5 ms·

It's good to see Acton quoted; he'd been so silent since his donation-to/association-with Signal that I was beginning to wonder if behind the scenes, there'd be

by gojomo 7y ago

It's good to see Acton quoted; he'd been so silent since his donation-to/association-with Signal that I was beginning to wonder if behind the scenes, there'd been a falling out. However, these "enrichment features" from Signal over the last 2 years are less than what competitors like Telegram put out in 2 months. Really basic things remain undone. Like being able to carry your contacts/message-history forward across planned device-upgrades on iOS – https://github.com/signalapp/Signal-iOS/issues/2542 https://github.com/signalapp/Signal-iOS/issues/2542 – 4.5 years after it was "on the roadmap". Many of Signal's novel cryptographic innovations, while cool, depend on trusting Intel SGX: both as a technology & in Intel's stewardship of the master keys/attestation-chains. Many cryptographers don't believe SGX will be technologically reliable anytime soon, and much of the world will probably see US-based Intel Corp similar to how the US sees China-based Huawei.

balladeer 7y ago
Kind of unfortunate that Matrix is probably not focussing on making the protocol and apps easy to get on and use Matrix/Riot as a WhatsApp, Signal replacement for end users (person to person comm). It seems to be just for teams and orgs (Slack, Discord).
- Arathorn 7y ago
  RiotX (the next gen of Riot) is a Matrix client from the core team, designed to go up against WhatsApp/FB Messenger/iMessage by default... and then expand into Slack/Discord style use cases for powerusers who want that. It's currently in the final stages of beta on Android: https://play.google.com/store/apps/details?id=im.vector.riotx https://play.google.com/store/apps/details?id=im.vector.riot... Meanwhile there are lots of other promising Matrix clients emerging which are aiming for person-to-person comms - e.g. http://dittochat.org http://dittochat.org, https://pattle.im https://pattle.im, https://fluffy.chat https://fluffy.chat etc.
  - fladd 7y ago
    The fact that there exist other clients that are specifically "built with user experience in mind" (Ditto) or built "to be a Matrix app that everyone can use" (Pattle) sometimes makes me wonder why that would not also be the goal of the official client?
    - balladeer 7y ago
      I think RiotX is supposed to replace Riot eventually, at least the Android client https://github.com/vector-im/riotX-android https://github.com/vector-im/riotX-android. Didn't find a link for an iOS client though.
maqp 7y ago
"Many cryptographers don't believe SGX will be technologically reliable anytime soon" E.g. for online backups, SGX will only handle rate limiting. If you're using sufficiently secure password (+80 bits), Argon2 will provide robust enough security for your login and not even a backdoor in SGX matters.
gdoptimizer 7y ago
I second this. I like Signal and appreciate all the efforts people put in. But I don’t really care how Signal added cute stickers or optimized image showing. I just need a privacy app and keep my data. The only reason I didn’t recommend Signal to my non-tech friends was not being able to migrate/export chat history on iOS. This seems to be such a basic (not necessarily easy) thing to do but they just didn’t do it.
- deleted 7y ago
  [deleted]
- distances 7y ago
  > But I don’t really care how Signal added cute stickers or optimized image showing. That's maybe true for privacy enthusiasts. You severely underestimate the need for these cutesy features when targeting mass market though. I claim stickers are much more important for that than data exporting.
  - dejj 7y ago
    > cutesy features Personally, I don't care much for features supporting cyber-grooming. What's the point of using cutesy features to attract users who don't care about security, just so someone else can _securely_ cyber-groom them?
    - meowface 7y ago
      Can you elaborate? I'm not totally sure what you're defining "cyber-grooming" as here.
    - codewiz 7y ago
      The point is: if those users don't use Signal, you're forced to use another IM when you want to communicate with them.
    - distances 7y ago
      Are you somehow equating stickers and grooming? That takes quite a leap of imagination. Stickers aren't targeting young audiences in any sense. It's very weird to draw such conclusions just if you're not using them yourself (if that's the case).
DyslexicAtheist 7y ago
this popped up a few days ago. Could become an interesting alternative ode day. It's p2p based (no blockchain nonsense): > Session is an open-source, public-key-based secure messaging application which uses a set of decentralized storage servers and an onion routing protocol to send end-to-end encrypted messages with minimal exposure of user metadata. It does this while also providing common features of mainstream messaging applications https://news.ycombinator.com/item?id=22306140 https://news.ycombinator.com/item?id=22306140 whitepaper: https://getsession.org/wp-content/uploads/2020/02/Session-Whitepaper.pdf https://getsession.org/wp-content/uploads/2020/02/Session-Wh...
Vinnl 7y ago
> However, these "enrichment features" from Signal over the last 2 years are less than what competitors like Telegram put out in 2 months. It should be noted that most of these were released at breakneck speed in the past couple of months. It feels like they spent most of the past two years hiring and training new people, probably stabilising the code bases a bit, and that that's now starting to pay off.
Certhas 7y ago
Signal is on route to add contact/data recovery: https://www.signal.org/blog/secure-value-recovery/ https://www.signal.org/blog/secure-value-recovery/ ... they also cite this as a bottleneck for adding non-phone identifiers. It seems like they are putting the infrastructure in place to fix a lot of the remaining usability issues that people have with them.
- gojomo 7y ago
  'Secure Value Recovery' that will rely on their newfangled, Intel®-SGX-dependent trustworthy cloud key services. Why do they need me to trust Intel, or novel crypto/software that might be deployed in... when exactly? Why can't they let me just trust the same secure backups that all my other sensitive data/communications are in?
  - Groxx 7y ago
    SGX that, as a user, you can't even verify is in use. I really don't know why they're focusing on things like this. It does nothing to increase evidence-based trust, so it's no better than saying "we added a rate limiter, and delete keys after X attempts" (which I'd be totally fine with, and they could probably put in place in practically no time). Either way you're still relying on them doing what they said they're doing.

by gojomo 7y ago

balladeer 7y ago

Kind of unfortunate that Matrix is probably not focussing on making the protocol and apps easy to get on and use Matrix/Riot as a WhatsApp, Signal replacement for end users (person to person comm). It seems to be just for teams and orgs (Slack, Discord).

