Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Ecosystem Is Moving [video]

media.ccc.de

Post reply on HN
Print view View original

71–80 of 93 posts

Re: The Ecosystem Is Moving [video]

#71

Post by mirimir »

sweden wrote: post #53

Every time I see Moxie talking about decentralization, I can't help to think that this is all a big disguised agenda used to promote his own business for selling the Signal technology to any messaging vendors (WhatsApp, Facebook, Google, etc.) He keeps bringing data privacy and data encryption as the sole motive for decentralization but that's not really the point. The main point is data ownership and freedom of usag…

Also, every Signal user is likely geolocated at at least meter accuracy.

Can one still side load Signal via adb install?

Re: The Ecosystem Is Moving [video]

#72

Post by mirimir »

pa7ch wrote: post #62
sweden wrote: post #53

Every time I see Moxie talking about decentralization, I can't help to think that this is all a big disguised agenda used to promote his own business for selling the Signal technology to any messaging vendors (WhatsApp, Facebook, Google, etc.) He keeps bringing data privacy and data encryption as the sole motive for decentralization but that's not really the point. The main point is data ownership and freedom of usag…

There are trade-offs in user experience between a centrally controlled effort and something like Matrix. If you've listened to him talk many times before, it seems almost disingenuous that you'd believe he hasn't made this choice because mass-adoption and user experience are the first priority of his design constraints. It doesn't mean your criticisms aren't valid wants in a messenger but there is a logical and publi…

> ... mass-adoption and user experience are the first priority of his design constraints.

But then you force users into a risk model where third parties (such as Google or Apple) may know everything, and users must trust them.

Re: The Ecosystem Is Moving [video]

#73

Post by mirimir »

thekyle wrote: post #5

So in the beginning of the presentation Moxie brings up some valid cases where it's good that centralized services can rapidly iterate and improve such as WhatsApp being able to roll out end-to-end encryption with a single update, while email is still not encrypted despite the tools existing to do so for years. Basically centralized services can roll out changes quickly and decentralized ones are more or less set in…

> requiring phone numbers does reduce the privacy of Signal users

Reduce? I'd say eliminate. Unless it's an ~anonymous number. Which is entirely nontrivial.

Now maybe one can say that most people don't care about privacy. But it's only fair to be straight about it.

Re: The Ecosystem Is Moving [video]

#74

Post by pa7ch »

mirimir wrote: post #72
pa7ch wrote: post #62

Earlier quoted context omitted.

There are trade-offs in user experience between a centrally controlled effort and something like Matrix. If you've listened to him talk many times before, it seems almost disingenuous that you'd believe he hasn't made this choice because mass-adoption and user experience are the first priority of his design constraints. It doesn't mean your criticisms aren't valid wants in a messenger but there is a logical and publi…

> ... mass-adoption and user experience are the first priority of his design constraints. But then you force users into a risk model where third parties (such as Google or Apple) may know everything, and users must trust them.

My point is not that you must agree with Moxie's design choices. Just that there are inherently complex trade-offs involved and Moxie makes choices focused around mass adoption and not for selling the protocol to big companies.

Also, i'm not sure what you mean by third parties knowing "everything" since Signal provides E2E encryption of content and pretty good social graph protection. For existing users of Android and IOS (target market) I'm not sure what extra trust or knowledge Signal users must give to Apple/Google other then the fact that the user does use Signal.

Re: The Ecosystem Is Moving [video]

#75

Post by dvdgsng »

Arathorn wrote: post #41
saurik wrote: post #8

Earlier quoted context omitted.

He definitely states for each of his points that the people working on decentralized systems are misguided because decentralization doesn't automatically solve these hard problems; and while his thesis is what you state--that solving these problems is easier as a centralized system because you are more agile--other than a few awkward straw positions (many of which I addressed, and which aren't even really arguments b…

> (something the people behind Matrix actually admit in some of their internal talks) Actually, we've been quite clear publicly that Matrix's initial incarnation didn't try to deal with metadata privacy, e.g. this presentation taken from a 2015 talk at the Jardin Entropique cryptography conference in Rennes: https://matrix.org/~matthew/2016-12-22%20Matrix%20Balancing%... The fun thing is these days we've got to the p…

> It feels like we (as Matrix) should do a formal response

please do!

Re: The Ecosystem Is Moving [video]

#76

Post by mirimir »

pa7ch wrote: post #74
mirimir wrote: post #72

Earlier quoted context omitted.

> ... mass-adoption and user experience are the first priority of his design constraints. But then you force users into a risk model where third parties (such as Google or Apple) may know everything, and users must trust them.

