4 ms·

I mentioned it because it has a seamlessly built in onion routing protocol. I read further down the thread that Tor is blocked in Iran, but I’m guessing the sam

by 2cb 6y ago

I mentioned it because it has a seamlessly built in onion routing protocol. I read further down the thread that Tor is blocked in Iran, but I’m guessing the same is unlikely to be true of Loki/Oxen simply because it isn’t nearly as well known. The lack of metadata is also quite a unique selling point in my eyes. There’s a million encrypted messengers now sure. How many automatically connect through an onion router with zero config required and don’t require you to create an account at all, but instead assign you a random ID disconnected entirely from your phone number, email, and other personal identifiers? It’s certainly an option to consider is the only thing I’m saying. Tor was mentioned so Session popped into my head for the reasons mentioned above. Regarding PFS. They currently implement the Signal Protocol. Session is of course FOSS so anyone can check this. Your source does say they’re planning to fork it as the Session Protocol later this year so it integrates with their network more easily. But that’s an upcoming, unfinished project. To be honest I don’t know much about it as it’s still in development. I do know that currently Session uses the Signal Protocol through an onion router without the need to so much as create an account. And yes the network itself is a bit of a convoluted idea that tries to do many things at once, but the fact they run on a blockchain means they already have a lot of nodes set up in different countries around the world through which to route traffic, and the reason they could build a decentralised network quite quickly despite being a relatively young project is they incentivise those node operators with cryptocurrency. Because it is a young project they are still undergoing audit yes. This is absolutely something worth noting. It’s a relatively new project. It’s no longer in beta, but nowhere near as well established as Signal. However it’s precisely because of this it’s unlikely governments are bothering to target it yet.

olah_1 6y ago
Session protocol is currently running on session now[1]. It’s actually the reason that they were able to allow up to 100 people in closed groups now. [1]: https://getsession.org/session-release-roundup-10/ https://getsession.org/session-release-roundup-10/
- 2cb 6y ago
  Looking at the technical writeup [1] it sounds like they're currently running a hybrid of the two as they do a staged rollout of the various changes they've made to the Signal Protocol. But yes you are correct it looks like they're justifying ditching PFS by saying "if someone has your keys you're screwed anyway." However they're not just stripping away security outright, it's more that they're betting on onion routing to cover the user instead - no one who is sniffing traffic on your WiFi network will be able to get your keys because the traffic is routed through the onion network, therefore the only way anyone would get those keys is by pwning your entire device or having physical access to it while it's decrypted which, as they note, is endgame no matter what messenger you use. I don't necessarily think this is smart as it's best to not put all your eggs in one basket especially where security is concerned. But given all traffic goes between 5-7 nodes [1] the scope for someone without remote or physical access to your device to get your keys is extremely limited assuming their onion network is as secure as they claim. As for deniability, they sign the message with the long-term keypair, but once the message is validated this signature is wiped. So again it pretty much comes down to relying on their onion routing to ensure this signature isn't intercepted in transit. Finally I think it's relevant Session is really designed for a different use case than Signal - since your ID is not connected to any personal identifiers, you can wipe it whenever you want and get a new ID that has zero cryptographic connection to the old one. So while there's no ratcheting of keys, the intention isn't really for someone to stick with the same account for years like it is for Signal where your account uses your phone number as an identifier. I'll wait for the results of the audit, if they come out and say Session is fundamentally flawed I'll happily concede. I have zero ties to this project aside from finding it useful for particular use cases. My prediction is the initial audit will find some potential vulns as they roll out more of the Session Protocol simply because it's a new fork. Probably why they're getting the audit done now. That's the responsible move when forking a crypto protocol it seems to me. I maintain that for people who want a messenger that knows as little about them as possible, doesn't rely on a personal identifier, and connects to an onion router reliably (by comparison, using Tor on mobile is... not a good experience) it's at very least an interesting project to watch even if it still needs time to mature. [1] https://getsession.org/session-protocol-technical-information/ https://getsession.org/session-protocol-technical-informatio...
hayalci 6y ago
Jami and Tox are completely decentralized messaging systems. They are not directly associated with "blockchain" buzzword as well so they have that going for them, too. https://jami.net/ https://jami.net/ https://tox.chat/ https://tox.chat/
- 2cb 6y ago
  Jami uses git and TLS to implement E2E encrypted chats.[1] That doesn't sound all that secure to me. I'd feel much more comfortable using a fork of Signal with an onion router. I don't get the prejudice some have against blockchains either. It's not even like this is Keybase where they shoehorned a crypto wallet into the app. They do have a wallet but it's a totally separate application. Session is purely a messenger and nothing else, you'd have no idea a blockchain was involved at any part of the backend if you weren't told about it. I have played around with Tox and it's a cool project, but it's been in beta since 2014 and is not well optimised for mobile at all. I don't think it'll go very far personally. [1] https://jami.net/swarm-introducing-a-new-generation-of-group-conversations/ https://jami.net/swarm-introducing-a-new-generation-of-group...

