Learn to use radios (in mass balls-to-the-walls protests).
I remember a Nokia phone that had a walkie-talkie integrated in it and you could use it as a radio.
Too bad that this quirky feature will never make re-appearance.
Bridgefy, the messenger promoted for mass protests, is a privacy disaster
31–40 of 49 posts
Re: Bridgefy, the messenger promoted for mass protests, is a privacy disaster
#32The only usable tool for any organization of resistance is Telegram. Anything else is garbage. Here's why: Bluetooth/Mesh based local broadcast apps such as FireChat and Bridgfy are literally extreme low signal to noise streams of thoughts coming from everyone around you. We don't even need to get to the privacy or security part to eliminate it due to it being completely unusable in areas with more than a couple peop…
>actually go and try using your proposed alternatives in protests. Most if not all of these so-called secure chats are completely unusable
This cannot be stressed enough. One can do their imaginary layman revolutions and or secret operation in these chats, citing theoretical security features, etc. But when it comes to the real world, they simply do not work, in the same way your todolist mvc example doesn't work for project management and accounting.
Re: Bridgefy, the messenger promoted for mass protests, is a privacy disaster
#33The only usable tool for any organization of resistance is Telegram. Anything else is garbage. Here's why: Bluetooth/Mesh based local broadcast apps such as FireChat and Bridgfy are literally extreme low signal to noise streams of thoughts coming from everyone around you. We don't even need to get to the privacy or security part to eliminate it due to it being completely unusable in areas with more than a couple peop…
But in Hong Kong's case, a number of Telegram chat room operators have been prosecuted by the police for anti-government activities. If TG is really secure then this shouldn't have happened.
Well there is a number of ways for identity information to leak, from simple self-deanon mistakes to "third degrees" of key positions who were unfortunate to be caught in action and unable to prevent their chats from being analyzed. A good old handcuffing to a radiator still works too. Your claim can only be strictly true in an ideal world of ideal operation on one side and an ideal human-respecting law on the other.
Re: Bridgefy, the messenger promoted for mass protests, is a privacy disaster
#34From the article these attacks allow for: * deanonymizing users * building social graphs of users’ interactions, both in real time and after the fact * decrypting and reading direct messages * impersonating users to anyone else on the network * completely shutting down the network * performing active man-in-the-middle attacks, which allow an adversary not only to read messages, but to tamper with them as well This ap…
> Doesn't that qualify as some sort of fraud or false advertising? Fraud typically requires some sort of mens rea. It sounds to me like Bridgefy is just really bad as making secure applications. > If not, I wonder if we need further regulation to protect the public from developers that are either incompetent or straight malicious. There is a long history of people trying to create liability for software bugs. It was…
Why?
If a bridge is built wrong and kills people when it collapses, someone must be at fault.
What’s the difference if it happens with a virtual “thing”?
Re: Bridgefy, the messenger promoted for mass protests, is a privacy disaster
#35Earlier quoted context omitted.
My money is on p2p matrix. It doesn't solve the immediate case Bridgefy does yet (I think it expects to have an internet connection), but it does solve the 'we have to trust central services like signal and or have incredibly difficult ux' scenario somewhat. Metadata resistant to a point etc. Cwtch.im (pronounced couch) is an app I'm looking closely at but doesn't seem to have much movement in terms of shipping new r…
> Cwtch.im (pronounced couch) You can forget about this one. With a name like that, it isn't going anywhere.
It might be popular in Britain. Cwtch is the one Welsh word that non-Welsh people know. A bit like craic.
Re: Bridgefy, the messenger promoted for mass protests, is a privacy disaster
#36Earlier quoted context omitted.
> Doesn't that qualify as some sort of fraud or false advertising? Fraud typically requires some sort of mens rea. It sounds to me like Bridgefy is just really bad as making secure applications. > If not, I wonder if we need further regulation to protect the public from developers that are either incompetent or straight malicious. There is a long history of people trying to create liability for software bugs. It was…
Why? If a bridge is built wrong and kills people when it collapses, someone must be at fault. What’s the difference if it happens with a virtual “thing”?
What’s the difference if it happens with a virtual “thing”?
