Live data from Hacker News

The Ecosystem Is Moving [video]

media.ccc.de

81–90 of 93 posts

Re: The Ecosystem Is Moving [video]

#81
post #80
post #31

Earlier quoted context omitted.

If any of the people you are communicating with are using an email provider that they don't personally host, then the problem is exactly the same. In fact, arguably a better comparison to E2EE is that they have to host an email server on each of their devices (which precisely zero people do).

Not at all. As long as your keys to decrypt messages are on your device only, the body of the message will be gibberish for your email host. You could argue that metadata is in jeopardy since the email recipient is not obfuscated but that is the same thing with Signal where you rely on a central server with phone numbers connecting people to each other's.

> As long as your keys to decrypt messages are on your device only, the body of the message will be gibberish for your email host.

The original comment didn't imply usage of PGP. They asked whether messages being encrypted between mail hosts counted as E2EE -- and remember that the number of email users who also use PGP is close to 0%.

But with PGP, sure -- though PGP has many other problems which make it a questionable choice unless you are forced to use email for some other reason:

* Most email clients don't know how to use it and will often allow you to accidentally reply to an encrypted email with clear-text. This comes back to "every single one of the recipients of your email needs to actively know how to use it correctly".

* PGP doesn't have perfect forward secrecy (instead depending on long-lived keys) which means your entire conversation history is threatened if your keys ever become compromised.

* Most PGP implementations are not using properly-authenticated cryptography (yeah, there's the MDC but Efail showed that there were serious bugs in its design -- and backwards compatibility made it bypassable). OpenPGP still hasn't standardised AEAD.

Re: The Ecosystem Is Moving [video]

#82
post #5

So in the beginning of the presentation Moxie brings up some valid cases where it's good that centralized services can rapidly iterate and improve such as WhatsApp being able to roll out end-to-end encryption with a single update, while email is still not encrypted despite the tools existing to do so for years. Basically centralized services can roll out changes quickly and decentralized ones are more or less set in…

> "Although I agree that requiring phone numbers does reduce the privacy of Signal users, I think it is a worthwhile trade off for making the app usable by the public."

My phone service is data-only. Requiring I have a legacy communication service like a phone number makes the service unusable by me and I'm sure I'm not the only one.

Re: The Ecosystem Is Moving [video]

#83
post #71
post #53

Every time I see Moxie talking about decentralization, I can't help to think that this is all a big disguised agenda used to promote his own business for selling the Signal technology to any messaging vendors (WhatsApp, Facebook, Google, etc.) He keeps bringing data privacy and data encryption as the sole motive for decentralization but that's not really the point. The main point is data ownership and freedom of usag…

Also, every Signal user is likely geolocated at at least meter accuracy. Can one still side load Signal via adb install?

> Can one still side load Signal via adb install?

Yes, you can download the APK from the Signal website (https://signal.org/android/apk/) and install it with adb. If you have trust issues then you should think about compiling the source code yourself—it's very easy in Android Studio—and installing with adb.

Re: The Ecosystem Is Moving [video]

#84
post #63
post #42

Link is dead now. 404

Does anyone know why it was removed? It was removed from Youtube too.

Yeah I'm also wondering what happened... I was going to share the CCC page with friends, but the talk is missing from the 363C list (https://media.ccc.de/c/36c3). Feels weird sending around backup mirrors...

Re: The Ecosystem Is Moving [video]

#85
post #38
post #6

Earlier quoted context omitted.

> because decentralization doesn't _automatically and inherently_ solve hard problems _merely due to the technology being decentralized_, we should not waste time working on decentralized systems and instead work on and support centralized ones (one would imagine, particularly his) That is an extraordinary mischaracterization of his talk. What he actually says is that decentralization makes many desirable characteris…

The talk can be taken in two ways. 1) It's a reasonable comparison of centralised and decentralised systems. 2) It's a way to discredit decentralised systems so people move to Signal because Moxie is a corporate / government shill or want to be the personal Jesus or something. Which explanation looks more likely to someone, is mostly based on how they personally trust Moxie. And a lot of people in the community don't…

> And a lot of people in the community don't consider Moxie trustworthy.

