Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vuvuzela: Metadata-private messaging

vuvuzela.io

Post reply on HN
Print view View original

21–30 of 32 posts

Re: Vuvuzela: Metadata-private messaging

#21

Post by giancarlostoro »

deusofnull wrote: post #18

I love it. Gonna try and get some of my friends to use this! Plus there's something unabiguously cool about chatting through the terminal... hacker aesthetic or something like that. How would you say your privacy + tech measure up against Signal and WhisperSystems? I love those folks and what they build and have been using Signal primarily for texting for a while now.

I agree, I wish Signal could work in my terminal somehow in a way that's more secure than their "Desktop" application. They were storing the decryption keys in plain text in a SQLite database iirc. I understand why they have to store it, but it's just bad if it's plaintext.

Re: Vuvuzela: Metadata-private messaging

#22

Post by deusofnull »

giancarlostoro wrote: post #21
deusofnull wrote: post #18

I love it. Gonna try and get some of my friends to use this! Plus there's something unabiguously cool about chatting through the terminal... hacker aesthetic or something like that. How would you say your privacy + tech measure up against Signal and WhisperSystems? I love those folks and what they build and have been using Signal primarily for texting for a while now.

I agree, I wish Signal could work in my terminal somehow in a way that's more secure than their "Desktop" application. They were storing the decryption keys in plain text in a SQLite database iirc. I understand why they have to store it, but it's just bad if it's plaintext.

jesus christ, i didnt know that....

Re: Vuvuzela: Metadata-private messaging

#23

Post by giancarlostoro »

deusofnull wrote: post #22
giancarlostoro wrote: post #21

Earlier quoted context omitted.

I agree, I wish Signal could work in my terminal somehow in a way that's more secure than their "Desktop" application. They were storing the decryption keys in plain text in a SQLite database iirc. I understand why they have to store it, but it's just bad if it's plaintext.

jesus christ, i didnt know that....

Yeah, it's cause of the way their crypto works, you encrypt the next message with the hash of the previous or something of the sort. Somebody stored it in plaintext for the desktop version, and I believe it's a SQLite DB so it was easy to discover... It sucks, I wish they had at least encrypted it with a pin at the minimum or something? Maybe Yubikey might make sense for Signalin the desktop not sure.

Also the messages are stored in plaintext:

https://github.com/signalapp/Signal-Desktop/issues/1017

They say it's a non-fix cause you can use full disk encryption, and honestly that's what I do anyway, so I'm not as bothered.

Re: Vuvuzela: Metadata-private messaging

#25

Post by lgierth »

giancarlostoro wrote: post #21
deusofnull wrote: post #18

I love it. Gonna try and get some of my friends to use this! Plus there's something unabiguously cool about chatting through the terminal... hacker aesthetic or something like that. How would you say your privacy + tech measure up against Signal and WhisperSystems? I love those folks and what they build and have been using Signal primarily for texting for a while now.

I agree, I wish Signal could work in my terminal somehow in a way that's more secure than their "Desktop" application. They were storing the decryption keys in plain text in a SQLite database iirc. I understand why they have to store it, but it's just bad if it's plaintext.

There signal-cli [1] which works pretty nicely. Uses SMS for initial signup.

[1] https://github.com/AsamK/signal-cli

Re: Vuvuzela: Metadata-private messaging

#26

Post by silverlyra »

lazard wrote: post #11
Cynddl wrote: post #3

From their research paper at https://vuvuzela.io/static/vuvuzela.pdf : > Vuvuzela can support 1 million users exchanging text messages (up to 240 bytes each) with an end-to-end latency of 37 seconds, achieving a throughput of 68,000 messages/sec. Unfortunately, 37 seconds, even for a privacy-aware service, seems too slow to deliver instant messages.

Our latest paper, Karaoke, achieves 6.8 seconds with 2 million active users: https://vuvuzela.io/static/karaoke.pdf

cool! does (or will) the existing Vuvuzela client use Karaoke?

Re: Vuvuzela: Metadata-private messaging

#27

Post by wjjdjw »

giancarlostoro wrote: post #21
deusofnull wrote: post #18

I love it. Gonna try and get some of my friends to use this! Plus there's something unabiguously cool about chatting through the terminal... hacker aesthetic or something like that. How would you say your privacy + tech measure up against Signal and WhisperSystems? I love those folks and what they build and have been using Signal primarily for texting for a while now.

I agree, I wish Signal could work in my terminal somehow in a way that's more secure than their "Desktop" application. They were storing the decryption keys in plain text in a SQLite database iirc. I understand why they have to store it, but it's just bad if it's plaintext.

What's your attacker model here? On which operating system can the filesystem be compromised, but your application remains unaffected?

Re: Vuvuzela: Metadata-private messaging

#28

Post by giancarlostoro »

wjjdjw wrote: post #27
giancarlostoro wrote: post #21

Earlier quoted context omitted.

I agree, I wish Signal could work in my terminal somehow in a way that's more secure than their "Desktop" application. They were storing the decryption keys in plain text in a SQLite database iirc. I understand why they have to store it, but it's just bad if it's plaintext.

What's your attacker model here? On which operating system can the filesystem be compromised, but your application remains unaffected?

Any unencrypted file system can have the conversations in plain text extracted, without having to boot the OS or open the application to decrypt the contents.

Re: Vuvuzela: Metadata-private messaging

#29

Post by lazard »

silverlyra wrote: post #26
lazard wrote: post #11

Earlier quoted context omitted.

Our latest paper, Karaoke, achieves 6.8 seconds with 2 million active users: https://vuvuzela.io/static/karaoke.pdf

cool! does (or will) the existing Vuvuzela client use Karaoke?

It doesn't yet. I'd like to integrate Karaoke's techniques into the Vuvuzela client in the coming months.

Re: Vuvuzela: Metadata-private messaging

#30

Post by lazard »

asdkhadsj wrote: post #20

Pardon my ignorance, but is a technology like this anything more than research? Ie, lets pretend there is a market for this (ie, that people actually cared about security) , could this be used? I ask because the 2M (concurrent?) users would be a very small limit in a hypothetical whatsapp/telegram/etc replacement. So my question is not a critique, but an honest question. I imagine either this is purely research, or t…

Our followup Karaoke system [1] can support more users by adding more servers, but we still have more work to do to support billions of users. Regardless, I think it's worth deploying these research prototypes to get a sense of what problems matter to users.

[1] https://vuvuzela.io/static/karaoke.pdf

Post reply on HN