6 ms·
About a decade ago (Oh no, it's never a good sign when you can legitimately start a story like that...) I was introduced to Jabber by a friend. I was complainin
by sillysaurusx 6y ago
About a decade ago (Oh no, it's never a good sign when you can legitimately start a story like that...) I was introduced to Jabber by a friend. I was complaining that I really wanted to talk to him about a certain topic, but that the topic was sensitive enough that I was paranoid about it being logged forever on some server somewhere.
He pointed out the OTR plugin, and it blew my mind that it was guaranteed that no one could possibly snoop our conversation.
I knew that it was theoretically possible, but I can't overstate how important it is to package the crypto in a user-friendly way. Being able to get the session going in about 30 seconds was a killer feature.
But, more than that, it seemed to have an advantage over present-day Signal: I use Signal now, but I always feel a bit queasy about trusting it implicitly. I do trust it, but it's such a massive ecosystem now that it doesn't feel nearly as "transparent" as the OTR plugin did. The OTR plugin was like, if this is broken, there are many eyeballs that will know pretty quickly. Whereas Signal doesn't quite feel the same way.
I'm not entirely sure why, or if that feeling is just me. There's no reason to feel like an OTR plugin is inherently more secure. And yet, as evidenced by the article, it was rock solid for 18 years.
- vlovich123 6y agoThe technical and product requirements that Signal is solving is drastically different to anything attempted before in the open source community. Signal is only looking to generate a movement to guarantee e2e encryption across all chat and social stacks. They don’t care who ends up owning the social wars, as long as that becomes the new standard. Think of it as an attempt to strike at the heart of the capitalistic forces that have diverted that kind of research away from production. It’s a brilliant strategic play they’re doing so I’m more grateful to figuring out how to do that because it looked like it had repeatedly failed in the past.
- joe_the_user 6y agoI'm in one reading group that uses signal primarily for its communication. We have not been able to figure out what we're going to read next because suggested texts get lost as people make random comments. I hope that post Facebook messages gets to the level of threaded messages. Sometimes pure chat is enough and sometimes chat is really annoying for accomplishing things.
- nyokodo 6y agoMaybe have a channel for chat and a separate one for reading suggestions?
- oh_sigh 6y agoThe alternative to capitalistic forces showing you ads personalized based on your conversation isn't to get the same app with no ads at all - it is either get the same app just with non-personalized ads, or no app at all.
- remexre 6y agowell... signal doesn't have ads...
- deleted 6y ago[deleted]
- nine_k 6y agoWhy, outright paying for products and services is pretty capitalistic! Works well in many cases.
- esyir 6y agoThat's a fine argument and all, but practically speaking, we see that as driven content for free outcompetes.
- vlovich123 6y agoDisallowing such content then might be the right solution if you view the societal trade offs as not being worth the increased economic activity.
- 1ark 6y agoYou are right to feel uneasy about Signal, because there is a possibility (I don't know how big) to snoop and is centralized. Checkout Session, forked Signal with decentralized infrastructure.
- 1vuio0pswjnm7 6y agoSession relies the Loki network overlay. Loki is another cryptocurrency. Any decentralised alternatives without the cryptocurrency linkage.
- 1ark 6y agoYes, the Loki is the incentive to running nodes. Jami is decentralized without incentives. Berty.tech is distributed, also without incentives.
- throwawa4234324 6y ago> I use Signal now, but I always feel a bit queasy about trusting it implicitly. I do trust it, but it's such a massive ecosystem now that it doesn't feel nearly as "transparent" as the OTR plugin did Conversations on Android works quite well for XMPP on Android. Quicksy by the same author even has phone-based discoverability.
- approxim8ion 6y agoConversations reminds me of Google Talk in a good way. Also blown away by how fast onboarding and message delivery is over XMPP. Movim is another pretty great XMPP client.
- pabs3 6y agoOTRv3 is definitely not considered secure now, there is an unimplemented and unfinished OTRv4 that updates the crypto though: https://github.com/otrv4/otrv4 https://github.com/otrv4/otrv4
- upofadown 6y agoOTR is certainly simpler than Signal. Signal's claim to fame is that it can deal with the case of an offline client and still offer forward secrecy. In Signal's case that means a server based infrastructure to store cryptographic state that the decentralized OTR gets along without. On top of that, Signal's per message forward secrecy (OTR is per session) adds even more complexity.
- nousermane 6y ago> deal with the case of an offline client and still offer forward secrecy. Wasn't that addressed by OMEMO, the OTR "replacement" protocol?
- upofadown 6y agoYeah. Basically Signal protocol over XMPP. It uses the XMPP server for the stored/delayed cryptographic state which is why you need a server that can do PEP (Personal Eventing Protocol) if you want to do OMEMO. OMEMO has pretty much replaced OTR in the clients so if you want simple/stateless you are left with one of the two PGP flavours.