6 ms·

Please Stop Writing Secure Messaging Tools

69 points by zurn 11y ago

mempko 11y ago
We need to make secure p2p messaging easy so we can focus on building the other software. I am building yet another secure messaging tool called Firestr (http://firestr.com http://firestr.com and https://github.com/mempko/firestr https://github.com/mempko/firestr). Except it is designed to be a platform for building all that other software. Has a built in application editor and application distribution system. I have already built file transfer, voice chat, white boarding, and game examples. I want p2p distributed software to be EASIER to write than client/server. The execution might not be ideal and it is a very small project, but I hope the idea catches on and inspires something better.
- Pharaoh2 11y ago
  https://xkcd.com/927/ https://xkcd.com/927/
  - mempko 11y ago
    Haha, Yes! I hate competition with a passion. For example, who the hell cares about my p2p protocol? I don't, which is why I will use GNUnet in a future version. I wrote my own to learn and don't feel the need to compete with much better works.
- lmm 11y ago
  Sounds similar to GNUNet - did you look at that / consider being compatible with their protocol?
  - mempko 11y ago
    Yes! My p2p protocol is a throwaway and the goal is to use GNUNet long term. The apps built on top have no idea about the protocol.
- vmateixeira 11y ago
  Great idea! "I want p2p distributed software to be EASIER to write than client/server" Totally agree.
  - raverbashing 11y ago
    This is like saying "I want heavier things to be easier to lift"
    - Xylakant 11y ago
      That desire lead to the invention of levers and pulleys. In the end, the don't save work, but they make things easier to lift.
      - raverbashing 11y ago
        Yes, but it is still harder to lift than something light
    - vmateixeira 11y ago
      My point is that nowadays there is a focus on writing for a client/server arch, other than any other. As a result, you get lots of open-sourced frameworks/libraries. The same doesn't happen with p2p. In my opinion, as we are having more powerful clients coming out everyday (more processing speed, more memory, etc) perhaps there should be an investment as well on trying to get something more out of that power other than rendering heavy client UIs.
    - mempko 11y ago
      P2P in many ways IS easier. The same code is used with all peers. While client/server typically has two separate code bases. P2P either client can start in any order, while client/server, the server typically has to be running first. There are many more examples why P2P can be easier to write.
- qznc 11y ago
  Can really use p2p technology on a mobile? I assume it would be required to be actively online all the time and drain the battery. If it avoids being actively online, then all mobile users are leeches. Federation or a central solution is more efficient, since it uses less resources.
robin_reala 11y ago
Cache: https://webcache.googleusercontent.com/search?q=cache:dymaxion.org%2Fessays%2Fpleasestop.html https://webcache.googleusercontent.com/search?q=cache:dymaxi...
mehrdada 11y ago
The only tool that's free software and doesn't use shady crypto at the moment seems to be Signal (TextSecure) which is not a great messaging app UI-wise. Perhaps a couple more do exist as well, but I don't see a plethora of actually secure tools around. Remember, Telegram and similar crap do not actually count as secure tools. Therefore, I disagree. There is still no tool with iMessage-quality UI that facilitates messaging and has an explicit key exchange step that a journalist can easily use, so please carry on with writing usable secure messaging/encryption tools or contributing to the existing one(s?).
- deleted 11y ago
  [deleted]
- hvidgaard 11y ago
  I want a WP, browser and desktop based version of Signal. I use it on my phone and it's good enough, but I need an integrated experience with my computer. I really don't think people should write new tool, but contribute to existing ones, otherwise we'll end up with a fragmented space that no one uses.
  - mehrdada 11y ago
    My point is, I think the area is too immature at the moment and needs a lot more innovation before we call for standardization. Security in particular is an area that often requires breaking away from compatibility (not just in the technical sense, but in the social and network sense as well) to actually work. I worry that we would lose great ideas if we call for standardization too early and stick to the way we do things today, which sucks. (Also, empirically, fragmentation in other domains, even relatively late in the game, like social networks did not prevent from one clear winner to emerge. I don't see fragmentation as a big issue long term. Perhaps it's even good to some degree for security.)
    - hvidgaard 11y ago
      Perhaps the conclusion is that we need to focus on a proper secure implementation of the underlying communication. If a standardized decentralised p2p communication overlay network exists, we can build tools on top of that, including IM and practically any other tool that can be implemented with messages.
glogla 11y ago
There isn't a working secure messaging now. GPG+email has UX problems meaning BFU's will never use it. Signal is bound to Google, and Moxie's views on corporate control and calling getting applications from somewhere else than Google "going back to the old broken desktop security model" doesn't exactly inspire confidence. Telegram has broken crypto, doesn't ecrypt by default and the authors being arrogant about their broken crypto doesn't exactly inspire confidence. Whatsapp and iMessage are closed source, so they are completely unverifiable. There isn't secure messaging tool that can be widely used as of now. I know not many people are good enough with crypto to be able to reliably write one, but that doesn't mean we should stop trying. Being able to communicate easily and securely is very very very important and should be part of basic infrastructure by now.
- gambiting 11y ago
  In my personal opinion: if you want to communicate securely, with a very low probability of eavesdropping - use voice chat in any of modern games, on any platform. On both PS4 and X1, voice chat communication has to be encrypted(it's a compliance requirement), but at the same time there is no requirement that you have to implement a server relay - so a lot of games don't bother doing it, and it's a straight up P2P mesh implementation. You have encrypted, P2P traffic, not stored anywhere, that you can create an anonymous account to use.
  - random778 11y ago
    http://ethanheilman.tumblr.com/post/133488739430/is-playstation-4-network-traffic-especially http://ethanheilman.tumblr.com/post/133488739430/is-playstat... It seems that PS4 encryption is broken.
