5 ms·

Its WeChat. Did she really feel like she had a guarantee of anonymity using a Chinese messaging app? That seems seriously naïve.

ShabbosGoy 9y ago
At this point, what messaging app is truly OTR? Signal doesn’t allow third parties to build the source, Telegram is compromised for sure, same with WhatsApp.
- mastax 9y ago
  > Signal doesn’t allow third parties to build the source No. Signal is GPLv3. They don't allow third parties to distribute modified binaries that connect to their servers. You can argue if that is a good idea, but don't misrepresent the situation.
  - ShabbosGoy 9y ago
    The only way I can get a Signal binary is through OWS. Why should I trust them? The whole spirit of GPL and FOSS is to be able to examine the source, modify it, and distribute it freely. It’s a form of DRM to restrict who can and cannot distribute the Signal binary.
  - exikyut 9y ago
    That's... that's really weird. I definitely argue that it's not a good idea, and I'd also argue it puts quite a few nails in the coffin in terms of my trusting it as a good protocol. Maybe this is an unpopular opinion, but IMO the fact that Facebook "trust" it means that I have a lot of reserve about using it myself.
    - viraptor 9y ago
      It's not that weird from their point of view. "I was using Signal, but my messages were intercepted anyway" - "But were you using original Signal, or a third-party build with ads and malware?" (if that's the rule anyway - I couldn't find confirmation for that)
      - StudentStuff 9y ago
        Additionally, you end up with crap like Noise (a Signal fork that uses the main servers) where features inconsistently work or are available and the devs of Noise don't actually pull down new code very often, resulting in a two tiered network that has many unreliably working features. Hence why Moxie doesn't think federation is practical with an evolving communications protocol.
        exikyut 9y ago
        Good point. This is really hard :/
  - ComputerGuru 9y ago
    Ok so they can build them but they can’t use them. I think the OP’s hyperbole might be excused.
    - StudentStuff 9y ago
      You say that, but Noise and Signal-CLI work just fine. Not that either actually keeps current with features, which is mainly why Moxie has stated he doesn't like people using unmaintained forks of Signal on OWS's servers.
- chatmasta 9y ago
  One that’s open source, on servers and devices only you and your correspondents control. Or you could speak face to face.
- mindB 9y ago
  I recommend matrix[1] which has a fairly nice set of clients in Riot[2]. It's better than OTR in that it supports e2e group chat and multiple devices. [1] https://matrix.org https://matrix.org [2] https://riot.im https://riot.im
  - amboar 9y ago
    I think Riot has a terrible UX with respect to key management in group chats.
    - dharma1 9y ago
      Can I have a chat with you about this? I'm looking to help Riot improve their UX
      - amboar 9y ago
        Yeah no worries. I'm @arj:matrix.org, or if you want to try other avenues my keybase profile is listed in my hn profile
devy 9y ago
WeChat didn't use end-2-end encryption at all, at least up till 2016. [1] [1]: https://cointelegraph.com/news/skype-wechat-snapchat-thrashed-by-amnesty-intl-for-lack-of-basic-privacy-protection https://cointelegraph.com/news/skype-wechat-snapchat-thrashe...

ShabbosGoy 9y ago

At this point, what messaging app is truly OTR? Signal doesn’t allow third parties to build the source, Telegram is compromised for sure, same with WhatsApp.

mastax 9y ago
> Signal doesn’t allow third parties to build the source No. Signal is GPLv3. They don't allow third parties to distribute modified binaries that connect to their servers. You can argue if that is a good idea, but don't misrepresent the situation.
- ShabbosGoy 9y ago
  The only way I can get a Signal binary is through OWS. Why should I trust them? The whole spirit of GPL and FOSS is to be able to examine the source, modify it, and distribute it freely. It’s a form of DRM to restrict who can and cannot distribute the Signal binary.
- exikyut 9y ago
  That's... that's really weird. I definitely argue that it's not a good idea, and I'd also argue it puts quite a few nails in the coffin in terms of my trusting it as a good protocol. Maybe this is an unpopular opinion, but IMO the fact that Facebook "trust" it means that I have a lot of reserve about using it myself.
  - viraptor 9y ago
    It's not that weird from their point of view. "I was using Signal, but my messages were intercepted anyway" - "But were you using original Signal, or a third-party build with ads and malware?" (if that's the rule anyway - I couldn't find confirmation for that)
    - StudentStuff 9y ago
      Additionally, you end up with crap like Noise (a Signal fork that uses the main servers) where features inconsistently work or are available and the devs of Noise don't actually pull down new code very often, resulting in a two tiered network that has many unreliably working features. Hence why Moxie doesn't think federation is practical with an evolving communications protocol.
      - exikyut 9y ago
        Good point. This is really hard :/
- ComputerGuru 9y ago
  Ok so they can build them but they can’t use them. I think the OP’s hyperbole might be excused.
  - StudentStuff 9y ago
    You say that, but Noise and Signal-CLI work just fine. Not that either actually keeps current with features, which is mainly why Moxie has stated he doesn't like people using unmaintained forks of Signal on OWS's servers.
chatmasta 9y ago
One that’s open source, on servers and devices only you and your correspondents control. Or you could speak face to face.
mindB 9y ago
I recommend matrix[1] which has a fairly nice set of clients in Riot[2]. It's better than OTR in that it supports e2e group chat and multiple devices. [1] https://matrix.org https://matrix.org [2] https://riot.im https://riot.im
- amboar 9y ago
  I think Riot has a terrible UX with respect to key management in group chats.
  - dharma1 9y ago
    Can I have a chat with you about this? I'm looking to help Riot improve their UX
    - amboar 9y ago
      Yeah no worries. I'm @arj:matrix.org, or if you want to try other avenues my keybase profile is listed in my hn profile

devy 9y ago

WeChat didn't use end-2-end encryption at all, at least up till 2016. [1] [1]: https://cointelegraph.com/news/skype-wechat-snapchat-thrashed-by-amnesty-intl-for-lack-of-basic-privacy-protection https://cointelegraph.com/news/skype-wechat-snapchat-thrashe...