4 ms·

The only tool that's free software and doesn't use shady crypto at the moment seems to be Signal (TextSecure) which is not a great messaging app UI-wise. Perhap

The only tool that's free software and doesn't use shady crypto at the moment seems to be Signal (TextSecure) which is not a great messaging app UI-wise. Perhaps a couple more do exist as well, but I don't see a plethora of actually secure tools around. Remember, Telegram and similar crap do not actually count as secure tools. Therefore, I disagree. There is still no tool with iMessage-quality UI that facilitates messaging and has an explicit key exchange step that a journalist can easily use, so please carry on with writing usable secure messaging/encryption tools or contributing to the existing one(s?).

deleted 11y ago
[deleted]
hvidgaard 11y ago
I want a WP, browser and desktop based version of Signal. I use it on my phone and it's good enough, but I need an integrated experience with my computer. I really don't think people should write new tool, but contribute to existing ones, otherwise we'll end up with a fragmented space that no one uses.
- mehrdada 11y ago
  My point is, I think the area is too immature at the moment and needs a lot more innovation before we call for standardization. Security in particular is an area that often requires breaking away from compatibility (not just in the technical sense, but in the social and network sense as well) to actually work. I worry that we would lose great ideas if we call for standardization too early and stick to the way we do things today, which sucks. (Also, empirically, fragmentation in other domains, even relatively late in the game, like social networks did not prevent from one clear winner to emerge. I don't see fragmentation as a big issue long term. Perhaps it's even good to some degree for security.)
  - hvidgaard 11y ago
    Perhaps the conclusion is that we need to focus on a proper secure implementation of the underlying communication. If a standardized decentralised p2p communication overlay network exists, we can build tools on top of that, including IM and practically any other tool that can be implemented with messages.
laen 11y ago
Why isn't there a tool with iMessage-quality UI? I find it hard to understand why the demand is not being met. Could it be that a core tenet of a secure app is being open source and open source is less profitable, thus removing incentive. The article suggests it is because efforts are fragmented, which ostensibly is true. Maybe a combination of the two? What am I missing?
- mehrdada 11y ago
  This [...is less profitable, thus removing incentive] is probably true, unfortunately. I personally seriously considered this space and actually wrote a quite complete prototype with this exact goal more than a year ago, but eventually decided to not move forward with it at the time. One problem is that it is really hard for an average user to distinguish BS security claims from proper crypto. An average user would likely consider Snapchat to be more secure than an E2E app.
  - laen 11y ago
    Mulling on this a bit more - the profitability is further impacted from the inability to mine customer data on a secure app. Anecdotally, when presented with a free unsecure app vice a paid secure app, average Joe will go with the free app. Maybe there isn't a true demand like eps mentions
- eps 11y ago
  Because, realistically speaking, there's no notable demand.
- mbrock 11y ago
  On iPhone, is it even possible to distribute software that's open source in the sense of being verifiable? It's all binaries coming from a central server. And the operating system code is secret. Maybe all your keystrokes are sent directly to Obama so he can scan them for terrorism.
  - mehrdada 11y ago
    It is now possible to compile your own binaries and deploy it yourself without paying $99. As for trusting the OS, it is true, but I would argue it is no better than running on an Android phone that you don't compile and deploy the OS for. There can be a hardware backdoor in your phone too. At some point, you will have to trust your infrastructure to a degree.
IanCal 11y ago
> Signal (TextSecure) which is not a great messaging app UI-wise. I've been using it recently on android and it seems nice, are there some nice UI things I'm missing but don't expect to have? Maybe some other problems I've not run into?
- mehrdada 11y ago
  Don't know about the Android version, but the iOS version repeatedly crashed on me and was nowhere as nice as iMessage to be honest.
- doubleduke 11y ago
  The main problem I have with Signal is that it's funded by the US government (see https://news.ycombinator.com/item?id=8106721 https://news.ycombinator.com/item?id=8106721), which was the main reason for me to switch to Threema.
  - amandabc 11y ago
    wow, wasn't aware of that. certainly doesn't inspire confidence. will check out threema right away.

deleted 11y ago

[deleted]

hvidgaard 11y ago

I want a WP, browser and desktop based version of Signal. I use it on my phone and it's good enough, but I need an integrated experience with my computer. I really don't think people should write new tool, but contribute to existing ones, otherwise we'll end up with a fragmented space that no one uses.

mehrdada 11y ago
My point is, I think the area is too immature at the moment and needs a lot more innovation before we call for standardization. Security in particular is an area that often requires breaking away from compatibility (not just in the technical sense, but in the social and network sense as well) to actually work. I worry that we would lose great ideas if we call for standardization too early and stick to the way we do things today, which sucks. (Also, empirically, fragmentation in other domains, even relatively late in the game, like social networks did not prevent from one clear winner to emerge. I don't see fragmentation as a big issue long term. Perhaps it's even good to some degree for security.)
- hvidgaard 11y ago
  Perhaps the conclusion is that we need to focus on a proper secure implementation of the underlying communication. If a standardized decentralised p2p communication overlay network exists, we can build tools on top of that, including IM and practically any other tool that can be implemented with messages.

laen 11y ago

Why isn't there a tool with iMessage-quality UI? I find it hard to understand why the demand is not being met. Could it be that a core tenet of a secure app is being open source and open source is less profitable, thus removing incentive. The article suggests it is because efforts are fragmented, which ostensibly is true. Maybe a combination of the two? What am I missing?

mehrdada 11y ago
This [...is less profitable, thus removing incentive] is probably true, unfortunately. I personally seriously considered this space and actually wrote a quite complete prototype with this exact goal more than a year ago, but eventually decided to not move forward with it at the time. One problem is that it is really hard for an average user to distinguish BS security claims from proper crypto. An average user would likely consider Snapchat to be more secure than an E2E app.
- laen 11y ago
  Mulling on this a bit more - the profitability is further impacted from the inability to mine customer data on a secure app. Anecdotally, when presented with a free unsecure app vice a paid secure app, average Joe will go with the free app. Maybe there isn't a true demand like eps mentions
eps 11y ago
Because, realistically speaking, there's no notable demand.
mbrock 11y ago
On iPhone, is it even possible to distribute software that's open source in the sense of being verifiable? It's all binaries coming from a central server. And the operating system code is secret. Maybe all your keystrokes are sent directly to Obama so he can scan them for terrorism.
- mehrdada 11y ago
  It is now possible to compile your own binaries and deploy it yourself without paying $99. As for trusting the OS, it is true, but I would argue it is no better than running on an Android phone that you don't compile and deploy the OS for. There can be a hardware backdoor in your phone too. At some point, you will have to trust your infrastructure to a degree.

IanCal 11y ago

> Signal (TextSecure) which is not a great messaging app UI-wise. I've been using it recently on android and it seems nice, are there some nice UI things I'm missing but don't expect to have? Maybe some other problems I've not run into?

mehrdada 11y ago
Don't know about the Android version, but the iOS version repeatedly crashed on me and was nowhere as nice as iMessage to be honest.
doubleduke 11y ago
The main problem I have with Signal is that it's funded by the US government (see https://news.ycombinator.com/item?id=8106721 https://news.ycombinator.com/item?id=8106721), which was the main reason for me to switch to Threema.
- amandabc 11y ago
  wow, wasn't aware of that. certainly doesn't inspire confidence. will check out threema right away.