Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Moxie Marlinspike has a plan to reclaim our privacy

newyorker.com

Post reply on HN
Print view View original

101–110 of 237 posts

Re: Moxie Marlinspike has a plan to reclaim our privacy

#101

Post by cwyers »

lrvick wrote: post #65
storrgie wrote: post #55

Earlier quoted context omitted.

not the _identity_ servers currently though.

I have run my own identity servers for private deployments without issue. This is, granted, not as easy as it should be, but it is an issue the matrix team is working on improving. You also don't need to use the identity service at all. It is totally optional for user discovery. Third party implementations of the identity server already exist too. Someone could even write their own replacement that uses SGX if they r…

Optional security isn't security. Especially with the sort of metadata that is in _someone else's phone_. Basically, everybody who has my phone number probably has it in their iOS/Android contacts. I can't opt out of _them_ using a bad identity server.

Re: Moxie Marlinspike has a plan to reclaim our privacy

#102

Post by darcys22 »

Another project that is doing interesting stuff in this space is Loki.

https://loki.network/

They have built a tor/onion network and use it as the backend for their messenger (forked from signal). Its end to end encrypted and doesnt have centralised servers.

https://getsession.org/

Re: Moxie Marlinspike has a plan to reclaim our privacy

#103

Post by sdenton4 »

RichardHeart wrote: post #56

I applaud the man for trying really, really, hard to make a difference, and succeeding. I look forward to the day when Signal doesn't require a phone number. Telegram, while requiring a phone number doesn't require you to disclose it to receive messages. Others having your phone number opens you to all kind of other attacks, which are quite bad. Sim swapping, and SS7 attacks. SS7 vulns can disclose your real time loc…

OTOH, Telegram's crypto is... suspect.

https://security.stackexchange.com/a/49802

Re: Moxie Marlinspike has a plan to reclaim our privacy

#104

Post by rpdillon »

nullc wrote: post #30
elevation wrote: post #14

It's frustrating to see Signal's reputation undermined in technical circles by the shortsighted zeitgeist. Signal's constitutional emphasis on usability supports user demographics that no other security product can attract. My elderly relatives use Signal now instead of Skype. This drew in other family members who just wanted to video chat with grandma and grandpa. Matrix will never win markets like this. When tech n…

> update agility makes Signal infinitely superior to every existing or proposed federated network. Translation: Signals ability to forcefully change the software and protocol out for users without any consent (much less informed consent) renders it functionally immune to any criticism or review because any aspect of the protocol could be changed ('improved') at a moments notice. I think signal is a fine insecure mess…

You mention Signal is fine as an insecure messenger. I'd be very curious if you know of an app that is fine _secure_ messenger. Do you know of one, or is your point that nothing that's made generally available can be considered secure?

Re: Moxie Marlinspike has a plan to reclaim our privacy

#105

Post by elevation »

jhayward wrote: post #57
elevation wrote: post #14

It's frustrating to see Signal's reputation undermined in technical circles by the shortsighted zeitgeist. Signal's constitutional emphasis on usability supports user demographics that no other security product can attract. My elderly relatives use Signal now instead of Skype. This drew in other family members who just wanted to video chat with grandma and grandpa. Matrix will never win markets like this. When tech n…

> The Signal group has an uncompromising commitment to user privacy Would you say that outing people who are signal users and putting them in signal contact lists without their permission is 'uncompromising commitment to user privacy?'

Far from "compromise", Signal implements the only privacy conscious possibility here.

Without automatic contact discovery "Signal private messenger" would be forced to default to not-private for all contacts until manual confirmation could occur. Adding UX friction to the primary use case would hinder adoption among non security-enthusiasts. With protection for the casual user eliminated, the truly sensitive communications of those motivated for privacy would stick out like a sore thumb, revealing many more bits of meta data than just "this number had signal once."

Elite users who care about being "outted" simply for signal participation can take steps to mitigate. The rest of us need automatic contact discovery for Signal to not be useless.

Re: Moxie Marlinspike has a plan to reclaim our privacy

#106

Post by m-p-3 »

fidelramos wrote: post #45
walrus01 wrote: post #43

Earlier quoted context omitted.

