8 ms·

Briar Desktop for Linux

179 points by Sami_Lehtinen 5y ago

dingdingdang 5y ago
Since I needed brief intro myself, Wikipedia says: "The initial target audience for Briar includes "activists, journalists and civil society" with plans to make the system "simple enough to help anyone keep their data safe." As the ability to function in the absence of internet infrastructure may also make the project valuable to disaster response and aid organisations, the developers are working with the Open Humanitarian Initiative and Taarifa. Ultimately, the developers aim to create a system which is "as simple to use as WhatsApp, as secure as PGP, and that keeps working if somebody breaks the Internet."" Would personally love a blog review or two of Briar but found little thus far.
- giphyman 5y ago
  Their website has a press page with some reviews and presentations: https://briarproject.org/press/ https://briarproject.org/press/
- pulse7 5y ago
  Who can guarantee me that this isn't built by some national security agency with some tiny, hidden backdoors?
  - grote 5y ago
    No one can, but isn't that the case for all software? At least it is Free Software with reproducible builds, so you can audit the shit out of it.
    - mburee 5y ago
      I totally agree, but no one ever pays the money to have it properly audited
      - vorpalhex 5y ago
        It's you. You can pay to have it audited right now. You can also audit it, if you have the skillset.
      - sodality2 5y ago
        It has been audited. https://code.briarproject.org/briar/briar/-/wikis/FAQ#has-briar-been-independently-audited https://code.briarproject.org/briar/briar/-/wikis/FAQ#has-br...
        coldtea 5y ago
        And who audits the auditors?
  - sodality2 5y ago
    https://code.briarproject.org/briar/briar/-/wikis/FAQ#has-briar-been-independently-audited https://code.briarproject.org/briar/briar/-/wikis/FAQ#has-br...
  - Iolaum 5y ago
    The person you can hire to audit the code ;)
- mobilemidget 5y ago
  is there already some compare available that shows differences with other messengers like Telegram or Signal?
  - derbOac 5y ago
    It's been awhile since I used Briar, but unlike something like Signal, Briar is decentralized. So you can communicate with other Briar users in the absence of a central server. Briar at least used to be very strict about how you established contacts, so, for example, to add a contact you had to have them physically in your presence and exchange QR codes on your phone. You couldn't just add someone from your phone contacts, for example, or look up their phone number. The downside to these things is that Briar tends to use up battery on mobile devices, because it's constantly running to handle the decentralized communications. Also, having to have someone physically in your presence makes it difficult to add someone casually like some other apps. Some of these things might have changed, as they've been pretty consistent and active in developing the software, and it has evolved over time into offering more and more functionality. In general, Briar development tends to be very conservative about security, but also very encouraging of "robustness" development for lack of a better way of putting it (I think at one time they had an API so that it could be extended to general "off grid" communication protocols, or at least were discussing it). I'm a little surprised it hasn't gotten more attention over the years, because I think it has been audited and seems very very secure. It also pops up on places like HN from time to time. On the other hand, that conservativism about security makes it sort of impractical for someone who, say, just wants to chat with friends and family. I think the best comparison is probably with Matrix rather than Signal or Telegram, but Briar lacks the federated component at the moment. This desktop release is interesting to me because in some ways it represents a major expansion of the software. As I said, they've tended to be very conservative and it's interesting to see it added. It also probably makes it more feasible to treat the desktop instance as a sort of "permanent on" server with access to a power supply instead of running off a battery (to be honest, starting with a desktop service kinda makes more sense to me given the power requirements). Take this all with a grain of salt because, although I have it on my phone, I haven't actually used it in some time and haven't actively kept up with development in a couple of years.
- leonry 5y ago
