Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

whispersystems.org

Post reply on HN
Print view View original

201–210 of 225 posts

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#201

Post by ownagefool »

ComodoHacker wrote: post #172
tptacek wrote: post #91

Earlier quoted context omitted.

For what it's worth, Steve Thomas's vulnerability was not the most important in that code. I think Steve Thomas (fair warning: a friend) might dispute the "full disclosure" comment you made, as well.

Thomas, aren't you trying to make security-related products and infosec in general too "reputation-based"? Do you really think that some bad code or design or lack of theoretical background during early career should be an "out-of-profession" sentence for lifetime? Hadn't you ever made such mistakes yourself?

Yeah, whilst I generally agree with the sentiment that nobody should roll their own crypto nor use something you randomly find on the net, if nobodies creating these things, you will have no future professionals.

Good for his consulting rate, no doubt, but probably not good for society.

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#202

Post by skrowl »

reitanqild wrote: post #43
dmix wrote: post #33

Earlier quoted context omitted.

> on a personal note, the desktop client requiring chrome is pretty awful. Why? I haven't had any issues with it. I even have a shortcut on linux for dmenu, typing "signal" opens the chrome extension URL, opening the app in a new popup window (not a full browser, just the app in a chromeless window). So it functions just like a normal app to me. This is the `signal` bash script: #!/usr/bin/dash /opt/google/chrome-uns…

To me it is personally annoying because so many people and esp developers seems to want Chrome to become the new IE: a subpar (yeah, until google give you nested vertical tabs ;-) browser that web developers have fallen in love with to the point where they forget anything else. Anything that reinforces this automatically qualifies as bad (and I'm only partially joking here ;-)

This is exactly it! People are now making chrome apps instead of web apps.

How many times have you been to a webapp and it said "Your browser is not supported, for best results please use Google Chrome."

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#203

Post by detaro »

haffenloher wrote: post #195
detaro wrote: post #161

Earlier quoted context omitted.

To add to what rtkwe said, I assume the Signal client is a Chrome plugin because as far as I know you can't use GCM push messages with Chromium/NW/Electron, but only in Android and Google Chrome.

Signal Desktop does not use GCM. You can use the extension with Chromium or any Chromium-based browser.

Really? Wow, how did I miss that... Thanks for correcting me!

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#204

Post by tremon »

ikeboy wrote: post #191
tremon wrote: post #189

Earlier quoted context omitted.

Wanting an E2E chat that stays on my device when I'm done should be fine. Only if all other participants in that chat are fine with it. So you'd end up with an implementation that only allows saving to disk if all parties allow saving. That's a lot more complexity than simply a separate checkbox. I still agree with you, there is value in allowing the features to be controlled separately.

Why? I could always screenshot it, there's never a guarantee when you send information that it won't be retained by others with access. Letting me keep it without screenshotting is just a local convenience feature.

Sure, you could screenshot it. You can make a screencast too. But that would be your choice and your effort, not the tool's. There is a difference between a conversation partner that spends effort to violate the (possibly implicit) rules for that conversation, and a conversational tool that encourages subversion without effort.

In other words, it would be bad for Whisper to allow saving confidential conversations for two reasons:

- the user chooses to not save the conversation, but can't be sure if other partners save it regardless

- the user chooses to save the conversation, but can't be sure if the tool will really do so because of other partners' choices

Either of the options above will lead to more end-user questions (and necessary UI to prevent those) than simply combining E2E and persistence in one option.

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#205

Post by mimi89999 »

mimi89999 wrote: post #177
moxie wrote: post #135

Earlier quoted context omitted.

Hey Chris, as you know, we have no problem with you distributing our GPL software through the app store. Most of your communication has centered around asking us to change the license on our source base to something other than the GPL. We like the GPL for the quality control that it provides. If someone publicly says that they're using our software, we want to see if they've made any changes, and whether they're usin…

It looks like you can publish GPL apps in the App Store if you are the author. If you want to use someone's GPL lib in your app, then you might have a problem...

The GPL is not compatible with the Apple App Store because it contains: "You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License." By submitting an app to the Apple App Store and signing the license an author can grant that right to Apple, but somebody that wants to use the code can't do that...

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#206

Post by stinkytaco »

nandhp wrote: post #124
StavrosK wrote: post #80

Earlier quoted context omitted.

I lament the fact that we're moving more and more to closed chat protocols. Shortly, nothing will work with Pidgin/Adium any more, and it's a shame because it's by far the best way to chat.

