Briar Project • Hacker News Board

Re: Briar Project

#121

Post by namibj » Mon, Aug 03, 2020, 10:38 AM UTC

riobard wrote: post #96

gorgoiler wrote: post #91

Earlier quoted context omitted.

TEMPEST is a generic term for extracting data that emanates from channels which were are not supposed to carry data. It’s usually an attack, used to spy on people. The classic example is pointing a high speed camera at an office window across the street and recording the brightness of the walls. Even if the office computer is hidden out of sight the attacker can reconstruct what’s on screen by analysing subtle change…

> The classic example is pointing a high speed camera at an office window across the street and recording the brightness of the walls. Even if the office computer is hidden out of sight the attacker can reconstruct what’s on screen by analysing subtle changes in brightness reflected off the wall. Is this feasible now?

That was specific for CRTs. You can still exploit diffuse reflections, though that's much harder.

Re: Briar Project

#122

Post by codethief » Mon, Aug 03, 2020, 10:39 AM UTC

lebaux wrote: post #94

dunefox wrote: post #6

I've been looking for secure messengers during the last few weeks. I use WhatsApp, Signal, and Telegram. Telegram isn't very secure, WhatsApp is owned by Facebook and even Signal - while very secure - requires a cell phone number... Briar seems great in this regard but isn't available on iPhone and has no support for images, calls, voice messages, etc. Apparently they're going to support images and a desktop client,…

> Telegram isn't very secure Can someone elaborate?

To add to my sibling's comment: Contact lists also get synced with the servers (in contrast to e.g. how Signal handles this).

Re: Briar Project

#123

Post by namibj » Mon, Aug 03, 2020, 10:48 AM UTC

untog wrote: post #29

davidzweig wrote: post #13

Earlier quoted context omitted.

Is IPv6 likely to be a practical solution to the router/NAT issue? Are routers assigning globally-routable IPs to their clients, is that already a thing?

IPv6 solves one of the reasons to use NAT. One more intractable reason is that many players (cellphone network operators, corporate networks) consider it a positive thing that individual devices are not globally accessible.

For cellphone networks it's not just a provider-side incentive, as inbound traffic will drain battery and you'd have no good way to stop it. But this only requires some sort of spam filter to be in front of the cellular link, like with a friends-based system where you keep connections to some friend's online nodes when you lock your phone, and just exchange IP+port info on both sides to just send a UDP packet to each other's IP+port from your own IP+port, punching your firewall. Theoretically you might even actively control your firewall to allow closing it off and also maintaining some permanent open entries for your friends to reach you with no indirection from their usual network(s). A provider could make money by selling (quota for) provider-side user-controlled firewall entries, and you could have your OS give out quota to apps.

It's feasible once you reach the point where it's worth the effort of implementing.

Re: Briar Project

#124

Post by mosselman » Mon, Aug 03, 2020, 11:29 AM UTC

mpartel wrote: post #109

Legogris wrote: post #97

Earlier quoted context omitted.

This is precisely why it's important to make these tools (protocols/applications) part of the core layer of how businesses operate consumer-facing services online; it's only true if the ratio of "interesting" communication over these channels is high enough. In an alternative timeline where ISPs where more strictly regulated and trusted and everything was cleartext HTTP, I'm certain that HTTPS/TLS would face pushback…

Oppressors can (and I think some already do) subvert HTTPS by mandating installation of government-issued certs so they can do their MITM.

That is an irrelevant detail. The comment you are responding to isn’t saying that https is foolproof. They are saying that it would help people to be more free of digital control if privacy respecting technology is so common that it isn’t suspicious when you use it.

Re: Briar Project

#125

Post by Watsons221 » Mon, Aug 03, 2020, 11:47 AM UTC

theamk wrote: post #68

Watsons221 wrote: post #34

Earlier quoted context omitted.

I understand your frustration, but Signal didn't notify your contacts because you installed it. It notified the other person, because he had your phone number. Your local Signal installation regularly checks if any of your contacts (with the phone numbers you have of them) are registered at the Signal servers - and then lets you know it, such that you can text this contact securely.

