3 ms·

Technologically, it's end to end encryption, with forward secrecy. Done. We have lots of commercial and non commercial products that do this, from PGP to Signal

Technologically, it's end to end encryption, with forward secrecy. Done. We have lots of commercial and non commercial products that do this, from PGP to Signal. Even WhatsApp does it. Eventually, the elderly, uninformed US government is going to pass a law requiring a back door. And two things will happen: - someone nefarious will get the private key, and do something nefarious with it. (Hopefully no one will die) - offshore private messaging will become a thing. There's a market for bith insecure-but-endorsed and secure-but-illegal, to be sure. And the 5 eyes will probably fight for decades to squash private messaging. For a worst case scenario, see the war on drugs for an example of how this could go.

mirimir 8y ago
Yeah, I recently researched a piece on secure messaging apps. Briar and Ricochet are the only arguably secure ones. They're both P2P, and use Tor .onion services. Tox and Ring are also both P2P, but peer IPs are readily discoverable, so users are vulnerable to identity compromise. For the rest, all bets are off. Signal, Telegram and WhatsApp say in their privacy policies that they may disclose such account information as IP address and phone number when legally required. And there are no others that protect against identity compromise.
jstanley 8y ago
> Eventually, the elderly, uninformed US government is going to pass a law requiring a back door. Eventually, the elederly, uninformed governments are going to die off, to be replaced with younger governments. Still uninformed, but hopefully less tyrannical. > offshore private messaging will become a thing. This won't have to happen. Just because the law says there has to be a backdoor doesn't mean open source software developers will comply. Develop your software anonymously, release it anonymously, and run it wherever you want. It doesn't need to be a service provided by a company in a foreign land, it can just be software you run on your own computer.
- cyphar 8y ago
  > Still uninformed, but hopefully less tyrannical. I don't think this is a reasonable thing to just hope for. Historically, governments have always had tyrannical streaks and I don't think it makes much sense to simply assert that "this time it'll be different". It probably won't.
  - jstanley 8y ago
    I think policy just lags social acceptance. It never used to be legal to be homosexual, for example, then it became socially acceptable, and then a generation of politicians had to die off, and then it became legal.
- aleksei 8y ago
  > It doesn't need to be a service provided by a company in a foreign land, it can just be software you run on your own computer. Problem is, in a worst case scenario ISPs could be compelled to proxy all traffic through government boxes for analysis. At that point any suspicious activity will probably be frowned upon.
  - mirimir 8y ago
    That's why it's gotta be spread as malware, for plausible deniability, and use covert channels, to make detection difficult.

mirimir 8y ago

Yeah, I recently researched a piece on secure messaging apps. Briar and Ricochet are the only arguably secure ones. They're both P2P, and use Tor .onion services. Tox and Ring are also both P2P, but peer IPs are readily discoverable, so users are vulnerable to identity compromise. For the rest, all bets are off. Signal, Telegram and WhatsApp say in their privacy policies that they may disclose such account information as IP address and phone number when legally required. And there are no others that protect against identity compromise.

jstanley 8y ago

> Eventually, the elderly, uninformed US government is going to pass a law requiring a back door. Eventually, the elederly, uninformed governments are going to die off, to be replaced with younger governments. Still uninformed, but hopefully less tyrannical. > offshore private messaging will become a thing. This won't have to happen. Just because the law says there has to be a backdoor doesn't mean open source software developers will comply. Develop your software anonymously, release it anonymously, and run it wherever you want. It doesn't need to be a service provided by a company in a foreign land, it can just be software you run on your own computer.

cyphar 8y ago
> Still uninformed, but hopefully less tyrannical. I don't think this is a reasonable thing to just hope for. Historically, governments have always had tyrannical streaks and I don't think it makes much sense to simply assert that "this time it'll be different". It probably won't.
- jstanley 8y ago
  I think policy just lags social acceptance. It never used to be legal to be homosexual, for example, then it became socially acceptable, and then a generation of politicians had to die off, and then it became legal.
aleksei 8y ago
> It doesn't need to be a service provided by a company in a foreign land, it can just be software you run on your own computer. Problem is, in a worst case scenario ISPs could be compelled to proxy all traffic through government boxes for analysis. At that point any suspicious activity will probably be frowned upon.
- mirimir 8y ago
  That's why it's gotta be spread as malware, for plausible deniability, and use covert channels, to make detection difficult.