5 ms·

Considering the BND's (German equivalent of NSA) love of intercepting traffic and gathering metadata about citizens, I wouldn't put "funded by the German govern

Considering the BND's (German equivalent of NSA) love of intercepting traffic and gathering metadata about citizens, I wouldn't put "funded by the German government" in the Pro column.

tuukkah 7y ago
One, end-to-end encrypted push service can make any intercepted data useless, as you cannot even know if the traffic corresponds to a message or is just a ping, let alone which app or contact the message is from.
- _-___________-_ 7y ago
  I actually doubt this is the case. Pings probably happen on some relatively-predictable interval, while a back-and-forth conversation between two parties is going to result in push notifications with much shorter intervals than any reasonable ping implementation would use. The metadata might be limited in value, but it still has some value, and I think it could easily be distinguished from pings. Do you have any references for your assertion?
  - sliken 7y ago
    Sure a determined attacked with control over hardware in the network path can analyze the timing and packet sizes. However a smart application/protocol writer could make make a ping and a message delivery take the same number of bytes. Which of course means some wasted payload on pings. Additionally if trying to track peers you could every N seconds send a ping OR a message. After all if you succeed in sending a message you know the peer is reachable. So it's possible, but no idea how careful OpenPush is though.
    - _-___________-_ 7y ago
      Any attacker in a position to inspect traffic in the path between a push service and a mobile device is probably determined. I agree about the countermeasures, though.
      - sliken 7y ago
        I've pondered DHT nodes for a basis privacy protecting network of peers. There's a fair bit of traffic for tracking peers. Each peer could use their peerID as a public key. A bit of padding on the normal traffic (mostly get, put, ping, and findpeer) could hide messaging. Likely not a good fit for TCP streams (like tor), but could easily hide enough bandwidth for instant messaging (like signal) or email, er email like service. Could hide store/forwarding, include onion routing (bouncing through a few nodes), and be quite resistant to traffic analysis. If each node send X packets of Y bytes to Z nodes per minute then it would be quite hard indeed to tell who you were talking to. Maybe give peers a few choices in high bandwidth, medium bandwidth, and low bandwidth configurations. All would just vary in the number of nodes they track.
TuringTest 7y ago
It may be a case of German government's right hand not knowing what German government's left hand is doing. An open source distributed framework can't be coerced into routing its messages through a central server for surveillance.
- TrickyRick 7y ago
  That's a good point!
- ge0rg 7y ago
  Open Source and centralized are orthogonal to each other. Signal is both, just to name an example. An open push framework only makes sense (for battery optimization at least) if it's centralized, and all applications make use of it.
  - ryukafalz 7y ago
    >An open push framework only makes sense (for battery optimization at least) if it's centralized, and all applications make use of it. Sure, from the perspective of a single device. But that doesn't mean all devices have to use the same push server.
    - ge0rg 7y ago
      So as an app developer, I need to integrate each of those into my app, or provide alternative builds for all?
      - lern_too_spel 7y ago
        No, you need to use a library that allows the user to configure the push server, which should be configured device-wide and communicated to the app server.
        ryukafalz 7y ago
        Exactly. I believe this is how Web Push works; the major browser vendors each run their own push servers, and the protocol is standardized.
dr_hooo 7y ago
I see no reason make this negative link. The BMBF is a research agency which gives out grants for research through public calls (somewhat similar to the NSF in the US). There are no strings attached, besides providing reports on scientific contributions achieved throughout the project. It's not like the BND will come knocking on your door saying make algorithm X weak or you will not receive funding (or worse).

Considering the BND's (German equivalent of NSA) love of intercepting traffic and gathering metadata about citizens, I wouldn't put "funded by the German government" in the Pro column.

tuukkah 7y ago

One, end-to-end encrypted push service can make any intercepted data useless, as you cannot even know if the traffic corresponds to a message or is just a ping, let alone which app or contact the message is from.

_-___________-_ 7y ago
I actually doubt this is the case. Pings probably happen on some relatively-predictable interval, while a back-and-forth conversation between two parties is going to result in push notifications with much shorter intervals than any reasonable ping implementation would use. The metadata might be limited in value, but it still has some value, and I think it could easily be distinguished from pings. Do you have any references for your assertion?
- sliken 7y ago
  Sure a determined attacked with control over hardware in the network path can analyze the timing and packet sizes. However a smart application/protocol writer could make make a ping and a message delivery take the same number of bytes. Which of course means some wasted payload on pings. Additionally if trying to track peers you could every N seconds send a ping OR a message. After all if you succeed in sending a message you know the peer is reachable. So it's possible, but no idea how careful OpenPush is though.
  - _-___________-_ 7y ago
    Any attacker in a position to inspect traffic in the path between a push service and a mobile device is probably determined. I agree about the countermeasures, though.
    - sliken 7y ago
      I've pondered DHT nodes for a basis privacy protecting network of peers. There's a fair bit of traffic for tracking peers. Each peer could use their peerID as a public key. A bit of padding on the normal traffic (mostly get, put, ping, and findpeer) could hide messaging. Likely not a good fit for TCP streams (like tor), but could easily hide enough bandwidth for instant messaging (like signal) or email, er email like service. Could hide store/forwarding, include onion routing (bouncing through a few nodes), and be quite resistant to traffic analysis. If each node send X packets of Y bytes to Z nodes per minute then it would be quite hard indeed to tell who you were talking to. Maybe give peers a few choices in high bandwidth, medium bandwidth, and low bandwidth configurations. All would just vary in the number of nodes they track.

TuringTest 7y ago

It may be a case of German government's right hand not knowing what German government's left hand is doing. An open source distributed framework can't be coerced into routing its messages through a central server for surveillance.

TrickyRick 7y ago
That's a good point!
ge0rg 7y ago
Open Source and centralized are orthogonal to each other. Signal is both, just to name an example. An open push framework only makes sense (for battery optimization at least) if it's centralized, and all applications make use of it.
- ryukafalz 7y ago
  >An open push framework only makes sense (for battery optimization at least) if it's centralized, and all applications make use of it. Sure, from the perspective of a single device. But that doesn't mean all devices have to use the same push server.
  - ge0rg 7y ago
    So as an app developer, I need to integrate each of those into my app, or provide alternative builds for all?
    - lern_too_spel 7y ago
      No, you need to use a library that allows the user to configure the push server, which should be configured device-wide and communicated to the app server.
      - ryukafalz 7y ago
        Exactly. I believe this is how Web Push works; the major browser vendors each run their own push servers, and the protocol is standardized.

dr_hooo 7y ago

I see no reason make this negative link. The BMBF is a research agency which gives out grants for research through public calls (somewhat similar to the NSF in the US). There are no strings attached, besides providing reports on scientific contributions achieved throughout the project. It's not like the BND will come knocking on your door saying make algorithm X weak or you will not receive funding (or worse).