3 ms·

It is great and I root for Signal. I only wish Moxie was less polarizing and actually stepped down from being its face. He often makes subpar and inaccurate st

It is great and I root for Signal. I only wish Moxie was less polarizing and actually stepped down from being its face. He often makes subpar and inaccurate statements about other technologies. He is famous for his derogatory comments about PGP. His talk at recent CCC was anything but dismissive of others. The thing is, Signal is not special. Matrix, Wire and others sorted problems of encryption while remaining open (Wire is commercial but that good for some). So congratulations Signal. But we should think really hard whether we want another centralized behemoth. I would prefer donate to Matrix. Support project building client with great UX for masses on top of open, extensible protocol rather than hand over more control to centralized organization led by individual speaking in absolutes.

K0SM0S 7y ago
I think we see in this that Signal's success is less about tech and more about some product-driven superiority, insofar as it actually reached users and is used a lot already. It's the old mantra that you may need a Wozniak to do it but you need a Jobs to package it into a great product and sell it. I feel like Moxie is opinionated like a product leader, even more so than as a technologist. He's polarizing. And while it rubs everyone the wrong way on occasion, it's also the story of many a great success.
- mbowcutt 7y ago
  The Snowden endorsement sure helped.
  - maqp 7y ago
    Good thing Snowden thinks twice before recommending anything.
kick 7y ago
His statements about PGP are right, though. It's using terrible, outdated cryptography. The odds of finding one who's actually got a setup that isn't full of holes for it is slim, even among programmers. It's barely been used. It's a UX and technical disaster. Matrix still hasn't gotten E2E encryption rolled out by default, or something like half of the stuff they want to have done before doing it: https://github.com/vector-im/riot-web/issues/6779 https://github.com/vector-im/riot-web/issues/6779 Wire keeps track of everyone that every user has contacted for the entirety of the lifespan of their account (not to mention only released it as Free Software after someone found a bunch of glaring holes in their platform, including sending passwords to the server in plain text), and is a U.S. company that goes out of its way to store excessive amounts of metadata. For that matter, actually, Signal's just as open as Wire. Wire's more or less as centralized, but with way greater risks in the event of Wire's datacenter getting raided. Tox is the best thing trying to do a similar thing that Signal is doing, and even Tox isn't even very good.
- Arathorn 7y ago
  We turned on E2E by default on Matrix a few weeks ago at FOSDEM on the develop branches: https://fosdem.org/2020/schedule/event/matrix/ https://fosdem.org/2020/schedule/event/matrix/. The bug you quoted will get updated and closed once it gets released to stable in the coming weeks. See the last comments on the bug for the actual status :/
  - kick 7y ago
    I read the last comment there! "on the develop branches" is way different from "on stable branches." The edits make it more clear, though, good job! I definitely like what you're trying to do, though! I hope it goes smoothly!
- openplatypus 7y ago
  > Wire keeps track of everyone that every user has contacted for the entirety of the lifespan of their account (not to mention only released it as Free Software after someone found a bunch of glaring holes in their platform, including sending passwords to the server in plain text), Can you link to these issues you mention? > and is a U.S. company that goes out of its way to store excessive amounts of metadata. How did you arrive to this conclusion? It is registered in Switzerland https://wire.com/en/about/ https://wire.com/en/about/. Whole development takes place in either Switzerland or Germany. They have usual sales office in San Francisco.
  - kick 7y ago
    https://forum.privacytools.io/t/wire-swiss-gmbh-is-now-owned-by-a-usa-holding-company/1932 https://forum.privacytools.io/t/wire-swiss-gmbh-is-now-owned... Wire Swiss GmbH is owned by a U.S. company. > Can you link to these issues you mention? https://crysp.uwaterloo.ca/opinion/wire/ https://crysp.uwaterloo.ca/opinion/wire/ The Wire client authenticates with a central server in order to provide user presence information. (Wire does not attempt to hide metadata, other than the central server promising not to log very much information.) The Wire whitepapers spend an unusual amount of space discussing the engineering details of this part of the protocol. However, the method of authentication is the same as it is on the web: the Wire client sends the unencrypted, unhashed password to the central server over TLS, the server hashes the plaintext password with scrypt, and the hash is compared to the hash stored by the server. This process leaks the user's password to the central server; the server operators (or anyone who compromises the server) could log all of the plaintext passwords as users authenticate. This particular report is what caused them to open up the server.

