7 ms·
I just tried the app via the US App Store and it requires you to verify through SMS before use. This means that it’s neither anonymous nor fit for use in a disa
by bitcurious 7y ago
I just tried the app via the US App Store and it requires you to verify through SMS before use. This means that it’s neither anonymous nor fit for use in a disaster zone.
Good example of software that would be better if open source.
- i_am_proteus 7y agoI had the same experience and was disappointed. But a good mesh app is inherently difficult to monetize! Combining mesh over some/several form(s) of 802.11, Signal protocol public key distribution "locally" via QR code, and Delay-Tolerant Networking (Cerf et al. 2007) would be the holy grail (and would have no reliance on SMS or phone number) and also could not be monetized. Which is a damn shame, because it's eminently technically feasible, but complicated enough that I'd probably need a professional team to implement.
- mehhh 7y agoCharging businesses to use it would be a path to monetization, hence WhatsApp's partnership with Twilio.
- i_am_proteus 7y agoNot a bad point, but what business prefers a mesh to a centralized messaging system?
- mehhh 7y agoMost businesses do not care about the technical details of the platforms they use. Look at adoption of the PSTN (centralized) & Email (federated and interoperable) among businesses, they migrate to where their customers are most reachable.
- discordance 7y agoBusinesses selling gas masks, helmets and med-kits?
- FridgeSeal 7y agoCyberpunk future, here we come!
- anigbrowl 7y agoConstruction industry supply would prefer to sell you walkie-talkies
- ma2rten 7y agoDoes everything need to be monetized?
- deelowe 7y agoThese days? It appears so.
- i_am_proteus 7y agoNo! But assembling the talent to build a product without a potential source of revenue is difficult.
- joering2 7y agoI used a simple mobile "burner" and was fine to authenticate. I bought bunch of $5 cards with cash in a small store and used this one in my dumb flip phone bought on a flea market few months ago. I am certain to a high degree that's pretty enough setup to stay under radar.
- Phlarp 7y agoThis burner phone and your "real" phone are going to be easy to correlate retroactively based on the towers they are both hitting
- mehhh 7y agoHopefully OP uses a different cell network than the one Simple Mobile rides atop.
- Phlarp 7y agoThis kind of device matching can be done across any of the carriers or their MVNOs, all of them give up the data when asked by a government entity. Many tower locations will even be identical across carriers, making the matching even easier. Also this correlation could be done with stingray towers without bringing the cell carriers into the loop.
- wolco 7y agoWith the higher clustered protestors the tower linking won't be as identifiable as you might think.
- Phlarp 7y agoIt may take longer to get enough samples to filter out unwanted user associations but if you have all the data points from every tower retroactively over ~10 weeks of protest it's going to be difficult to hide. I don't think gp here is in china, but rather just offering their procedure for acquiring a burner phone.
- cwyers 7y agoHow would it being open source solve the problem of addressing?
- kspacewalk2 7y agoAddresses can be made non-identifying.
- cwyers 7y agoYes, but people typically want addresses to be identifying to _somebody_ otherwise they're not actually all that useful. If I am Alice and know Bob, I want to know Bob's address. Using the cell phone number, an address I already have for Bob, solves that problem. Verifying the number via SMS provides some reasonable (but not ironclad) guarantees that it actually is Bob. Yes, as an address scheme, it prioritizes convenience over other things. If you want wide acceptance, that's a requirement. Wide acceptance can be useful if you need to adopt something in a hurry and you didn't think to set up something in advance. It's also great because it isn't exactly great opsec to look different from the crowd, and using Tor is a giant "HI I AM DOING CRIMES" beacon to the world.
- newscracker 7y agoThen why hasn’t that happened with Signal yet? Being open source may not have much of a correlation on how features change for such apps.
- cwyers 7y agoSignal is really three things with the same name (four or five, if you count the foundation and/or the LLC): 1) The Signal protocol, which can have multiple implementations (WhatsApp, Facebook Messenger and Skype all use it), 2) The Signal client and server, which are open source, and 3) The Signal service operated by Signal Messenger, LLC. You can use either 1 or 2 to implement a system that doesn't require a phone number to use. Wire, for instance, is a messenger that has adopted parts of the Signal protocol and the Signal source code. [https://github.com/wireapp/proteus/blob/develop/src/internal/session.rs#L2 https://github.com/wireapp/proteus/blob/develop/src/internal...] What you can't do is change how the Signal servers operated by Signal Messenger are operated, or refer to your own client/server using Signal trademarks.
- goatsi 7y agoFor an open source, anonymous version of this check out the Briar Project: https://briarproject.org/how-it-works/ https://briarproject.org/how-it-works/
- socceroos 7y agoExactly this. I don't see any other solution that offers remotely near the same privacy that Briar does.
- computerfriend 7y agoBriar is definitely far superior. However, one major drawback is that it is not cross platform. This alone means it won't gain traction in the Hong Kong protests, unfortunately.
- vertis 7y agoBriar looks very interesting, however it lacks the broadcast mode that Bridgefy has, which I suspect is a major feature for coordinating a protest. It also lacks the ability to use existing contacts (you have to do a QR code exchange).
- Sami_Lehtinen 7y agoStill quite useless, because key exchange process is so badly designed. But they've promised to fix this in future.
- jorgeribs 7y agoHi! You can skip the SMS verification step, which is how thousands of people have used it after earthquakes and hurricanes :) we also have an SDK so that developer can create their own app and make it work however they want.
- x62Bh7948f 7y agohow do you skip verification? after hitting the cancel button the start screen shows again
- rcw4256 7y agoApparently you need to fail verification a few times before it'll present the option. I kept giving it bogus phone numbers and eventually a "skip" button appeared.
- jay_kyburz 7y agoI wouldn't trust an app where the first thing you have to do is navigate dark patterns.
- quaquaqua1 7y agoI wouldn't either, but it would seem that HKers don't have many options at this time. Hope more are identified and that there aren't malicious intentions with this current one.
- SolarNet 7y agoIt's likely because of those dark patterns that they can use it in the first place given how walled garden app stores treat apps that do allow for actual anonymous or distributed messaging systems.
- jorgeribs 7y agoHow is that a dark pattern? It's better if you do verify, so you can see your contacts and others can know it's you. If that fails, then we offer to use the app without verification.
- aussieguy1234 7y agoNext step, Chinese intelligence hacks their database of verified phone numbers. Anonymity over. Having the resources of a nation state, they could probably do it easily.
- pishpash 7y agoOr join as a malicious node. There is no panacea without control over some infrastructure.
- Ar-Curunir 7y agoFor something as low latency as messaging, you can probably use proof of work for DoS resistance
- newnewpdro 7y agoBecause messaging software that drains batteries is what everyone wants...
- m-p-3 7y agoIt's better than the alternative, which is no messaging.
- newnewpdro 7y agoPoW or no messaging seems to me like an obviously false dichotomy.
- henearkr 7y agoIf they were doing E2E encryption, that would not be a problem. Broadcasting to find the right recipient (the one with the decrypting key) but contents protected from everybody else.
- lclarkmichalek 7y ago
- mhh__ 7y agoIs there any software that would be worse when open source?
- cygaril 7y agoOnline game clients which attempt to verify that a human is playing rather than a bot.
- fooker 7y agoSearch engines, an adversary knowing how the ranking works can manipulate(/'optimize') results seen by the users.
- whenchamenia 7y agoOnly those that use the widely debunked 'Security through obscurity" model. So most of it unfortunately.