    - gambiting 11y ago
      Yep, but pretty much all games implement their own voip, in addition to system chat(Party Chat) - and while system chat can be forced to relay through MS/Sony servers, custom implementations in games do not have this requirement. They can also use different encryption to the system one.
tracker1 11y ago
In the end, I think that something using WebRTC combined with something like keybase.io to hold public keys as a lookup system could work. You load app, which connects into DHT network... you search for a contact via keybase.io lookup, which then does a query to find the given contact, and all further communication happens over webrtc against the public key of the target user. Other key sources could exist, as well as other registries, or side-loading keys via other channels. It could be distributed, anonymous and secure. The down side is there isn't much one can do to fight flooding attacks. Also, peer negotiation of "friends" might get interesting as well. It wouldn't be too hard to create an initial client using electron, or similar.
- MichaelGG 11y ago
  WebRTC as in a browser? How do you verify peers? As far as I've seen and understood, WebRTC's trust model is the same as the webpage's model - you must trust the page. And if not in a browser, why WebRTC of all things? It still uses rather ugly SDP (which, at least in SIP, still suffers from being originally designed as a multicast protocol for one direction - the offer/answer stuff is poorly grafted in and doesn't really work like people expect, though in practise implementors seem to ignore stuff and code it like they think it should work. SDP is also bad because it's a text-based protocol, and those are almost never unambiguously parsed even if the spec is technically OK). WebRTC is probably more secure due to high-quality teams writing browser-facing code, whereas even 1000-line SIP programs are laughably terrible.
  - tracker1 11y ago
    Each client has a key pair, their public key can be published, such as via keybase.io, you get the public key, and send the message that only the corresponding private key can handle. WebRTC is also a protocol, intended for, but not necessarily tethered to a browser. I think given the distribution level of browsers, it makes sense as a communication channel. Not that it's the best protocol option, but it's relatively easy to interface with at a higher level.
    - MichaelGG 11y ago
ahalam 11y ago
Some one needs to pay attention to Bittorrent Bleep https://www.bleep.pm/ https://www.bleep.pm/ It is closed source but it riding on a big P2P betwork.. the Mainline DHT
- IanCal 11y ago
  I'm not filled with confidence when visiting a secure messaging app site that fires off warnings when visiting the https url.
  - XorNot 11y ago
    Of course HTTPS is not at all secure due to that central source of authority enabling easy large-organization MITM.
    - IanCal 11y ago
      If the problem you're solving is bringing E2E encryption to the masses, then starting with a site that brings up "Your connection is not private Attackers might be trying to steal your information" as the very first thing I see is not really leaping over the first hurdle.
- MichaelGG 11y ago
  Why would a closed source client from a company known to be scummy (looking at what they did to uTorrent) be something anyone should pay any attention to? (FWIW I did check it out, but it wasn't better than Telegram, nor was it better when it was released than Signal is now.)
willvarfar 11y ago
So the argument is "please stop writing secure messaging tools that scratch your itch, and work on UI stuff that this chap wants instead"?
deleted 11y ago
[deleted]
jack9 11y ago
It's not clear why anyone would care, but a basic concept might be that making umpteen tools throws them all into the bucket of "wasting time on something that won't exist in a few years" while hindering the products that will.
carlchenet 11y ago
blablabla show me your code
KnightHawk3 11y ago
Website seems to be down, heres a mirror: http://webcache.googleusercontent.com/search?q=cache:UvM4KhYj6BoJ:dymaxion.org/essays/pleasestop.html+&cd=1&hl=en&ct=clnk&gl=au http://webcache.googleusercontent.com/search?q=cache:UvM4KhY...
KnightHawk3 11y ago
Websites down, heres Google's Cache: http://webcache.googleusercontent.com/search?q=cache:UvM4KhYj6BoJ:dymaxion.org/essays/pleasestop.html+&cd=1&hl=en&ct=clnk&gl=au http://webcache.googleusercontent.com/search?q=cache:UvM4KhY...
mbrock 11y ago
I found this post very inspiring. She's not really saying "don't work on secure messaging apps," but something more like "let's not focus entirely on secure internet messaging, but also help nonprofits and other organizations with a diverse variety of secure collaboration tools." The list is fantastic.
- mbrock 11y ago
  By the way, here's a project Saitta is involved in, an app for distributed secure messaging. https://briarproject.org/how-it-works.html https://briarproject.org/how-it-works.html > Briar is a messaging app designed for activists, journalists, and anyone else who needs a safe, easy and robust way to communicate. Unlike traditional messaging tools such as email, Twitter or Telegram, Briar doesn't rely on a central server - messages are synchronized directly between the users' devices. If the Internet's down, Briar can sync via Bluetooth or Wi-Fi, keeping the information flowing in a crisis. If the Internet's up, Briar can sync via the Tor network, protecting users and their relationships from surveillance.
erikb 11y ago
Totally supporting this. As always in that kind of thread I feel it should be mentioned though, that easier to use is never, never, never ever more secure. Yes, less clutch means more secure. But if you ever think you can just start any computer and do something secure, without checking, configuring and understanding your environment, then you live in a dream world. Higher security means having more control of the environment, and that might very well mean understanding some physical and mathematical boundaries. "just starting to do X securely" (with X possibly being communicating with someone else) is impossible. In fact security gets harder every year, not easier, because our computers get more complex and harder to understand. If you have a smartphone it's really hard to even understand the hardware you have, because 90% of that computer is in a single chip. You can't look inside just like that anymore. And besides all these technical issues there is also always the human factor. The most secure tool is only as secure as you interact with people. You can't improve that with a better GUI or something either.