Moving to closed protocols isn't the whole problem. Everyone used to use AIM, ICQ, MSN Messenger, Yahoo! Messenger, which were all* closed protocols. And yet, the developers of gAIM (now Pidgin) and Trillian both developed clients that interoperated with all of these services and others. Sure, we had five years when everyone was on XMPP. But given that rich history of protocol investigation, what's surprising to me i…

I think federation has largely moved to the device. I do most of my messaging on my phone, where which app I'm using isn't invisible, but it's also not really a hassle to switch (mostly it involves dragging down my notification shade and tapping on the message I received). Not perfect, but also not really requiring the cognitive overhead that switching between desktop clients seemed to have. My phone federates my contacts, email, calendars, etc without much input from me and I believe chat will go that direction as well.

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#207

Post by stinkytaco »

ikeboy wrote: post #184
nl wrote: post #152

Earlier quoted context omitted.

What use-case does E2E without incognito address? * Sharing naked pics on a monitored work network? No - there is at least some chance that your company owns your device, so therefore you want it to disappear from that * Sharing politically outlawed content? No - you can be compelled to give up your device. Wanting it "just because" is fine, but simplifying the UI is a pretty valid counter argument too.

Combined with full disk encryption it ensures nobody can get it. Or maybe you want to use an open WiFi hotspot without letting anyone get your data. (Https solves this, though.) Or maybe you don't want Google to have your messages for targeting purposes.

Full disk encryption and end-to-end are not really ensuring no one can get it. I feel like I beat this point into the ground in these discussions, but all encryption is weak against rubber hose cryptography. If someone can compel you to give up your device and key, then all end-to-end does for you is make it less likely you will be caught by someone monitoring traffic.

Which brings us to point two: if that's your primary concern, then using Google may not be your best bet. If you are using Google messaging apps, it's likely because you value the additional convenience Google provides and privacy is a secondary concern.

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#208

Post by newjersey »

egjerlow wrote: post #194
dave2000 wrote: post #148

Earlier quoted context omitted.

Why would I want to use a browser to do non broswery things? It's bad enough that we have to use browsers in the first place. Wouldn't we be better starting from scratch and developing a secure, standards-friendly way of deploying text, images and video rather than taking something which was designed to display just text and try and make it useful?

Any ideas?

I don't really have any ideas. Software distribution should be a solved problem by now but even if we limit ourselves to GNU/Linux on x86-64 computers, we can't agree on a distribution mechanism. We are all over the place from the blessed apt and yum to oh just curl this url and pipe it to sh (I am a n00b so I may have said it incorrectly). There is no good way to make sure everyone gets updated. It is a mess.

I am typing this on Mozilla Firefox but I can see the draws of Chrome as a platform. I personally love the distraction that working on the plumbing on different platform involves but I would rather the people who work on secure communications -- that journalists, politicians, and policy makers, and social influencers in general can trust with their lives -- not be distracted by the fun plumbing.

The way I see it, we have to abstract it at some level. If systems folks can't agree on a standard, then applications will standardize on apps that live on top of them.

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#209

Post by Zigurd »

morgante wrote: post #6
tptacek wrote: post #2

This is fantastic news. The two largest messaging platforms on the Internet will both be using Signal protocol. I could ask for more: E2E could be the default for Allo, and it isn't. That's not great. But the E2E you get when you ask for it will apparently be best-in-class.

Uh, where are you defining Allo as one of the largest messaging platforms on the internet? It literally just launched. It might do well, but it could also easily be a flop (as many other social initiatives from Google have been). Either way it's a long ways from catching up to WeChat, Viber, or even Facebook Messenger.

"Allo" is just one aspect of IMS in Android. While it isn't certain that Allo as a product will succeed, Google's approach to IMS, carrier messaging, and basing products like Allo and Duo on those APIs and underlying networks means that this is more like adding the Signal protocol to an open IMS-based ecosystem of messaging than it is depending on Allo.

Re: Open Whisper Systems Partners with Google on End-To-end Encryption for Allo

#210

Post by Zigurd »

mike_hearn wrote: post #100
PuffinBlue wrote: post #96

Earlier quoted context omitted.

Agreed. Hangouts didn't catch on because it was delivered as a group video calling service that then also did (or perhaps became about?) text, even becoming the default SMS app on Android. It also hasn't caught on because it is overly complex. With any other video calling service you call a person and they have a conversation with you - of you initiate a group conference and off you go. Hangout needs you to invite so…

The Hangouts mobile app is also incredibly buggy.

I don't always agree something is "incredibly buggy" but when I do, it's because I experience multiple daily crashes on a Nexus 5X, which should be the most compatible and thoroughly tested platform it's running on. That qualifies as "incredible."
Post reply on HN