4 ms·
I don't know that I made any extrodinary claims. You did ask me if I audited things before and I answered honestly. I frequently report vulnerabilities in a ra
by lrvick 8y ago
I don't know that I made any extrodinary claims.
You did ask me if I audited things before and I answered honestly. I frequently report vulnerabilities in a range of open and closed systems and read a lot about those others find. I also don't consider myself an expert and generally distrust people that claim they are in this space because it is, as you say, really hard.
I initially started a spreadsheet to document the very high level objective traits of messengers I find useful and others found it interesting/useful and helped extend it.
It is far too much cognitive overhead to do deep dive evaluation of 75+ messengers, but what this list allows one to do is quickly eliminate services from consideration that lack features vital to address their use cases, platform targets, or threat profile: for instance the ability to self host, or end to end encryption.
From there once you have your short list, you can then make more effective use of time reading code, doing audits, reviewing audits of others.
If a list like this simply makes someone aware of new up and coming projects in the space, or old ones that have been quietly evolving in capability... then I feel justified in having shared it instead of having kept it as a private document of my personal notes.
I for one learned about a number of new projects when putting this sheet together, and interesting new approaches on solving these problems.
The thing that is pretty subjective about the list is how I sorted items based on my own research and threat profile.
I won't sit here and say Matrix or briar or any other items near the top are perfect, or lacks any security flaws. I personally place my bets on Matrix at this point based on my deep dive evaluation of it and similarly featured alternatives, but that is subject to change! Others are free to share your view that a well funded but closed source messenger like whatsapp is the general best bet.
To sober up on this topic a bit: Matrix has had glaring security flaws in the past, but also so have the options you personally recommend like Signal and Whatsapp.
At the end of the day all one can do is collect data, look over all the options, deep dive into the relative merits and claims of each to the extent one can, look at the research provided by others, and make a judgement call.
This list should be considered a starting point for research and a way to discover lesser known projects as it was for me.
It should -not- be seen as an end all "use this it is most secure" recommendation by any means. Anyone that looks at any one high level list of binary data points and makes an exclusive choice on that alone is doomed to shoot themselves in the foot with or without my help.
Hopefully that addresses your concerns about my intent here.
- pvg 8y agoI don't know that I made any extrodinary claims. You published a spreadsheet listing messaging apps 'ordered by security' in which Signal, Whatsapp and iMessage are shown as way less secure than IRC. It also still says, and you've repeatedly argued here, that things like whether, say, WhatsApp uses E2E encryption is essentially unknowable.
- smbullet 8y agoThe apps listed in the spreadsheet are clearly sorted by number of features supported (with weights). I don't think OP is necessarily claiming IRC is more secure than Signal.
- pvg 8y agoThey are sorted largely by security, according to the author. "It is currently roughly sorted by security. Usability is subjective and people can work down the list to the most secure tool they feel they can comfortably use." https://news.ycombinator.com/item?id=18233721 https://news.ycombinator.com/item?id=18233721
- smbullet 8y agoOops, I guess I missed that comment. Thanks!
- lrvick 8y agoYou are correct. I generalized this as "roughly sorted by security". Some in the list, like Tox, have notable design flaws, but this list is binary and does not account for implementation quality. This is mostly for discovery of options to consider diving into.
- tptacek 8y agoHe's not correct (as he has since acknowledged!), and you did, and still do, suggest that placement on the chart implies greater or lesser security. You literally included instructions on how to read and use the chart that make that point. "Usability is subjective and people can work down the list to the most secure tool they feel they can comfortably use."