3 ms·

> Wire keeps track of everyone that every user has contacted for the entirety of the lifespan of their account (not to mention only released it as Free Software

> Wire keeps track of everyone that every user has contacted for the entirety of the lifespan of their account (not to mention only released it as Free Software after someone found a bunch of glaring holes in their platform, including sending passwords to the server in plain text), Can you link to these issues you mention? > and is a U.S. company that goes out of its way to store excessive amounts of metadata. How did you arrive to this conclusion? It is registered in Switzerland https://wire.com/en/about/ https://wire.com/en/about/. Whole development takes place in either Switzerland or Germany. They have usual sales office in San Francisco.

kick 7y ago
https://forum.privacytools.io/t/wire-swiss-gmbh-is-now-owned-by-a-usa-holding-company/1932 https://forum.privacytools.io/t/wire-swiss-gmbh-is-now-owned... Wire Swiss GmbH is owned by a U.S. company. > Can you link to these issues you mention? https://crysp.uwaterloo.ca/opinion/wire/ https://crysp.uwaterloo.ca/opinion/wire/ The Wire client authenticates with a central server in order to provide user presence information. (Wire does not attempt to hide metadata, other than the central server promising not to log very much information.) The Wire whitepapers spend an unusual amount of space discussing the engineering details of this part of the protocol. However, the method of authentication is the same as it is on the web: the Wire client sends the unencrypted, unhashed password to the central server over TLS, the server hashes the plaintext password with scrypt, and the hash is compared to the hash stored by the server. This process leaks the user's password to the central server; the server operators (or anyone who compromises the server) could log all of the plaintext passwords as users authenticate. This particular report is what caused them to open up the server.
- openplatypus 7y ago
  Thanks for links. The commenters on privacytools sites were insightful but sounds like they missed the key piece of information: https://wire.com/en/blog/wire_business_update/ https://wire.com/en/blog/wire_business_update/ > In connection with the financing, our holding company moved from Luxembourg to the U.S., as we believe this will be helpful in future fundraising necessary to support our strong growth. Notwithstanding the foregoing, our current and future customers are licensed and serviced from Wire Switzerland, our software development team remains in Berlin, Germany, and our hosting is European-based. Our enterprise customers can deploy their own instance of Wire in their own data center. If data, technology and control is subsidiary then Wire, as technology, data and its user still fall under Swiss law. Holding company =!= all of its business is based in that country. That said, I appreciate the murky approach to communicating this fact.
  - kick 7y ago
    Holding company = they're still subject to U.S. law.
    - openplatypus 7y ago
      Yes, holding company is. Subsidiary? Greatly depends on the control structure, agreed terms AND law in which subsidiary is incorporated. Given that these details are not disclosed at this time accusing Wire Swiss GmbH of anything constitutes rumors and conspiracy theory.

kick 7y ago

https://forum.privacytools.io/t/wire-swiss-gmbh-is-now-owned-by-a-usa-holding-company/1932 https://forum.privacytools.io/t/wire-swiss-gmbh-is-now-owned... Wire Swiss GmbH is owned by a U.S. company. > Can you link to these issues you mention? https://crysp.uwaterloo.ca/opinion/wire/ https://crysp.uwaterloo.ca/opinion/wire/ The Wire client authenticates with a central server in order to provide user presence information. (Wire does not attempt to hide metadata, other than the central server promising not to log very much information.) The Wire whitepapers spend an unusual amount of space discussing the engineering details of this part of the protocol. However, the method of authentication is the same as it is on the web: the Wire client sends the unencrypted, unhashed password to the central server over TLS, the server hashes the plaintext password with scrypt, and the hash is compared to the hash stored by the server. This process leaks the user's password to the central server; the server operators (or anyone who compromises the server) could log all of the plaintext passwords as users authenticate. This particular report is what caused them to open up the server.

openplatypus 7y ago
Thanks for links. The commenters on privacytools sites were insightful but sounds like they missed the key piece of information: https://wire.com/en/blog/wire_business_update/ https://wire.com/en/blog/wire_business_update/ > In connection with the financing, our holding company moved from Luxembourg to the U.S., as we believe this will be helpful in future fundraising necessary to support our strong growth. Notwithstanding the foregoing, our current and future customers are licensed and serviced from Wire Switzerland, our software development team remains in Berlin, Germany, and our hosting is European-based. Our enterprise customers can deploy their own instance of Wire in their own data center. If data, technology and control is subsidiary then Wire, as technology, data and its user still fall under Swiss law. Holding company =!= all of its business is based in that country. That said, I appreciate the murky approach to communicating this fact.
- kick 7y ago
  Holding company = they're still subject to U.S. law.
  - openplatypus 7y ago
    Yes, holding company is. Subsidiary? Greatly depends on the control structure, agreed terms AND law in which subsidiary is incorporated. Given that these details are not disclosed at this time accusing Wire Swiss GmbH of anything constitutes rumors and conspiracy theory.