The technical details do not really matter. Many people might have my phone number, possibly from a long ago. But the number itself is pretty safe -- there is no way to tell if this phone is in use or not. Signal breaks that assumption -- it immediately tells every other user that this number is alive, valid, and can be contacted right now. This is a terrible idea to do by default, especially if one cannot disable it…

But in this case they do matter. When you give someone your phone number, you give them the possibility to contact you. And then it should be securely, if it's possible.

A check for "aliveness" of a number can be done without Signal. Just call and see if it is ringing. You get the same information. Your Signal profile name and picture, however, will only be shared when you accept it.

Re: Briar Project

#126

Post by mpartel » Mon, Aug 03, 2020, 11:53 AM UTC

mosselman wrote: post #124

mpartel wrote: post #109

Earlier quoted context omitted.

Oppressors can (and I think some already do) subvert HTTPS by mandating installation of government-issued certs so they can do their MITM.

That is an irrelevant detail. The comment you are responding to isn’t saying that https is foolproof. They are saying that it would help people to be more free of digital control if privacy respecting technology is so common that it isn’t suspicious when you use it.

I agree that it helps (though I'm probably more pessimistic about how much it helps). I wanted to counter the assertion that "There's no way it can be banned today, though" (which I should have quoted). Even a disconcertingly non-trivial number of western lawmakers make regular noises about requiring all encryption to be backdoored.

Re: Briar Project

#127

Post by eeZah7Ux » Mon, Aug 03, 2020, 12:02 PM UTC

londons_explore wrote: post #120

new2628 wrote: post #101

Earlier quoted context omitted.

This is like saying that the weapons advanced countries sell to less advanced countries are more "life-respecting".

Imagine a world where a gun sold is by the US to a poor wartorn nation. When the trigger is pulled, it does facial recognition to figure out who it is aimed at, and if it detects someone friendly to US interests, it will refuse to hit them.

> Imagine a world where a gun sold is by the US to a poor wartorn nation

There is no need to imagine it.

Re: Briar Project

#128

Post by eeZah7Ux » Mon, Aug 03, 2020, 12:03 PM UTC

swsieber wrote: post #41

dunefox wrote: post #6

I've been looking for secure messengers during the last few weeks. I use WhatsApp, Signal, and Telegram. Telegram isn't very secure, WhatsApp is owned by Facebook and even Signal - while very secure - requires a cell phone number... Briar seems great in this regard but isn't available on iPhone and has no support for images, calls, voice messages, etc. Apparently they're going to support images and a desktop client,…

Self hosted matrix? It has e2e encryption.

It still leaks all the connections metadata. It's very easy to correlate TCP connections to and from the server.

Re: Briar Project

#129

Post by eeZah7Ux » Mon, Aug 03, 2020, 12:03 PM UTC

PostOnce wrote: post #24

dunefox wrote: post #6

I've been looking for secure messengers during the last few weeks. I use WhatsApp, Signal, and Telegram. Telegram isn't very secure, WhatsApp is owned by Facebook and even Signal - while very secure - requires a cell phone number... Briar seems great in this regard but isn't available on iPhone and has no support for images, calls, voice messages, etc. Apparently they're going to support images and a desktop client,…

Signal is working on getting rid of the cell # requirement, but it'll take a while.

It still leaks all the connections metadata. It's very easy to correlate TCP connections to and from the server.

Re: Briar Project

#130

Post by benhurmarcel » Mon, Aug 03, 2020, 12:05 PM UTC

foresto wrote: post #74

Earlier this year, I finally took the time to revisit the state of instant messaging services. My requirements: - open source - cross-platform (linux, mac, windows, ios, android) - group chats - end-to-end encryption - well-understood crypto ciphers & protocols - mature enough for a reasonable expectation of security & privacy - easy enough for most computer users - some way to protect metadata (e.g. self-hosting) -…

You might want to look at Wire

https://wire.com/