41–50 of 68 posts
Sorry if this question sounds ignorant, the details and best practices of encryption are way over my head.
Earlier quoted context omitted.
Libre is a prerequisite, gratis isn't. This is an important distinction to make. While it is true that this software seems to be neither, it is important to note when we try to convince them to release it free, we mean libre and not necessarily gratis . (Although the two often go hand in hand.) When people hear us complaining about it, they often think we want to avoid paying money for it. This is false, and a bad im…
Libre isn't prerequisite either. Access to buildable source is.
According to the free software definition [1], it's one of the essential freedoms:
>The freedom to study how the program works, and change it so it does your computing as you wish. Access to the source code is a precondition for this.
Why do people keep releasing messaging applications? These things rarely, if ever catch on. Awaiting the inevitable HN thread about how Chadder is flawed.
Anyone care to explain how this is supposed to work? If Chadder don't store or transmit the key, how does the person I'm sending a message to have it? The ambiguity in the way the video explained it makes me a bit suspicious.
I do not know what your objections are. It's pretty straight forward. I guess it's something like: For messages: AES Key exchange: RSA Alice and Bob both generates their own RSA keypair (the server do not have their private keys). Alice generates the AES key to be used with Bob, encrypts it using Bobs public RSA key and then sends it to him.. done
Anyone care to explain how this is supposed to work? If Chadder don't store or transmit the key, how does the person I'm sending a message to have it? The ambiguity in the way the video explained it makes me a bit suspicious.
I do not know what your objections are. It's pretty straight forward. I guess it's something like: For messages: AES Key exchange: RSA Alice and Bob both generates their own RSA keypair (the server do not have their private keys). Alice generates the AES key to be used with Bob, encrypts it using Bobs public RSA key and then sends it to him.. done
Anyone care to explain how this is supposed to work? If Chadder don't store or transmit the key, how does the person I'm sending a message to have it? The ambiguity in the way the video explained it makes me a bit suspicious.
I do not know what your objections are. It's pretty straight forward. I guess it's something like: For messages: AES Key exchange: RSA Alice and Bob both generates their own RSA keypair (the server do not have their private keys). Alice generates the AES key to be used with Bob, encrypts it using Bobs public RSA key and then sends it to him.. done
- How is the problem of key distribution solved? How does Bob know that the key is in fact Alices and not Mallorys?
- The scheme you propose does not provide forward secrecy.
- (How) is authentication performed? Are signatures used; if so, are they non-repudiable or deniable?
Secure instant messaging is not a solved problem (at least not in the form of a practical, usable implementation).
Earlier quoted context omitted.
I do not know what your objections are. It's pretty straight forward. I guess it's something like: For messages: AES Key exchange: RSA Alice and Bob both generates their own RSA keypair (the server do not have their private keys). Alice generates the AES key to be used with Bob, encrypts it using Bobs public RSA key and then sends it to him.. done
But then how does Alice know if she's talking to the right Bob and not some evil middle-man? In other words, she has to trust the server that it is giving her the correct public key.
Encryption:
* Messages are encrypted with AES 128 CBC
* Random key for each message
* The AES key is sent to the server, and exchanged for some key-id
* They key id is prepended to the message
* Split message into key id and encrypted part
* Download key from server
* Decrypt message