3 ms·

A good implementation in secure messaging app that doesn't use meta data at all, ( only a pubkey ) is olvid. https://www.olvid.io/assets/documents/2020-12-15_Ol

by majaxg 5y ago

A good implementation in secure messaging app that doesn't use meta data at all, ( only a pubkey ) is olvid. https://www.olvid.io/assets/documents/2020-12-15_Olvid-specifications.pdf https://www.olvid.io/assets/documents/2020-12-15_Olvid-speci...

southerntofu 5y ago
This Olvid looks like bullshit. 1) there's no source code. Security via obscurity is not a feature for software (but it's a first line of defense for networks). 2) Olvid is distributed via malicious repos Apple AppStore and Google Play Store 3) Olvid is distributed with spyware: https://reports.exodus-privacy.eu.org/en/reports/io.olvid.messenger/latest/ https://reports.exodus-privacy.eu.org/en/reports/io.olvid.me... 4) They insist on "French tech", which is an ultra nationalist startup-nation label which does not imply any form of security, but rather that they report to french intelligence services (DGSI/DGSE) not USA intelligence services 5) They claim on the website that they're the first messenger certified by ANSSI, which is true but misleading. ANSSI has previously certified other secure messaging components (such as PGP implementations), and has very likely been involved in approving (though not certifying for private use) the french government's fork of Element matrix client (Tchap) as the official secure messenger application of the French government. All in all, it's just a french startup making claims to make money. Nothing to see there, unlike Session which has some actual source code and novel approaches to show off (despite my reluctance due to blockchain tech).
- majaxg 5y ago
  1) it isn't open source yet because of reduced team https://olvid.io/faq/is-olvid-open-source/ https://olvid.io/faq/is-olvid-open-source/ it'll change soon 2) If you consider AppStore and PlayStore as malicious repos you can stop using Android or Apple phone i think ... 3) if you search "network.loki.messenger" app on exodus you can find "Loki Messenger" (old name of Session ) with two "spyware" inside too 4) & 5) ok but i trust the very skilled person behind this software (https://dblp.org/pid/f/MatthieuFiniasz.html https://dblp.org/pid/f/MatthieuFiniasz.html) that worked 6 years on this project. I think Session is just another textsecure implementation (https://en.wikipedia.org/wiki/TextSecure https://en.wikipedia.org/wiki/TextSecure) that limit meta data nothing new under the sun.
  - southerntofu 5y ago
    > it isn't open source yet I've heard that claim so many times, yet very few startups hold their promise to open the source code. Especially for something branded as a secure messenger, how to give it any credibility without being able to inspect/audit the source? > you can stop using Android or Apple phone i think I use deblobbed android without google services -> replicant.us > you can find "Loki Messenger" (old name of Session ) with two "spyware" inside too I pointed it out in another comment so i'm aware. However these trackers have been removed in the meantime, and Session is actually free software which you can build from source. > i trust the very skilled person Good to see they've got a competent cryptographer, however competent cryptographers does not necessarily make a successful and secure decentralized messenger. See also Wire who had serious crypto and promises to open source everything, but to my knowledge the server side was never released, and Wire more or less failed as yet-another encrypted centralized messenger like Signal. Or GNU/Net who also has some solid research and practical applications [0], yet didn't grow so much over the years. > Session is just another textsecure implementation In fact not. It's certainly a TextSecure fork, but the only TextSecure implementation left is silence.im, whose maintainer is an employee of La Quadrature du Net from what i understand. But being SMS-based, silence.im leaks a lot of metadata (unique identifiers + timestamps). And contrary to other TextSecure forks (like Signal), Session does not rely on a centralized infrastructure or sketchy "secure enclaves". Like i said i'm very critical of relying on a blockchain at all, but i have to admit Session looks (from a quick look) like a serious project. [0] https://www.gnunet.org/en/news/2021-05-DISSENS.html https://www.gnunet.org/en/news/2021-05-DISSENS.html
    - ripply 5y ago
      > See also Wire who had serious crypto and promises to open source everything, but to my knowledge the server side was never released The wire server code is open source AFAIK [0] > This repository contains the source code for the Wire server. It contains all libraries and services necessary to run Wire. [0] https://github.com/wireapp/wire-server https://github.com/wireapp/wire-server
      - southerntofu 5y ago

