4 ms·

His statements about PGP are right, though. It's using terrible, outdated cryptography. The odds of finding one who's actually got a setup that isn't full of ho

by kick 7y ago

His statements about PGP are right, though. It's using terrible, outdated cryptography. The odds of finding one who's actually got a setup that isn't full of holes for it is slim, even among programmers. It's barely been used. It's a UX and technical disaster. Matrix still hasn't gotten E2E encryption rolled out by default, or something like half of the stuff they want to have done before doing it: https://github.com/vector-im/riot-web/issues/6779 https://github.com/vector-im/riot-web/issues/6779 Wire keeps track of everyone that every user has contacted for the entirety of the lifespan of their account (not to mention only released it as Free Software after someone found a bunch of glaring holes in their platform, including sending passwords to the server in plain text), and is a U.S. company that goes out of its way to store excessive amounts of metadata. For that matter, actually, Signal's just as open as Wire. Wire's more or less as centralized, but with way greater risks in the event of Wire's datacenter getting raided. Tox is the best thing trying to do a similar thing that Signal is doing, and even Tox isn't even very good.

Arathorn 7y ago
We turned on E2E by default on Matrix a few weeks ago at FOSDEM on the develop branches: https://fosdem.org/2020/schedule/event/matrix/ https://fosdem.org/2020/schedule/event/matrix/. The bug you quoted will get updated and closed once it gets released to stable in the coming weeks. See the last comments on the bug for the actual status :/
- kick 7y ago
  I read the last comment there! "on the develop branches" is way different from "on stable branches." The edits make it more clear, though, good job! I definitely like what you're trying to do, though! I hope it goes smoothly!
openplatypus 7y ago
> Wire keeps track of everyone that every user has contacted for the entirety of the lifespan of their account (not to mention only released it as Free Software after someone found a bunch of glaring holes in their platform, including sending passwords to the server in plain text), Can you link to these issues you mention? > and is a U.S. company that goes out of its way to store excessive amounts of metadata. How did you arrive to this conclusion? It is registered in Switzerland https://wire.com/en/about/ https://wire.com/en/about/. Whole development takes place in either Switzerland or Germany. They have usual sales office in San Francisco.
- kick 7y ago
  https://forum.privacytools.io/t/wire-swiss-gmbh-is-now-owned-by-a-usa-holding-company/1932 https://forum.privacytools.io/t/wire-swiss-gmbh-is-now-owned... Wire Swiss GmbH is owned by a U.S. company. > Can you link to these issues you mention? https://crysp.uwaterloo.ca/opinion/wire/ https://crysp.uwaterloo.ca/opinion/wire/ The Wire client authenticates with a central server in order to provide user presence information. (Wire does not attempt to hide metadata, other than the central server promising not to log very much information.) The Wire whitepapers spend an unusual amount of space discussing the engineering details of this part of the protocol. However, the method of authentication is the same as it is on the web: the Wire client sends the unencrypted, unhashed password to the central server over TLS, the server hashes the plaintext password with scrypt, and the hash is compared to the hash stored by the server. This process leaks the user's password to the central server; the server operators (or anyone who compromises the server) could log all of the plaintext passwords as users authenticate. This particular report is what caused them to open up the server.
  - openplatypus 7y ago
    Thanks for links. The commenters on privacytools sites were insightful but sounds like they missed the key piece of information: https://wire.com/en/blog/wire_business_update/ https://wire.com/en/blog/wire_business_update/ > In connection with the financing, our holding company moved from Luxembourg to the U.S., as we believe this will be helpful in future fundraising necessary to support our strong growth. Notwithstanding the foregoing, our current and future customers are licensed and serviced from Wire Switzerland, our software development team remains in Berlin, Germany, and our hosting is European-based. Our enterprise customers can deploy their own instance of Wire in their own data center. If data, technology and control is subsidiary then Wire, as technology, data and its user still fall under Swiss law. Holding company =!= all of its business is based in that country. That said, I appreciate the murky approach to communicating this fact.
    - kick 7y ago
      Holding company = they're still subject to U.S. law.

by kick 7y ago

Arathorn 7y ago

We turned on E2E by default on Matrix a few weeks ago at FOSDEM on the develop branches: https://fosdem.org/2020/schedule/event/matrix/ https://fosdem.org/2020/schedule/event/matrix/. The bug you quoted will get updated and closed once it gets released to stable in the coming weeks. See the last comments on the bug for the actual status :/

kick 7y ago
I read the last comment there! "on the develop branches" is way different from "on stable branches." The edits make it more clear, though, good job! I definitely like what you're trying to do, though! I hope it goes smoothly!

openplatypus 7y ago

> Wire keeps track of everyone that every user has contacted for the entirety of the lifespan of their account (not to mention only released it as Free Software after someone found a bunch of glaring holes in their platform, including sending passwords to the server in plain text), Can you link to these issues you mention? > and is a U.S. company that goes out of its way to store excessive amounts of metadata. How did you arrive to this conclusion? It is registered in Switzerland https://wire.com/en/about/ https://wire.com/en/about/. Whole development takes place in either Switzerland or Germany. They have usual sales office in San Francisco.

kick 7y ago
https://forum.privacytools.io/t/wire-swiss-gmbh-is-now-owned-by-a-usa-holding-company/1932 https://forum.privacytools.io/t/wire-swiss-gmbh-is-now-owned... Wire Swiss GmbH is owned by a U.S. company. > Can you link to these issues you mention? https://crysp.uwaterloo.ca/opinion/wire/ https://crysp.uwaterloo.ca/opinion/wire/ The Wire client authenticates with a central server in order to provide user presence information. (Wire does not attempt to hide metadata, other than the central server promising not to log very much information.) The Wire whitepapers spend an unusual amount of space discussing the engineering details of this part of the protocol. However, the method of authentication is the same as it is on the web: the Wire client sends the unencrypted, unhashed password to the central server over TLS, the server hashes the plaintext password with scrypt, and the hash is compared to the hash stored by the server. This process leaks the user's password to the central server; the server operators (or anyone who compromises the server) could log all of the plaintext passwords as users authenticate. This particular report is what caused them to open up the server.
- openplatypus 7y ago
  Thanks for links. The commenters on privacytools sites were insightful but sounds like they missed the key piece of information: https://wire.com/en/blog/wire_business_update/ https://wire.com/en/blog/wire_business_update/ > In connection with the financing, our holding company moved from Luxembourg to the U.S., as we believe this will be helpful in future fundraising necessary to support our strong growth. Notwithstanding the foregoing, our current and future customers are licensed and serviced from Wire Switzerland, our software development team remains in Berlin, Germany, and our hosting is European-based. Our enterprise customers can deploy their own instance of Wire in their own data center. If data, technology and control is subsidiary then Wire, as technology, data and its user still fall under Swiss law. Holding company =!= all of its business is based in that country. That said, I appreciate the murky approach to communicating this fact.
  - kick 7y ago
    Holding company = they're still subject to U.S. law.