10 ms·

To me it seems like Open Whisper Systems are accepting a lot of concessions in order to have Signal included into products. The trust I once had for moxie is qu

To me it seems like Open Whisper Systems are accepting a lot of concessions in order to have Signal included into products. The trust I once had for moxie is quickly dissipating. * Privacy is only provided in Allo in a secondary mode. Not by default. * Federation of the Signal protocol has been rejected for non-technical reasons. Also, on a personal note, the desktop client requiring chrome is pretty awful.

zanny 10y ago
Matrix uses the same encryption protocol but is also federated, which is nice.
- ThatGeoGuy 10y ago
  And interesting enough, Matrix faces a different problem than Signal: It doesn't have many good clients at all (at least, last I had checked a few months back). I will agree it would be very nice if Matrix was the dominant messaging protocol that everyone needed to speak with their friends. However, that's not feasible until somebody makes an easy-to-use, beautiful Android and iOS client that doesn't require the user to install multiple bridges or wrangle several accounts to chat with their friends.
  - zanny 10y ago
    I have no experience with iOS anything, but at least the Matrix Console Android client is pretty good for what I use it for. It even supports multiple simultaneous accounts which I really appreciate. I believe the iOS version of it is very similar.
  - anc84 10y ago
    Vector and recently Tensor are pretty awesome.
  - ryukafalz 10y ago
    Vector is now out on both Android[1] and iOS[2], and the web version of Vector has improved significantly. It doesn't have end to end encryption support yet, but they're working on it. 1: https://play.google.com/store/apps/details?id=im.vector.alpha https://play.google.com/store/apps/details?id=im.vector.alph... 2: https://itunes.apple.com/us/app/vector.im/id1083446067 https://itunes.apple.com/us/app/vector.im/id1083446067
    - Arathorn 10y ago
      Yup, it's very true that until recently native Matrix clients have been geared up for developers. Hopefully the arrival of FOSS yet polished apps like Vector (https://vector.im https://vector.im) changes that - and meanwhile one can always benefit from Matrix via bridges from existing polished apps (e.g. Slack!)
- moxie 10y ago
  Matrix uses an encryption protocol of their own devising that employs the double ratchet, which is one component of Signal Protocol. But it's not Signal Protocol, it's their own thing.
  - Arathorn 10y ago
    Yup, just to reinforce from the Matrix side: Olm is an independent E2E protocol which happens to implement the double ratchet (formerly known as the axolotl ratchet), but it's not Signal Protocol and it's increasingly divergent from Signal, and it's completely independent of Open Whisper Systems. For instance, we're defining different behaviour for group chat ratchets, called Megolm, following our own design at http://matrix.org/speculator/spec/drafts%2Fe2e/client_server/unstable.html#a-possible-design-for-group-chat-using-olm http://matrix.org/speculator/spec/drafts%2Fe2e/client_server.... That said, we've tried to architect it such that we could implement compatibility with Signal if Moxie and OWS were ever open to it. But it looks like we'll need to first prove that Matrix can support a rapidly evolving yet federated ecosystem without compromising UX or privacy :)
dmix 10y ago
> on a personal note, the desktop client requiring chrome is pretty awful. Why? I haven't had any issues with it. I even have a shortcut on linux for dmenu, typing "signal" opens the chrome extension URL, opening the app in a new popup window (not a full browser, just the app in a chromeless window). So it functions just like a normal app to me. This is the `signal` bash script: #!/usr/bin/dash /opt/google/chrome-unstable/google-chrome-unstable --user-data-dir=/home/dmix/.config/google-chrome-unstable --profile-directory=Default --app-id=bikioccmkafdpakkkcpdbppfkghcmihk
- aroch 10y ago
  Because some of us don't want to use Chrome? How is vendor lock-in at the browser level any better than at the OS or device level?
  - dmix 10y ago
    The script above basically acts like a wrapper script, launching in a small square chromeless window. So you don't even need to use Chrome, just launch that at startup so it runs in the background. Small software companies have to make platform decisions. They chose the most popular browser (and notably most secure browser), allowing the app to work on all OSes.
    - reitanqild 10y ago
      I don't think you completely get how some of us feel about chrome. Chrome is a good, modern browser but this constant pushing by google (telling me to download a "better browser" when I'm visiting their site in Firefox) as well as every lazy web developer annoys me (seriously, at least consider if you should test basic functionality in all major browsers even if you aren't directly paid for it) .
      - reitanqild 10y ago
        Wish I could remove the "lazy" part, my apologies webdevs! Still: wish less companies would be fine with shipping web apps that break in one or more of modern browsers.
mike_hearn 10y ago
WhatsApp makes a lot of sacrifices to have encryption by default, like no backup of messages, no real ability for the servers to do anything smart, no real search functionality, desktop client that requires the phone to be on, etc. An incognito mode allows the default mode to have more functionality, and matches their approach with Chrome. It's not a bad tradeoff.
