4 ms·

Here's the obligatory reference to the source code not being fully open: https://threema.ch/en/faq/source_code https://threema.ch/en/faq/source_code Yes, they

Here's the obligatory reference to the source code not being fully open: https://threema.ch/en/faq/source_code https://threema.ch/en/faq/source_code Yes, they sent some source code for security review in 2015, but there is no guarantee that the binary you download is related to that source code at all. Nowadays I'd expect a secure messaging app to not just be open source, but also have reproducible builds (checked by third parties). It would be nice to have Binary Transparency too, so that people can check that they are being offered the same binary as other users are getting.

giancarlostoro 8y ago
Binary transparency would be nice to see even with Signal. A notification is sent from one client to the next encrypted if either party is not up to date sent to both parties in the convo, and another if their apps are not properly sourced. Since these notifications would be sent end to end encrypted only both parties should in theory know. Then if the feature ever got removed... It would be a canary of its own. Could be applied to any other app that attempts to do end to end encryption.
- bredren 8y ago
  With Gliph for iOS, we tried binary transparency by trying to track a hash of the app binary after building. The idea is we'd publish the hash with each version increment or include the hash in the description of the updates. However, I believe we found that Apple would alter the binary prior to release so we couldn't even guarantee the binary Apple was producing was ours. So it was not possible to allow users a way to validate even from the time of our closed-source build.
  - azinman2 8y ago
    If this is important to you I’d suggest filing a bug report. Apple is very sensitive to privacy needs and such a need us likely not on the radar.
dweekly 8y ago
Are there best-practices public platforms for generating and/or verifying reproducible builds? I'm not aware of this as a feature with GitHub or similar.
- dane-pgp 8y ago
  There is some documentation about the cross-distro effort to produce reproducible package builds here: https://reproducible-builds.org/docs/sharing-certifications/ https://reproducible-builds.org/docs/sharing-certifications/ and this is a good explanation about Mozilla's plan for logging Binary Transparency results: https://wiki.mozilla.org/Security/Binary_Transparency https://wiki.mozilla.org/Security/Binary_Transparency
huhtenberg 8y ago
> reproducible builds Are there any IMs that actually have these?
- BlackLotus89 8y ago
  Signal since 2016 https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/
- deleted 8y ago
  [deleted]
- equalunique 8y ago
  Briar[0] on F-Droid[1]. [0] https://briarproject.org/ https://briarproject.org/ [1] https://f-droid.org/en/2018/08/16/twif-17-the-reproducible-builds-and-encrypted-e-mail-edition.html https://f-droid.org/en/2018/08/16/twif-17-the-reproducible-b...
chappi42 8y ago
At this time, their 'No Ads, No Investors, No Conflicts of Interest' phrase (and a very polished product which even runs great on my Jolla), is more important for me than source. Of course, not being FOSS is a pity, a trade-off. But I believe their 'solid business' would be made impossible then. (Unless someone invests $50 million or so - but frankly I prefer the status quo).
- znpy 8y ago
  > No Investors Uhm... Would one be able to verify that? Threema is a swiss company, and Switzerland is known for their high standards in terms of privacy. Would it be possible to see who owns the shares of Threema the company?
  - bobjob 8y ago
    There are no shares. It is a GmbH, which means a group of people(1-x, persons or other legal identidies) owns the company... There should be public records of owners you can follow. Understanding German and swiss law is probably helpful.
    - pjtr 8y ago
      Those public records are the Commercial Register: https://sz.chregister.ch/cr-portal/auszug/auszug.xhtml?uid=CHE-221.440.104 https://sz.chregister.ch/cr-portal/auszug/auszug.xhtml?uid=C...
    - dbrgn 8y ago
      The startup scene in Switzerland is quite different from silicon valley. There are still a lot of "classic small company" startups that start with a business idea, try to become self-financed as soon as possible and then slowly build upon that. It's a very sustainable model, you add more people once you can pay them, and most people that fund a company like that are in it for the long term. In contrast, the silicon valley idea of a startup is "get as much investor money as you can get, grow your team quickly, become a unicorn, sell your company and cash out, rinse and repeat". Both have their advantages and disadvantages, but especially for privacy focused products I prefer to get those from companies that finance themselves, and that don't have big VC investors which will want to see big ROI sooner or later. If the startup behind a free product I use is sold, then my user data is sold with the company. And usually financial interests stand above privacy considerations. (Obviously, otherwise the investors wouldn't invest.) Money is power. Ideally your money comes from your users.
nickpsecurity 8y ago
"Nowadays I'd expect a secure messaging app to not just be open source, but also have reproducible builds (checked by third parties). " Alternatively, they can make it paid, shared source to allow inspections while simultaneously making money. If aiming for contributions to paid source (eg bug fixes or feature improvements), they can make the licenses irrevocable per version with the OS interfacing parts permissive, open source with allowance to swap them out as desired. So, the old version could be updated legally for new platforms giving potentially, perpetual ROI. People wanting upgrades or security fixes have to buy the new version or maintain a subscription. I mean, nothing would stop people from just doing that themselves with the source shared. I just figure lots of paying customers will stay paying customers switching for reasons having nothing to do with source license. They move for all kinds of non-security, non-philosophical reasons.

