5 ms·

Telegram uses a home-brewed crypto protocol and posted a challenge to break it by pasting some ciphertext. In my eyes they're ridiculous. Just use Signal Messa

Telegram uses a home-brewed crypto protocol and posted a challenge to break it by pasting some ciphertext. In my eyes they're ridiculous. Just use Signal Messager.

ge0rg 10y ago
Signal uses a home-brewed crypto protocol(^) and their CTO disallows third party clients, even based on their own open source code. Just use XMPP. (^) Granted, moxie can be considered a crypto expert, and the design got some public auditing.
- dsacco 10y ago
  The Axolotl key management algorithm was jointly developed by Moxie and Trevor Perrin. Both of them are widely respected in cryptography, and the protocol has undergone formal cryptanalysis. A novel crypto algorithm someone puts up on GitHub is "home-brewed." The Axolotl algorithm can no longer fairly be described as "home-brewed."
- mahyarm 10y ago
  You can go start, pay for and manage your own server set and go hog wild writing whatever client you want to.
erlehmann_ 10y ago
The author of Signal (Moxie Marlinspike) seems actively hostile to not only federation efforts but also compatibility with other clients, even one that only removed the dependency of Signal on Google Play Services: http://news.dieweltistgarnichtso.net/posts/signal-lock-in.html http://news.dieweltistgarnichtso.net/posts/signal-lock-in.ht...
- hointytointy 10y ago
  Not to mention the questionable ethics of supporting companies that are so blatantly anti-user. Facebook and Google can now tout "Moxie approved" crypto while their business models of surveillance remain intact.
- geofft 10y ago
  Federation and security is a hard problem. The code is there for anyone to use, but it's an entirely reasonable and prudent security decision to announce your lack of support for a forked version using the same servers. (Also, does Telegram have a version without Google Play Services?)
  - dest 10y ago
    About Telegram: the fdroid version has no google dependencies, AFAIK
  - erlehmann_ 10y ago
    The XMPP ecosystem has federation, security and almost every client can talk to almost every server. If Moxie Marlinspike claims that interoperability does not work well in the context of instant messaging, I see this as him trying to manipulate the users so they do not judge him for his behaviour.
    - geofft 10y ago
      The XMPP ecosystem doesn't have security anywhere comparable to what we're talking about (well-implemented, end-to-end, forward-secure, multi-device messaging).
      - kobayashi 10y ago
        >multi-device messaging Correct me if I'm wrong, but I don't think that Signal supports this feature
        y7 10y ago
        It does, but it's beta and Android only: https://whispersystems.org/blog/signal-desktop/ https://whispersystems.org/blog/signal-desktop/
- glogla 10y ago
  Yeah. Telegram is sketchy, and their "we are Russian math PhDs, we don't need to listen to other people about crypto" attitude is very unhealthy, but unlike Moxie, I can at least think we are on the same side.
- kuschku 10y ago
  Even worse, he tries to deny people their legal right to build their own clients to services they have the right to use. Which is a legal right in the EU (and even allows you to reverse engineer proprietary code for the purpose of writing your own system that interoperates with a proprietary one), so this is very sketchy. Moxie seems like a Google-employee.
  - Natanael_L 10y ago
    He doesn't. You just can't use custom clients with his server.
- whyever 10y ago
  Why don't you just link his blog post on federation instead of misrepresenting his opinion? https://whispersystems.org/blog/the-ecosystem-is-moving/ https://whispersystems.org/blog/the-ecosystem-is-moving/
  - narrowrail 10y ago
    I've been thinking about this a bit, and I think it would be possible to setup a non-profit, 'Federation Authority' (if you will), that could transparently govern a network of independent operators (that interoperate). Wikipedia works pretty well (IMO), and there would be an opportunity to iterate on their model (e.g. live web stream of board meetings). I believe with enough traction, we could get hedge funds to give money while shorting the publicly traded companies that operate walled-garden networks. N.B. I read your link when it was written originally, and have not taken the time to go at the issues raised point-for-point, but I'd like to see more efforts made in the direction I mentioned above. Edit: The protocol has to have federation built-in from the beginning, and the ability of any server to granularly discriminate against any given TLD at their operator's discretion.
  - erlehmann_ 10y ago
    I did not know that blog post. However, it does not give evidence that Moxie Marlinspike is friendly to federation and third-party clients. If anything, it shows that he opposes open, interoperable protocols as well. Moxie Marlinspike asserts that federation needs standardization and that standardization inhibits changes. He also asserts that protocols have to change to keep up with changing requirements. His unspoken assumption is that it is impossible to create real-world forward-compatible protocols. While I agree with the first assertion, I strongly disagree on the latter two. Consider that protocols and data formats that do not have to change exist. An encoding like UTF-8 will probably never have to change to keep up with new codepoints. Also consider that forward-compatible protocols and data formats exist. HTTP seems to be a very good example for that.

