Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please Stop Writing Secure Messaging Tools (2015)

dymaxion.org

Post reply on HN
Print view View original

11–20 of 73 posts

Re: Please Stop Writing Secure Messaging Tools (2015)

#11

Post by vxNsr »

throwa34943way wrote: post #6

> Because we have too many other tools we also need. Yes, but secure messaging is a well understood domain I suppose so it's the kind of app that is simple(not easy) to write and most tools compete on UX. A lot of tools on the list at the end have complex domains that are not that well understood by stock developers, or they might require a lot of R&D or actually talking to teams that have a problem to solve. Further…

I would think that at least half of the domains mentioned are being used in some way by developers. So it's entirely possible to dogfood them.

Some examples I know I've used: PMS, Wiki, Calendar, VFM. I'd love a good group password vault, so far I've come up empty for something open source...

Re: Please Stop Writing Secure Messaging Tools (2015)

#12

Post by izacus »

gumby wrote: post #10

The essay I wish she had written would have said, "we don't need more 'secure messaging systems' -- we should be making all the following tools secure by design" For example, (and whether you love them or hate them) Apple takes this seriously: your fingerprints don't leave the device and are implemented by a piece of hardware in such a way that even Apple doesn't have access to them. Compare that to the Android imple…

What? Google CTS demands that devices store fingerprints in TEE and they never can touch filesystem. Where did you get the idea that fingerprints are stored on a filesystem?! O.o

(Android Fingerprint HAL document: https://source.android.com/security/authentication/fingerpri... )

(Note that the document allows storing fingerprints on FS, but they must be additionally encrypted. Better devices do not do that.)

Re: Please Stop Writing Secure Messaging Tools (2015)

#15

Post by DiThi »

pingiun wrote: post #9

I think matrix forms a nice basis for a secure chat platform. Only the apps are not really all that good. The desktop apps are electron based and the android app is just not up to par with telegram or WhatsApp.

In a lot of regards, the "not up to par" part of riot.im or matrix is the lack of a contact list (or simulated equivalent with same UX). IMHO it's the usability problem #1, and the reason for our team not to switch yet. The issue[0] should receive more attention.

[0] https://github.com/vector-im/riot-web/issues/4488

Re: Please Stop Writing Secure Messaging Tools (2015)

#16

Post by zaroth »

izacus wrote: post #12
gumby wrote: post #10

The essay I wish she had written would have said, "we don't need more 'secure messaging systems' -- we should be making all the following tools secure by design" For example, (and whether you love them or hate them) Apple takes this seriously: your fingerprints don't leave the device and are implemented by a piece of hardware in such a way that even Apple doesn't have access to them. Compare that to the Android imple…

What? Google CTS demands that devices store fingerprints in TEE and they never can touch filesystem. Where did you get the idea that fingerprints are stored on a filesystem?! O.o (Android Fingerprint HAL document: https://source.android.com/security/authentication/fingerpri... ) (Note that the document allows storing fingerprints on FS, but they must be additionally encrypted. Better devices do not do that.)

Sounds like you are agreeing then with gumby.

Re: Please Stop Writing Secure Messaging Tools (2015)

#17

Post by Arathorn »

pingiun wrote: post #9

I think matrix forms a nice basis for a secure chat platform. Only the apps are not really all that good. The desktop apps are electron based and the android app is just not up to par with telegram or WhatsApp.

this isn't strictly true - there's a new generation of desktop apps which are native Qt and looking really nice, e.g. https://github.com/mujx/nheko. In terms of the Android app; we're working on it as fast as we can (but it's a one man team atm).

Re: Please Stop Writing Secure Messaging Tools (2015)

#18

Post by pyre »

EGreg wrote: post #5

I totally agree with this guy, but who is he in the industry? Someone famous for something? Just curious.

If you really cared about the author's credentials, then why didn't you even bother to do the most basic of Google searches before coming here to complain about not knowing immediately who the author was? I mean you didn't even get the author's gender right. What exactly are you contributing to the conversation here?

Re: Please Stop Writing Secure Messaging Tools (2015)

#19

Post by pudo »

That list is pure genius. I'm working with reporters mostly in non-OECD countries, 80% of the stuff on that list are real, largely unmet needs. Signal isn't perfect, but it works fine, thanks.

A special place in hell should also be reserved for those in the tech world that mix up security (a real and critical need that people have) and their software politics. If you don't like Microsoft, Google, Adobe, "the Cloud", or smart phones, that's fine. There are plenty of reasons. But don't short circuit security assessments in the interest of promoting technology you find politically superior.

Re: Please Stop Writing Secure Messaging Tools (2015)

#20

Post by gurkendoktor »

izacus wrote: post #12
gumby wrote: post #10

The essay I wish she had written would have said, "we don't need more 'secure messaging systems' -- we should be making all the following tools secure by design" For example, (and whether you love them or hate them) Apple takes this seriously: your fingerprints don't leave the device and are implemented by a piece of hardware in such a way that even Apple doesn't have access to them. Compare that to the Android imple…

What? Google CTS demands that devices store fingerprints in TEE and they never can touch filesystem. Where did you get the idea that fingerprints are stored on a filesystem?! O.o (Android Fingerprint HAL document: https://source.android.com/security/authentication/fingerpri... ) (Note that the document allows storing fingerprints on FS, but they must be additionally encrypted. Better devices do not do that.)

Google may theoretically demand that, but:

https://betanews.com/2015/08/11/htc-and-samsung-phones-stori...

Post reply on HN