K0SM0S 7y ago

I think we see in this that Signal's success is less about tech and more about some product-driven superiority, insofar as it actually reached users and is used a lot already. It's the old mantra that you may need a Wozniak to do it but you need a Jobs to package it into a great product and sell it. I feel like Moxie is opinionated like a product leader, even more so than as a technologist. He's polarizing. And while it rubs everyone the wrong way on occasion, it's also the story of many a great success.

mbowcutt 7y ago
The Snowden endorsement sure helped.
- maqp 7y ago
  Good thing Snowden thinks twice before recommending anything.

kick 7y ago

His statements about PGP are right, though. It's using terrible, outdated cryptography. The odds of finding one who's actually got a setup that isn't full of holes for it is slim, even among programmers. It's barely been used. It's a UX and technical disaster. Matrix still hasn't gotten E2E encryption rolled out by default, or something like half of the stuff they want to have done before doing it: https://github.com/vector-im/riot-web/issues/6779 https://github.com/vector-im/riot-web/issues/6779 Wire keeps track of everyone that every user has contacted for the entirety of the lifespan of their account (not to mention only released it as Free Software after someone found a bunch of glaring holes in their platform, including sending passwords to the server in plain text), and is a U.S. company that goes out of its way to store excessive amounts of metadata. For that matter, actually, Signal's just as open as Wire. Wire's more or less as centralized, but with way greater risks in the event of Wire's datacenter getting raided. Tox is the best thing trying to do a similar thing that Signal is doing, and even Tox isn't even very good.

Arathorn 7y ago
We turned on E2E by default on Matrix a few weeks ago at FOSDEM on the develop branches: https://fosdem.org/2020/schedule/event/matrix/ https://fosdem.org/2020/schedule/event/matrix/. The bug you quoted will get updated and closed once it gets released to stable in the coming weeks. See the last comments on the bug for the actual status :/
- kick 7y ago
  I read the last comment there! "on the develop branches" is way different from "on stable branches." The edits make it more clear, though, good job! I definitely like what you're trying to do, though! I hope it goes smoothly!
openplatypus 7y ago
> Wire keeps track of everyone that every user has contacted for the entirety of the lifespan of their account (not to mention only released it as Free Software after someone found a bunch of glaring holes in their platform, including sending passwords to the server in plain text), Can you link to these issues you mention? > and is a U.S. company that goes out of its way to store excessive amounts of metadata. How did you arrive to this conclusion? It is registered in Switzerland https://wire.com/en/about/ https://wire.com/en/about/. Whole development takes place in either Switzerland or Germany. They have usual sales office in San Francisco.
- kick 7y ago
  https://forum.privacytools.io/t/wire-swiss-gmbh-is-now-owned-by-a-usa-holding-company/1932 https://forum.privacytools.io/t/wire-swiss-gmbh-is-now-owned... Wire Swiss GmbH is owned by a U.S. company. > Can you link to these issues you mention? https://crysp.uwaterloo.ca/opinion/wire/ https://crysp.uwaterloo.ca/opinion/wire/ The Wire client authenticates with a central server in order to provide user presence information. (Wire does not attempt to hide metadata, other than the central server promising not to log very much information.) The Wire whitepapers spend an unusual amount of space discussing the engineering details of this part of the protocol. However, the method of authentication is the same as it is on the web: the Wire client sends the unencrypted, unhashed password to the central server over TLS, the server hashes the plaintext password with scrypt, and the hash is compared to the hash stored by the server. This process leaks the user's password to the central server; the server operators (or anyone who compromises the server) could log all of the plaintext passwords as users authenticate. This particular report is what caused them to open up the server.