Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Moxie Marlinspike has a plan to reclaim our privacy

newyorker.com

Post reply on HN
Print view View original

131–140 of 237 posts

Re: Moxie Marlinspike has a plan to reclaim our privacy

#131

Post by elpy1 »

walrus01 wrote: post #43
elevation wrote: post #14

It's frustrating to see Signal's reputation undermined in technical circles by the shortsighted zeitgeist. Signal's constitutional emphasis on usability supports user demographics that no other security product can attract. My elderly relatives use Signal now instead of Skype. This drew in other family members who just wanted to video chat with grandma and grandpa. Matrix will never win markets like this. When tech n…

My primary concern about Signal and usability is the insistence on using phone numbers to identify a person as a user ID. Anything that relies on SS7/PSTN working correctly is a very bad design choice in my opinion. Giving out your phone number to possibly untrusted contacts is also a bad decision because it opens up opportunities for scams, spam and social-engineering attempted hijacks of accounts (SIM swap attacks…

You might be interested in Session (https://getsession.org)

Re: Moxie Marlinspike has a plan to reclaim our privacy

#132

Post by cyphar »

elevation wrote: post #105
jhayward wrote: post #57

Earlier quoted context omitted.

> The Signal group has an uncompromising commitment to user privacy Would you say that outing people who are signal users and putting them in signal contact lists without their permission is 'uncompromising commitment to user privacy?'

Far from "compromise", Signal implements the only privacy conscious possibility here. Without automatic contact discovery "Signal private messenger" would be forced to default to not-private for all contacts until manual confirmation could occur. Adding UX friction to the primary use case would hinder adoption among non security-enthusiasts. With protection for the casual user eliminated, the truly sensitive communic…

Alternatively, users could be given the option to opt-out of automated contact discovery so that most users have the current behaviour but people who don't want others to find out they've started using Signal (there are dozens of fairly serious situations where this could be very bad -- dismissing them like you did by calling them "elite" betrays you don't actually care about the issue being described).

I mean, the fact that Signal actively notifies you when a contact registers for Signal is a complete misfeature (yes, this is basically a cosmetic complaint). It actively outs people who don't want to be outed and it's a useless notification to all of your contacts if you don't care about it.

Re: Moxie Marlinspike has a plan to reclaim our privacy

#133

Post by ancientworldnow »

darcys22 wrote: post #102

Another project that is doing interesting stuff in this space is Loki. https://loki.network/ They have built a tor/onion network and use it as the backend for their messenger (forked from signal). Its end to end encrypted and doesnt have centralised servers. https://getsession.org/

Session is exciting but it's currently broken. Group chats don't work properly with messages frequently getting lost and not delivered to all users. We've tried to switch several times for groups that need encrypted group chat with disappearing messages, group admin, and usernames instead of phone numbers (basically making them the only game in town) but it just doesn't work right 100% of the time which is a deal breaker.

Re: Moxie Marlinspike has a plan to reclaim our privacy

#134

Post by 3np »

crossroadsguy wrote: post #107
ryukafalz wrote: post #27

Earlier quoted context omitted.

> When tech nerds nit pick Signal's implementation, they ignore that the unfederated nature of Signal limits the damage these decisions can cause. It limits the damage that some decisions can cause, but exacerbates others. Signal only allows the first-party client to connect to its network; if the developers were legally compelled to add a backdoor into that client, users would have few options. Its security depends…

> I’d also contest the idea that Matrix can never have a client as usable as Signal, but I’ll agree that there isn’t one yet. After being around for multiple years and having not managed to do it even once (or come close) I think I am inclined to bet they won't. Or they'd just focus on being enterprise software (which I think they are doing and they must if they want to earn money). Of all the IM apps Matrix is my mo…

Even the server-side software is not feature complete yet. Give it time.

Another client that I think is aiming to fill that gap (and also has a provider with bridges to eg Messenger et al) is Novachat: https://nova.chat/

Matrix is not an IM app, it’s a protocol. Anyone is encouraged to make an app for it.

It’s a long game. I’d give it another year or two before I think it’s grandma-ready.

Re: Moxie Marlinspike has a plan to reclaim our privacy

#135

Post by mapgrep »

I thought this was interesting:

“

Perrin told me that, despite appearances, ‘Moxie leads from the front, and he just leads by doing. One of his favorite quotes is “The only secret is to begin.” If you want to get good at something or do something, you just do it, and you figure it out along the way.’

“

Re: Moxie Marlinspike has a plan to reclaim our privacy

#136

Post by cyphar »

toast0 wrote: post #72
upofadown wrote: post #29

Earlier quoted context omitted.

>Like the key agility that makes the Axolotl Ratchet so superior to GPG, I am not sure how you can usefully compare a thing originally intended to secure email to a thing intended to secure IM. The ratchet only provides forward secrecy anyway. My take on that is that it is a pointless thing for something like email and pointless in practice for most IM applications. Most IM users keep their old messages and practical…

It provides forward secrecy and deniability. Your chat database doesn't prove that I said what your database says I said.

