41–50 of 90 posts
As an alternative to Signal, I would also recommend Threema. Mobile only, paid, end-to-end encrypted with in-person verification. Team and infrastructure is based in Switzerland https://threema.ch/en/
The major reason why we (IT group in Switzerland) are not using it as much, is because they are still not providing a Desktop Client.
Security people recommend Signal a lot (e.g. https://medium.com/@thegrugq/signal-intelligence-free-for-al... , Snowden uses it and repeatedly recommended it: https://twitter.com/Snowden/status/661313394906161152 , ...). Personally, I use it all the time and it's nice. Most of the initial problems have been sorted out, so I encourage anyone who's had trouble with it before to try it out again. It has text (one-on-one…
Encrypted video calls will crush mobile CPUs in my opinion, but indeed it would be nice to have one.
Earlier quoted context omitted.
Where is the source code?
"Biocoded source code, security protocols and implementations are audited by independent security agencies. Open source is not a guarantee or even an indicator of security. For sensitive governmental and corporate use, open source solutions are often dismissed outright." https://biocoded.com/faq#0
This is true.
> For sensitive governmental and corporate use, open source solutions are often dismissed outright."
But this is a false argument. Open source solutions aren't dismissed because they are open source per se, but because they generally lack predictable longer-term support.
I like https://wire.com and https://threema.ch/en
Wire was in the middle of a shitstorm a while back iirc because it falsly advertised that it encrypted everything end-to-end, when in actual fact only text was so.
http://gizmodo.com/why-you-should-stop-using-telegram-right-...
I am working on a messaging & email encryption platform (for the reason you mentioned) which will finally make encryption easy to use for non tech savvy people. It is based on PGP, source will be available. If anyone is interested in helping, giving feedback or learning more send me an email (in my bio or my username at gmail.com)
Can you tell us all more here?
Situation: Us "techies" know or easily can learn how to set up encryption and protect ourselves, the general public will not. Everyone needs encryption but most will only use it if: -their friends are using it -it is so easy a cave man can do it -it is beautiful
Complication: Current products are hard to use and are built for hackers. Encryption products need to build in vitality and understand the use cases of most users. To be successful this must be built with usability and UX first, not security methods first. Sormthing pretty decent that people use is much better than a great system that most people don't use.
Solution: Browser plugins that act like they are a part of the current email experience. Beautiful phone apps that give users the same functionality that they are used to having with much better security. More info below, this is my current thought process and work, not perfect I'm sure, would love input.
UX: Most users use email via browsers and default phone app. Initial plan is browser plugins + standalone phone app. Browser plugins exist for pgp but are too complex for the general public to understand and set up and require a user to get the recipient's key. We streamline the process by just having the user click "encrypt", enter a passphrase (will get to this in tech section), and click send. We take care of setting up the recipient with their account if they don't have one to be able to view their message. As for mobile messaging, users will enter their passphrase when launching the app and then be able to freely message, call, video chat until the switch to another app or exit.
Tech: Encryption using private/public key pairs according to pgp spec, of which implementation is gpg. Encryption/decryption happens on device or browser. We host last known good info for user public keys to prevent MITM attacks and will only use other sources if we don't have info of a user. Private keys are stored on our platform for cross device compatibility and so they are not stored on the users device. However these keys will be encrypted/decrypted on the users device using symmetric key encryption implemented as a complex passphrase.
Earlier quoted context omitted.
"Biocoded source code, security protocols and implementations are audited by independent security agencies. Open source is not a guarantee or even an indicator of security. For sensitive governmental and corporate use, open source solutions are often dismissed outright." https://biocoded.com/faq#0
> Open source is not a guarantee or even an indicator of security. This is true. > For sensitive governmental and corporate use, open source solutions are often dismissed outright." But this is a false argument. Open source solutions aren't dismissed because they are open source per se, but because they generally lack predictable longer-term support.
Not for governments. Some are pragmatic, others will not even consider it if open source.
I like https://wire.com and https://threema.ch/en
I did read that facebook messenger now has end to end encryption, but as far as I can tell this is only for "secret" conversations - which are only available from the device you initiate the conversation from. Whatsapp would probably be a good choice if you (OP) have a lot of friends already using it.
Earlier quoted context omitted.
> Open source is not a guarantee or even an indicator of security. This is true. > For sensitive governmental and corporate use, open source solutions are often dismissed outright." But this is a false argument. Open source solutions aren't dismissed because they are open source per se, but because they generally lack predictable longer-term support.
> But this is a false argument. Not for governments. Some are pragmatic, others will not even consider it if open source.
That is, of a government entity that explicitly rejects software products made by recognized (for-profit) companies because it's an open source.
At the moment, Signal and Wire seem to be the best options. They have open-source clients, end-to-end encryption, are easy enough to use that even less-computer savy people can be realistically convinced to use them and they seem to offer decent protection for metadata (not technical, but policy-wise). There are, however, some upcoming developments which will change the situation in the next couple of months: 1) The…