My point is not that you must agree with Moxie's design choices. Just that there are inherently complex trade-offs involved and Moxie makes choices focused around mass adoption and not for selling the protocol to big companies. Also, i'm not sure what you mean by third parties knowing "everything" since Signal provides E2E encryption of content and pretty good social graph protection. For existing users of Android an…

Users typically don't have root on Android or iOS. How do we know that Google/Android (or maybe telco) aren't obtaining plaintext before encryption?

I'm not arguing that they're doing that. Just that the risk model depends on trusting them not to do it.

And if there is compelling evidence that they can't do it, I'd love some cites.

Also, Signal accounts are tied to telephone numbers. And it's well known that phones by default accurately know their locations. So any app with adequate permissions knows the device's location. And location privacy depends entirely on software settings.

Re: The Ecosystem Is Moving [video]

#77

Post by sweden »

pa7ch wrote: post #62
sweden wrote: post #53

Every time I see Moxie talking about decentralization, I can't help to think that this is all a big disguised agenda used to promote his own business for selling the Signal technology to any messaging vendors (WhatsApp, Facebook, Google, etc.) He keeps bringing data privacy and data encryption as the sole motive for decentralization but that's not really the point. The main point is data ownership and freedom of usag…

There are trade-offs in user experience between a centrally controlled effort and something like Matrix. If you've listened to him talk many times before, it seems almost disingenuous that you'd believe he hasn't made this choice because mass-adoption and user experience are the first priority of his design constraints. It doesn't mean your criticisms aren't valid wants in a messenger but there is a logical and publi…

It seems to me that these design constraints are more to their benefit than to the benefit of the users because it simplifies a lot the maintenance of their infrastructure:

- By relying purely on phone numbers for user accounts, they remove a good chunk of infrastructure for having to deal with problems with logging in or missing passwords or stealing accounts.

- And by relying on Google Play Services, they avoid having to maintain a push notification infrastructure.

And I'm okay with this! It's smart and effective but I just wish he would be open and honest about it and not spread FUD about decentralization and other alternatives as an attempt to justify Signal's design decisions and make it look like "the only true way of messaging securely".

When he was asked by the public during his talk about the phone numbers, he went a long way to give an answer that didn't really answer the question. It was almost like a politician trying to justify an ulterior decision.

He is a salesman, a very good salesman. A good part of his presentation was not even about the "ecosystem", he just was wandering off-topic walking the public through his point of view. You could see this when he started to sneakily dismiss decentralization with saying "I host my own email" basically saying "So I am an authority on everything about decentralization".

Re: The Ecosystem Is Moving [video]

#78

Post by mirimir »

saurik wrote: post #3

In this video, Moxie Marlinspike--the developer of Signal, someone who has been consistently extremely negative on not just the idea of federated and decentralized systems but of open protocols and alternative clients for centralized systems (to the point where it shocks me he still does any development as open source, given how hard he pushes on the idea that people who fork his clients are actively doing something…

Great post. I totally agree.

I totally don't get the phone number obsession.

All you need is a seed phrase that generates a key.

Re: The Ecosystem Is Moving [video]

#79

Post by cyphar »

j88439h84 wrote: post #69
cyphar wrote: post #33

Earlier quoted context omitted.

Signal is also the protocol, and there is only one official Signal client for each platform (and Moxie has been incredibly aggressive towards any alternative clients -- threatening trademark lawsuits in some cases, or just blocking the clients from their network). Matrix, on the other hand, is an open protocol which has many clients (of which Riot is the most popular). This would be like calling all of email "GMail"…

> Signal is also the protocol Yes but I was referring to the clients.

Sure, but you can't communicate with someone using just a client. As I said, it would be like referring to email as "Outlook" or "GMail". To compare Signal and Matrix, you'd be comparing the entire ecosystem (both the clients and protocols).

Re: The Ecosystem Is Moving [video]

#80

Post by ekianjo »

cyphar wrote: post #31
ekianjo wrote: post #24

Earlier quoted context omitted.

Nothing prevents you from not using Gmail.

If any of the people you are communicating with are using an email provider that they don't personally host, then the problem is exactly the same. In fact, arguably a better comparison to E2EE is that they have to host an email server on each of their devices (which precisely zero people do).

Not at all. As long as your keys to decrypt messages are on your device only, the body of the message will be gibberish for your email host. You could argue that metadata is in jeopardy since the email recipient is not obfuscated but that is the same thing with Signal where you rely on a central server with phone numbers connecting people to each other's.
Post reply on HN