Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We can do better than Signal

icyphox.sh

Post reply on HN
Print view View original

191–200 of 290 posts

Re: We can do better than Signal

#191

Post by vbezhenar »

Caligatio wrote: post #29

I feel like Signal is held to a ridiculously high bar when it comes to anything. Is it perfect? No. But come on now; I see other threads on HN where people are debating/bashing their use of Intel SGX, really? Assuming you trust the client builds (or use a verified build) and verify the public key, all of these arguments go out the window with the exception of exposing your phone number. This situation seems like a pr…

If they're transparent, why don't they expose their commits to server code to the public?

Re: We can do better than Signal

#192

Post by hiq »

xrisk wrote: post #103
StavrosK wrote: post #65

Earlier quoted context omitted.

If you're cryptographically checking that the connection you have is to your own server, sure, but I don't know any program that does that sort of thing. I guess if you're using TLS as a transport, the client handles that (if you have a self-signed certificate that you've told the client to trust exclusively).

Yeah, TLS solves that right? So we can agree that a decentralized system effectively removes the need to ever trust any third party system?

TLS is not decentralized in its common form, you just use a certificate signed by a third-party (CA). So you end up trusting this CA. Why are you willing to trust this CA instead of Signal's server?

If you self-sign a certificate instead, how do I check that the signature matches yours?

To get a (proper) secure channel, you need at least an authenticated channel first.

Re: We can do better than Signal

#193

Post by aleken »

OmniiTyler wrote: post #112

Hey icy, the issue you raise about Signal not being decentralized, I think, is a valid one. You should check out a decentralized messaging and social media app I have been working on - Omnii. Omnii allows each user to manage their encryption keys, and all data exists in a decentralized manner - only on endpoints (users' phones), and not on a backend. https://omnii.co is our website if you are interested.

Omnii looks exciting. Signed up for the beta in Play store. But can’t find the app afterwards. Does it require specific hardware?

Re: We can do better than Signal

#194

Post by hiq »

justapassenger wrote: post #61

Signal will have very hard time competing as a product with WhatsApp. Their main value proposal is that they aren’t backed by Facebook, but other than that, there’s no real difference to end user. That’s enough for geeks, but not very compelling argument to break to mainstream. To break into such a highly competitive market, they need more unique features. Or they can count on Facebook to keep on shooting themselves…

> Signal will have very hard time competing as a product with WhatsApp.

You seem to assume that they want to be bigger than WhatsApp, but as a non-profit I don't think that's their goal. Their goal is (broadly) to secure most communication in a privacy-preserving way. If WhatsApp does it because of the pressure from Signal, it's also a win for them (again as a non-profit).

Re: We can do better than Signal

#195

Post by sliken »

stavros wrote: post #10

I'm a bit annoyed at "we can do better than X" when, you know what? Maybe we can't. Yes, it's nice that you and I can install Element and deal with the finicky crypto handshake that for some reason always shows red for me because a friend opened the web UI and closed it before he completed the handshake and now we can never actually make that check go green, and it's nice that Mastodon is distributed but mastodon.hos…

It's not easy to do better. Sure, Moxie has has a strong opinions, but has reasoning behind it.

Not distributed or federated, because then you'll inevitable version drift, complex handshakes, more attack surface, different quality implementations, more risk to users, and overall a less secure system.

Requiring a sim, annoying, makes it easier to track people through whoever paid for the sim. However it does make it hard for an attacker to create millions of accounts and camp on user names.

Re: We can do better than Signal

#196

Post by kd913 »

walrus01 wrote: post #141
kd913 wrote: post #137

Earlier quoted context omitted.

On the other hand, email is the single largest causes of cyber attacks. The communication is not E2E encrypted (apart from a few GPG/SMIME users), no forward secrecy and barely any signature checks. Even if outlook, thunderbird maybe supports it, goodluck getting all the mobile versions to support it too. The clients used to view emails suffer from the same problem with browsers so are subject to all the HTML/JS/CSS…

> I wish all companies would move to something centralized solution where communication is guaranteed to only come from those within the same service. This way Sharon from HR won't open every link, download every crypto/ransomeware. It's totally possible to set up 'email' for intranet purposes only, using your own DNS setup, standards compliant smtpd and imap daemons over TLS. The persons using it just need to know i…

It's possible, but every company security, tech otherwise is not setup like this.

Frankly, I am just happy slack is picking up the slack here.

Re: We can do better than Signal

#197

Post by proactivesvcs »

interestica wrote: post #154
Arathorn wrote: post #136

Earlier quoted context omitted.

Speaking as project lead for Matrix (and Element), I'm trying to understand the mixed feedback we've had this week, and somehow channel all the negativity into improving things. While some folks are clearly using it successfully and seem to like it, another bunch of people say "it was a huge pain in the butt to get E2EE working, and if it two software engineers struggled this much..." etc. When did this E2EE failure…

> If anyone in the "I tried Matrix and it was awful" camp could give detailed feedback (either here, or on github.com/vector-im/element-{web,ios,android}/issues) then it would be genuinely useful for prioritising our work. At the moment the vast majority of negative feedback on HN has been "it sucked" without giving a hint of what actually went wrong. Your two modes of suggested contact (HN, GitHub) ensure only a cer…

I can easily use both of those methods and even I always like apps that allow me to just push a button and it composes an email in my phone's email app, prefilled with application version etc., and lets me send an email to report a bug/crash.