What gives you that impression? I've heard many cryptographers say a good first step is to "just trust moxie and install his stuff". He's certainly better regarded than Pavel Durov (Telegram).

Re: The Ecosystem Is Moving [video]

#86
post #53

Every time I see Moxie talking about decentralization, I can't help to think that this is all a big disguised agenda used to promote his own business for selling the Signal technology to any messaging vendors (WhatsApp, Facebook, Google, etc.) He keeps bringing data privacy and data encryption as the sole motive for decentralization but that's not really the point. The main point is data ownership and freedom of usag…

> - We are also required to have Google Play services installed on our Android phones

FYI: You can download the Signal apk from their homepage.

Re: The Ecosystem Is Moving [video]

#87
post #73
post #5

So in the beginning of the presentation Moxie brings up some valid cases where it's good that centralized services can rapidly iterate and improve such as WhatsApp being able to roll out end-to-end encryption with a single update, while email is still not encrypted despite the tools existing to do so for years. Basically centralized services can roll out changes quickly and decentralized ones are more or less set in…

> requiring phone numbers does reduce the privacy of Signal users Reduce? I'd say eliminate. Unless it's an ~anonymous number. Which is entirely nontrivial. Now maybe one can say that most people don't care about privacy. But it's only fair to be straight about it.

Privacy and anonymity are not the same thing.

Re: The Ecosystem Is Moving [video]

#88
post #77
post #62

Earlier quoted context omitted.

There are trade-offs in user experience between a centrally controlled effort and something like Matrix. If you've listened to him talk many times before, it seems almost disingenuous that you'd believe he hasn't made this choice because mass-adoption and user experience are the first priority of his design constraints. It doesn't mean your criticisms aren't valid wants in a messenger but there is a logical and publi…

It seems to me that these design constraints are more to their benefit than to the benefit of the users because it simplifies a lot the maintenance of their infrastructure: - By relying purely on phone numbers for user accounts, they remove a good chunk of infrastructure for having to deal with problems with logging in or missing passwords or stealing accounts. - And by relying on Google Play Services, they avoid hav…

> - And by relying on Google Play Services, they avoid having to maintain a push notification infrastructure.

It was mentioned in a sibling comment to GP, but Play Services are no longer required. If you don't have them installed, Signal will use its own push notification infrastructure.

Indeed, this was not always possible, because they had to implement and maintain it first, in a way that would provide a good user experience for users. (And even then, the non-Play Services version is still somewhat detrimental to the user in the sense that their battery depletes more quickly, so it's a trade-off they'll have to make themselves now.)

Re: The Ecosystem Is Moving [video]

#89

Its funny how he mentions domain fronting as a technique to counteract censorship, and even uses Google as an example, while in fact Google (and also AWS) banned them from doing domain fronting a long time ago... https://signal.org/blog/looking-back-on-the-front/

domain fronting is also something that you can do with any service, it does not require centralization. You can still use it on top of the censorship advantages decentralization gives you.

Re: The Ecosystem Is Moving [video]

#90
post #3

In this video, Moxie Marlinspike--the developer of Signal, someone who has been consistently extremely negative on not just the idea of federated and decentralized systems but of open protocols and alternative clients for centralized systems (to the point where it shocks me he still does any development as open source, given how hard he pushes on the idea that people who fork his clients are actively doing something…

The decentralized pockets of internet we used to know and love are rapidly disappearing. The new ones that get created are selling out or shutting down. There's no society wide impetus for that diversification anymore. We are all going to be locutus of borg whether we like it or not because the money is in building institutions now. The monetization of the web went from services fees to advertising supported to subsc…

I agree with you and it is sad. The most depressing thing is that people, by and large, don't really care. They don't want to pay even $1 a month and would rather sell their privacy if it makes it free. VC funded companies are selling out to FAANG because it is too hard to build a revenue model. SMS is free today, few people will pay for private SMS. The same holds for email.
Post reply on HN