by majaxg 5y ago

southerntofu 5y ago

This Olvid looks like bullshit. 1) there's no source code. Security via obscurity is not a feature for software (but it's a first line of defense for networks). 2) Olvid is distributed via malicious repos Apple AppStore and Google Play Store 3) Olvid is distributed with spyware: https://reports.exodus-privacy.eu.org/en/reports/io.olvid.messenger/latest/ https://reports.exodus-privacy.eu.org/en/reports/io.olvid.me... 4) They insist on "French tech", which is an ultra nationalist startup-nation label which does not imply any form of security, but rather that they report to french intelligence services (DGSI/DGSE) not USA intelligence services 5) They claim on the website that they're the first messenger certified by ANSSI, which is true but misleading. ANSSI has previously certified other secure messaging components (such as PGP implementations), and has very likely been involved in approving (though not certifying for private use) the french government's fork of Element matrix client (Tchap) as the official secure messenger application of the French government. All in all, it's just a french startup making claims to make money. Nothing to see there, unlike Session which has some actual source code and novel approaches to show off (despite my reluctance due to blockchain tech).

majaxg 5y ago
1) it isn't open source yet because of reduced team https://olvid.io/faq/is-olvid-open-source/ https://olvid.io/faq/is-olvid-open-source/ it'll change soon 2) If you consider AppStore and PlayStore as malicious repos you can stop using Android or Apple phone i think ... 3) if you search "network.loki.messenger" app on exodus you can find "Loki Messenger" (old name of Session ) with two "spyware" inside too 4) & 5) ok but i trust the very skilled person behind this software (https://dblp.org/pid/f/MatthieuFiniasz.html https://dblp.org/pid/f/MatthieuFiniasz.html) that worked 6 years on this project. I think Session is just another textsecure implementation (https://en.wikipedia.org/wiki/TextSecure https://en.wikipedia.org/wiki/TextSecure) that limit meta data nothing new under the sun.
- southerntofu 5y ago
  > it isn't open source yet I've heard that claim so many times, yet very few startups hold their promise to open the source code. Especially for something branded as a secure messenger, how to give it any credibility without being able to inspect/audit the source? > you can stop using Android or Apple phone i think I use deblobbed android without google services -> replicant.us > you can find "Loki Messenger" (old name of Session ) with two "spyware" inside too I pointed it out in another comment so i'm aware. However these trackers have been removed in the meantime, and Session is actually free software which you can build from source. > i trust the very skilled person Good to see they've got a competent cryptographer, however competent cryptographers does not necessarily make a successful and secure decentralized messenger. See also Wire who had serious crypto and promises to open source everything, but to my knowledge the server side was never released, and Wire more or less failed as yet-another encrypted centralized messenger like Signal. Or GNU/Net who also has some solid research and practical applications [0], yet didn't grow so much over the years. > Session is just another textsecure implementation In fact not. It's certainly a TextSecure fork, but the only TextSecure implementation left is silence.im, whose maintainer is an employee of La Quadrature du Net from what i understand. But being SMS-based, silence.im leaks a lot of metadata (unique identifiers + timestamps). And contrary to other TextSecure forks (like Signal), Session does not rely on a centralized infrastructure or sketchy "secure enclaves". Like i said i'm very critical of relying on a blockchain at all, but i have to admit Session looks (from a quick look) like a serious project. [0] https://www.gnunet.org/en/news/2021-05-DISSENS.html https://www.gnunet.org/en/news/2021-05-DISSENS.html
  - ripply 5y ago
    > See also Wire who had serious crypto and promises to open source everything, but to my knowledge the server side was never released The wire server code is open source AFAIK [0] > This repository contains the source code for the Wire server. It contains all libraries and services necessary to run Wire. [0] https://github.com/wireapp/wire-server https://github.com/wireapp/wire-server
    - southerntofu 5y ago