Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted messengers: Riot, not Signal, is the future

titus-stahl.de

Post reply on HN
Print view View original

71–80 of 178 posts

Re: Encrypted messengers: Riot, not Signal, is the future

#71

Post by widforss »

mxuribe wrote: post #50

Nothing against Signal, But I sure hope matrix-based platforms and clients (like riot.im) keeping growing. The folks who work on both matrix.org and riot.im have done so much work in such a short time...not just in developing the protocol/server/apps...but also in education. They really have helped people like me to setup our own little home servers (i.e. private networks)...which ultimately helps the entire federate…

> Signal - while certainly can be setup/hosted by anyone else separate of OpenWhisper - leaves some to be desired in the actual self-implementation details; just not enough tutorials out there.

That is the problem at hand, that Signal _does_not_federate_. You could modify your Signal app to connect to your own server, but then you would not be able to talk to anybody else.

For the record I prefer usability and walled-garden-security instead of federation, even though it hurts to admit as a long time FOSS user.

Re: Encrypted messengers: Riot, not Signal, is the future

#72

Post by no_protocol »

acqq wrote: post #11

> Riot is based on the so-called Matrix protocol which is a federated protocol > In addition, people are writing alternative clients to access the Matrix/Riot network, implementing their favorite features and workflows. As users can vote with their feet for their own interests and choose providers and apps of their liking Can I run my own network which is not part of other networks (i.e. not "federated")? Can I tell…

Yes, I set up my own Synapse server and connected to it from the official Riot app on phone and web. Worked fine. Also connected with another Matrix client and that also worked.

Re: Encrypted messengers: Riot, not Signal, is the future

#73

Post by voltagex_ »

ajamesm wrote: post #67
stonogo wrote: post #57

Earlier quoted context omitted.

> You can run your own private Signal service A distinction without a difference. I use Signal because people use Signal. People do not use 'the Signal service'. They use OWS's app and OWS's servers and moxie has explained he will not federate. The fact that OWS goes to all the effort of creating this excellent protocol, and then insists on only deploying it to insecure devices (with direct-memory-access baseband rad…

I'm not a fan of opaque baseband firmwares either, don't get me wrong, but what's the alternative? Not for the DoD, I mean for union organizers making $50k a year -- people who aren't going to get murdered by Mossad, but still need to authenticate and encrypt their communication channels. What device would you recommend?

Who's the likely threat to union organisers? I suspect a pair-locked iPhone with Signal or Whatsapp would be more than secure enough.

Re: Encrypted messengers: Riot, not Signal, is the future

#74

Post by ajamesm »

voltagex_ wrote: post #73
ajamesm wrote: post #67

Earlier quoted context omitted.

I'm not a fan of opaque baseband firmwares either, don't get me wrong, but what's the alternative? Not for the DoD, I mean for union organizers making $50k a year -- people who aren't going to get murdered by Mossad, but still need to authenticate and encrypt their communication channels. What device would you recommend?

Who's the likely threat to union organisers? I suspect a pair-locked iPhone with Signal or Whatsapp would be more than secure enough.

The most prominent example would be https://en.wikipedia.org/wiki/Jimmy_Hoffa

and then the long, storied history of American strike-breaking &c.

Re: Encrypted messengers: Riot, not Signal, is the future

#75

Post by tptacek »

Sir_Cmpwn wrote: post #70
floatboth wrote: post #66

Earlier quoted context omitted.

MicroG does implement the GCM client! I've been getting push notifications through that thing for several months.

Through Google, yes, but you can't bring along your own push notification delivery service.

Your argument has become circular, because the what Signal uses push notifications for isn't security-relevant: the messages are empty and used only as a wakeup.

Re: Encrypted messengers: Riot, not Signal, is the future

#76

Post by Forbo »

stephengillie wrote: post #45
Forbo wrote: post #43

Earlier quoted context omitted.

The developers have feature justifications for every permission requested: https://support.whispersystems.org/hc/en-us/articles/2125358... Edit: Reading your link now, as I didn't see it before I made my comment. Was that added in as an edit?

These are the justifications of developers who are unfamiliar with the Intent system. Were I unaware of Intent, I would make the same design decisions.

Are intents the same as the run-time permissions? I might still be misunderstanding, but I think they have an issue open for this already: https://github.com/WhisperSystems/Signal-Android/issues/3983

Re: Encrypted messengers: Riot, not Signal, is the future

#77

Post by Perceptes »

It should be noted that Riot is just the first Matrix client to support end-to-end encryption, but there will be more in the future. The thing you want to bet on is the Matrix protocol, not necessarily Riot. (Although both are a safe bet since Riot is developed by the same team that built Matrix.)

I'm not part of the Matrix or Riot teams, but I'm convinced enough that Matrix is a great way forward for modern messaging. I started my own Matrix homeserver (as well as other Matrix libraries, eventually to include a Matrix client) written in Rust. If you're interested in Matrix, Rust, or both, I encourage you to get involved! https://www.ruma.io/

Re: Encrypted messengers: Riot, not Signal, is the future

#78

Post by meredydd »

zimbatm wrote: post #33
tptacek wrote: post #9

This topic has been beaten to death on HN over the last year (other people can provide links to discussions, with Moxie participating). I think something worth keeping in mind is that almost everyone who works in secure messaging agrees on one thing: that electronic mail is not the future of secure communication. There's no fundamental reason why that should be the case. The store-and-forward model used by SMTP could…

If browsers are able to deprecate old encryption layers I don't see a reason why matrix client wouldn't be able to do the same. And as with browsers, if the clients or servers don't get upgraded then at some point they will stop working.

That is only possible at all because web browsers are an oligopoly. There are only four organisations whose opinions matter, so they can coordinate to make breaking changes. (Even so, SHA1 deprecation is happening 1000x slower than, say, Whatsapp's rollout of E2E encryption.)

This level of oligopoly would not be tolerable to those who want to federate Signal-like apps. The whole point is to make it practical to use a small operator that's not such an easy target for one government's intervention (eg an NSL). But that ecosystem looks much more like email than web browsing - diverse, but fragmented, and impossible to upgrade in this way.

Re: Encrypted messengers: Riot, not Signal, is the future

#79

Post by Sir_Cmpwn »

tptacek wrote: post #75
Sir_Cmpwn wrote: post #70

Earlier quoted context omitted.

Through Google, yes, but you can't bring along your own push notification delivery service.

Your argument has become circular, because the what Signal uses push notifications for isn't security-relevant: the messages are empty and used only as a wakeup.

They still contain information, though. They say when you're talking on Signal. Matched with someone else's messages at about the right frequency to indicate a conversation, they give a pretty decent idea of who you're talking to.
Post reply on HN