3 ms·

Looks like a non-standard XMPP clone. XMPP already offers standard encryption.

by encryptluks2 5y ago

soziawa 5y ago
It's actually forked from Signal.
- christophilus 5y ago
  Couldn’t find the “why’d we fork” anywhere. Got a link?
  - southerntofu 5y ago
    Not a link, but from quick reading: - Session does not require phone numbers, which is Signal's greatest and well-known weakness and has led to a lot of (police/stalker) harassment - Session uses some form of onion routing, and the messages arriving while you're offline are stored for a certain amount of time (TTL) by "Oxen service nodes" ; no centralized server controlled by Amazon & other evil corps relying on Intel's SGX "secure enclaves" (yes, that is actually Signal's threat model lol) - Session appears to be involved with the Oxen blockchain where you can pay for a global username to be registered to your public key; i don't know if there's recovery mechanisms if you loose you key/device, but i do know it took me only two clicks from homepage to reach talk of blockchain and tokens and that does not inspire me confidence - Session claims loud and clear to be developed by a non-profit and to be user/UX-oriented, which is great! Signal's finances and decision making have never been very transparent, and interviews published here in the past year implied they needed more users in order to monetize the platform (how?)
bjoli 5y ago
I dont know where you got that impression. It is not based on xmpp. It is, more or less, a decentralised signal with onion routing. Edit: apparently they switched away from the signal protocol 2021. It is no longer signal-with-onion-routing. It has diverged significantly sice they forked.
- kitkat_new 5y ago
  well, maybe decentralized Signal UI. Since it does neither use Signal encryption nor does its encryption have the properties modern E2EE encryption has (Perfect Forward Secrecy, existing in Signal, Matrix, Wire and even WhatsApp), it cannot really be called Signal anymore
  - bjoli 5y ago
    You are right: they have switched away from the signal protocol to their own session protocol during 2021. I did not know that. Last time I checked (late 2020) they were using signals protocol.
  - ajconway 5y ago
    Here is their reasoning for a change of protocol: https://getsession.org/session-protocol-technical-information https://getsession.org/session-protocol-technical-informatio... HN discussion: https://news.ycombinator.com/item?id=25690036 https://news.ycombinator.com/item?id=25690036 Summary: forward secrecy and deniability are nice to have, but removing them makes significant UX improvements possible.
- Arnt 5y ago
  Looking at the web site, I can see how one might get that impression. The code base comes from signal, but the web site looks more than a bit like various XMPP things from a few years ago. It seems to say "we have features most XMPP clients don't" as I read it. Compare this to signal.org, which seems to be written from a list of FAQs/complaints. "Privacy" in the first sentence, four endorsements, and then a variety of FAQ points: "No creepy affiliates", "no SMS charges", "we have groups", "share GIFs freely".

Looks like a non-standard XMPP clone. XMPP already offers standard encryption.

soziawa 5y ago

It's actually forked from Signal.

christophilus 5y ago
Couldn’t find the “why’d we fork” anywhere. Got a link?
- southerntofu 5y ago
  Not a link, but from quick reading: - Session does not require phone numbers, which is Signal's greatest and well-known weakness and has led to a lot of (police/stalker) harassment - Session uses some form of onion routing, and the messages arriving while you're offline are stored for a certain amount of time (TTL) by "Oxen service nodes" ; no centralized server controlled by Amazon & other evil corps relying on Intel's SGX "secure enclaves" (yes, that is actually Signal's threat model lol) - Session appears to be involved with the Oxen blockchain where you can pay for a global username to be registered to your public key; i don't know if there's recovery mechanisms if you loose you key/device, but i do know it took me only two clicks from homepage to reach talk of blockchain and tokens and that does not inspire me confidence - Session claims loud and clear to be developed by a non-profit and to be user/UX-oriented, which is great! Signal's finances and decision making have never been very transparent, and interviews published here in the past year implied they needed more users in order to monetize the platform (how?)

bjoli 5y ago

I dont know where you got that impression. It is not based on xmpp. It is, more or less, a decentralised signal with onion routing. Edit: apparently they switched away from the signal protocol 2021. It is no longer signal-with-onion-routing. It has diverged significantly sice they forked.

kitkat_new 5y ago
well, maybe decentralized Signal UI. Since it does neither use Signal encryption nor does its encryption have the properties modern E2EE encryption has (Perfect Forward Secrecy, existing in Signal, Matrix, Wire and even WhatsApp), it cannot really be called Signal anymore
- bjoli 5y ago
  You are right: they have switched away from the signal protocol to their own session protocol during 2021. I did not know that. Last time I checked (late 2020) they were using signals protocol.
- ajconway 5y ago
  Here is their reasoning for a change of protocol: https://getsession.org/session-protocol-technical-information https://getsession.org/session-protocol-technical-informatio... HN discussion: https://news.ycombinator.com/item?id=25690036 https://news.ycombinator.com/item?id=25690036 Summary: forward secrecy and deniability are nice to have, but removing them makes significant UX improvements possible.
Arnt 5y ago
Looking at the web site, I can see how one might get that impression. The code base comes from signal, but the web site looks more than a bit like various XMPP things from a few years ago. It seems to say "we have features most XMPP clients don't" as I read it. Compare this to signal.org, which seems to be written from a list of FAQs/complaints. "Privacy" in the first sentence, four endorsements, and then a variety of FAQ points: "No creepy affiliates", "no SMS charges", "we have groups", "share GIFs freely".