Arathorn 7y ago
RiotX (the next gen of Riot) is a Matrix client from the core team, designed to go up against WhatsApp/FB Messenger/iMessage by default... and then expand into Slack/Discord style use cases for powerusers who want that. It's currently in the final stages of beta on Android: https://play.google.com/store/apps/details?id=im.vector.riotx https://play.google.com/store/apps/details?id=im.vector.riot... Meanwhile there are lots of other promising Matrix clients emerging which are aiming for person-to-person comms - e.g. http://dittochat.org http://dittochat.org, https://pattle.im https://pattle.im, https://fluffy.chat https://fluffy.chat etc.
- fladd 7y ago
  The fact that there exist other clients that are specifically "built with user experience in mind" (Ditto) or built "to be a Matrix app that everyone can use" (Pattle) sometimes makes me wonder why that would not also be the goal of the official client?
  - balladeer 7y ago
    I think RiotX is supposed to replace Riot eventually, at least the Android client https://github.com/vector-im/riotX-android https://github.com/vector-im/riotX-android. Didn't find a link for an iOS client though.

maqp 7y ago

"Many cryptographers don't believe SGX will be technologically reliable anytime soon" E.g. for online backups, SGX will only handle rate limiting. If you're using sufficiently secure password (+80 bits), Argon2 will provide robust enough security for your login and not even a backdoor in SGX matters.

gdoptimizer 7y ago

I second this. I like Signal and appreciate all the efforts people put in. But I don’t really care how Signal added cute stickers or optimized image showing. I just need a privacy app and keep my data. The only reason I didn’t recommend Signal to my non-tech friends was not being able to migrate/export chat history on iOS. This seems to be such a basic (not necessarily easy) thing to do but they just didn’t do it.

deleted 7y ago
[deleted]
distances 7y ago
> But I don’t really care how Signal added cute stickers or optimized image showing. That's maybe true for privacy enthusiasts. You severely underestimate the need for these cutesy features when targeting mass market though. I claim stickers are much more important for that than data exporting.
- dejj 7y ago
  > cutesy features Personally, I don't care much for features supporting cyber-grooming. What's the point of using cutesy features to attract users who don't care about security, just so someone else can _securely_ cyber-groom them?
  - meowface 7y ago
    Can you elaborate? I'm not totally sure what you're defining "cyber-grooming" as here.
  - codewiz 7y ago
    The point is: if those users don't use Signal, you're forced to use another IM when you want to communicate with them.
  - distances 7y ago
    Are you somehow equating stickers and grooming? That takes quite a leap of imagination. Stickers aren't targeting young audiences in any sense. It's very weird to draw such conclusions just if you're not using them yourself (if that's the case).

DyslexicAtheist 7y ago

this popped up a few days ago. Could become an interesting alternative ode day. It's p2p based (no blockchain nonsense): > Session is an open-source, public-key-based secure messaging application which uses a set of decentralized storage servers and an onion routing protocol to send end-to-end encrypted messages with minimal exposure of user metadata. It does this while also providing common features of mainstream messaging applications https://news.ycombinator.com/item?id=22306140 https://news.ycombinator.com/item?id=22306140 whitepaper: https://getsession.org/wp-content/uploads/2020/02/Session-Whitepaper.pdf https://getsession.org/wp-content/uploads/2020/02/Session-Wh...

Vinnl 7y ago

> However, these "enrichment features" from Signal over the last 2 years are less than what competitors like Telegram put out in 2 months. It should be noted that most of these were released at breakneck speed in the past couple of months. It feels like they spent most of the past two years hiring and training new people, probably stabilising the code bases a bit, and that that's now starting to pay off.

Certhas 7y ago

Signal is on route to add contact/data recovery: https://www.signal.org/blog/secure-value-recovery/ https://www.signal.org/blog/secure-value-recovery/ ... they also cite this as a bottleneck for adding non-phone identifiers. It seems like they are putting the infrastructure in place to fix a lot of the remaining usability issues that people have with them.

gojomo 7y ago
'Secure Value Recovery' that will rely on their newfangled, Intel®-SGX-dependent trustworthy cloud key services. Why do they need me to trust Intel, or novel crypto/software that might be deployed in... when exactly? Why can't they let me just trust the same secure backups that all my other sensitive data/communications are in?
- Groxx 7y ago
  SGX that, as a user, you can't even verify is in use. I really don't know why they're focusing on things like this. It does nothing to increase evidence-based trust, so it's no better than saying "we added a rate limiter, and delete keys after X attempts" (which I'd be totally fine with, and they could probably put in place in practically no time). Either way you're still relying on them doing what they said they're doing.