5 ms·

Show HN: ChatSecure iOS v4.0 – OMEMO and Signal Protocol

107 points by chrisballinger 10y ago

bredren 10y ago
Congratulations to Chris and team on getting this release out the door.
- chrisballinger 10y ago
  Thanks! It's been quite the rollercoaster. We're extremely grateful that Moxie resolved the App Store / GPL license issue with their Signal Protocol libraries.
  - deleted 10y ago
    [deleted]
  - lelandgaunt 10y ago
    Thanks for your contribution. How can one report usability bugs?
ge0rg 10y ago
Congratulations! It's nice to see that we now have both Android (https:/mconversations.im) and iOS covered by usable and secure XMPP clients!
- gtirloni 10y ago
  The list of features at conversations.im is impressive. Despite the fact that nobody I know is using it, I wanted to have a quick look but it's a paid app (I know, GPL, etc). And one I know I won't be actively using. There is too much friction to try it out.
  - erlehmann_ 10y ago
    One can get Conversations from the F-Droid store without spending money: https://f-droid.org/ https://f-droid.org/
    - openplatypus 10y ago
      Then you can support project but paying for really reliable service and for few extra € you can even use your own domain.
  - BuuQu9hu 10y ago
    Asking for money in return for binaries of GPL/FLOSS apps uploaded to the app stores of proprietary platforms seems like a decent way to fund FLOSS development. Folks there are used to paying anyway. Folks interested in FLOSS will be using platforms like Cydia, F-Droid or Debian/Fedora anyway.
    - gtirloni 10y ago
      I'm not arguing about the validity of the method that was chosen. I agree it's a valid method. What I'm saying is that, if the goal is widespread usage, there are little small roadblocks before users can actually be using the app. I cannot ask my family and friends to install F-droid or pay for an app that I'm not even sure they will like. So realistically, I will never mention it to them. Maybe I misunderstood what is the target audience from the beginning. You're telling me it is the 0.0001℅ of the population that uses 3rd-party app stores, Linux, etc. That's fine too but it comes with its own limitations.
- ge0rg 10y ago
  The correct URL is of course https://conversations.im https://conversations.im
bradknowles 10y ago
So, how does this compare with the Signal app, WhatsApp, and other secure chat clients that use the same library? What makes ChatSecure a better choice? What can I do with it that they can't?
- LukeShu 10y ago
  I'm not familiar with ChatSecure, but from what I can tell: It ChatSecure is an XMPP client; XMPP being an open federated protocol. Signal uses Google infrastructure; while this isn't an issue for security purposes (because everything is encrypted), some people don't like it, some people like to run their own servers. With a "centralized" protocol like Signal, running your own server means you are cut off from everyone on the main server; with a "federated" protocol like XMPP your server can communicate with the other servers, so you can chat with users on other servers. The innovation with ChatSecure over other XMPP clients is that it has implemented an XMPP extension (XMPP is an extensible protocol) called "OMEMO" that implements encryption, by borrowing substantially from the Signal protocol. This is an improvement over OTR, the status-quo way of doing encrypted XMPP, which the linked page explains was designed around desktop usage and doesn't work well with phones.
  - chrisballinger 10y ago
    That's correct. Our main differentiator from Signal/WhatsApp/Wire/Telegram/etc is that we have no centralized messaging infrastructure. Users are free to run their own servers, or connect to any 3rd party providers they trust. We also have integrated Tor support, but plan to remove that once iCepa reaches maturity.
    - BuuQu9hu 10y ago
      How many trustworthy and well administered XMPP servers are out there? BTW, for anyone wanting to setup a modern XMPP server, check out this: http://www.enricozini.org/blog/2017/debian/modern-and-secure-instant-messaging/ http://www.enricozini.org/blog/2017/debian/modern-and-secure... http://www.trueelena.org/computers/howto/modern_xmpp_server.html http://www.trueelena.org/computers/howto/modern_xmpp_server....
mrmondo 10y ago
Well done! I take it group chat is now in place as well?
tristan-k 10y ago
Congratulations! Is there any ETA on MAM in ChatSecure and will the beta-testing in TestFlight continue?
- chrisballinger 10y ago
  MAM will be in 4.1, but there's currently no timeline for that release yet. We plan to do a 4.0.1 release soon to resolve some bugs, and then start working on 4.1. If you signed up for the 4.0 beta, you'll get notifications for the next beta as soon as its ready.
antihero 10y ago
Yay! Amazing! I literally checked out ChatSecure yesterday due to the WhatsApp issues and looked at the GitHub issues to see if it supported OMEMO, and here we are! Thank you so much, it's like Christmas :)
mp3geek 10y ago
Unless I'm looking at the wrong git repo, the Android version seems to be rather undeveloped? [1] https://github.com/guardianproject/ChatSecureAndroid https://github.com/guardianproject/ChatSecureAndroid
- moosingin3space 10y ago
  I think Android users are supposed to use Conversations, which has native OMEMO support.
- upofadown 10y ago
  Last I heard was that the past Android version of chatsecure was being abandoned. Conversations would become the new Android client. Any future work on the original Android chatsecure will go to the Zom project: * https://github.com/zom/zom-android https://github.com/zom/zom-android
antihero 10y ago
Ok so a few problems, on every network I've tried. DuckDuckGo: Adding people doesn't seem to work via QR code, at all. And the client gets weird when trying to delete the account. evil.im: Adder never gets notified that they have been "accepted", so can't view the conversation except via notification. null.pm: Adding works fine, but OMEMO just stays at yellow exclamation marks. dismail.de (supposedly has a fully green bar): No QR code adding, no notification of accepted contact request, OMEMO is fucked. talker.to Basically the same as dismail.de. So is there an actual server that is reliable and supports the requisite features set to make this a usable experience? Are these client bugs? Because otherwise this is going nowhere. I'm sitting next to my mate and cannot actually find a server that allows us to communicate normally. I'm trying to set up a Jabber prosody server and I think it's working. I have no idea how to test if it is really. I got A/A on the server test thing. How do they compile a list like this? https://gultsch.de/compliance_ranked.html https://gultsch.de/compliance_ranked.html Do they have a suite that I can run against my own server?
- ge0rg 10y ago
  Are these client bugs? Most probably yes, you should report such things to the issue tracker at https://github.com/ChatSecure/ChatSecure-iOS https://github.com/ChatSecure/ChatSecure-iOS Do they have a suite that I can run against my own server? The compliance testing is performed by https://github.com/iNPUTmice/ComplianceTester https://github.com/iNPUTmice/ComplianceTester You should also be able to ask Daniel (iNPUTmice) in the Conversations chart room at https://yax.im/i/#conversations@conference.siacs.eu?join https://yax.im/i/#conversations@conference.siacs.eu?join <xmpp:conversations@conference.siacs.eu?join>
- chrisballinger 10y ago
  Thanks for testing so thoroughly. Some of these problems are likely related to server incompatibilities, but others are definitely client bugs like the QR code stuff. Please report individual issues here [1]. Thank you! 1. https://github.com/chatsecure/chatsecure-ios/issues https://github.com/chatsecure/chatsecure-ios/issues
  - antihero 10y ago

