Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

matrix.org

Post reply on HN
Print view View original

81–90 of 204 posts

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#81

Post by Arathorn »

giggles_giggles wrote: post #76
j4pe wrote: post #57

I had to roll my own chat system recently because the open source solutions out there were surprisingly insufficient - nothing seems to support websockets. Looking forward to the French contributions to the ecosystem! For instance: at the moment Matrix server implementations expect clients like Riot to long-poll for JSON about each room/chat they're connected to. Alternatives like Prosody's XMPP server implementation…

Rocket Chat supports WebSockets. They don't advertise it very well, but if you look at the nginx config under the manual installation, you'll see that the 'upgrade' header is added when using nginx as a reverse proxy, presumably for ws support. Also, they have an experimental realtime API that uses WS and it looks like it's just the API that is still experimental, while WS are already in use for the regular desktop a…

Matrix also supports WS actually but nobody bothers with it: https://github.com/matrix-org/matrix-doc/blob/master/drafts/...

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#82

Post by marknadal »

Congrats Matrix team! That is huge.

Competitor here, few questions:

- You guys are currently implementing federated protocols, right? We do P2P protocols, I'm curious why you guys chose federated - why do you think it is better?

- How are you guys different than Signal? Obviously way different than Telegram, as it isn't even Open Source (thanks for Open Sourcing your work!).

- When I was working on our E2EE private messaging app (ugly demo here: https://twitter.com/marknadal/status/989602258638684160 ), I ran into problems about metadata. Stuff like, do you guys reveal which public keys are talking to which other public keys? And the frequency of those conversations? Or do you encrypt that information as well (and if you do, how do you handle discovery then, and is it vulnerable to network frequency analysis attacks?)

Awesome work, congrats again, keep it up! Curious to hear more about your architecture.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#84

Post by Jaepa »

kuwze wrote: post #70

It's sort of ironic considering France's history with Minitel[0] and encryption[1]. [0]: https://en.wikipedia.org/wiki/Minitel [1]: https://www.forbes.com/forbes/1997/1201/6012058a.html#75b6a6... Specifically from [1] is the line: "Its illegal in France to encrypt any communication in any way unless you have permission from the government. How is electronic commerce going to get off the ground in such a society? Good…

The US used to regulate "exports" of cryptography under the U.S. Munitions List. Some of the restrictions still remain, but most of them were gradually relaxed in until 2000.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#85

Post by forty »

majewsky wrote: post #63
Jaepa wrote: post #52

Earlier quoted context omitted.

I have no clue what you are trying to ask, sorry. Could you clarify? Do you mean IP lawsuit's against Matrix itself?

I guess grandparent means how Google (and later Slack) initially supported XMPP in their chat products, then disabled the XMPP gateway once their userbase was significantly large that most conversations were inside their own bubble. There's not much that Matrix can do to defend against that, except for strategic marketing with the purpose of achieving a large distributed userbase. If Gmail had existed in 1990, we wou…

Isn't that what is slowly happening? My understanding is that it's becoming harder and harder to send email to a Gmail address of you are not yourself using Gmail (without being tagged as spam/junk I mean)

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#86

Post by Jaepa »

riazrizvi wrote: post #77
kuwze wrote: post #70

It's sort of ironic considering France's history with Minitel[0] and encryption[1]. [0]: https://en.wikipedia.org/wiki/Minitel [1]: https://www.forbes.com/forbes/1997/1201/6012058a.html#75b6a6... Specifically from [1] is the line: "Its illegal in France to encrypt any communication in any way unless you have permission from the government. How is electronic commerce going to get off the ground in such a society? Good…

It's pretty common. Almost all EU governments reserve the right to decrypt encrypted communications by law, also India, Russia, China, Australia. Here's a map https://www.gp-digital.org/world-map-of-encryption/ , click 'Powers to intercept...'

I've always wondered about that. The law says

    Criminal Procedure Code: Article 230, modified by Law No. 2001-1062 
    and Law No. 2014-1353 requires the disclosure of encryption keys upon 
    the authorization of a judge.
So what happens if the connection uses diffie-hellman or double ratchet (as Matrix can use)? the intermediate doesn't have any useful keys to turn over.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#87

Post by sli »

Arathorn wrote: post #25
rb808 wrote: post #21

I tried matrix/riot out, looks perfect for me and app is slick. Sending messages though from a server to a room was more difficult than I expected. Java SDK didn't build and many of the other languages were alpha too. Go seemed favored but I dont really want to install. Is there a recommended simple command line app or script to send messages?

curl? O:-) Matrix is intended to be simple enough that you don’t even need an SDK unless you really want one. which java sdk did you try?

> Matrix is intended to be simple enough that you don’t even need an SDK unless you really want one.

Huh. So Haskell + Servant might be really nice for writing a client, then, yeah?

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#88

Post by superkuh »

pmlnr wrote: post #65
foobarbazetc wrote: post #35

Don’t suppose anyone knows why the Signal protocol wasn’t chosen?

Because when you build something like this, you shouldn't: - requiere a phone - build on s3 & a lot of other services without the option of a self hosted alternative. Look up the signal server requirements.

Yup. Signal sounds great but I can't use it because I don't have (or want) a smartphone with a phone number. I use Matrix clients instead.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#89

Post by Jaepa »

forty wrote: post #85
majewsky wrote: post #63

Earlier quoted context omitted.

I guess grandparent means how Google (and later Slack) initially supported XMPP in their chat products, then disabled the XMPP gateway once their userbase was significantly large that most conversations were inside their own bubble. There's not much that Matrix can do to defend against that, except for strategic marketing with the purpose of achieving a large distributed userbase. If Gmail had existed in 1990, we wou…

Isn't that what is slowly happening? My understanding is that it's becoming harder and harder to send email to a Gmail address of you are not yourself using Gmail (without being tagged as spam/junk I mean)

It's still federated, its just harder to federate your own instance. It is still totally doable you just have to jump through the hoops of setting up SPF, DKIM, and DMARC.

Re: Matrix and Riot Confirmed as the Basis for France’s Secure Instant Messenger App

#90

Post by snthd »

lucb1e wrote: post #28
hoschicz wrote: post #23

Earlier quoted context omitted.

Do you feel like WhatsApp is not polished?

If polish is broadly defined as "something that was hitherto still missing in (claimed-to-be) end to end encrypted chat applications", then open source and a decent profit model are definitely features lacking from WhatsApp. Telegram is open source, but one has to consciously turn on encryption and it doesn't work on the web or desktop clients (and the profit model is non-existent). Signal doesn't work without Google…

>Signal doesn't work without Google services

Not true, it has a websockets alternative to gcm.

>and requires a phone number

The phone number can be anything you control.

>and turned-on phone iirc

Yes

>(and their profit model seems to be extorting companies like Wire and helping closed source software like Whatsapp advertise with Signal-level encryption).

It (now) has its own nonprofit backing it (and a generous benefactor). It's not trying to be profitable.

The "extortion" thing seems to have been about wire using signal code in breach of copyright (ie not complying with the open source license).

Signal has stated that the goal of working with WhatsApp (and others) is to make good crypto be used as widely as possible. Matrix crypto is also based on what's used in signal.

>Wire is the best of all, but the Android app drains battery and everything is web

Signal is very polished (at least on Android - I'm not familiar with the ios app).

Post reply on HN