4 ms·

TL;DR he doesn’t trust Signal because he doesn’t trust the Android operating system, and something about federation. > No doubt these are non-trivial problems

by apeace 8y ago

TL;DR he doesn’t trust Signal because he doesn’t trust the Android operating system, and something about federation. > No doubt these are non-trivial problems to solve. But I have personally been involved in open source projects which have collectively solved similarly difficult problems a thousand times over with a combined budget on the order of tens of thousands of dollars. Shut up and code then. I’ll personally review your fully decentralized and secure chat app which nobody uses because it’s not available on any app store. Let me know when it’s done.

IshKebab 8y ago
"It's easy! Just just generate a 2048 bit PGP key using this command (make sure you don't use the default insecure options) and then mail it through the post to anyone you need to communicate with."
jMyles 8y ago
The author expressly endorses Matrix.
- apeace 8y ago
  And which operating system does the author expect people to use Matrix on? The one he personally wrote and reviews every commit to? Does he expect everyone to only chat on "trusted" open-source desktop operating systems and not their phones? The F-Droid argument is a really empty one. Packages are cryptographically signed? Are you verifying those signatures? In an article about "trust", can you explain how exactly you trust F-Droid packages and not Google Play ones? What about iOS? The whole article is extremely vapid and lacks any compelling argument. Signal has introduced state-of-the-art encryption to millions of people in an accessible way. The author goes on to poke fun at the animated GIF feature of Signal as if it is a waste of time compared to working on an F-Droid distribution, but neglects to address five of the seven points written by Moxie (which he links to) about why they chose not to do that.
  - jhasse 8y ago
    > In an article about "trust", can you explain how exactly you trust F-Droid packages and not Google Play ones? It's easier for Google to manipulate a package on Google Play than on F-Droid. > Signal has introduced state-of-the-art encryption to millions of people in an accessible way. WhatsApp has done that to even more people, so what's the point of Signal?
    - lorenzhs 8y ago
      > It's easier for Google to manipulate a package on Google Play than on F-Droid. That's not how Android app signing works. It's a "trust on first use" model, so once you install an app, any update must be signed by the same key or the system will refuse to install it. That key is held by Signal, not Google, so Google cannot sign updates to apps. > WhatsApp has done that to even more people, so what's the point of Signal? You know who implemented the end-to-end encryption in WhatsApp? The people behind Signal. But compared to Signal, WhatsApp provides a lot more metadata to the server, and it's owned by Facebook, a company not commonly associated with guarding your privacy. Both have their pros and cons, and both have legitimate reasons to exist.
      - jMyles 8y ago
        > That's not how Android app signing works. It's a "trust on first use" model, so once you install an app, any update must be signed by the same key or the system will refuse to install it. That key is held by Signal, not Google, so Google cannot sign updates to apps. My understanding (and I'd love to be corrected if I'm wrong) is that Google Play Services run with access to root privileges, and thus can circumvent this protection without the user becoming aware.
      - jhasse 8y ago
        > That's not how Android app signing works. Google has root, so it can change how app signing works at any time. > Both have their pros and cons, and both have legitimate reasons to exist. I just looks to me like whenever someone mentions a pro point of Signal, it's something where WhatsApp shines even more (e.g. "brings end-to-end encryption to the masses", "it's available on the App stores", "better iOS support than something like Tox", ...).
- deleted 8y ago
  [deleted]

by apeace 8y ago

IshKebab 8y ago

"It's easy! Just just generate a 2048 bit PGP key using this command (make sure you don't use the default insecure options) and then mail it through the post to anyone you need to communicate with."

jMyles 8y ago

The author expressly endorses Matrix.

apeace 8y ago
And which operating system does the author expect people to use Matrix on? The one he personally wrote and reviews every commit to? Does he expect everyone to only chat on "trusted" open-source desktop operating systems and not their phones? The F-Droid argument is a really empty one. Packages are cryptographically signed? Are you verifying those signatures? In an article about "trust", can you explain how exactly you trust F-Droid packages and not Google Play ones? What about iOS? The whole article is extremely vapid and lacks any compelling argument. Signal has introduced state-of-the-art encryption to millions of people in an accessible way. The author goes on to poke fun at the animated GIF feature of Signal as if it is a waste of time compared to working on an F-Droid distribution, but neglects to address five of the seven points written by Moxie (which he links to) about why they chose not to do that.
- jhasse 8y ago
  > In an article about "trust", can you explain how exactly you trust F-Droid packages and not Google Play ones? It's easier for Google to manipulate a package on Google Play than on F-Droid. > Signal has introduced state-of-the-art encryption to millions of people in an accessible way. WhatsApp has done that to even more people, so what's the point of Signal?
  - lorenzhs 8y ago
    > It's easier for Google to manipulate a package on Google Play than on F-Droid. That's not how Android app signing works. It's a "trust on first use" model, so once you install an app, any update must be signed by the same key or the system will refuse to install it. That key is held by Signal, not Google, so Google cannot sign updates to apps. > WhatsApp has done that to even more people, so what's the point of Signal? You know who implemented the end-to-end encryption in WhatsApp? The people behind Signal. But compared to Signal, WhatsApp provides a lot more metadata to the server, and it's owned by Facebook, a company not commonly associated with guarding your privacy. Both have their pros and cons, and both have legitimate reasons to exist.
    - jMyles 8y ago
      > That's not how Android app signing works. It's a "trust on first use" model, so once you install an app, any update must be signed by the same key or the system will refuse to install it. That key is held by Signal, not Google, so Google cannot sign updates to apps. My understanding (and I'd love to be corrected if I'm wrong) is that Google Play Services run with access to root privileges, and thus can circumvent this protection without the user becoming aware.
    - jhasse 8y ago
      > That's not how Android app signing works. Google has root, so it can change how app signing works at any time. > Both have their pros and cons, and both have legitimate reasons to exist. I just looks to me like whenever someone mentions a pro point of Signal, it's something where WhatsApp shines even more (e.g. "brings end-to-end encryption to the masses", "it's available on the App stores", "better iOS support than something like Tox", ...).
deleted 8y ago
[deleted]