69 points by zurn 11y ago

We need to make secure p2p messaging easy so we can focus on building the other software. I am building yet another secure messaging tool called Firestr (http://firestr.com http://firestr.com and https://github.com/mempko/firestr https://github.com/mempko/firestr). Except it is designed to be a platform for building all that other software. Has a built in application editor and application distribution system. I have already built file transfer, voice chat, white boarding, and game examples. I want p2p distributed software to be EASIER to write than client/server. The execution might not be ideal and it is a very small project, but I hope the idea catches on and inspires something better.

Pharaoh2 11y ago
https://xkcd.com/927/ https://xkcd.com/927/
- mempko 11y ago
  Haha, Yes! I hate competition with a passion. For example, who the hell cares about my p2p protocol? I don't, which is why I will use GNUnet in a future version. I wrote my own to learn and don't feel the need to compete with much better works.
lmm 11y ago
Sounds similar to GNUNet - did you look at that / consider being compatible with their protocol?
- mempko 11y ago
  Yes! My p2p protocol is a throwaway and the goal is to use GNUNet long term. The apps built on top have no idea about the protocol.
vmateixeira 11y ago
Great idea! "I want p2p distributed software to be EASIER to write than client/server" Totally agree.
- raverbashing 11y ago
  This is like saying "I want heavier things to be easier to lift"
  - Xylakant 11y ago
    That desire lead to the invention of levers and pulleys. In the end, the don't save work, but they make things easier to lift.
    - raverbashing 11y ago
      Yes, but it is still harder to lift than something light
  - vmateixeira 11y ago
    My point is that nowadays there is a focus on writing for a client/server arch, other than any other. As a result, you get lots of open-sourced frameworks/libraries. The same doesn't happen with p2p. In my opinion, as we are having more powerful clients coming out everyday (more processing speed, more memory, etc) perhaps there should be an investment as well on trying to get something more out of that power other than rendering heavy client UIs.
  - mempko 11y ago
    P2P in many ways IS easier. The same code is used with all peers. While client/server typically has two separate code bases. P2P either client can start in any order, while client/server, the server typically has to be running first. There are many more examples why P2P can be easier to write.
qznc 11y ago
Can really use p2p technology on a mobile? I assume it would be required to be actively online all the time and drain the battery. If it avoids being actively online, then all mobile users are leeches. Federation or a central solution is more efficient, since it uses less resources.

