Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Three lessons from Threema: Analysis of a secure messenger

breakingthe3ma.app

Post reply on HN
Print view View original

21–30 of 55 posts

Re: Three lessons from Threema: Analysis of a secure messenger

#21

Post by dewey »

tptacek wrote: post #19
dewey wrote: post #6

Not directly related to the topic but how is it that Threema is the only popular secure messenger where you have a random ID to give to people to communicate with and not a phone number (Signal) or have your name show up across all your contacts / groups (Telegram)?

You're right; this isn't directly related to the topic. It's a recapitulation of every thread we have ever had about Signal, on a story that has very little to do with Signal and that unveils new cryptography research. Unfortunately, this is a big dynamic on HN, not just on cryptography threads, but especially on threads rooted in stories with intense technical details. It's time consuming to bring yourself up to spe…

I get your point but this is not a thread about Signal. Threema is a lot less common of a topic on HN than Signal and the only reason I’m using it and am familiar with it is this feature so I don’t think it’s such an off topic question to ask.

Re: Three lessons from Threema: Analysis of a secure messenger

#22

Post by TechBro8615 »

dewey wrote: post #6

Not directly related to the topic but how is it that Threema is the only popular secure messenger where you have a random ID to give to people to communicate with and not a phone number (Signal) or have your name show up across all your contacts / groups (Telegram)?

Telegram is an obvious law enforcement honeypot. Trust me bro, just upload all your contacts to our servers bro, we won't share them with anyone, promise...

Hey, me and the guys are planning a riot at the Capitol. Wanna come? Join my telegram group and we can talk about it in secret thanks to end-to-end encryption! Here's the public link...

Re: Three lessons from Threema: Analysis of a secure messenger

#23

Post by _8j50 »

tptacek wrote: post #19
dewey wrote: post #6

Not directly related to the topic but how is it that Threema is the only popular secure messenger where you have a random ID to give to people to communicate with and not a phone number (Signal) or have your name show up across all your contacts / groups (Telegram)?

You're right; this isn't directly related to the topic. It's a recapitulation of every thread we have ever had about Signal, on a story that has very little to do with Signal and that unveils new cryptography research. Unfortunately, this is a big dynamic on HN, not just on cryptography threads, but especially on threads rooted in stories with intense technical details. It's time consuming to bring yourself up to spe…

To be fair, they also mentioned telegram and the subject of the comment was a really good feature of threema.

Re: Three lessons from Threema: Analysis of a secure messenger

#24

Post by tptacek »

_8j50 wrote: post #23
tptacek wrote: post #19

Earlier quoted context omitted.

You're right; this isn't directly related to the topic. It's a recapitulation of every thread we have ever had about Signal, on a story that has very little to do with Signal and that unveils new cryptography research. Unfortunately, this is a big dynamic on HN, not just on cryptography threads, but especially on threads rooted in stories with intense technical details. It's time consuming to bring yourself up to spe…

To be fair, they also mentioned telegram and the subject of the comment was a really good feature of threema.

The thread is about new cryptographic research. Or it was, and should be.

Re: Three lessons from Threema: Analysis of a secure messenger

#25

Post by sampa »

dewey wrote: post #6

Not directly related to the topic but how is it that Threema is the only popular secure messenger where you have a random ID to give to people to communicate with and not a phone number (Signal) or have your name show up across all your contacts / groups (Telegram)?

Matrix uses email-style ids

Re: Three lessons from Threema: Analysis of a secure messenger

#26

Post by rainsford »

tptacek wrote: post #5
upofadown wrote: post #4

Threema has responded: https://threema.ch/en/blog/posts/news-alleged-weaknesses-sta... New Paper on Old Threema Protocol

As Kenny Paterson points out, on behalf of the research group, the's "the old Threema protocol" in large part because of the work they did, which makes the "old protocol" thing pretty hollow.

Also bragging in 2023 that your shiny new protocol has PFS really emphasizes that this is not a great PR strategy. Being dismissive of security research because you finally got around to implementing some cryptography principles that have been considered table stakes for a while now, especially if the research was part of what motivated your changes, is incredibly not confidence inspiring.

Re: Three lessons from Threema: Analysis of a secure messenger

#27

Post by rainsford »

upofadown wrote: post #4

Threema has responded: https://threema.ch/en/blog/posts/news-alleged-weaknesses-sta... New Paper on Old Threema Protocol

The baffling part of that response is that they could easily have conveyed the same basic message in a much less defensive way instead of making me glad I don't rely on Threema for my messaging security.

"Good research, and here's how we've addressed those issues and proactively enhanced our security even further" is a decent story to be able to tell about how you're constantly trying to make your customers safer. Being defensive and dismissive sends the exact opposite message...image is more important than security.

Re: Three lessons from Threema: Analysis of a secure messenger

#28

Post by godelski »

tptacek wrote: post #19
dewey wrote: post #6

Not directly related to the topic but how is it that Threema is the only popular secure messenger where you have a random ID to give to people to communicate with and not a phone number (Signal) or have your name show up across all your contacts / groups (Telegram)?

You're right; this isn't directly related to the topic. It's a recapitulation of every thread we have ever had about Signal, on a story that has very little to do with Signal and that unveils new cryptography research. Unfortunately, this is a big dynamic on HN, not just on cryptography threads, but especially on threads rooted in stories with intense technical details. It's time consuming to bring yourself up to spe…

It makes sense to talk about Signal in these types of threads, despite not being about Signal, because Signal is still the de facto private messenger. The userbase is much larger than that of Threema so it is worthwhile to compare how these platforms are doing things differently. Especially in the context of if users should switch. Just like how in threads about Signal it is similarly appropriate to discuss WhatsApp and Telegram (and vise versa). Though I'll admit that these conversations can degrade into flame wars and get off topic quickly.

Re: Three lessons from Threema: Analysis of a secure messenger

#29

Post by [deleted] »

marosgrego wrote: post #15

Threema messages of Marian Kočner, a contorversial Slovak businessman who allegedly ordered a murder of a local journalist, were somehow obtained with the help of Europol. [0] The part of his trial where a security expert explained how the police got the messages was purposely not made public. [0] https://spectator.sme.sk/c/22216551/threema-saga-kocner-repo...

[deleted]
Post reply on HN