  If you understand German, then I recommend the review by Mike Kuketz (https://www.kuketz-blog.de/briar-anonymitaet-und-sicherheit-gehen-vor-messenger-teil8/ https://www.kuketz-blog.de/briar-anonymitaet-und-sicherheit-...). Maybe you get a decent translation with Deepl, though I stay wary. There is also a comparison to other messenger systems on https://www.freie-messenger.de/systemvergleich/ https://www.freie-messenger.de/systemvergleich/. They have a PDF in English available, but it doesn't really tell much.
- coldtea 5y ago
  >"The initial target audience for Briar includes "activists, journalists and civil society" Sounds exactly like a project an agency would help create/infiltrate to tap unto all of the above....
- rosndo 5y ago
  > as secure as PGP Well, that doesn’t sound promising at all. You can ask any cryptographer, they will tell you to not use PGP.
  - 0xdeadb00f 5y ago
    PGP _supports_ up-to-date, secure cryptographic algorithms, but it's usability falls short. these new algorithms are rarely made the PGP implementation's default algorithms.
    - rosndo 5y ago
      Those algorithms are unsuitable for messaging as implemented in gpg.
  - scraptor 5y ago
    Because the usability sucks (supposedly leading you to shoot yourself in the foot), not because of any problems with the crypto or the implementation.
    - rosndo 5y ago
      The crypto is also very questionable for any use case relevant to briar.
irfwashere 5y ago
What does the YComb community think p2p apps like GNU Jami? I never hear much about it and think it's pretty decent unless someone has good reasons to think otherwise. Thanks
- timbit42 5y ago
  I haven't had a chance to try it as it won't connect through my firewall, yet Tox will.
rogers18445 5y ago
There is another project which I'm keeping an eye on: https://cwtch.im/ https://cwtch.im/ source code: https://git.openprivacy.ca/cwtch.im https://git.openprivacy.ca/cwtch.im
- maverick74 5y ago
  Berty is also interesting
- throwawayair557 5y ago
  Me too. They seem to be in need of funding to be sustainable. https://www.patreon.com/openprivacy https://www.patreon.com/openprivacy
only4here 5y ago
I had no idea that Briar had a desktop version. I would have been using it waay sooner!
PhilKunz 5y ago
how do devices find each other without an introductory server?
- grote 5y ago
  Using Tor onion services that get exchanges when adding a contact nearby via WiFi or Bluetooth. If adding over the internet, a rendezvous service will be created.
- sebkur 5y ago
  When you're close to someone you can make an initial exchange via QR+bluetooth. When you're distant you need to exchange your briar:// links on a different channel.
  - sebkur 5y ago
    It's also safe to post your briar:// link online (https://code.briarproject.org/briar/briar/-/wikis/FAQ#is-it-safe-to-publish-my-briar-link-publicly https://code.briarproject.org/briar/briar/-/wikis/FAQ#is-it-...) So if anyone wants to try the app but doesn't want to convince somebody else to do so too, just add my link and post yours below: briar://acyeao3gd3sqldlljx6etcjyxdr4ux6m6s3ge3r4z6st7ju2ac5xg
efficax 5y ago
Do any of these "decentralized" and "end to end" encryption communication systems actually solve the fundamental problem which is that you have to trust the person you're communicating with to not give up the content of the messages they've sent and received. People's telegram and signal comms are always showing up in subpoenas because someone unlocks their phone for the feds. I guess what I'm thinking here is that there's nothing about this that is any better than pgp emails, and i'm not sure i understand why these forms of communication are flourishing when they seem to offer little real protection against a motivated state adversary who doesn't need to attack the system if they can just ask someone for the keys
- tapoxi 5y ago
  At least for my family members, they switched to Signal because they don't trust Facebook and Google abandons their products after a few years. iMessage isn't an option because half of the family is on Android. If a motivated state actor wants pictures of my baby niece then I guess they're welcome to it.
- PragmaticPulp 5y ago
  > People's telegram and signal comms are always showing up in subpoenas because someone unlocks their phone for the feds. If the counterpart can see something with their own eyes (or a screenshot) then how would you even expect to protect against this?
  - cassianoleal 5y ago
    With a Neuralyzer [0], I guess. /s [0] https://meninblack.fandom.com/wiki/Neuralyzer https://meninblack.fandom.com/wiki/Neuralyzer
- anjbe 5y ago
  Signal’s primary defense against that is disappearing messages. Beyond that, what can you really do against what is essentially an untrusted endpoint? Education and awareness, and hope that it sticks.
- ben-schaaf 5y ago
l30n4da5 5y ago