- ikeboy 10y ago
  I don't get why encryption and incognito (not leaving a trace on the device) go together. I should be able to have one without the other.
  - eightysix_four 10y ago
    Did you watch what Allo does? In its normal mode it couldn't possibly function with end-to-end encryption. They also have encryption to and from the server in the middle when you aren't in that mode.
    - ikeboy 10y ago
      Incognito is a useful feature. E2E encryption is a useful feature. There's no reason to only allow those two features to be used together. You could have them both turned off by default, and have three modes, one which turns on E2E and one which turns on incognito. Also, the incognito decision should be made by each side independently. Just because I want to delete my traces doesn't mean my partner does.
      - eightysix_four 10y ago
        I think this is a terminology issue - from what's been said elsewhere the only two differences in incognito mode is that it is E2E and doesn't show messages on your lockscreen. It's not ephemeral messaging like Snapchat or something, although they are discussing it as a future feature.
        10y ago
StavrosK 10y ago
I lament the fact that we're moving more and more to closed chat protocols. Shortly, nothing will work with Pidgin/Adium any more, and it's a shame because it's by far the best way to chat.
- nandhp 10y ago
  Moving to closed protocols isn't the whole problem. Everyone used to use AIM, ICQ, MSN Messenger, Yahoo! Messenger, which were all* closed protocols. And yet, the developers of gAIM (now Pidgin) and Trillian both developed clients that interoperated with all of these services and others. Sure, we had five years when everyone was on XMPP. But given that rich history of protocol investigation, what's surprising to me is that progress on support for closed protocols is so much slower now than it was ten, fifteen years ago. Support for Skype, Facebook, Slack, Whatsapp, Signal, Telegram -- is poor or limited, and some of these are even open protocols. (Plus, there's still SMS to support, both natively on phones and via services like Pushbullet on the desktop.) Is there simply no call for unified messaging anymore? Do people enjoy having to use four different messaging apps now? Are the protocols so much harder to figure out? Or are there simply not enough volunteers? * AOL had two protocols: TOC was mostly open, but the closed OSCAR protocol offered many more features.
  - Freak_NL 10y ago
    Most people use whatever is dominant. People who have contacts on more than one 'app' simply install those apps and mope about it a bit (but accept it nontheless). In the Netherlands (and a lot of other countries), the dominant player is Whatsapp, although some countries have their own dominant player, such as Kakao Talk in South Korea. Of course there is call for unified messaging; it just isn't in the interest of the companies behind the currently dominant messing apps to facilitate it. To monetize their product, they need you to use their software, on (or through) an operating system approved by them, following their rules (e.g., Whatsapp's requirement of a relatively high-value personal identifier in the form a phone number). Using anything else to access their protocol causes a devaluation of their product — whatever their eventual business model will be after the make-sure-everyone-uses-us phase will be (advertising, user tracking/marketing profiles, freemium model), users will need to interact with them on their terms, with their software.
baby 10y ago
> the desktop client requiring chrome is pretty awful That's rubbish. They are a small company with not enough person-time to develop native versions for all OS. Would you prefer only to have a windows version available? Developing with Chrome/NW.js/Electron allows you to have an app that runs on 3 OS's from the start. I think it's pretty awesome. Plus you only need chrome installed, it doesn't have to run if I understand correctly. Who doesn't have Chrome installed? Or why would you not install it?
- supergreg 10y ago
  I've used NW and electron based applications and don't have chrome installed. Why is Chrome needed at all for those to work?
  - rtkwe 10y ago
    Electron uses chromium as the renderer.
  - detaro 10y ago
    To add to what rtkwe said, I assume the Signal client is a Chrome plugin because as far as I know you can't use GCM push messages with Chromium/NW/Electron, but only in Android and Google Chrome.
    - haffenloher 10y ago
      Signal Desktop does not use GCM. You can use the extension with Chromium or any Chromium-based browser.
      - detaro 10y ago
        Really? Wow, how did I miss that... Thanks for correcting me!
    - baby 10y ago
      it's a chrome app, you can launch it independently of chrome. At this point I don't know why they didn't go the Electron route.
tuyguntn 10y ago
Having exactly same feelings towards moxie. He wrote a lot about Telegram and how they are not using encryption by default and security is optional, now he is accepting Allo, which is not going to use encryption by default, otherwise it cannot answer to questions like this[1] [1] - https://lh3.googleusercontent.com/1ai7j4RhAwXDz33dFcS5xcxk1IbVmxril9Dd3mbpXU0LFfe_hAQcZPcQGtWBL7_fz08=h900 https://lh3.googleusercontent.com/1ai7j4RhAwXDz33dFcS5xcxk1I...
Perixoog 10y ago
Making someone else's crypto not suck is not the same as endorsing their product.

zanny 10y ago

Matrix uses the same encryption protocol but is also federated, which is nice.

