Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted messengers: Riot, not Signal, is the future

titus-stahl.de

Post reply on HN
Print view View original

21–30 of 178 posts

Re: Encrypted messengers: Riot, not Signal, is the future

#21

Post by Strom »

exstudent2 wrote: post #10

A question I've had about Signal is what is stopping Apple from modifying and rebuilding the source with a backdoor in it? Is this technically possible (seems like it would be since they control distribution of the binary to devices)? The article is correct in stating that web based chat is inherently insecure but it seems all iOS apps are also inherently insecure. I'm by no means an expert though so would love to he…

Yes you depend on Apple's cooperation on iOS & Google's cooperation on Android. Even if you flash your phone with your own custom OS, your radio chips will still run proprietary firmware that can be updated over the air without the OS even knowing.

These aren't high priority problems right now for mass surveillance, as we have people using plain text chat. If you're expecting a wealthy adversary to directly target you, then the only safe move is to avoid technology.

Re: Encrypted messengers: Riot, not Signal, is the future

#22

Post by rahrahrah »

NoGravitas wrote: post #13
rahrahrah wrote: post #4

The question I would ask is: given the list of capabilities presented in this post, is there even any difference between Riot and e-mail? Or are you reinventing the wheel?

End-to-end encryption. Even if you encrypt email with PGP, which no one has come up with a satisfactorily easy interface for, it leaks a lot of metadata. Riot gives essentially the same privacy guarantees as Signal, but with email-like federation.

PGP can be used to encrypt at the ends, in which case it is end-to-end encryption. So that's not a different feature.

Care to share what you mean by PGP leaks a lot of metadata? You might be right, I'm just not aware of such details.

Re: Encrypted messengers: Riot, not Signal, is the future

#23

Post by smacktoward »

exstudent2 wrote: post #10

A question I've had about Signal is what is stopping Apple from modifying and rebuilding the source with a backdoor in it? Is this technically possible (seems like it would be since they control distribution of the binary to devices)? The article is correct in stating that web based chat is inherently insecure but it seems all iOS apps are also inherently insecure. I'm by no means an expert though so would love to he…

I'm not sure it really matters -- if Apple wants to log your conversations they don't have to put a backdoor into Signal, they could just put a backdoor into iOS itself. An attacker with privileged access to the guts of the operating system doesn't have much need to muck around with hacking the applications that run on it.

Which is to say, security-minded users should strive to trust as few parties as possible, but since at the end of the day you have to trust somebody if you don't trust Apple the only really secure move would be to not use iOS devices at all.

Re: Encrypted messengers: Riot, not Signal, is the future

#24

Post by acqq »

NoGravitas wrote: post #14
acqq wrote: post #11

> Riot is based on the so-called Matrix protocol which is a federated protocol > In addition, people are writing alternative clients to access the Matrix/Riot network, implementing their favorite features and workflows. As users can vote with their feet for their own interests and choose providers and apps of their liking Can I run my own network which is not part of other networks (i.e. not "federated")? Can I tell…

I believe so, yes. If not with the standard homeserver (synapse), than with a custom homeserver.

Note: my question is, with a plain client, downloadable from the app store, not with some special custom build of the client.

Also, how puringpanda's question fits to your claim?

https://news.ycombinator.com/item?id=13239925

Re: Encrypted messengers: Riot, not Signal, is the future

#25

Post by nickodell »

buzzybee wrote: post #20
rahrahrah wrote: post #4

The question I would ask is: given the list of capabilities presented in this post, is there even any difference between Riot and e-mail? Or are you reinventing the wheel?

Riot is most comparable to Slack or Discord. It has chat rooms. It supports voice, image posts, file transfer, etc. It stores conversation history. You can private message people. Matrix is a generalized protocol for decentralized and federated communications; it's agnostic to the application layer provided by Riot. Something Matrix doesn't have, but is on the issue backlog, is support for email-esque thread contexts…

Discord/slack isn't federated, is it?

Re: Encrypted messengers: Riot, not Signal, is the future

#27

Post by cguess »

exstudent2 wrote: post #10

A question I've had about Signal is what is stopping Apple from modifying and rebuilding the source with a backdoor in it? Is this technically possible (seems like it would be since they control distribution of the binary to devices)? The article is correct in stating that web based chat is inherently insecure but it seems all iOS apps are also inherently insecure. I'm by no means an expert though so would love to he…

Technically? There's nothing stopping them. For that matter, there's no stopping Google from doing the same. There's also no stopping Apple from patching LLVM so that only patched versions of OpenSSL are ever compiled against. The question is how paranoid are you and what is your threat model?

We have to trust someone, eventually. This is especially true for the 99% of the population who doesn't have the skill to compile source themselves (nor should they have to).

Re: Encrypted messengers: Riot, not Signal, is the future

#28

Post by guelo »

exstudent2 wrote: post #10

A question I've had about Signal is what is stopping Apple from modifying and rebuilding the source with a backdoor in it? Is this technically possible (seems like it would be since they control distribution of the binary to devices)? The article is correct in stating that web based chat is inherently insecure but it seems all iOS apps are also inherently insecure. I'm by no means an expert though so would love to he…

The way the App Store works is that the app is signed by both apple and the developer's private key. Without the developer's private key Apple is not supposed to be able to sign the app in a way that the App Store would upgrade an app and consider it to be the same app. But of course Apple could modify the app store or ios in a way to remove those restrictions.

Re: Encrypted messengers: Riot, not Signal, is the future

#29

Post by acqq »

smacktoward wrote: post #23
exstudent2 wrote: post #10

A question I've had about Signal is what is stopping Apple from modifying and rebuilding the source with a backdoor in it? Is this technically possible (seems like it would be since they control distribution of the binary to devices)? The article is correct in stating that web based chat is inherently insecure but it seems all iOS apps are also inherently insecure. I'm by no means an expert though so would love to he…

I'm not sure it really matters -- if Apple wants to log your conversations they don't have to put a backdoor into Signal, they could just put a backdoor into iOS itself. An attacker with privileged access to the guts of the operating system doesn't have much need to muck around with hacking the applications that run on it. Which is to say, security-minded users should strive to trust as few parties as possible, but s…

Exactly: as soon as you use Apple, you can as well use iMessage and FaceTime with the other iOS users. You just need something to be able to communicate a bit safer with the users who don't have iOS.

But if the user has another OS, then you can believe those who get control of that OS/device can read your messages to that user and record your calls to him/her.

It's turtles all the way around. The more communication the less can you expect to remain "private." Come to think, it is so without computers too.

Re: Encrypted messengers: Riot, not Signal, is the future

#30

Post by zitterbewegung »

exstudent2 wrote: post #10

A question I've had about Signal is what is stopping Apple from modifying and rebuilding the source with a backdoor in it? Is this technically possible (seems like it would be since they control distribution of the binary to devices)? The article is correct in stating that web based chat is inherently insecure but it seems all iOS apps are also inherently insecure. I'm by no means an expert though so would love to he…

There is no technical restriction. But if Apple did do this and someone figured it out it would probably hurt their perception by their users and it would be a bunch of bad PR.
Post reply on HN