Live data from Hacker News

Briar Desktop for Linux

briarproject.org

21–30 of 87 posts

Re: Briar Desktop for Linux

#21
post #14

Do any of these "decentralized" and "end to end" encryption communication systems actually solve the fundamental problem which is that you have to trust the person you're communicating with to not give up the content of the messages they've sent and received. People's telegram and signal comms are always showing up in subpoenas because someone unlocks their phone for the feds. I guess what I'm thinking here is that t…

pgp is fussy to set up, and that matters.

But beyond that, good secure messaging protocols are designed so the recipient can verify you sent a message but not prove that to anyone else.

And they also make it so a compromise of your private key can't be used to decrypt old messages.

Re: Briar Desktop for Linux

#22
post #14

Do any of these "decentralized" and "end to end" encryption communication systems actually solve the fundamental problem which is that you have to trust the person you're communicating with to not give up the content of the messages they've sent and received. People's telegram and signal comms are always showing up in subpoenas because someone unlocks their phone for the feds. I guess what I'm thinking here is that t…

There is a word for "You can't prove I said that", and even though English is my only language, I can't remember the word. It feels like "repudibility". I think I'm on the right track: https://en.wiktionary.org/wiki/repudiate

I think it is related to forward secrecy.

Maybe the E2EE apps should have a button for that, call it something snazzy like "The 5th Amendment button" and right next to that is a button for trivially forging texts and screenshots with the app's own UI, so that everyone knows that anything can be fake.

Re: Briar Desktop for Linux

#23
post #14

Do any of these "decentralized" and "end to end" encryption communication systems actually solve the fundamental problem which is that you have to trust the person you're communicating with to not give up the content of the messages they've sent and received. People's telegram and signal comms are always showing up in subpoenas because someone unlocks their phone for the feds. I guess what I'm thinking here is that t…

There is a word for "You can't prove I said that", and even though English is my only language, I can't remember the word. It feels like "repudibility". I think I'm on the right track: https://en.wiktionary.org/wiki/repudiate I think it is related to forward secrecy. Maybe the E2EE apps should have a button for that, call it something snazzy like "The 5th Amendment button" and right next to that is a button for trivi…

Repudiation

Re: Briar Desktop for Linux

#24
post #14

Do any of these "decentralized" and "end to end" encryption communication systems actually solve the fundamental problem which is that you have to trust the person you're communicating with to not give up the content of the messages they've sent and received. People's telegram and signal comms are always showing up in subpoenas because someone unlocks their phone for the feds. I guess what I'm thinking here is that t…

I love PGP, but let's be honest, it's not user friendly in the slightest. It's an esoteric bolt-on to email that requires both ends to want to use it and go through the trouble of setting it up, which basically means that it's really only useful to nerds and people with sufficient requirement for secrecy that they actually go through the trouble.

Services like Signal are great because they're E2EE by default and they're user friendly. We got my tech illiterate mother and stepfather on Signal so they could participate in family group chats. No way she would have been able to navigate GPG.

As for the issue you're bringing up about the endpoint getting compromised, the simple solution is a retention policy (disappearing messages), which Signal has supported for some time now. It doesn't help if the allegiance of owner of that endpoint is flipped (they can simply screenshot future messages), but it does prevent the adversary from getting a full text dump of previous conversations if they swipe the phone for example.

Re: Briar Desktop for Linux

#25
post #14

Do any of these "decentralized" and "end to end" encryption communication systems actually solve the fundamental problem which is that you have to trust the person you're communicating with to not give up the content of the messages they've sent and received. People's telegram and signal comms are always showing up in subpoenas because someone unlocks their phone for the feds. I guess what I'm thinking here is that t…

> actually solve the fundamental problem

If you consider this "the" fundamental problem you're (a) underestimating the severity of other problems and (b) wildly overestimating what technology can achieve for humanity.