107 points by chrisballinger 10y ago

bredren 10y ago

Congratulations to Chris and team on getting this release out the door.

chrisballinger 10y ago
Thanks! It's been quite the rollercoaster. We're extremely grateful that Moxie resolved the App Store / GPL license issue with their Signal Protocol libraries.
- deleted 10y ago
  [deleted]
- lelandgaunt 10y ago
  Thanks for your contribution. How can one report usability bugs?

ge0rg 10y ago

Congratulations! It's nice to see that we now have both Android (https:/mconversations.im) and iOS covered by usable and secure XMPP clients!

gtirloni 10y ago
The list of features at conversations.im is impressive. Despite the fact that nobody I know is using it, I wanted to have a quick look but it's a paid app (I know, GPL, etc). And one I know I won't be actively using. There is too much friction to try it out.
- erlehmann_ 10y ago
  One can get Conversations from the F-Droid store without spending money: https://f-droid.org/ https://f-droid.org/
  - openplatypus 10y ago
    Then you can support project but paying for really reliable service and for few extra € you can even use your own domain.
- BuuQu9hu 10y ago
  Asking for money in return for binaries of GPL/FLOSS apps uploaded to the app stores of proprietary platforms seems like a decent way to fund FLOSS development. Folks there are used to paying anyway. Folks interested in FLOSS will be using platforms like Cydia, F-Droid or Debian/Fedora anyway.
  - gtirloni 10y ago
    I'm not arguing about the validity of the method that was chosen. I agree it's a valid method. What I'm saying is that, if the goal is widespread usage, there are little small roadblocks before users can actually be using the app. I cannot ask my family and friends to install F-droid or pay for an app that I'm not even sure they will like. So realistically, I will never mention it to them. Maybe I misunderstood what is the target audience from the beginning. You're telling me it is the 0.0001℅ of the population that uses 3rd-party app stores, Linux, etc. That's fine too but it comes with its own limitations.
ge0rg 10y ago
The correct URL is of course https://conversations.im https://conversations.im

bradknowles 10y ago

So, how does this compare with the Signal app, WhatsApp, and other secure chat clients that use the same library? What makes ChatSecure a better choice? What can I do with it that they can't?