ThatGeoGuy 10y ago
And interesting enough, Matrix faces a different problem than Signal: It doesn't have many good clients at all (at least, last I had checked a few months back). I will agree it would be very nice if Matrix was the dominant messaging protocol that everyone needed to speak with their friends. However, that's not feasible until somebody makes an easy-to-use, beautiful Android and iOS client that doesn't require the user to install multiple bridges or wrangle several accounts to chat with their friends.
- zanny 10y ago
  I have no experience with iOS anything, but at least the Matrix Console Android client is pretty good for what I use it for. It even supports multiple simultaneous accounts which I really appreciate. I believe the iOS version of it is very similar.
- anc84 10y ago
  Vector and recently Tensor are pretty awesome.
- ryukafalz 10y ago
  Vector is now out on both Android[1] and iOS[2], and the web version of Vector has improved significantly. It doesn't have end to end encryption support yet, but they're working on it. 1: https://play.google.com/store/apps/details?id=im.vector.alpha https://play.google.com/store/apps/details?id=im.vector.alph... 2: https://itunes.apple.com/us/app/vector.im/id1083446067 https://itunes.apple.com/us/app/vector.im/id1083446067
  - Arathorn 10y ago
    Yup, it's very true that until recently native Matrix clients have been geared up for developers. Hopefully the arrival of FOSS yet polished apps like Vector (https://vector.im https://vector.im) changes that - and meanwhile one can always benefit from Matrix via bridges from existing polished apps (e.g. Slack!)
moxie 10y ago
Matrix uses an encryption protocol of their own devising that employs the double ratchet, which is one component of Signal Protocol. But it's not Signal Protocol, it's their own thing.
- Arathorn 10y ago
  Yup, just to reinforce from the Matrix side: Olm is an independent E2E protocol which happens to implement the double ratchet (formerly known as the axolotl ratchet), but it's not Signal Protocol and it's increasingly divergent from Signal, and it's completely independent of Open Whisper Systems. For instance, we're defining different behaviour for group chat ratchets, called Megolm, following our own design at http://matrix.org/speculator/spec/drafts%2Fe2e/client_server/unstable.html#a-possible-design-for-group-chat-using-olm http://matrix.org/speculator/spec/drafts%2Fe2e/client_server.... That said, we've tried to architect it such that we could implement compatibility with Signal if Moxie and OWS were ever open to it. But it looks like we'll need to first prove that Matrix can support a rapidly evolving yet federated ecosystem without compromising UX or privacy :)

dmix 10y ago

> on a personal note, the desktop client requiring chrome is pretty awful. Why? I haven't had any issues with it. I even have a shortcut on linux for dmenu, typing "signal" opens the chrome extension URL, opening the app in a new popup window (not a full browser, just the app in a chromeless window). So it functions just like a normal app to me. This is the `signal` bash script: #!/usr/bin/dash /opt/google/chrome-unstable/google-chrome-unstable --user-data-dir=/home/dmix/.config/google-chrome-unstable --profile-directory=Default --app-id=bikioccmkafdpakkkcpdbppfkghcmihk

aroch 10y ago
Because some of us don't want to use Chrome? How is vendor lock-in at the browser level any better than at the OS or device level?
- dmix 10y ago
  The script above basically acts like a wrapper script, launching in a small square chromeless window. So you don't even need to use Chrome, just launch that at startup so it runs in the background. Small software companies have to make platform decisions. They chose the most popular browser (and notably most secure browser), allowing the app to work on all OSes.
  - reitanqild 10y ago
    I don't think you completely get how some of us feel about chrome. Chrome is a good, modern browser but this constant pushing by google (telling me to download a "better browser" when I'm visiting their site in Firefox) as well as every lazy web developer annoys me (seriously, at least consider if you should test basic functionality in all major browsers even if you aren't directly paid for it) .
    - reitanqild 10y ago
      Wish I could remove the "lazy" part, my apologies webdevs! Still: wish less companies would be fine with shipping web apps that break in one or more of modern browsers.

mike_hearn 10y ago

WhatsApp makes a lot of sacrifices to have encryption by default, like no backup of messages, no real ability for the servers to do anything smart, no real search functionality, desktop client that requires the phone to be on, etc. An incognito mode allows the default mode to have more functionality, and matches their approach with Chrome. It's not a bad tradeoff.