by 2cb 6y ago

olah_1 6y ago

Session protocol is currently running on session now[1]. It’s actually the reason that they were able to allow up to 100 people in closed groups now. [1]: https://getsession.org/session-release-roundup-10/ https://getsession.org/session-release-roundup-10/

2cb 6y ago
Looking at the technical writeup [1] it sounds like they're currently running a hybrid of the two as they do a staged rollout of the various changes they've made to the Signal Protocol. But yes you are correct it looks like they're justifying ditching PFS by saying "if someone has your keys you're screwed anyway." However they're not just stripping away security outright, it's more that they're betting on onion routing to cover the user instead - no one who is sniffing traffic on your WiFi network will be able to get your keys because the traffic is routed through the onion network, therefore the only way anyone would get those keys is by pwning your entire device or having physical access to it while it's decrypted which, as they note, is endgame no matter what messenger you use. I don't necessarily think this is smart as it's best to not put all your eggs in one basket especially where security is concerned. But given all traffic goes between 5-7 nodes [1] the scope for someone without remote or physical access to your device to get your keys is extremely limited assuming their onion network is as secure as they claim. As for deniability, they sign the message with the long-term keypair, but once the message is validated this signature is wiped. So again it pretty much comes down to relying on their onion routing to ensure this signature isn't intercepted in transit. Finally I think it's relevant Session is really designed for a different use case than Signal - since your ID is not connected to any personal identifiers, you can wipe it whenever you want and get a new ID that has zero cryptographic connection to the old one. So while there's no ratcheting of keys, the intention isn't really for someone to stick with the same account for years like it is for Signal where your account uses your phone number as an identifier. I'll wait for the results of the audit, if they come out and say Session is fundamentally flawed I'll happily concede. I have zero ties to this project aside from finding it useful for particular use cases. My prediction is the initial audit will find some potential vulns as they roll out more of the Session Protocol simply because it's a new fork. Probably why they're getting the audit done now. That's the responsible move when forking a crypto protocol it seems to me. I maintain that for people who want a messenger that knows as little about them as possible, doesn't rely on a personal identifier, and connects to an onion router reliably (by comparison, using Tor on mobile is... not a good experience) it's at very least an interesting project to watch even if it still needs time to mature. [1] https://getsession.org/session-protocol-technical-information/ https://getsession.org/session-protocol-technical-informatio...

hayalci 6y ago

Jami and Tox are completely decentralized messaging systems. They are not directly associated with "blockchain" buzzword as well so they have that going for them, too. https://jami.net/ https://jami.net/ https://tox.chat/ https://tox.chat/

2cb 6y ago
Jami uses git and TLS to implement E2E encrypted chats.[1] That doesn't sound all that secure to me. I'd feel much more comfortable using a fork of Signal with an onion router. I don't get the prejudice some have against blockchains either. It's not even like this is Keybase where they shoehorned a crypto wallet into the app. They do have a wallet but it's a totally separate application. Session is purely a messenger and nothing else, you'd have no idea a blockchain was involved at any part of the backend if you weren't told about it. I have played around with Tox and it's a cool project, but it's been in beta since 2014 and is not well optimised for mobile at all. I don't think it'll go very far personally. [1] https://jami.net/swarm-introducing-a-new-generation-of-group-conversations/ https://jami.net/swarm-introducing-a-new-generation-of-group...