Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

White Noise – secure and private messenger

whitenoise.chat

Post reply on HN
Print view View original

31–40 of 51 posts

Re: White Noise – secure and private messenger

#31

Post by rendaw »

shark_laser wrote: post #14
heavyset_go wrote: post #4

> White Noise stands out by merging Nostr’s decentralized network with advanced encryption. How does White Noise address criticisms surrounding Nostr's implementation[1]: > While nostr offers the ability to send encrypted DMs to user pubkeys, the metadata of these messages are broadcast publicly via relays. This is the same as a bitcoin transaction being viewable on the public ledger. The contents of the direct messa…

This criticism of Nostr is quite outdated. I haven't looked into the White Noise code, but Gift Wrapping is just one way this issue was solved a long time ago: https://nips.nostr.com/59

How does gift wrapping address what GP brought up? I read through and AFAICT it obscures explicit metadata in the message, but not external stuff such as source/dest ip that logging any shared relay could give you.

AFAIK the only real ways to get metadata privacy are onion routing (increase the chance of a non-compromised node) and N-anonymity (decrease the value of a discovered connection).

Re: White Noise – secure and private messenger

#33

Post by heavyset_go »

heavensteeth wrote: post #30
heavyset_go wrote: post #4

> White Noise stands out by merging Nostr’s decentralized network with advanced encryption. How does White Noise address criticisms surrounding Nostr's implementation[1]: > While nostr offers the ability to send encrypted DMs to user pubkeys, the metadata of these messages are broadcast publicly via relays. This is the same as a bitcoin transaction being viewable on the public ledger. The contents of the direct messa…

That article reeks of AI generation. The "author" also uses an AI generated profile picture. I struggle to trust anything this page says.

It's a sentiment that's spread for years and I first heard it on Mastodon, but don't have a link to it in my history.

What I posted is just the first link I found on DDG that talks about it.

Re: White Noise – secure and private messenger

#34

Post by hiimkeks »

miloignis wrote: post #18
hiimkeks wrote: post #3

Congratulations on the release! As someone who used to be in the Secure Scuttlebutt community an now works on OpenMLS, I wonder how they (you?) deal with concurrency of Commit messages. I spent quite some time thinking about ways to detect and resolve forks, and the current iteration of MLS doesn't really have good answers here.

I looked up the spec, and it seems like they just tiebreak on time and hash and throw away the losing commit: https://github.com/nostr-protocol/nips/blob/001c516f72943081...

Huh, that would make it easy to provoke forks by just backdating a second commit.

Re: White Noise – secure and private messenger

#35

Post by abhsag »

heavyset_go wrote: post #4

> White Noise stands out by merging Nostr’s decentralized network with advanced encryption. How does White Noise address criticisms surrounding Nostr's implementation[1]: > While nostr offers the ability to send encrypted DMs to user pubkeys, the metadata of these messages are broadcast publicly via relays. This is the same as a bitcoin transaction being viewable on the public ledger. The contents of the direct messa…

Lol, nostr metadata leak was a criticism of NIP-04 , which has long been considered obsolete NIP-17 messages addressed this long time ago, but it was not scalable to large groups. MLS solves this problem so we finally have, scalable, private, decentralized messeging on the internet, all these specs are public, the very fact that you did not understand this, means no one will be able to make you understand with a comment.

Re: White Noise – secure and private messenger

#36

Post by abhsag »

ktallett wrote: post #5

As much as I love the idea of these secure messaging apps, until I see how a company responds to government intimidation I am always wary of being too invested and trustworthy of the marketing.

Yep, this is what makes THIS app special, it's a protocol not a company

Re: White Noise – secure and private messenger

#37

Post by abhsag »

globalnode wrote: post #7

i admit i havent looked at the app, but i assume is centrally run. firstly: i think the only way secure p2p messaging can work is if its decentralised. no 3rd parties to communication, how this would be done i have no idea. maybe like email but without the server? secondly: you'd need to ensure a secure os on each end that you can trust to not take screenshots and send to hq before transmission or after reception. si…

It's not centrally run, that's the whole point.

Re: White Noise – secure and private messenger

#38

Post by abhsag »

gblargg wrote: post #22
journal wrote: post #19

title: secure and private terms: we're not responsible

Software advertising itself as "A truly secure and private messenger" raises my skepticism. It might be truly secure. Its creators might believe it is and have zero doubt that they've made no errors and there are no flaws. Or it is neither and they want me to think it's those things. The only thing definite is that it claims to be truly secure.

Don't trust, verify ;)

Re: White Noise – secure and private messenger

#39

Post by happymellon »

rendaw wrote: post #29
ikawe wrote: post #23

Earlier quoted context omitted.

https://signal.org/blog/sealed-sender/ The short version is: Traditionally, Bob needed to “log in” to be able to send a message to Alice’s inbox. With Sealed Sender, Alice gives Bob a credential that allows him to message her from now on without logging in. Only Alice can tell that the message she received is from Bob. There’s some subtlety around bootstrapping these credentials and preventing abuse which means that…

Ah thanks, okay, I'm not sure I'm missing anything in that case. But if so, doesn't signal still know that alice and bob are communicating because it's transferring messages between them? Even if Bob doesn't log in IP B is still sending payloads that eventually get delivered to IP A, and if law enforcement later asks signal for logs they could be correlated.

Indeed, at some point in time a byte has to move from point A to point B, and unless you random VPN to a different location the source and destination IPs can be identified.

Even if they can't read it, a hostile government won't care.

There is only so much you can do against a really determined adversary thats well funded. I just want a Signal that doesn't tie everything back to a phone number.

Post reply on HN