Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ring, officially a GNU package

blog.savoirfairelinux.com

Post reply on HN
Print view View original

51–60 of 68 posts

Re: Ring, officially a GNU package

#51

Post by qwertyuiop924 »

Arathorn wrote: post #49
qwertyuiop924 wrote: post #47

Earlier quoted context omitted.

...No, not unless you're converting from an external ID. Matrix IDs are decentralized, last I checked.

the ID service in Matrix is optional, and should be called an 'ID mapping service', really. All it does is to map 3rd party IDs such as email addresses to decentralised matrix IDs. Currently it is a logically centralised service, and this is a major shortcoming: in future we intend to decentralise it as much as possible. This is Hard however, and we're kinda hoping that a decentralised equivalent to Keybase will come…

Yes, that is what I meant, in case it wasn't clear.

Re: Ring, officially a GNU package

#52

Post by teraflop »

brute wrote: post #37
alpb wrote: post #33

Little bit off-topic but: > respects freedoms and privacy of its users It downloads the binary over http on http://ring.cx , makes it susceptible to tampering. Is serving binaries over HTTP a GNU thing because the expectation is that you would check the signature?

Care to elaborate? http://ring.cx has a 301 forward to https://ring.cx , and all the downloads seem to use https as well. Where is it using plain http? Or was the forward added in the last hour?

The links on the "Downloads" page are HTTPS, but the download button on the home page points to http://gpl.savoirfairelinux.net/ring-download/windows/ring-w... with no security.

Re: Ring, officially a GNU package

#53

Post by lima »

nextos wrote: post #15
irl_ wrote: post #10

The DHT system for identities is cool, but the thing that gets me is that they don't have support for SRTP with ZRTP, only SRTP with SDES. There's no perfect forward secrecy, and a bunch of other features that ZRTP has. https://www.silentcircle.com/products-and-solutions/technolo...

Yes, that's true. A more comparable thing to Signal is Matrix [1] and it's client Riot [2]. Theoretically, it has perfect forward secrecy. It's not as distributed as Ring is, but there is no centralized server as in Signal either. Riot is also in F-Droid. So while not a GNU member, I find it sufficiently open and free. A totally distributed approach with forward secrecy is Tox [3]. It needs a good code audit, though.…

Is it true that Matrix is based on polling? So no push?

Re: Ring, officially a GNU package

#54

Post by synchronise »

snvzz wrote: post #34

While I'm sure it's well-intended, it does have a couple of fatal flaws. * Lack of full forward secrecy means logged network logs can be decrypted in the future if an endpoint key is ever compromised. * e2e encryption is optional, due to legacy SIP support. This is extremely dangerous as it will no doubt lead to false sense of security, with users assuming they're safe just because Ring is the program they're talking…

e2e could be enforced for the DHT clients if the user states they aren't going to be using SIP though, right?

Either way, I don't use SIP so that feature isn't a dealbreaker for me.

Re: Ring, officially a GNU package

#55

Post by synchronise »

lima wrote: post #53
nextos wrote: post #15

Earlier quoted context omitted.

Yes, that's true. A more comparable thing to Signal is Matrix [1] and it's client Riot [2]. Theoretically, it has perfect forward secrecy. It's not as distributed as Ring is, but there is no centralized server as in Signal either. Riot is also in F-Droid. So while not a GNU member, I find it sufficiently open and free. A totally distributed approach with forward secrecy is Tox [3]. It needs a good code audit, though.…

Is it true that Matrix is based on polling? So no push?

Push messaging is part of the base standard in Matrix now IIRC, or it will be in the near future.

Re: Ring, officially a GNU package

#56

Post by sitkack »

snvzz wrote: post #22
qwertyuiop924 wrote: post #20

Why this over Tox, Psyc, or Matrix? There doesn't seem to be much benefit...

I hear tox has been approached before, but they were uninterested. Remember GNU requires transferring rights to the FSF, which many aren't comfortable with. I personally favor tox, because ec25519 and full forward secrecy. Also, not fond of SIP.

I have interacted with Tox core devs, the exchange was not pleasant. The overlap between professional and mature (both in social and engineering aspects) seems to very slim in the security space.

Re: Ring, officially a GNU package

#57

Post by snvzz »

synchronise wrote: post #54
snvzz wrote: post #34

While I'm sure it's well-intended, it does have a couple of fatal flaws. * Lack of full forward secrecy means logged network logs can be decrypted in the future if an endpoint key is ever compromised. * e2e encryption is optional, due to legacy SIP support. This is extremely dangerous as it will no doubt lead to false sense of security, with users assuming they're safe just because Ring is the program they're talking…

e2e could be enforced for the DHT clients if the user states they aren't going to be using SIP though, right? Either way, I don't use SIP so that feature isn't a dealbreaker for me.

> e2e could be enforced for the DHT clients if the user states they aren't going to be using SIP though, right?

That needs user intervention, which implies his understanding of why it is necessary.

Here's a better idea, remove backwards compatibility. Perhaps they could release a separate SIP client under a different name. Just keep it away from Ring itself. Let Ring be actually secure.

Re: Ring, officially a GNU package

#58

Post by qwertyuiop924 »

sitkack wrote: post #56
snvzz wrote: post #22

Earlier quoted context omitted.

I hear tox has been approached before, but they were uninterested. Remember GNU requires transferring rights to the FSF, which many aren't comfortable with. I personally favor tox, because ec25519 and full forward secrecy. Also, not fond of SIP.

I have interacted with Tox core devs, the exchange was not pleasant. The overlap between professional and mature (both in social and engineering aspects) seems to very slim in the security space.

What did you expect? You know where they come from, right?

If you don't, they come from 4chan. So yeah...

But they got accepted into GSoC as a mentor project, so they can't all be bad.

Re: Ring, officially a GNU package

#59

Post by alphapapa »

brute wrote: post #37
alpb wrote: post #33

Little bit off-topic but: > respects freedoms and privacy of its users It downloads the binary over http on http://ring.cx , makes it susceptible to tampering. Is serving binaries over HTTP a GNU thing because the expectation is that you would check the signature?

Care to elaborate? http://ring.cx has a 301 forward to https://ring.cx , and all the downloads seem to use https as well. Where is it using plain http? Or was the forward added in the last hour?

Couldn't a MitM attack skip the redirect?

Re: Ring, officially a GNU package

#60

Post by brute »

teraflop wrote: post #52
brute wrote: post #37

Earlier quoted context omitted.

Care to elaborate? http://ring.cx has a 301 forward to https://ring.cx , and all the downloads seem to use https as well. Where is it using plain http? Or was the forward added in the last hour?

The links on the "Downloads" page are HTTPS, but the download button on the home page points to http://gpl.savoirfairelinux.net/ring-download/windows/ring-w... with no security.

Thank you, that explains it. For me, the same button links to https://ring.cx/en/download/gnu-linux but under windows you are right.
Post reply on HN