4 ms·

I'm seeing "No e2e encrypted DMs" as one of the cons for most of these.. anyone have a solution?

zokier 11y ago
For the usecase I see these to be useful, I don't see lack of e2e such a huge concern. I would assume that in most cases the server would be more or less trusted in the context they are used in, so TLS style client-server security would be adequate. In other words, if I really wanted to have discussion secret enough to warrant e2e I probably wouldn't be using company/project chat for that no matter what sort of promises it gives. That being said, of course e2e chat would be beneficial addition, and might help especially in larger enterprise deployments.
- squidlogic 11y ago
  For less important things, I agree, run of the mill TLS is enough. But for things that are critical to the business, trade secrets, strategy, SWOT analysis of a recent breach, etc, I think every company should have an e2ee chat/file sharing app in their toolkit.
- meowface 11y ago
  >if I really wanted to have discussion secret enough to warrant e2e I probably wouldn't be using company/project chat for that no matter what sort of promises it gives. Why not, though? Assuming logging is disabled by both parties and the E2E is working as intended, you have something that's almost as secure as in-person conversation. The only weakness is if someone has malware actively on their machine recording the conversation as it's occurring... but then you also have many other issues.
itistoday2 11y ago
Rocket.Chat does have an open issue with discussion about this: https://github.com/RocketChat/Rocket.Chat/issues/36 https://github.com/RocketChat/Rocket.Chat/issues/36
bitstacker 11y ago
The ones that support XMPP can probably have an OTR plugin built for them. Might be able to develop an Axolotl plugin too.
heavenlyhash 11y ago
The matrix[1] team is working on an axolotl implementation meant to be used pluggably: https://matrix.org/git/olm/ https://matrix.org/git/olm/ --- [1] https://matrix.org/ https://matrix.org/
- lmm 11y ago
  I searched for axolotl and got some cute pictures but not much information. Why this thing rather than OTR?
  - Arathorn 11y ago
    OTR has some major shortcomings - in the classic implementation, it doesn't do group chat and it requires both parties to be online at the same time to synchronise the cryptographic ratchet. The best explanation of why Axolotl is better is https://whispersystems.org/blog/advanced-ratcheting https://whispersystems.org/blog/advanced-ratcheting - or if you prefer a more comprehensive spec, we've published one at https://matrix.org/docs/spec/olm.html https://matrix.org/docs/spec/olm.html. Anyone wanting to know more about Olm & Matrix's Axolotl support might be interested to flip to the end of https://matrix.org/~matthew/2015-06-26%20Matrix%20Jardin%20Entropique.pdf https://matrix.org/~matthew/2015-06-26%20Matrix%20Jardin%20E... (p.s. hi!)
    - lmm 11y ago
      Hi indeed. Are there any plans for formal standardisation, review or the like? The docs look cool but at this point I'm suspicious of any single-vendor cryptography.
      - Arathorn 11y ago
        yup, we will get it properly reviewed once complete.
squidlogic 11y ago
Maybe give balboa.io a try, it's the closest I can think of. Not just DMs but also file storage and transfer. Kind of similar UI to slack. Also, peerio.com, but they don't have a 'channels-like' interface, so maybe not what you're looking for.
newman314 11y ago
Does Slack even have e2e encryption?
derefr 11y ago
There's just an inherent conflict there, because your DMs are indexed+searchable just like any other message, and really, you want them that way. The only obvious solution, right now, is running your own private server if you want private indexes. But the One True Way to solve this problem, in the fullness of time, is for every enterprise to run their own little PaaS with a standard API, and for SaaS providers to launch their app instances into the enterprise's PaaS using that API. This would be the cloud equivalent of the SaaS-provider selling the enterprise an "appliance" they can keep within their data-center. The enterprise gets full control of the data: their PaaS can be set up to not allow the SaaS-provider any way to exfiltrate the data the app creates, to determine rollout schedule for new app versions, etc. (And note that when I say "enterprise", I could just as well mean that any individual user could own their own completely-automated black-box micro-PaaS, living "across" various IaaS providers and migrating to new ones as necessary, brought into existence for them by the first SaaS vendor to try launching something into it. Effectively, the ultimate evolution of a personal VPS, providing you with a "management interface" that looks like a cross between Heroku's dashboard and the Windows "Programs and Features" pane.)