Never heard of Briar. Title made me think it was some new cool desktop environment for linux. It took me longer than I care to admit before I realized Briar is just a messaging app.
- forgetfulness 5y ago
  A new environment with just a handful of apps comes every so often. In that regard, what are other apps like Briar? The premise is: > Briar is a messaging app designed for activists, journalists, and anyone else who needs a safe, easy and robust way to communicate. Unlike traditional messaging apps, Briar doesn’t rely on a central server - messages are synchronized directly between the users' devices. If the internet’s down, Briar can sync via Bluetooth or Wi-Fi, keeping the information flowing in a crisis. If the internet’s up, Briar can sync via the Tor network, protecting users and their relationships from surveillance
  - feanaro 5y ago
    There's some overlap with P2P Matrix (which isn't yet done but is in the works).
    - IceWreck 5y ago
      Difference is P2P isnt matrix's main goal. Their approach to P2P is to just bundle an entire homeserver on your phone or desktop client. Briar was built for P2P from the ground up, so presumably they planned this better. This isn't a criticism of matrix. Matrix is great and I use it everyday but gotta give credit where its due.
      - feanaro 5y ago
        A lightweight homeserver. If lightweight enough (which remains to be demonstrated in practice of course), I don't see a meaningful difference from a monolith design. I see no reason to think P2P isn't a goal of Matrix either; the reason it's not P2P now is that federation was easier, but the long-term game certainly looks to be P2P with work on cryptographic, portable identities and Bluetooth mesh networking in the form of Pinecone. I've also seen arathorn confirm this on HN.
ddtaylor 5y ago
I don't feel comfortable trusting a new "secure" messaging platform or interested in doing the work to dig through the sources to see if it's legit or not combined with the fact that I don't even know if the source they provide generates the same binary they distribute to many. Just use Matrix instead.
- sprash 5y ago
  > Just use Matrix instead. No just don't. Matrix exposes metadata to every connected server.
  - Arathorn 5y ago
    no, Matrix exposes metadata to only the servers whose users are talking together.
- joshuaissac 5y ago
  Briar is older than Matrix. It has been around since at least mid-2012, whereas Matrix is from 2014. Disclosure: I was an intern for them in mid-2012.
  - ddtaylor 5y ago
    Thanks that's really interesting. Does Briar have multiple client implementations like a documented protocol or something too?
    - giphyman 5y ago
      briar is built on a p2p syncing protocol called bramble, you can read more here: https://code.briarproject.org/briar/briar/-/wikis/A-Quick-Overview-of-the-Protocol-Stack https://code.briarproject.org/briar/briar/-/wikis/A-Quick-Ov...
- mab122 5y ago
  Briar is p2p/offgridy/meshnety and Matrix is federated, always on internet connected.
l-albertovich 5y ago
What I found interesting about this was the bluetooth / offline communication part.
orblivion 5y ago
My experience a few years ago just giving Briar a try for fun was that both parties had to be online at the same time to relay messages (since there's no normal servers) and that it drained my phone battery quickly when I was online. Not practical. I was thinking it would be nice to be able to run some sort of node under my own control that could buffer those messages. I feel like there was even an option to do that for phones, where someone could help relay messages between two friends, but I could be remembering wrong. At any rate, it would be cool if the desktop app could play this role.
- giphyman 5y ago
  it looks like briar is already working on that buffer node concept: https://code.briarproject.org/briar/briar-mailbox https://code.briarproject.org/briar/briar-mailbox
  - orblivion 5y ago
    Thanks, I'll keep my eye on it!
jedahan 5y ago
When I tested peer-to-peer messaging a couple of years ago, Briar was the only messenger that was able to sync messages and data without needing a common router. Was very happy to see.
bubersson 5y ago
It's great that the messaging works over bluetooth and local wifi, but I really wish the phone app would be able to cache and relay encrypted messages to others. Or does that somehow work through the posts and forums in the app?
- tekknolagi 5y ago
  Apparently being worked on: https://news.ycombinator.com/item?id=30025858 https://news.ycombinator.com/item?id=30025858
  - bubersson 5y ago
    It requires someone running a server device. I don't think that's a good direction to take unless it's really easy to enable that within the mobile app :(