Certification. Engineering is a protected profession, which means there are preconditions to working in that field and real consequences for failure. Software "engineering" has none of the preconditions.
Re: Bridgefy, the messenger promoted for mass protests, is a privacy disaster
#37Earlier quoted context omitted.
Why? If a bridge is built wrong and kills people when it collapses, someone must be at fault. What’s the difference if it happens with a virtual “thing”?
What’s the difference if it happens with a virtual “thing”? Certification. Engineering is a protected profession, which means there are preconditions to working in that field and real consequences for failure. Software "engineering" has none of the preconditions.
You're explaining why there _is_ a difference, but not why their _should be_ a difference.
1. "It is a bad idea to make software developers liable for bugs".
2. "Why? We make engineers liable for physical malfunctions, why not make software engineers liable for software malfunctions?"
3. "Because they are uncertified"
It fails to address the actual point. Is it better that software developers are uncertified? Why not introduce standards?
I guess it's easier to transport software, even running software, across borders today. But even there, one could say, "If Google relocates to Canada, then stuff them - we will drop their packets at the border till they comply with domestic law."
This would be a disruption of the free market, but we already admit that a free market shouldn't exist in house construction. Why should a free market exist in message distribution? The question is always, why is software on this side of the border, and bridges on that side?
(My guess is that it's because few people die when your email is mishandled, but many people could die if bridges fell out of the sky whenever they got bored.)
Re: Bridgefy, the messenger promoted for mass protests, is a privacy disaster
#38Earlier quoted context omitted.
What’s the difference if it happens with a virtual “thing”? Certification. Engineering is a protected profession, which means there are preconditions to working in that field and real consequences for failure. Software "engineering" has none of the preconditions.
You're explaining why there _is_ a difference, but not why their _should be_ a difference. 1. "It is a bad idea to make software developers liable for bugs". 2. "Why? We make engineers liable for physical malfunctions, why not make software engineers liable for software malfunctions?" 3. "Because they are uncertified" It fails to address the actual point. Is it better that software developers are uncertified? Why not…
So it seems like it ends up being a moral dilemma:
If a software issue causes for example a data breach, it could cause lots of people to experience mild annoyances, like time wasted on changing passwords, money lost through more effective scamming attempts, etc..
If we compare an actual life lost in an accident with lots of people losing some hours/days from their lives, when can we say they are an equal loss?
1 people = 100 people losing 1 year?
How about if the person is your family member?
This gets waaay too complicated to resolve rationally..
Re: Bridgefy, the messenger promoted for mass protests, is a privacy disaster
#39Earlier quoted context omitted.
> Doesn't that qualify as some sort of fraud or false advertising? Fraud typically requires some sort of mens rea. It sounds to me like Bridgefy is just really bad as making secure applications. > If not, I wonder if we need further regulation to protect the public from developers that are either incompetent or straight malicious. There is a long history of people trying to create liability for software bugs. It was…
Why? If a bridge is built wrong and kills people when it collapses, someone must be at fault. What’s the difference if it happens with a virtual “thing”?
> someone must be at fault
Some times, yes, other times, no. Yet, it's not fraud, when someone is at fault, it's for other issues.
Re: Bridgefy, the messenger promoted for mass protests, is a privacy disaster
#40Earlier quoted context omitted.
Somebody needs to expend a bunch of effort to provide identity. It doesn't have to be you (in a PKI the effort is expended by the Certificate Authorities and those overseeing them, not by Relying Parties) but it does have to be somebody you trust. For personal identity the most plausible outside authority is government, and it's unlikely that people protesting a government would trust it to identify them - after all…
> But trust isn't transitive so PGP's apparently more powerful offering doesn't actually do anything ... Trust in the abstract isn't inherently transitive, agreed. I'd argue that employing PGP as though it were is misusing the tool (that might well be easier to do than it ought to be, but that's a different conversation). WoT as realized by PGP seems to me to be a very good tool for manually assessing whether to trus…
> WoT as realized by PGP seems to me to be a very good tool for manually assessing whether to trust a previously unknown key for someone that a third (untrusted) party sends you.