Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Briar Project

briarproject.org

Post reply on HN
Print view View original

141–150 of 189 posts

Re: Briar Project

#141

Post by fsflover »

gorgoiler wrote: post #80
dancemethis wrote: post #72

Earlier quoted context omitted.

It is, alongside limiting what you can do with their leased equipment that people think they bought.

This made me jump. You make one excellent point, with appropriately shocking language: When I can’t do what I want with my phone, I may as well be leasing it. Hmmm. But I don’t believe Apple’s business model is to spy on me.

> But I don’t believe Apple’s business model is to spy on me.

"Location-Based Apple Ads: Your iPhone will send your location to Apple in order to provide you with geographically relevant ads on Apple News and in the App Store."

More: https://support.apple.com/en-us/HT207056

So not exactly "business model", but does it matter?

Re: Briar Project

#142

Post by dunefox »

eeZah7Ux wrote: post #129
PostOnce wrote: post #24

Earlier quoted context omitted.

Signal is working on getting rid of the cell # requirement, but it'll take a while.

It still leaks all the connections metadata. It's very easy to correlate TCP connections to and from the server.

How exactly does Element leak metadata?

Re: Briar Project

#143

Post by maqp »

xwdv wrote: post #62

What the fuck ever happened to communicating through plain old radios? Impractical for someone to track you, trivial to speak in codes.

And the way to agree on the code over the radio anyone can eavesdrop is?

Re: Briar Project

#145

Post by fsflover »

laegooose wrote: post #119
felixfoertsch wrote: post #117

Earlier quoted context omitted.

There are different aspects to this. The first and the easily verifiable one is that they default to client-server-client connections, not end-to-end encryption. If you want to have an end-to-end encrypted channel, you have to explicitly open a "secret chat". However, this removes the convenience of cross device syncing. The second one is more difficult to evaluate. If you use the above mentioned "secret chat" featur…

Telegram clients are open source. I downloaded and built MacOS version recently - it was very straightforward. https://telegram.org/apps#source-code Encryption for secret chats doesn't involve server, so technically it can be analyzed. It's a pity Telegram decided to roll their own encryption scheme. I use Telegram a lot for daily business because it's superior desktop messenger product. I would gladly participate if…

> Encryption for secret chats doesn't involve server, so technically it can be analyzed.

Except if you are on desktop, you have no secret chats at all. And "desktop" includes GNU/Linux phones.

Re: Briar Project

#146

Post by maqp »

benhurmarcel wrote: post #130
foresto wrote: post #74

Earlier this year, I finally took the time to revisit the state of instant messaging services. My requirements: - open source - cross-platform (linux, mac, windows, ios, android) - group chats - end-to-end encryption - well-understood crypto ciphers & protocols - mature enough for a reasonable expectation of security & privacy - easy enough for most computer users - some way to protect metadata (e.g. self-hosting) -…

You might want to look at Wire https://wire.com/

"some way to protect metadata (e.g. self-hosting)"

is incompatible with Wire. Let's not just scream product names without understanding if it's for their threat model. If you're here to promote Wire then I perfectly understand why you'd recommend it anyway.

Re: Briar Project

#147

Post by maqp »

untog wrote: post #30
myself248 wrote: post #26

Earlier quoted context omitted.

Seems to me like there should be a DHT way to solve this. When you boot up, you take your place in the table and query your neighbors for messages. If someone's unreachable when a message is sent, you hand the message to their neighbors to hold it until they appear.

Which requires you to trust your neighbours. To which you might say: aha! Just use end to end encryption! And sure, you can. But at that point, what benefits are you getting over using E2E with a centralised system? Very few. And you’re getting a bunch of drawbacks in terms of reliability too.

E2EE only protects content. Metadata is also very important and where as p2p apps like Briar, Ricochet, Cwtch and TFC hide it from all, centralized and decentralized apps have one or more weak points that allow eavesdropping on larger amounts of metadata.

Re: Briar Project

#148

Post by maqp »

fiddlerwoaroof wrote: post #42
aaravchen wrote: post #20

Earlier quoted context omitted.

It seems like this might be the eventual intent of the Scuttlebutt protocol, and so far that's also the furthest along in approaching such a solution.

Isn’t matrix basically all that’s needed? It even has out-of-band verification of your friend’s keys.

If only the ecosystem had been built to use E2EE by default, always. They fucked up with the design allowing bridges and bots, left E2EE for later, and now they're in the vicious circle of downgrade attacks until all major clients switch to E2EE with no insecure fall-back option.

Re: Briar Project

#149

Post by Legogris »

maqp wrote: post #139
Legogris wrote: post #110

Earlier quoted context omitted.

Huh. They do mention this as "potential obvious advantage" in the post I linked: > Bridging between Matrix and Whisper (Ethereum's own real-time communication protocol) - exposing all of the Matrix ecosystem into Ethereum and vice versa But maybe this is just meaningless marketing fluff and something that's effectively left to "the community".

Quick unrelated comment from the peanut gallery: Every time any crypto-currency related messaging app is published, I think it should be mandatory to immediately explain what the currency and/or blockchain brings to the table. Is it a paid app? Does it store ciphertexts indenfinitely to the blockchain? Or public keys?

While I understand where you're coming from, Status is an interesting project even if you completely disregard their (IMO shoehorned utility-) token.

The main thing they have right now is an app acting as a wallet (ETH and Ethereum-based tokens) and IM app (Whisper protocol).

It's standard practice that what you request is answered in a whitepaper, which is also the case for Status: https://status.im/whitepaper.pdf

Re: Briar Project

#150

Post by dunefox »

foresto wrote: post #74

Earlier this year, I finally took the time to revisit the state of instant messaging services. My requirements: - open source - cross-platform (linux, mac, windows, ios, android) - group chats - end-to-end encryption - well-understood crypto ciphers & protocols - mature enough for a reasonable expectation of security & privacy - easy enough for most computer users - some way to protect metadata (e.g. self-hosting) -…

Just installed it. How do direct messages work? Is it just a room with two people in it?
Post reply on HN