Telegram uses a home-brewed crypto protocol and posted a challenge to break it by pasting some ciphertext. In my eyes they're ridiculous. Just use Signal Messager.

ge0rg 10y ago

Signal uses a home-brewed crypto protocol(^) and their CTO disallows third party clients, even based on their own open source code. Just use XMPP. (^) Granted, moxie can be considered a crypto expert, and the design got some public auditing.

dsacco 10y ago
The Axolotl key management algorithm was jointly developed by Moxie and Trevor Perrin. Both of them are widely respected in cryptography, and the protocol has undergone formal cryptanalysis. A novel crypto algorithm someone puts up on GitHub is "home-brewed." The Axolotl algorithm can no longer fairly be described as "home-brewed."
mahyarm 10y ago
You can go start, pay for and manage your own server set and go hog wild writing whatever client you want to.

erlehmann_ 10y ago

The author of Signal (Moxie Marlinspike) seems actively hostile to not only federation efforts but also compatibility with other clients, even one that only removed the dependency of Signal on Google Play Services: http://news.dieweltistgarnichtso.net/posts/signal-lock-in.html http://news.dieweltistgarnichtso.net/posts/signal-lock-in.ht...

hointytointy 10y ago
Not to mention the questionable ethics of supporting companies that are so blatantly anti-user. Facebook and Google can now tout "Moxie approved" crypto while their business models of surveillance remain intact.
geofft 10y ago
Federation and security is a hard problem. The code is there for anyone to use, but it's an entirely reasonable and prudent security decision to announce your lack of support for a forked version using the same servers. (Also, does Telegram have a version without Google Play Services?)
- dest 10y ago
  About Telegram: the fdroid version has no google dependencies, AFAIK
- erlehmann_ 10y ago
  The XMPP ecosystem has federation, security and almost every client can talk to almost every server. If Moxie Marlinspike claims that interoperability does not work well in the context of instant messaging, I see this as him trying to manipulate the users so they do not judge him for his behaviour.
  - geofft 10y ago
    The XMPP ecosystem doesn't have security anywhere comparable to what we're talking about (well-implemented, end-to-end, forward-secure, multi-device messaging).
    - kobayashi 10y ago
      >multi-device messaging Correct me if I'm wrong, but I don't think that Signal supports this feature
      - y7 10y ago
        It does, but it's beta and Android only: https://whispersystems.org/blog/signal-desktop/ https://whispersystems.org/blog/signal-desktop/
glogla 10y ago
Yeah. Telegram is sketchy, and their "we are Russian math PhDs, we don't need to listen to other people about crypto" attitude is very unhealthy, but unlike Moxie, I can at least think we are on the same side.
kuschku 10y ago
Even worse, he tries to deny people their legal right to build their own clients to services they have the right to use. Which is a legal right in the EU (and even allows you to reverse engineer proprietary code for the purpose of writing your own system that interoperates with a proprietary one), so this is very sketchy. Moxie seems like a Google-employee.
- Natanael_L 10y ago
  He doesn't. You just can't use custom clients with his server.
whyever 10y ago
Why don't you just link his blog post on federation instead of misrepresenting his opinion? https://whispersystems.org/blog/the-ecosystem-is-moving/ https://whispersystems.org/blog/the-ecosystem-is-moving/
- narrowrail 10y ago
  I've been thinking about this a bit, and I think it would be possible to setup a non-profit, 'Federation Authority' (if you will), that could transparently govern a network of independent operators (that interoperate). Wikipedia works pretty well (IMO), and there would be an opportunity to iterate on their model (e.g. live web stream of board meetings). I believe with enough traction, we could get hedge funds to give money while shorting the publicly traded companies that operate walled-garden networks. N.B. I read your link when it was written originally, and have not taken the time to go at the issues raised point-for-point, but I'd like to see more efforts made in the direction I mentioned above. Edit: The protocol has to have federation built-in from the beginning, and the ability of any server to granularly discriminate against any given TLD at their operator's discretion.
- erlehmann_ 10y ago
  I did not know that blog post. However, it does not give evidence that Moxie Marlinspike is friendly to federation and third-party clients. If anything, it shows that he opposes open, interoperable protocols as well. Moxie Marlinspike asserts that federation needs standardization and that standardization inhibits changes. He also asserts that protocols have to change to keep up with changing requirements. His unspoken assumption is that it is impossible to create real-world forward-compatible protocols. While I agree with the first assertion, I strongly disagree on the latter two. Consider that protocols and data formats that do not have to change exist. An encoding like UTF-8 will probably never have to change to keep up with new codepoints. Also consider that forward-compatible protocols and data formats exist. HTTP seems to be a very good example for that.