4 ms·
That's all well and good, but I believe the original complaint was more concerning the second party in the conversation. There's no way for me, a hypothetical p
by KAMSPioneer 5y ago
That's all well and good, but I believe the original complaint was more concerning the second party in the conversation. There's no way for me, a hypothetical person who wants to keep my Signal messages 100% encrypted in the Signal ecosystem, to opt out of my contacts using an Element bridge.
Sure, I can go around and tell everyone I know that they shouldn't bridge Signal to Element One because <cryptonerd rant>, but there's no way for me to tell that my advice has been followed. Previously, the chances that someone had set up such a bridge were small, but by nature of making these things accessible, Element One also increases the risk of my conversations being (benevolently?) MITM'd.
I think it's a great offering, but I share GP's reticence about a system that puts what used to be zero-knowledge conversations in plaintext on a third-party server...all without me realizing.
- xanaxagoras 5y ago> I think it's a great offering, but I share GP's reticence about a system that puts what used to be zero-knowledge conversations in plaintext on a third-party server...all without me realizing. Element CEO here, you must be a tinfoil hat crazy person, everyone should communicate in cleartext, you're not a terrorist are you
- dunefox 5y agoElement CEO here, why won't anybody think of the children?!
- 0xdeadb00f 5y agoElement CEO here, this comment thread made my day!
- drummer 5y agoElement CEO here, I don't know wtf got into us breaking Signal E2EE, I am stepping the fuck down.
- anticensor 5y agoThe username of the actual Element CEO is "Arathorn".
- deleted 5y ago[deleted]
- _red 5y ago>There's no way for me, a hypothetical person who wants to keep my Signal messages 100% encrypted in the Signal ecosystem, to opt out of my contacts using an Element bridge. This sounds like a made-up concern. How do you stop me from screenshotting your convo and posting on twitter, or just copying and pasting from one app to the next?
- KAMSPioneer 5y agoThose are distinct from my concern. In your scenarios, I have trusted you to keep the conversation secret, and you betrayed that trust. My concern is about giving messages in an automatic fashion to a third party, which I'm completely unaware of and have no way of making an informed decision about. The third party could be breached (they run an online service, which is much, much easier to attack than some dude's iPhone).
- feanaro 5y agoJust ask your conversation partner? An Element bridge is just a Signal client hosted on Element's infrastructure. Them using an Element bridge is no different than them using an extra device you didn't know about. That device could've well been insecure, or shared by many people, or hosted in the cloud. If you care about this, you should ask.
- KAMSPioneer 5y agoI thought I addressed that in my original comment: I _could_ go to each of my contacts and explain why I don't want them to do things like use the cool new Element service with Signal. But 1) I (finally) have a lot of contacts using Signal, so that would be a pain to manage; 2) to me, the entire idea of Signal is that I can pretty much set it and forget it on any relatively-modern smartphone for friends, family, etc. and not have to worry about anything but the biennial phone migration for my mother. In the end it isn't a huge deal, as most conversations are extremely innocuous, and those I care about I'll take the time to verify. But after all the trouble to proselytize Signal, I get nervous about large public projects that could, in my opinion, strictly reduce the security of my secure messaging system.