My primary concern about Signal and usability is the insistence on using phone numbers to identify a person as a user ID. Anything that relies on SS7/PSTN working correctly is a very bad design choice in my opinion. Giving out your phone number to possibly untrusted contacts is also a bad decision because it opens up opportunities for scams, spam and social-engineering attempted hijacks of accounts (SIM swap attacks…

Signal is moving to allow users registering without a phone number. The infamous PIN was a necessary step to achieve that and other features, such as proper group management, which has just been released.

Finally!

Re: Moxie Marlinspike has a plan to reclaim our privacy

#107

Post by crossroadsguy »

ryukafalz wrote: post #27
elevation wrote: post #14

It's frustrating to see Signal's reputation undermined in technical circles by the shortsighted zeitgeist. Signal's constitutional emphasis on usability supports user demographics that no other security product can attract. My elderly relatives use Signal now instead of Skype. This drew in other family members who just wanted to video chat with grandma and grandpa. Matrix will never win markets like this. When tech n…

> When tech nerds nit pick Signal's implementation, they ignore that the unfederated nature of Signal limits the damage these decisions can cause. It limits the damage that some decisions can cause, but exacerbates others. Signal only allows the first-party client to connect to its network; if the developers were legally compelled to add a backdoor into that client, users would have few options. Its security depends…

> I’d also contest the idea that Matrix can never have a client as usable as Signal, but I’ll agree that there isn’t one yet.

After being around for multiple years and having not managed to do it even once (or come close) I think I am inclined to bet they won't. Or they'd just focus on being enterprise software (which I think they are doing and they must if they want to earn money).

Of all the IM apps Matrix is my most favourite in the spirit and least favourite in usability. Any attempt to introduce friends and family has failed miserably. Irony is, I myself was not convinced and I was trying to convert them.

Re: Moxie Marlinspike has a plan to reclaim our privacy

#108

Post by ryukafalz »

crossroadsguy wrote: post #107
ryukafalz wrote: post #27

Earlier quoted context omitted.

> When tech nerds nit pick Signal's implementation, they ignore that the unfederated nature of Signal limits the damage these decisions can cause. It limits the damage that some decisions can cause, but exacerbates others. Signal only allows the first-party client to connect to its network; if the developers were legally compelled to add a backdoor into that client, users would have few options. Its security depends…

> I’d also contest the idea that Matrix can never have a client as usable as Signal, but I’ll agree that there isn’t one yet. After being around for multiple years and having not managed to do it even once (or come close) I think I am inclined to bet they won't. Or they'd just focus on being enterprise software (which I think they are doing and they must if they want to earn money). Of all the IM apps Matrix is my mo…

I mean, keep in mind that while Element is effectively the reference client, it's also still just one client. It's not trying to be a Signal-style messenger, it's trying to be something like Slack - and at that I'd say it succeeds.

There are other clients in development that are closer UI-wise to your typical mobile messenger, e.g. https://dittochat.org/

Re: Moxie Marlinspike has a plan to reclaim our privacy

#109

Post by avhon1 »

bilal4hmed wrote: post #7

Other than matrix, what are some other alternatives or upcomers in the messaging field I should try. Matrix still has a high burden of me setting up my own server and maintaining it. Till their P2P solution doesnt release, they have their own metadata problem.

Tox (clients include uTox and qTox) has an... interesting history, but is technically interesting (true p2p), and worked fairly well when I last used it (around 2018).

https://github.com/TokTok/c-toxcore

https://github.com/uTox/uTox/

https://github.com/qTox/qTox

Re: Moxie Marlinspike has a plan to reclaim our privacy

#110

Post by blurbleblurble »

elevation wrote: post #14

It's frustrating to see Signal's reputation undermined in technical circles by the shortsighted zeitgeist. Signal's constitutional emphasis on usability supports user demographics that no other security product can attract. My elderly relatives use Signal now instead of Skype. This drew in other family members who just wanted to video chat with grandma and grandpa. Matrix will never win markets like this. When tech n…

I agree, Signal is great
Post reply on HN