robin_reala 11y ago

Cache: https://webcache.googleusercontent.com/search?q=cache:dymaxion.org%2Fessays%2Fpleasestop.html https://webcache.googleusercontent.com/search?q=cache:dymaxi...

mehrdada 11y ago

The only tool that's free software and doesn't use shady crypto at the moment seems to be Signal (TextSecure) which is not a great messaging app UI-wise. Perhaps a couple more do exist as well, but I don't see a plethora of actually secure tools around. Remember, Telegram and similar crap do not actually count as secure tools. Therefore, I disagree. There is still no tool with iMessage-quality UI that facilitates messaging and has an explicit key exchange step that a journalist can easily use, so please carry on with writing usable secure messaging/encryption tools or contributing to the existing one(s?).

deleted 11y ago
[deleted]
hvidgaard 11y ago
I want a WP, browser and desktop based version of Signal. I use it on my phone and it's good enough, but I need an integrated experience with my computer. I really don't think people should write new tool, but contribute to existing ones, otherwise we'll end up with a fragmented space that no one uses.
- mehrdada 11y ago
  My point is, I think the area is too immature at the moment and needs a lot more innovation before we call for standardization. Security in particular is an area that often requires breaking away from compatibility (not just in the technical sense, but in the social and network sense as well) to actually work. I worry that we would lose great ideas if we call for standardization too early and stick to the way we do things today, which sucks. (Also, empirically, fragmentation in other domains, even relatively late in the game, like social networks did not prevent from one clear winner to emerge. I don't see fragmentation as a big issue long term. Perhaps it's even good to some degree for security.)
  - hvidgaard 11y ago
    Perhaps the conclusion is that we need to focus on a proper secure implementation of the underlying communication. If a standardized decentralised p2p communication overlay network exists, we can build tools on top of that, including IM and practically any other tool that can be implemented with messages.

glogla 11y ago

There isn't a working secure messaging now. GPG+email has UX problems meaning BFU's will never use it. Signal is bound to Google, and Moxie's views on corporate control and calling getting applications from somewhere else than Google "going back to the old broken desktop security model" doesn't exactly inspire confidence. Telegram has broken crypto, doesn't ecrypt by default and the authors being arrogant about their broken crypto doesn't exactly inspire confidence. Whatsapp and iMessage are closed source, so they are completely unverifiable. There isn't secure messaging tool that can be widely used as of now. I know not many people are good enough with crypto to be able to reliably write one, but that doesn't mean we should stop trying. Being able to communicate easily and securely is very very very important and should be part of basic infrastructure by now.

gambiting 11y ago
In my personal opinion: if you want to communicate securely, with a very low probability of eavesdropping - use voice chat in any of modern games, on any platform. On both PS4 and X1, voice chat communication has to be encrypted(it's a compliance requirement), but at the same time there is no requirement that you have to implement a server relay - so a lot of games don't bother doing it, and it's a straight up P2P mesh implementation. You have encrypted, P2P traffic, not stored anywhere, that you can create an anonymous account to use.
- random778 11y ago
  http://ethanheilman.tumblr.com/post/133488739430/is-playstation-4-network-traffic-especially http://ethanheilman.tumblr.com/post/133488739430/is-playstat... It seems that PS4 encryption is broken.
  - gambiting 11y ago
    Yep, but pretty much all games implement their own voip, in addition to system chat(Party Chat) - and while system chat can be forced to relay through MS/Sony servers, custom implementations in games do not have this requirement. They can also use different encryption to the system one.

tracker1 11y ago

In the end, I think that something using WebRTC combined with something like keybase.io to hold public keys as a lookup system could work. You load app, which connects into DHT network... you search for a contact via keybase.io lookup, which then does a query to find the given contact, and all further communication happens over webrtc against the public key of the target user. Other key sources could exist, as well as other registries, or side-loading keys via other channels. It could be distributed, anonymous and secure. The down side is there isn't much one can do to fight flooding attacks. Also, peer negotiation of "friends" might get interesting as well. It wouldn't be too hard to create an initial client using electron, or similar.