179 points by Sami_Lehtinen 5y ago

Since I needed brief intro myself, Wikipedia says: "The initial target audience for Briar includes "activists, journalists and civil society" with plans to make the system "simple enough to help anyone keep their data safe." As the ability to function in the absence of internet infrastructure may also make the project valuable to disaster response and aid organisations, the developers are working with the Open Humanitarian Initiative and Taarifa. Ultimately, the developers aim to create a system which is "as simple to use as WhatsApp, as secure as PGP, and that keeps working if somebody breaks the Internet."" Would personally love a blog review or two of Briar but found little thus far.

giphyman 5y ago
Their website has a press page with some reviews and presentations: https://briarproject.org/press/ https://briarproject.org/press/
pulse7 5y ago
Who can guarantee me that this isn't built by some national security agency with some tiny, hidden backdoors?
- grote 5y ago
  No one can, but isn't that the case for all software? At least it is Free Software with reproducible builds, so you can audit the shit out of it.
  - mburee 5y ago
    I totally agree, but no one ever pays the money to have it properly audited
    - vorpalhex 5y ago
      It's you. You can pay to have it audited right now. You can also audit it, if you have the skillset.
    - sodality2 5y ago
      It has been audited. https://code.briarproject.org/briar/briar/-/wikis/FAQ#has-briar-been-independently-audited https://code.briarproject.org/briar/briar/-/wikis/FAQ#has-br...
      - coldtea 5y ago
        And who audits the auditors?
- sodality2 5y ago
  https://code.briarproject.org/briar/briar/-/wikis/FAQ#has-briar-been-independently-audited https://code.briarproject.org/briar/briar/-/wikis/FAQ#has-br...
- Iolaum 5y ago
  The person you can hire to audit the code ;)
mobilemidget 5y ago
is there already some compare available that shows differences with other messengers like Telegram or Signal?
- derbOac 5y ago
  It's been awhile since I used Briar, but unlike something like Signal, Briar is decentralized. So you can communicate with other Briar users in the absence of a central server. Briar at least used to be very strict about how you established contacts, so, for example, to add a contact you had to have them physically in your presence and exchange QR codes on your phone. You couldn't just add someone from your phone contacts, for example, or look up their phone number. The downside to these things is that Briar tends to use up battery on mobile devices, because it's constantly running to handle the decentralized communications. Also, having to have someone physically in your presence makes it difficult to add someone casually like some other apps. Some of these things might have changed, as they've been pretty consistent and active in developing the software, and it has evolved over time into offering more and more functionality. In general, Briar development tends to be very conservative about security, but also very encouraging of "robustness" development for lack of a better way of putting it (I think at one time they had an API so that it could be extended to general "off grid" communication protocols, or at least were discussing it). I'm a little surprised it hasn't gotten more attention over the years, because I think it has been audited and seems very very secure. It also pops up on places like HN from time to time. On the other hand, that conservativism about security makes it sort of impractical for someone who, say, just wants to chat with friends and family. I think the best comparison is probably with Matrix rather than Signal or Telegram, but Briar lacks the federated component at the moment. This desktop release is interesting to me because in some ways it represents a major expansion of the software. As I said, they've tended to be very conservative and it's interesting to see it added. It also probably makes it more feasible to treat the desktop instance as a sort of "permanent on" server with access to a power supply instead of running off a battery (to be honest, starting with a desktop service kinda makes more sense to me given the power requirements). Take this all with a grain of salt because, although I have it on my phone, I haven't actually used it in some time and haven't actively kept up with development in a couple of years.
leonry 5y ago
If you understand German, then I recommend the review by Mike Kuketz (https://www.kuketz-blog.de/briar-anonymitaet-und-sicherheit-gehen-vor-messenger-teil8/ https://www.kuketz-blog.de/briar-anonymitaet-und-sicherheit-...). Maybe you get a decent translation with Deepl, though I stay wary. There is also a comparison to other messenger systems on https://www.freie-messenger.de/systemvergleich/ https://www.freie-messenger.de/systemvergleich/. They have a PDF in English available, but it doesn't really tell much.
coldtea 5y ago
>"The initial target audience for Briar includes "activists, journalists and civil society" Sounds exactly like a project an agency would help create/infiltrate to tap unto all of the above....
rosndo 5y ago
> as secure as PGP Well, that doesn’t sound promising at all. You can ask any cryptographer, they will tell you to not use PGP.
- 0xdeadb00f 5y ago
  PGP _supports_ up-to-date, secure cryptographic algorithms, but it's usability falls short. these new algorithms are rarely made the PGP implementation's default algorithms.
  - rosndo 5y ago
    Those algorithms are unsuitable for messaging as implemented in gpg.
- scraptor 5y ago
  Because the usability sucks (supposedly leading you to shoot yourself in the foot), not because of any problems with the crypto or the implementation.
  - rosndo 5y ago
    The crypto is also very questionable for any use case relevant to briar.