It should be noted that (while cool from a cryptographic perspective), this security primitive is practically useless in any scenario where you might think it would be useful:

* The burden of evidence to introduce chat logs in legal proceedings is much lower than you would think. Often screenshots of Facebook messages are used, or SMS records (which are also easily spoofed). A judge or jury will likely not entertain the possibility the messages were fabricated unless you have substantial evidence to the contrary.

* If you're scared of national security actors discovering you've leaked some information, the fact there is a record of the secret information in the other person's phone is more than enough for them to black bag you. (And let's be honest, lack of evidence has never stopped the USA from black bagging people.)

* Generally speaking, the probability of the chat record being faked is so small that no reasonable person will entertain the possibility it was faked (even though it could've been).

Not to mention there are all sorts of forensic methods to prove that a particular person wrote some message using fingerprinting, and ultimately Signal LLC does actually know whether you sent a message or not and who to (though admittedly they claim they don't keep metadata logs).

Now, if you're dealing with an anonymised chat system with this property then it could be argued it is practically useful. But at that point the anonymisation is doing most of the heavy lifting.

Re: Moxie Marlinspike has a plan to reclaim our privacy

#137

Post by axaxs »

q3k wrote: post #89
bilal4hmed wrote: post #7

Other than matrix, what are some other alternatives or upcomers in the messaging field I should try. Matrix still has a high burden of me setting up my own server and maintaining it. Till their P2P solution doesnt release, they have their own metadata problem.

Wire: open source (AGPL server/clients), can self-host, available as a public cloud service (free for user-to-user comms, paid for orga comms). Disclosure: worked for them.

Wire was my favorite...much more featureful than Signal at least when I was testing them a couple years back. They also had some not so nice things to say about the Signal folks, but that's mostly gossip.

Re: Moxie Marlinspike has a plan to reclaim our privacy

#138

Post by _-___________-_ »

ryukafalz wrote: post #108
crossroadsguy wrote: post #107

Earlier quoted context omitted.

> I’d also contest the idea that Matrix can never have a client as usable as Signal, but I’ll agree that there isn’t one yet. After being around for multiple years and having not managed to do it even once (or come close) I think I am inclined to bet they won't. Or they'd just focus on being enterprise software (which I think they are doing and they must if they want to earn money). Of all the IM apps Matrix is my mo…

I mean, keep in mind that while Element is effectively the reference client, it's also still just one client. It's not trying to be a Signal-style messenger, it's trying to be something like Slack - and at that I'd say it succeeds. There are other clients in development that are closer UI-wise to your typical mobile messenger, e.g. https://dittochat.org/

Having spent a decent amount of time reading and attempting to implement small parts of the horrendous mess that is the Matrix protocol, I'd bet decent money that there will never be any reasonably complete alternatives to Element. Ditto looks nice, but is very barebones.

Re: Moxie Marlinspike has a plan to reclaim our privacy

#139

Post by _-___________-_ »

3np wrote: post #134
crossroadsguy wrote: post #107

Earlier quoted context omitted.

> I’d also contest the idea that Matrix can never have a client as usable as Signal, but I’ll agree that there isn’t one yet. After being around for multiple years and having not managed to do it even once (or come close) I think I am inclined to bet they won't. Or they'd just focus on being enterprise software (which I think they are doing and they must if they want to earn money). Of all the IM apps Matrix is my mo…

Even the server-side software is not feature complete yet. Give it time. Another client that I think is aiming to fill that gap (and also has a provider with bridges to eg Messenger et al) is Novachat: https://nova.chat/ Matrix is not an IM app, it’s a protocol. Anyone is encouraged to make an app for it. It’s a long game. I’d give it another year or two before I think it’s grandma-ready.

Indeed it's a protocol. A horrendous, reinvent-everything, excessively complex mess of a protocol, that the developers of the reference server have gone on record saying that they don't expect anyone else to be able to successfully implement.

Re: Moxie Marlinspike has a plan to reclaim our privacy

#140

Post by 3np »

dingaling wrote: post #18
cwyers wrote: post #9

Why is it, whenever Signal is brought up on Hacker News, we get inundated with the people who object to the core decisions of the Signal Project? Would Signal really be better if, instead of having a secure messenger available to the masses, it spent massive amounts of time implementing the things these people want? No. I would be comfortable recommending Signal (or WhatsApp) to a nontechnical friend and communicatin…

Signal only has any userbase due to advocacy; compared to the secure-enough-for-most WhatsApp which has literally billions of users and is the default choice, every user of Signal had to be convinced to install it. So I think it's unfair to bash people who criticise the project. The 'drag' they apply to wider adoption is still miniscule. Put it this way: why does Signal exist when WhatsApp is good enough? Wouldn't Mr…

Yeah, I wonder where they’d be without Snowden’s endorsement.
Post reply on HN