Trusting other individuals in this world is not a problem that's solvable by messaging protocols. Even literal scifi solutions like Mission Impossible exploding sunglasses inherently trust the recipient of the message not to share data post-self-destruct. Recipient trust is a fundamentally implicit part of deciding to communicate at all, through any medium.

Re: Briar Desktop for Linux

#26
post #14

Do any of these "decentralized" and "end to end" encryption communication systems actually solve the fundamental problem which is that you have to trust the person you're communicating with to not give up the content of the messages they've sent and received. People's telegram and signal comms are always showing up in subpoenas because someone unlocks their phone for the feds. I guess what I'm thinking here is that t…

There is a lot of misunderstandings around messaging systems.

End-to-end encryption is an extremely nice feature as it lets us make the assumption that messages cannot be read by a middle man even if 100% of the employees are corrupt and the messages pass right through FSB and NSAs networks twice.

But, as you point out: for most people this falls flat in most cases once you are up against the big guys and they have decided to get you.

That does not mean that it is useless though: most people won't get approached by these agencies, and E2E-encryption will keep it out of the hands of dragnet surveillance, snooping telecoms providers or FAANG companies and a number of other very realistic scenarios.

(That is unless you use a system that helpfully uploads unencrypted copies of everything you write to a certain large FAANG class company.)

Then there is federation, I guess that is what you mean by decentralized. This is another really sweet property of a messaging system. However, for security it has a number of problems - a little bit less or more depending on exact implementation.

On top of this there is technical execution: Everyones (including me) darling Signal for example has had some pretty nasty problems.

Alltogether it comes down to this if you want to avoid problems: stay out of what trouble you can stay out of and think opsec if you cannot.

And remember that US knew exactly when Soviet started working towards an atomic bomb, because after they started the flow of related research papers stopped ;-)

I.e. opsec is seriously hard if you are up against a powerful entity. Plausible deniability, blending in etc can be just as useful as bulletproof crypto.

Re: Briar Desktop for Linux

#27
post #14

Do any of these "decentralized" and "end to end" encryption communication systems actually solve the fundamental problem which is that you have to trust the person you're communicating with to not give up the content of the messages they've sent and received. People's telegram and signal comms are always showing up in subpoenas because someone unlocks their phone for the feds. I guess what I'm thinking here is that t…

> actually solve the fundamental problem If you consider this "the" fundamental problem you're (a) underestimating the severity of other problems and (b) wildly overestimating what technology can achieve for humanity. Trusting other individuals in this world is not a problem that's solvable by messaging protocols. Even literal scifi solutions like Mission Impossible exploding sunglasses inherently trust the recipient…

I think what they want is censorship resistant mesh network that wouldn't require first seeding from known addresses like I2P does and most of the others too.

Re: Briar Desktop for Linux

#28
post #14

Do any of these "decentralized" and "end to end" encryption communication systems actually solve the fundamental problem which is that you have to trust the person you're communicating with to not give up the content of the messages they've sent and received. People's telegram and signal comms are always showing up in subpoenas because someone unlocks their phone for the feds. I guess what I'm thinking here is that t…

Signal has a "Disappearing Messages" feature that deletes conversations contents after a set amount of time. This is the only feature that I'm aware of on these major messenger services that works to solve the concern for your conversations on the recipients devices.

Re: Briar Desktop for Linux

#29
post #10
post #7

how do devices find each other without an introductory server?

When you're close to someone you can make an initial exchange via QR+bluetooth. When you're distant you need to exchange your briar:// links on a different channel.

It's also safe to post your briar:// link online (https://code.briarproject.org/briar/briar/-/wikis/FAQ#is-it-...)

So if anyone wants to try the app but doesn't want to convince somebody else to do so too, just add my link and post yours below:

briar://acyeao3gd3sqldlljx6etcjyxdr4ux6m6s3ge3r4z6st7ju2ac5xg

Re: Briar Desktop for Linux

#30
Never heard of Briar. Title made me think it was some new cool desktop environment for linux.

It took me longer than I care to admit before I realized Briar is just a messaging app.

Post reply on HN