irfwashere 5y ago

What does the YComb community think p2p apps like GNU Jami? I never hear much about it and think it's pretty decent unless someone has good reasons to think otherwise. Thanks

timbit42 5y ago
I haven't had a chance to try it as it won't connect through my firewall, yet Tox will.

rogers18445 5y ago

There is another project which I'm keeping an eye on: https://cwtch.im/ https://cwtch.im/ source code: https://git.openprivacy.ca/cwtch.im https://git.openprivacy.ca/cwtch.im

maverick74 5y ago
Berty is also interesting
throwawayair557 5y ago
Me too. They seem to be in need of funding to be sustainable. https://www.patreon.com/openprivacy https://www.patreon.com/openprivacy

only4here 5y ago

I had no idea that Briar had a desktop version. I would have been using it waay sooner!

PhilKunz 5y ago

how do devices find each other without an introductory server?

grote 5y ago
Using Tor onion services that get exchanges when adding a contact nearby via WiFi or Bluetooth. If adding over the internet, a rendezvous service will be created.
sebkur 5y ago
When you're close to someone you can make an initial exchange via QR+bluetooth. When you're distant you need to exchange your briar:// links on a different channel.
- sebkur 5y ago
  It's also safe to post your briar:// link online (https://code.briarproject.org/briar/briar/-/wikis/FAQ#is-it-safe-to-publish-my-briar-link-publicly https://code.briarproject.org/briar/briar/-/wikis/FAQ#is-it-...) So if anyone wants to try the app but doesn't want to convince somebody else to do so too, just add my link and post yours below: briar://acyeao3gd3sqldlljx6etcjyxdr4ux6m6s3ge3r4z6st7ju2ac5xg

efficax 5y ago

Do any of these "decentralized" and "end to end" encryption communication systems actually solve the fundamental problem which is that you have to trust the person you're communicating with to not give up the content of the messages they've sent and received. People's telegram and signal comms are always showing up in subpoenas because someone unlocks their phone for the feds. I guess what I'm thinking here is that there's nothing about this that is any better than pgp emails, and i'm not sure i understand why these forms of communication are flourishing when they seem to offer little real protection against a motivated state adversary who doesn't need to attack the system if they can just ask someone for the keys

tapoxi 5y ago
At least for my family members, they switched to Signal because they don't trust Facebook and Google abandons their products after a few years. iMessage isn't an option because half of the family is on Android. If a motivated state actor wants pictures of my baby niece then I guess they're welcome to it.
PragmaticPulp 5y ago
> People's telegram and signal comms are always showing up in subpoenas because someone unlocks their phone for the feds. If the counterpart can see something with their own eyes (or a screenshot) then how would you even expect to protect against this?
- cassianoleal 5y ago
  With a Neuralyzer [0], I guess. /s [0] https://meninblack.fandom.com/wiki/Neuralyzer https://meninblack.fandom.com/wiki/Neuralyzer
anjbe 5y ago
Signal’s primary defense against that is disappearing messages. Beyond that, what can you really do against what is essentially an untrusted endpoint? Education and awareness, and hope that it sticks.
ben-schaaf 5y ago

l30n4da5 5y ago

Never heard of Briar. Title made me think it was some new cool desktop environment for linux. It took me longer than I care to admit before I realized Briar is just a messaging app.