Re: We can do better than Signal

#198

Post by gavinhoward »

tl;dr: With decentralized identities, we could have a messaging system based on the Signal Protocol that does not use central servers at all.

There seem to be a lot of opinions about whether it is possible to do better than Signal, and if so, what would that be like. There also seems to be a lot of opinions that federation is better.

There is something that can be better than Signal, but federation is not it. For one thing, it creates the problem in https://xkcd.com/927/ . For another, as some have said in the comments here, federation can easily lead back to centralization, especially if the biggest servers implement "extensions" that then become used and expected by users.

What would be better than Signal would be to take the Signal Protocol, which is fine as a protocol, and implement the protocol using software that the user runs themselves and that uses completely decentralized identities. I wrote about such a system at https://gavinhoward.com/2020/07/decentralizing-the-internet-... .

The key is that the users must control their data, like the pods that Sir Tim Berners-Lee's Inrupt is pushing. (This would solve a big problem with Signal: the lack of backups.)

However, without some way for each user's "server" to identify the location of another user's "server", this messaging system would not work. That is where decentralized identities come in.

With fully decentralized identities on a blockchain, it is easy to search the blockchain for the current location of the server for the user that a message needs to be sent to. There is no need for federation, no need for a centralized server at all; the messages go directly point-to-point.

Others in these comments have pointed out that decentralized systems are subject to abuse by spam and other things. That is true, but there are ways to mitigate the problem. You can read what my mitigation ideas are at https://gavinhoward.com/2020/07/decentralizing-the-internet-... .

Edit: I forgot to say that it is also important to address convenience. If it is not convenient for users to set up their own servers, then this solution will not work anyway. However, cloud providers would probably love to make it convenient by implementing one-click setups like they have for things like Wordpress.

Re: We can do better than Signal

#199

Post by cercatrova »

interestica wrote: post #154
Arathorn wrote: post #136

Earlier quoted context omitted.

Speaking as project lead for Matrix (and Element), I'm trying to understand the mixed feedback we've had this week, and somehow channel all the negativity into improving things. While some folks are clearly using it successfully and seem to like it, another bunch of people say "it was a huge pain in the butt to get E2EE working, and if it two software engineers struggled this much..." etc. When did this E2EE failure…

> If anyone in the "I tried Matrix and it was awful" camp could give detailed feedback (either here, or on github.com/vector-im/element-{web,ios,android}/issues) then it would be genuinely useful for prioritising our work. At the moment the vast majority of negative feedback on HN has been "it sucked" without giving a hint of what actually went wrong. Your two modes of suggested contact (HN, GitHub) ensure only a cer…

Yep, there should be a crash or bug report form within the app itself, and an email for bugs at something like support@element.io

Re: We can do better than Signal

#200

Post by leesalminen »

Arathorn wrote: post #136
tombert wrote: post #57

Earlier quoted context omitted.

I had a similar experience with Matrix/Element. I was using the desktop app to chat with a friend, and while we were able to get some end-to-end encryption working, it was a huge pain the butt, and if two software engineers struggled this much to get the damn thing working, there's no way in hell that I'm convincing my parents to use it. To me, we have to accept the incremental wins where we can get them; getting my…

Speaking as project lead for Matrix (and Element), I'm trying to understand the mixed feedback we've had this week, and somehow channel all the negativity into improving things. While some folks are clearly using it successfully and seem to like it, another bunch of people say "it was a huge pain in the butt to get E2EE working, and if it two software engineers struggled this much..." etc. When did this E2EE failure…

On another note, yesterday I set up my own matrix-synapse [0] homeserver along with a token-based registration page [1] with nginx+lets encrypt as a reverse proxy. I spent ~1 hour setting it up on a fresh Ubuntu 20.04 VM.

I then on-boarded my wife, brother, father and mother without issue. I just sent them a text with screenshots and detailed instructions on what to do. Everyone's in, and we have E2EE group chats going. Within ~20 minutes of sending instructions everyone was participating in chat.

The only issue encountered was that my mom entered the wrong homeserver URL (I set up the sign-up page to be join.subdomain.tld and the homeserver to be chat.subdomain.tld and she entered the former into Element). My dad was able to resolve the issue quickly for her.

All clients are Element [2] right now, though I plan on trying Weechat [3] this week.

Honestly, I didn't expect it to be this easy to do after seeing all the complaints on HN. I subscribed on Patreon yesterday and wish you all the best of luck!

[0] https://github.com/matrix-org/synapse

[1] https://github.com/ZerataX/matrix-registration

[2] https://element.io

[3] https://github.com/poljar/weechat-matrix

Post reply on HN