LukeShu 10y ago
I'm not familiar with ChatSecure, but from what I can tell: It ChatSecure is an XMPP client; XMPP being an open federated protocol. Signal uses Google infrastructure; while this isn't an issue for security purposes (because everything is encrypted), some people don't like it, some people like to run their own servers. With a "centralized" protocol like Signal, running your own server means you are cut off from everyone on the main server; with a "federated" protocol like XMPP your server can communicate with the other servers, so you can chat with users on other servers. The innovation with ChatSecure over other XMPP clients is that it has implemented an XMPP extension (XMPP is an extensible protocol) called "OMEMO" that implements encryption, by borrowing substantially from the Signal protocol. This is an improvement over OTR, the status-quo way of doing encrypted XMPP, which the linked page explains was designed around desktop usage and doesn't work well with phones.
- chrisballinger 10y ago
  That's correct. Our main differentiator from Signal/WhatsApp/Wire/Telegram/etc is that we have no centralized messaging infrastructure. Users are free to run their own servers, or connect to any 3rd party providers they trust. We also have integrated Tor support, but plan to remove that once iCepa reaches maturity.
  - BuuQu9hu 10y ago
    How many trustworthy and well administered XMPP servers are out there? BTW, for anyone wanting to setup a modern XMPP server, check out this: http://www.enricozini.org/blog/2017/debian/modern-and-secure-instant-messaging/ http://www.enricozini.org/blog/2017/debian/modern-and-secure... http://www.trueelena.org/computers/howto/modern_xmpp_server.html http://www.trueelena.org/computers/howto/modern_xmpp_server....

mrmondo 10y ago

Well done! I take it group chat is now in place as well?

tristan-k 10y ago

Congratulations! Is there any ETA on MAM in ChatSecure and will the beta-testing in TestFlight continue?

chrisballinger 10y ago
MAM will be in 4.1, but there's currently no timeline for that release yet. We plan to do a 4.0.1 release soon to resolve some bugs, and then start working on 4.1. If you signed up for the 4.0 beta, you'll get notifications for the next beta as soon as its ready.

antihero 10y ago

Yay! Amazing! I literally checked out ChatSecure yesterday due to the WhatsApp issues and looked at the GitHub issues to see if it supported OMEMO, and here we are! Thank you so much, it's like Christmas :)

mp3geek 10y ago

Unless I'm looking at the wrong git repo, the Android version seems to be rather undeveloped? [1] https://github.com/guardianproject/ChatSecureAndroid https://github.com/guardianproject/ChatSecureAndroid

moosingin3space 10y ago
I think Android users are supposed to use Conversations, which has native OMEMO support.
upofadown 10y ago
Last I heard was that the past Android version of chatsecure was being abandoned. Conversations would become the new Android client. Any future work on the original Android chatsecure will go to the Zom project: * https://github.com/zom/zom-android https://github.com/zom/zom-android

antihero 10y ago

Ok so a few problems, on every network I've tried. DuckDuckGo: Adding people doesn't seem to work via QR code, at all. And the client gets weird when trying to delete the account. evil.im: Adder never gets notified that they have been "accepted", so can't view the conversation except via notification. null.pm: Adding works fine, but OMEMO just stays at yellow exclamation marks. dismail.de (supposedly has a fully green bar): No QR code adding, no notification of accepted contact request, OMEMO is fucked. talker.to Basically the same as dismail.de. So is there an actual server that is reliable and supports the requisite features set to make this a usable experience? Are these client bugs? Because otherwise this is going nowhere. I'm sitting next to my mate and cannot actually find a server that allows us to communicate normally. I'm trying to set up a Jabber prosody server and I think it's working. I have no idea how to test if it is really. I got A/A on the server test thing. How do they compile a list like this? https://gultsch.de/compliance_ranked.html https://gultsch.de/compliance_ranked.html Do they have a suite that I can run against my own server?

ge0rg 10y ago
Are these client bugs? Most probably yes, you should report such things to the issue tracker at https://github.com/ChatSecure/ChatSecure-iOS https://github.com/ChatSecure/ChatSecure-iOS Do they have a suite that I can run against my own server? The compliance testing is performed by https://github.com/iNPUTmice/ComplianceTester https://github.com/iNPUTmice/ComplianceTester You should also be able to ask Daniel (iNPUTmice) in the Conversations chart room at https://yax.im/i/#conversations@conference.siacs.eu?join https://yax.im/i/#conversations@conference.siacs.eu?join <xmpp:conversations@conference.siacs.eu?join>
chrisballinger 10y ago
Thanks for testing so thoroughly. Some of these problems are likely related to server incompatibilities, but others are definitely client bugs like the QR code stuff. Please report individual issues here [1]. Thank you! 1. https://github.com/chatsecure/chatsecure-ios/issues https://github.com/chatsecure/chatsecure-ios/issues
- antihero 10y ago