Moxie Marlinspike has a plan to reclaim our privacy
newyorker.com
Moxie Marlinspike has a plan to reclaim our privacy
1–10 of 237 posts
Re: Moxie Marlinspike has a plan to reclaim our privacy
#2I was vouching for Signal for all my friends for years, supported them with donations, and was really rooting for them. However, I regrettably can't trust in moxie having the best intentions with Signal anymore. Lost count of the number of times this has been recycled on HN so I'm not taking the time to formulate this extremely well but:
* For the longest time, requires phone number as identifier. When asked to remove this restriction, the reply is "so we can bootstrap off the phone's native contact application". But Android and iOS contacts have natively supported e-mail addresses on contacts since forever? And those could be optional? Every time the conversation has gone this far with anyone involved in Signal, silence/ghosting.
* The whole PIN requirement debacle - where further amounts of metadata would be uploaded to Signal's servers (encrypted of course, with the PIN as passphrase of the key). Suddenly the app wouldn't start and users were locked out of all their Signal conversations (even reading them) without setting a PIN, no way to circumvent it. We were told this would be a strict requirement to be able to solve the above. After a lot of backlash they rolled it back after a week or so?
* Hostility towards alternative implementations.
* There's an open issue on GH for verified builds. Since 2015.
Signal may be good today. What about tomorrow? I think the only durable and realistic solution (because let's face it, pure P2P for the mainstream is not the latter) is federation.
Anyone feeling similarly should check out matrix.org. It may not be ready for the masses yet. But if we consider how we communicate in 5, 10, 20 years from now, it becomes obvious that we can't rely on a single actor as provider, regardless of how good they are today. The only way we get there is with people like the ones frequenting HN getting involved by using it, contributing, filing bugs, hosting home servers and using the clients.
Re: Moxie Marlinspike has a plan to reclaim our privacy
#3I was vouching for Signal for all my friends for years, supported them with donations, and was really rooting for them. However, I regrettably can't trust in moxie having the best intentions with Signal anymore. Lost count of the number of times this has been recycled on HN so I'm not taking the time to formulate this extremely well but: * For the longest time, requires phone number as identifier. When asked to remov…
These are all exact reasons I have never used Signal.
Additionally I find concerning the choice to bet the farm on SGX which has been repeatedly broken with repeated opportunities to extract the keys, at which point cracking small numeric pins is trivial.
Moxie simply promised they always patch right away and never take the keys when they have such opportunities to do so.
I do believe him, today, but I don't believe he is above being threatened or coerced tomorrow or that he won't get replaced by someone that cooperates better with state powers as happened with VK and countless others.
I also took issue with Signal having central network metadata chokepoints his DCs or ISP could do timing heuristics on even if he does not.
I tried to engage with Moxie about these issues but he dismissed each as things we will mostly have to accept because he feels it is not possible to create and rapidly improve a privacy focused communication tool for the masses that isn't produced and controlled by a single large company.
Moxie is brilliant, and his contributions to cryptography and bringing education on privacy and end to end encryption to millions can't be overstated.
The problem is Moxie and Signal are struggling to engineer best efforts under an assumption they treat like a law of nature: No end to end end encrypted messaging platform can succeed without complete centralization.
I operate under a different assumption: No centralized platform will ever escape censorship and control by the government it operates under.
Moxie has said before he is happy to be proven wrong.
I hope as Matrix and others continue to prove him wrong with his own cryptography research that he comes around and rejoins the fight for a decentralized internet with irrevocable privacy.
Re: Moxie Marlinspike has a plan to reclaim our privacy
#4This guy was very active during a weird campaign to bury information detrimental to WhatsApp that would have affected a US operation in Turkey (the one meant to replace Erdogan with Gulen - a friendlier theocrat).
https://www.cyberscoop.com/whatsapp-backdoor-guardian-open-l...
Re: Moxie Marlinspike has a plan to reclaim our privacy
#5Re: Moxie Marlinspike has a plan to reclaim our privacy
#6I was vouching for Signal for all my friends for years, supported them with donations, and was really rooting for them. However, I regrettably can't trust in moxie having the best intentions with Signal anymore. Lost count of the number of times this has been recycled on HN so I'm not taking the time to formulate this extremely well but: * For the longest time, requires phone number as identifier. When asked to remov…
I have some concerns around the Signal foundation:
The initial $50M in funding was a loan, not a donation, from Brian Acton to the new nonprofit Signal Technology Foundation. By the end of 2018, the loan had increased to $105,000,400, which is due to be repaid on February 28, 2068. The loan is unsecured and at 0% interest.[5]
The Foundation is completely controlled by Brian Acton, who is the sole "member" of the nonprofit, with the right to appoint or remove every member of the Board of Directors. The Board consists of Acton and Marlinspike. Acton is also the President.[5]
Re: Moxie Marlinspike has a plan to reclaim our privacy
#7Other than matrix, what are some other alternatives or upcomers in the messaging field I should try.
Matrix still has a high burden of me setting up my own server and maintaining it. Till their P2P solution doesnt release, they have their own metadata problem.
Re: Moxie Marlinspike has a plan to reclaim our privacy
#8Other than matrix, what are some other alternatives or upcomers in the messaging field I should try. Matrix still has a high burden of me setting up my own server and maintaining it. Till their P2P solution doesnt release, they have their own metadata problem.
These are all worth keeping tabs on.
Ethereum: https://status.im/
Loki: https://getsession.org/
Gun: https://iris.to/
IPFS: https://berty.tech/
Re: Moxie Marlinspike has a plan to reclaim our privacy
#9Why is it, whenever Signal is brought up on Hacker News, we get inundated with the people who object to the core decisions of the Signal Project? Would Signal really be better if, instead of having a secure messenger available to the masses, it spent massive amounts of time implementing the things these people want? No. I would be comfortable recommending Signal (or WhatsApp) to a nontechnical friend and communicating with them on it, with the expectation of a certain level of privacy. I spend a lot of time on Hacker News and consider myself a very technical person, and I'm not sure I trust myself to use Matrix in a forward-secure way where it's at right now. If everybody spent the time they spent complaining about Signal working on getting Matrix or whatever to a point where it was usable... well, frankly I don't think it'd be much better off than it is right now, but it seems more likely to bring about results to me than endlessly lobbying to have Moxie do _the thing he thinks cannot be freaking done right_. Right now, Signal exists and can be used securely (given certain common threat profiles) by the typical smartphone user. I'm really tired of people comparing the security that Signal offers to the security of imagined hypothetical messengers.
Re: Moxie Marlinspike has a plan to reclaim our privacy
#10Signal’s recent (not even yet out for many) implementation of mention-only notifications has reinvigorated my investment in them.
I am a bit more confident now that usernames will eventually come.
But the fact that it’s so slow to change is quite ironic, considering that the whole point is “the ecosystem is moving”. Well apparently it moves like molasses.