For the usecase I see these to be useful, I don't see lack of e2e such a huge concern. I would assume that in most cases the server would be more or less trusted in the context they are used in, so TLS style client-server security would be adequate. In other words, if I really wanted to have discussion secret enough to warrant e2e I probably wouldn't be using company/project chat for that no matter what sort of promises it gives. That being said, of course e2e chat would be beneficial addition, and might help especially in larger enterprise deployments.

squidlogic 11y ago
For less important things, I agree, run of the mill TLS is enough. But for things that are critical to the business, trade secrets, strategy, SWOT analysis of a recent breach, etc, I think every company should have an e2ee chat/file sharing app in their toolkit.
meowface 11y ago
>if I really wanted to have discussion secret enough to warrant e2e I probably wouldn't be using company/project chat for that no matter what sort of promises it gives. Why not, though? Assuming logging is disabled by both parties and the E2E is working as intended, you have something that's almost as secure as in-person conversation. The only weakness is if someone has malware actively on their machine recording the conversation as it's occurring... but then you also have many other issues.

itistoday2 11y ago

Rocket.Chat does have an open issue with discussion about this: https://github.com/RocketChat/Rocket.Chat/issues/36 https://github.com/RocketChat/Rocket.Chat/issues/36

bitstacker 11y ago

The ones that support XMPP can probably have an OTR plugin built for them. Might be able to develop an Axolotl plugin too.

heavenlyhash 11y ago

The matrix[1] team is working on an axolotl implementation meant to be used pluggably: https://matrix.org/git/olm/ https://matrix.org/git/olm/ --- [1] https://matrix.org/ https://matrix.org/

lmm 11y ago
I searched for axolotl and got some cute pictures but not much information. Why this thing rather than OTR?
- Arathorn 11y ago
  OTR has some major shortcomings - in the classic implementation, it doesn't do group chat and it requires both parties to be online at the same time to synchronise the cryptographic ratchet. The best explanation of why Axolotl is better is https://whispersystems.org/blog/advanced-ratcheting https://whispersystems.org/blog/advanced-ratcheting - or if you prefer a more comprehensive spec, we've published one at https://matrix.org/docs/spec/olm.html https://matrix.org/docs/spec/olm.html. Anyone wanting to know more about Olm & Matrix's Axolotl support might be interested to flip to the end of https://matrix.org/~matthew/2015-06-26%20Matrix%20Jardin%20Entropique.pdf https://matrix.org/~matthew/2015-06-26%20Matrix%20Jardin%20E... (p.s. hi!)
  - lmm 11y ago
    Hi indeed. Are there any plans for formal standardisation, review or the like? The docs look cool but at this point I'm suspicious of any single-vendor cryptography.
    - Arathorn 11y ago
      yup, we will get it properly reviewed once complete.

squidlogic 11y ago

Maybe give balboa.io a try, it's the closest I can think of. Not just DMs but also file storage and transfer. Kind of similar UI to slack. Also, peerio.com, but they don't have a 'channels-like' interface, so maybe not what you're looking for.

newman314 11y ago

Does Slack even have e2e encryption?

derefr 11y ago

There's just an inherent conflict there, because your DMs are indexed+searchable just like any other message, and really, you want them that way. The only obvious solution, right now, is running your own private server if you want private indexes. But the One True Way to solve this problem, in the fullness of time, is for every enterprise to run their own little PaaS with a standard API, and for SaaS providers to launch their app instances into the enterprise's PaaS using that API. This would be the cloud equivalent of the SaaS-provider selling the enterprise an "appliance" they can keep within their data-center. The enterprise gets full control of the data: their PaaS can be set up to not allow the SaaS-provider any way to exfiltrate the data the app creates, to determine rollout schedule for new app versions, etc. (And note that when I say "enterprise", I could just as well mean that any individual user could own their own completely-automated black-box micro-PaaS, living "across" various IaaS providers and migrating to new ones as necessary, brought into existence for them by the first SaaS vendor to try launching something into it. Effectively, the ultimate evolution of a personal VPS, providing you with a "management interface" that looks like a cross between Heroku's dashboard and the Windows "Programs and Features" pane.)