ikeboy 10y ago
I don't get why encryption and incognito (not leaving a trace on the device) go together. I should be able to have one without the other.
- eightysix_four 10y ago
  Did you watch what Allo does? In its normal mode it couldn't possibly function with end-to-end encryption. They also have encryption to and from the server in the middle when you aren't in that mode.
  - ikeboy 10y ago
    Incognito is a useful feature. E2E encryption is a useful feature. There's no reason to only allow those two features to be used together. You could have them both turned off by default, and have three modes, one which turns on E2E and one which turns on incognito. Also, the incognito decision should be made by each side independently. Just because I want to delete my traces doesn't mean my partner does.
    - eightysix_four 10y ago
      I think this is a terminology issue - from what's been said elsewhere the only two differences in incognito mode is that it is E2E and doesn't show messages on your lockscreen. It's not ephemeral messaging like Snapchat or something, although they are discussing it as a future feature.
      - 10y ago

StavrosK 10y ago

I lament the fact that we're moving more and more to closed chat protocols. Shortly, nothing will work with Pidgin/Adium any more, and it's a shame because it's by far the best way to chat.

nandhp 10y ago
Moving to closed protocols isn't the whole problem. Everyone used to use AIM, ICQ, MSN Messenger, Yahoo! Messenger, which were all* closed protocols. And yet, the developers of gAIM (now Pidgin) and Trillian both developed clients that interoperated with all of these services and others. Sure, we had five years when everyone was on XMPP. But given that rich history of protocol investigation, what's surprising to me is that progress on support for closed protocols is so much slower now than it was ten, fifteen years ago. Support for Skype, Facebook, Slack, Whatsapp, Signal, Telegram -- is poor or limited, and some of these are even open protocols. (Plus, there's still SMS to support, both natively on phones and via services like Pushbullet on the desktop.) Is there simply no call for unified messaging anymore? Do people enjoy having to use four different messaging apps now? Are the protocols so much harder to figure out? Or are there simply not enough volunteers? * AOL had two protocols: TOC was mostly open, but the closed OSCAR protocol offered many more features.
- Freak_NL 10y ago
  Most people use whatever is dominant. People who have contacts on more than one 'app' simply install those apps and mope about it a bit (but accept it nontheless). In the Netherlands (and a lot of other countries), the dominant player is Whatsapp, although some countries have their own dominant player, such as Kakao Talk in South Korea. Of course there is call for unified messaging; it just isn't in the interest of the companies behind the currently dominant messing apps to facilitate it. To monetize their product, they need you to use their software, on (or through) an operating system approved by them, following their rules (e.g., Whatsapp's requirement of a relatively high-value personal identifier in the form a phone number). Using anything else to access their protocol causes a devaluation of their product — whatever their eventual business model will be after the make-sure-everyone-uses-us phase will be (advertising, user tracking/marketing profiles, freemium model), users will need to interact with them on their terms, with their software.

baby 10y ago

> the desktop client requiring chrome is pretty awful That's rubbish. They are a small company with not enough person-time to develop native versions for all OS. Would you prefer only to have a windows version available? Developing with Chrome/NW.js/Electron allows you to have an app that runs on 3 OS's from the start. I think it's pretty awesome. Plus you only need chrome installed, it doesn't have to run if I understand correctly. Who doesn't have Chrome installed? Or why would you not install it?

supergreg 10y ago
I've used NW and electron based applications and don't have chrome installed. Why is Chrome needed at all for those to work?
- rtkwe 10y ago
  Electron uses chromium as the renderer.
- detaro 10y ago
  To add to what rtkwe said, I assume the Signal client is a Chrome plugin because as far as I know you can't use GCM push messages with Chromium/NW/Electron, but only in Android and Google Chrome.
  - haffenloher 10y ago
    Signal Desktop does not use GCM. You can use the extension with Chromium or any Chromium-based browser.
    - detaro 10y ago
      Really? Wow, how did I miss that... Thanks for correcting me!
  - baby 10y ago
    it's a chrome app, you can launch it independently of chrome. At this point I don't know why they didn't go the Electron route.

tuyguntn 10y ago

Having exactly same feelings towards moxie. He wrote a lot about Telegram and how they are not using encryption by default and security is optional, now he is accepting Allo, which is not going to use encryption by default, otherwise it cannot answer to questions like this[1] [1] - https://lh3.googleusercontent.com/1ai7j4RhAwXDz33dFcS5xcxk1IbVmxril9Dd3mbpXU0LFfe_hAQcZPcQGtWBL7_fz08=h900 https://lh3.googleusercontent.com/1ai7j4RhAwXDz33dFcS5xcxk1I...

Perixoog 10y ago

Making someone else's crypto not suck is not the same as endorsing their product.