forgetfulness 5y ago
A new environment with just a handful of apps comes every so often. In that regard, what are other apps like Briar? The premise is: > Briar is a messaging app designed for activists, journalists, and anyone else who needs a safe, easy and robust way to communicate. Unlike traditional messaging apps, Briar doesn’t rely on a central server - messages are synchronized directly between the users' devices. If the internet’s down, Briar can sync via Bluetooth or Wi-Fi, keeping the information flowing in a crisis. If the internet’s up, Briar can sync via the Tor network, protecting users and their relationships from surveillance
- feanaro 5y ago
  There's some overlap with P2P Matrix (which isn't yet done but is in the works).
  - IceWreck 5y ago
    Difference is P2P isnt matrix's main goal. Their approach to P2P is to just bundle an entire homeserver on your phone or desktop client. Briar was built for P2P from the ground up, so presumably they planned this better. This isn't a criticism of matrix. Matrix is great and I use it everyday but gotta give credit where its due.
    - feanaro 5y ago
      A lightweight homeserver. If lightweight enough (which remains to be demonstrated in practice of course), I don't see a meaningful difference from a monolith design. I see no reason to think P2P isn't a goal of Matrix either; the reason it's not P2P now is that federation was easier, but the long-term game certainly looks to be P2P with work on cryptographic, portable identities and Bluetooth mesh networking in the form of Pinecone. I've also seen arathorn confirm this on HN.

ddtaylor 5y ago

I don't feel comfortable trusting a new "secure" messaging platform or interested in doing the work to dig through the sources to see if it's legit or not combined with the fact that I don't even know if the source they provide generates the same binary they distribute to many. Just use Matrix instead.

sprash 5y ago
> Just use Matrix instead. No just don't. Matrix exposes metadata to every connected server.
- Arathorn 5y ago
  no, Matrix exposes metadata to only the servers whose users are talking together.
joshuaissac 5y ago
Briar is older than Matrix. It has been around since at least mid-2012, whereas Matrix is from 2014. Disclosure: I was an intern for them in mid-2012.
- ddtaylor 5y ago
  Thanks that's really interesting. Does Briar have multiple client implementations like a documented protocol or something too?
  - giphyman 5y ago
    briar is built on a p2p syncing protocol called bramble, you can read more here: https://code.briarproject.org/briar/briar/-/wikis/A-Quick-Overview-of-the-Protocol-Stack https://code.briarproject.org/briar/briar/-/wikis/A-Quick-Ov...
mab122 5y ago
Briar is p2p/offgridy/meshnety and Matrix is federated, always on internet connected.

l-albertovich 5y ago

What I found interesting about this was the bluetooth / offline communication part.

orblivion 5y ago

My experience a few years ago just giving Briar a try for fun was that both parties had to be online at the same time to relay messages (since there's no normal servers) and that it drained my phone battery quickly when I was online. Not practical. I was thinking it would be nice to be able to run some sort of node under my own control that could buffer those messages. I feel like there was even an option to do that for phones, where someone could help relay messages between two friends, but I could be remembering wrong. At any rate, it would be cool if the desktop app could play this role.

giphyman 5y ago
it looks like briar is already working on that buffer node concept: https://code.briarproject.org/briar/briar-mailbox https://code.briarproject.org/briar/briar-mailbox
- orblivion 5y ago
  Thanks, I'll keep my eye on it!

jedahan 5y ago

When I tested peer-to-peer messaging a couple of years ago, Briar was the only messenger that was able to sync messages and data without needing a common router. Was very happy to see.

bubersson 5y ago

It's great that the messaging works over bluetooth and local wifi, but I really wish the phone app would be able to cache and relay encrypted messages to others. Or does that somehow work through the posts and forums in the app?

tekknolagi 5y ago
Apparently being worked on: https://news.ycombinator.com/item?id=30025858 https://news.ycombinator.com/item?id=30025858
- bubersson 5y ago
  It requires someone running a server device. I don't think that's a good direction to take unless it's really easy to enable that within the mobile app :(