giancarlostoro 8y ago

Binary transparency would be nice to see even with Signal. A notification is sent from one client to the next encrypted if either party is not up to date sent to both parties in the convo, and another if their apps are not properly sourced. Since these notifications would be sent end to end encrypted only both parties should in theory know. Then if the feature ever got removed... It would be a canary of its own. Could be applied to any other app that attempts to do end to end encryption.

bredren 8y ago
With Gliph for iOS, we tried binary transparency by trying to track a hash of the app binary after building. The idea is we'd publish the hash with each version increment or include the hash in the description of the updates. However, I believe we found that Apple would alter the binary prior to release so we couldn't even guarantee the binary Apple was producing was ours. So it was not possible to allow users a way to validate even from the time of our closed-source build.
- azinman2 8y ago
  If this is important to you I’d suggest filing a bug report. Apple is very sensitive to privacy needs and such a need us likely not on the radar.

dweekly 8y ago

Are there best-practices public platforms for generating and/or verifying reproducible builds? I'm not aware of this as a feature with GitHub or similar.

dane-pgp 8y ago
There is some documentation about the cross-distro effort to produce reproducible package builds here: https://reproducible-builds.org/docs/sharing-certifications/ https://reproducible-builds.org/docs/sharing-certifications/ and this is a good explanation about Mozilla's plan for logging Binary Transparency results: https://wiki.mozilla.org/Security/Binary_Transparency https://wiki.mozilla.org/Security/Binary_Transparency

huhtenberg 8y ago

> reproducible builds Are there any IMs that actually have these?

BlackLotus89 8y ago
Signal since 2016 https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/
deleted 8y ago
[deleted]
equalunique 8y ago
Briar[0] on F-Droid[1]. [0] https://briarproject.org/ https://briarproject.org/ [1] https://f-droid.org/en/2018/08/16/twif-17-the-reproducible-builds-and-encrypted-e-mail-edition.html https://f-droid.org/en/2018/08/16/twif-17-the-reproducible-b...

chappi42 8y ago

At this time, their 'No Ads, No Investors, No Conflicts of Interest' phrase (and a very polished product which even runs great on my Jolla), is more important for me than source. Of course, not being FOSS is a pity, a trade-off. But I believe their 'solid business' would be made impossible then. (Unless someone invests $50 million or so - but frankly I prefer the status quo).

znpy 8y ago
> No Investors Uhm... Would one be able to verify that? Threema is a swiss company, and Switzerland is known for their high standards in terms of privacy. Would it be possible to see who owns the shares of Threema the company?
- bobjob 8y ago
  There are no shares. It is a GmbH, which means a group of people(1-x, persons or other legal identidies) owns the company... There should be public records of owners you can follow. Understanding German and swiss law is probably helpful.
  - pjtr 8y ago
    Those public records are the Commercial Register: https://sz.chregister.ch/cr-portal/auszug/auszug.xhtml?uid=CHE-221.440.104 https://sz.chregister.ch/cr-portal/auszug/auszug.xhtml?uid=C...
  - dbrgn 8y ago
    The startup scene in Switzerland is quite different from silicon valley. There are still a lot of "classic small company" startups that start with a business idea, try to become self-financed as soon as possible and then slowly build upon that. It's a very sustainable model, you add more people once you can pay them, and most people that fund a company like that are in it for the long term. In contrast, the silicon valley idea of a startup is "get as much investor money as you can get, grow your team quickly, become a unicorn, sell your company and cash out, rinse and repeat". Both have their advantages and disadvantages, but especially for privacy focused products I prefer to get those from companies that finance themselves, and that don't have big VC investors which will want to see big ROI sooner or later. If the startup behind a free product I use is sold, then my user data is sold with the company. And usually financial interests stand above privacy considerations. (Obviously, otherwise the investors wouldn't invest.) Money is power. Ideally your money comes from your users.

nickpsecurity 8y ago

"Nowadays I'd expect a secure messaging app to not just be open source, but also have reproducible builds (checked by third parties). " Alternatively, they can make it paid, shared source to allow inspections while simultaneously making money. If aiming for contributions to paid source (eg bug fixes or feature improvements), they can make the licenses irrevocable per version with the OS interfacing parts permissive, open source with allowance to swap them out as desired. So, the old version could be updated legally for new platforms giving potentially, perpetual ROI. People wanting upgrades or security fixes have to buy the new version or maintain a subscription. I mean, nothing would stop people from just doing that themselves with the source shared. I just figure lots of paying customers will stay paying customers switching for reasons having nothing to do with source license. They move for all kinds of non-security, non-philosophical reasons.