oh and off-the-record was there on Hangouts/Gtalk before - I used it but the chats were replicated across clients (e.g. Pidgin vs gmail.com) - so not really off-the-record (i.e. they lied).

It's "Off The Record" in that they claimed not to store history. As I understand this is completely unrelated to the OTR encryption system.

I got rate limited so here's my late reply:

Yes, I labelled that incorrectly and I was not talking about the OTR encryption tech - Google still lied though in terms that they kept a conversation record and replicated it live and time-delayed across channels.

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#174

Post by akerro »

cm3 wrote: post #112
cm3 wrote: post #31

Has anyone given this https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7 more thought and whether one should avoid Signal and work with a more friendly project that doesn't seemingly fail at its desire to have widespread use of the protocol and actually tried to sue WireApp? WireApp's now approved as a non-infringing implementation in Rust, so that's great for reliability. Edit: The suing part was initiated…

According to https://twitter.com/moxie/status/730289041493483520 Moxie is fine with reimplementations.

But he's not happy with recompilation of Signal? https://fdroid.eutopia.cz/

> Any other distribution channel we be treated as malware

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#175

Post by akerro »

ikeboy wrote: post #65
mderazon wrote: post #61

Earlier quoted context omitted.

They wouldn't be able to insert a chat bot to all of your conversations if they were all end to end encrypted. I agree it's a good trade-off

But why not allow E2E without incognito? Have both as separate options.

You have this in qTox and uTox

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#176

Post by NetStrikeForce »

I'm not sure I got it right.

Is Google going to be scanning all my conversations to give me suggestions on what to say next? Really?

I understand the price of things like Gmail, where I get a robust email system in exchange of scanning my emails and mining my data. I got something very good from Google, they got my data. Not the best of the deals I ever made, but it has (had?) a strong appeal.

On the other hand I don't understand this Allo thing: There's no appeal in the smart assistant, it doesn't bring anything I want to have.

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#177

Post by mimi89999 »

moxie wrote: post #135
chrisballinger wrote: post #118

Earlier quoted context omitted.

I've been pretty quiet about this, but over the last couple of months I have been trying to negotiate with Moxie a way to distribute the GPL licensed AxolotlKit on the iOS App Store in ChatSecure (which is open source). After being denied a license, I was told by Moxie that I would be unable to write a non-GPL AxolotlV3 implementation because there is not publicly available documentation, and that any re-implementati…

Hey Chris, as you know, we have no problem with you distributing our GPL software through the app store. Most of your communication has centered around asking us to change the license on our source base to something other than the GPL. We like the GPL for the quality control that it provides. If someone publicly says that they're using our software, we want to see if they've made any changes, and whether they're usin…

It looks like you can publish GPL apps in the App Store if you are the author. If you want to use someone's GPL lib in your app, then you might have a problem...

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#178

Post by dcposch »

DanBC wrote: post #153
dcposch wrote: post #132

Earlier quoted context omitted.

Nadim had a legitimate and reasonable question. For those who don't know, here was Thomas Ptacek recently joking about Nadim's penis: https://mobile.twitter.com/tqbf/status/705825790529662976 Here he is telling Nadim "go fuck yourself, forever": https://mobile.twitter.com/tqbf/status/705900243313758208 This is unprofessional. That kind of bullying is especially unacceptable coming from someone who has a lot of money…

> I think Hacker News should be better than this. I'm not sure how linking to twitter supports your comment that HN needs to improve. If he'd said that on HN he'd have been (I assume) banned. dang is constantly asking people not to be mean or dumb, or banning people for being mean.

That's fair. Here on HN, tptacek writes negatively about Nadim surprisingly often. I do think it's bullying, though you're right that it's more subtle than his behavior on Twitter.

dang is great. I just wish we had a bit less negativity.

--

Finally, a brief history for readers who dont know yet:

* Cryptocat v1 was a cat themed anonymous chat webapp with very broken homebrew encryption. It was basically Nadim's crypto learning project as far as I can tell when he was ~20 years old.

* Snowden allegedly used it at some point. Oops.

* Crypto experts reviewed it and found significant flaws. Tptacek wrote about how terrible it was, how JS crypto is Considered Harmful, how amateurs shouldn't write crypto because they could get someone killed, etc

* Cryptocat v2 a desktop chat app using Axolotl / Signal Protocol for e2e encryption. Nadim is a phd student now. It's a new and totally separate codebase.

tldr; there's no reason to assume that Cryptocat v2 sucks in the ways the original did. It may be totally sound.

(I have no involvement w the project and have not reviewed the code.)

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#179

Post by Arnt »

akerro wrote: post #174
cm3 wrote: post #112

Earlier quoted context omitted.

According to https://twitter.com/moxie/status/730289041493483520 Moxie is fine with reimplementations.

But he's not happy with recompilation of Signal? https://fdroid.eutopia.cz/ > Any other distribution channel we be treated as malware

He isn't fine with anyone distributing unsigned or resigned Signal. What he says is more or less "my app, my signature".

The fdroid people could recompile, check that the binary matches the one Moxie signed, and distribute the one with Moxie's signature.

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#180

Post by ComodoHacker »

ikeboy wrote: post #109
mike_hearn wrote: post #108

Earlier quoted context omitted.

I see. In that case, yes it'd make sense to have such a feature, probably implemented as an archive button in the incognito window (with a warning that archiving such a chat makes it non-private).

Are you assuming that all storage ends up on Google's servers (because that's what hangouts does, maybe)? Why can't it store E2E chats locally and never upload to google, or even encrypt with a passphrase like Chrome sync does?

Congrats, you have dug it down to the core. Google just doesn't need chats that it can't mine for useful data.
Post reply on HN