MichaelGG 11y ago
WebRTC as in a browser? How do you verify peers? As far as I've seen and understood, WebRTC's trust model is the same as the webpage's model - you must trust the page. And if not in a browser, why WebRTC of all things? It still uses rather ugly SDP (which, at least in SIP, still suffers from being originally designed as a multicast protocol for one direction - the offer/answer stuff is poorly grafted in and doesn't really work like people expect, though in practise implementors seem to ignore stuff and code it like they think it should work. SDP is also bad because it's a text-based protocol, and those are almost never unambiguously parsed even if the spec is technically OK). WebRTC is probably more secure due to high-quality teams writing browser-facing code, whereas even 1000-line SIP programs are laughably terrible.
- tracker1 11y ago
  Each client has a key pair, their public key can be published, such as via keybase.io, you get the public key, and send the message that only the corresponding private key can handle. WebRTC is also a protocol, intended for, but not necessarily tethered to a browser. I think given the distribution level of browsers, it makes sense as a communication channel. Not that it's the best protocol option, but it's relatively easy to interface with at a higher level.
  - MichaelGG 11y ago

ahalam 11y ago

Some one needs to pay attention to Bittorrent Bleep https://www.bleep.pm/ https://www.bleep.pm/ It is closed source but it riding on a big P2P betwork.. the Mainline DHT

IanCal 11y ago
I'm not filled with confidence when visiting a secure messaging app site that fires off warnings when visiting the https url.
- XorNot 11y ago
  Of course HTTPS is not at all secure due to that central source of authority enabling easy large-organization MITM.
  - IanCal 11y ago
    If the problem you're solving is bringing E2E encryption to the masses, then starting with a site that brings up "Your connection is not private Attackers might be trying to steal your information" as the very first thing I see is not really leaping over the first hurdle.
MichaelGG 11y ago
Why would a closed source client from a company known to be scummy (looking at what they did to uTorrent) be something anyone should pay any attention to? (FWIW I did check it out, but it wasn't better than Telegram, nor was it better when it was released than Signal is now.)

willvarfar 11y ago

So the argument is "please stop writing secure messaging tools that scratch your itch, and work on UI stuff that this chap wants instead"?

deleted 11y ago

[deleted]

jack9 11y ago

It's not clear why anyone would care, but a basic concept might be that making umpteen tools throws them all into the bucket of "wasting time on something that won't exist in a few years" while hindering the products that will.

carlchenet 11y ago

blablabla show me your code

KnightHawk3 11y ago

Website seems to be down, heres a mirror: http://webcache.googleusercontent.com/search?q=cache:UvM4KhYj6BoJ:dymaxion.org/essays/pleasestop.html+&cd=1&hl=en&ct=clnk&gl=au http://webcache.googleusercontent.com/search?q=cache:UvM4KhY...

KnightHawk3 11y ago

Websites down, heres Google's Cache: http://webcache.googleusercontent.com/search?q=cache:UvM4KhYj6BoJ:dymaxion.org/essays/pleasestop.html+&cd=1&hl=en&ct=clnk&gl=au http://webcache.googleusercontent.com/search?q=cache:UvM4KhY...

mbrock 11y ago

I found this post very inspiring. She's not really saying "don't work on secure messaging apps," but something more like "let's not focus entirely on secure internet messaging, but also help nonprofits and other organizations with a diverse variety of secure collaboration tools." The list is fantastic.

mbrock 11y ago
By the way, here's a project Saitta is involved in, an app for distributed secure messaging. https://briarproject.org/how-it-works.html https://briarproject.org/how-it-works.html > Briar is a messaging app designed for activists, journalists, and anyone else who needs a safe, easy and robust way to communicate. Unlike traditional messaging tools such as email, Twitter or Telegram, Briar doesn't rely on a central server - messages are synchronized directly between the users' devices. If the Internet's down, Briar can sync via Bluetooth or Wi-Fi, keeping the information flowing in a crisis. If the Internet's up, Briar can sync via the Tor network, protecting users and their relationships from surveillance.

erikb 11y ago

Totally supporting this. As always in that kind of thread I feel it should be mentioned though, that easier to use is never, never, never ever more secure. Yes, less clutch means more secure. But if you ever think you can just start any computer and do something secure, without checking, configuring and understanding your environment, then you live in a dream world. Higher security means having more control of the environment, and that might very well mean understanding some physical and mathematical boundaries. "just starting to do X securely" (with X possibly being communicating with someone else) is impossible. In fact security gets harder every year, not easier, because our computers get more complex and harder to understand. If you have a smartphone it's really hard to even understand the hardware you have, because 90% of that computer is in a single chip. You can't look inside just like that anymore. And besides all these technical issues there is also always the human factor. The most secure tool is only as secure as you interact with people. You can't improve that with a better GUI or something either.