11 ms·

I have never heard of wire, I will check it out. Looks interesting on first glance. One thing from the marketing page stood out to me: > Organizations can set

I have never heard of wire, I will check it out. Looks interesting on first glance. One thing from the marketing page stood out to me: > Organizations can set up customized alerts, bypassing silent mode on all devices, and trigger responses for crisis teams. Not a knock against Wire, I guess this is just where we are as a society, but I am not a fan of this whatsoever. I would refuse my company access to do this on my personal device. Mail me a pager, I'll turn it on when I'm up.

2pEXgD0fZ5cF 5y ago
This sounds like a feature that spawned from good intentions, but it's obvious in what ways this would get abused once you scale up the amount of Wire users.
gowld 5y ago
> Mail me a pager, I'll turn it on when I'm up. What's the point of hiring someone to be on call, if they refuse to be on call?
- fire 5y ago
  IMO things change quite a bit if you're actually being paid to be on call
- tasha0663 5y ago
  > What's the point of hiring someone to be on call, if they refuse to be on call? Indeed. I've walked out of interviews over this. The list of things that are actually that critical is incredibly small.
- xanaxagoras 5y ago
  You quoted me saying I'd be on call ... ?
lucgommans 5y ago
> I have never heard of wire, I will check it out. Looks interesting on first glance. It's basically Signal but without the popularity, despite predating it. Why Signal took off and Wire stagnated, I am not sure. The network effect is one part of it, probably caused by Moxie being popular in the community, but another part is that Wire does not seem to care as much about doing cool stuff like private contact discovery that Signal put some real R&D into (and no other service (Threema/Wire/etc.) even bothered to even copy, let alone build upon). Main differences: - Signal is better with metadata - Wire needs no phone number - Wire treats devices equivalently. If you want two phones, that's fine (Signal supports only 1 mobile device and N slave desktop devices; can't have desktop without mobile or more than one mobile) and is mostly feature-complete on each platform (Signal misses e.g. gifs on desktop) - Signal's apps are a bit more polished than Wire's, slightly better UX - Now that Signal has been gaining popularity and Wire, um, not as far as I can tell, Wire seems to be focusing more on corporate use. But it's still possible to register free accounts: https://app.wire.com/auth/?hl=en#createaccount https://app.wire.com/auth/?hl=en#createaccount - I think Wire has a bots system that Signal does not (and is generally more open to integrations), but I could be wrong here
- wolverine876 5y ago
  The above discusses the marketed features, but essential to security is the implementation. Based on what I understand from people with actual IT security expertise (I have IT expertise, but not specifically in security), Signal is on a different level than the others, and really the only option if you want real security (depending, of course, on your needs).
  - lucgommans 5y ago
    > The above discusses the marketed features The above discusses what I notice in practical terms. As a privacy nut, I want to use an encrypted messenger for my friends and family so I dove into the privacy aspect pretty deep. I work in security so I also understand the technical details. I also use Wire, Signal, Telegram, and Matrix/Element on a daily basis (and Threema ~weekly) so I know which practical pros and cons I run into for each of them. > what I understand from people with actual IT security expertise That would be me. Wire is solid. It's based on the same protocol as Signal and my employer (shortly before I started working there) audited the implementations and applications so I know the people that did this audit, and was later involved in a small architecture review as well. The reports are also open and available on the website of my employer as well as Wire's. Signal goes one step further and does innovative stuff like sealed sender and private contact discovery, but this does not impact the security of your messages or calls. It has more to do with privacy, aka how much Signal is able to do with your metadata. All of the measures they implemented can be broken if they wanted to (SGX vulns, traffic analysis, ...), so I am hesitant to consider it a solid advantage, but it's now harder to get your metadata so it's still worth something. On the other hand, there are the advantages (and disadvantages) I mentioned above. It's a trade-off and there's something to be said for each. (Of course I speak for myself and my employer may have a different opinion yada yada) > [Signal is] really the only option if you want real security That's not really true as a strong blanket statement. For message/call integrity and confidentiality: Wire and Signal are basically the same, because they use the same base protocol. If you (also) mean privacy, then... it depends: - Threema operates (app and infra) in a country with better privacy laws, and Cure53 audited them recently so their protocol should also be good. I'd go with them if I wanted the best privacy on a centralized service, though you don't get some of the fancier protocol features like plausible deniability (not that that's worth much, but it's nicer to have than not to have) - Signal does innovative stuff but requires a phone number (in my country that's linked to a government-issued identity) - Wire has infrastructure in the USA (big downside imo, I don't understand this choice) but their legal entity is iirc in Germany (which I would consider a similar jurisdiction as Threema's (Switzerland)) so that's still better than Signal in terms of coercion to hand over anything - Keybase has none of these advantages but still many people choose it for their integrations - Matrix-the-service I don't remember, but with federation it's fairly trivial to use your own home server so you're fully in control. This is obviously the best option, even if you'd not use e2ee and just encrypt-to-your-server because it's your server which can be in your house. Pick your poison on that front, or go decentralized. The aspect I cannot really speak to is exploitability, like how hard it would be to find an exploit that works on one of these apps. Best would be to have one that just shows plain text messages and doesn't do image parsing, video displaying, link resolving, peer to peer calling, etc. That is exactly none of the above and I assume that all of the above rely on system libraries for media/emoji/etc. parsing, so it should be about equal, but I don't know that for a fact.
unknown2374 5y ago
That convenience has to be let go when working on operations-critical services. This feature is an absolute necessity in a lot of cases, and of course employees can complain, but not resolving certain issues urgently can mean that an entire hospital's system stays inaccessible overnight, or worse.
- brewdad 5y ago
  Missed the point. If that operation is so critical, give me a workplace owned device to deal with it. My employer is not getting superuser access to my personal devices.
  - Spivak 5y ago
    They need superuser on Android? On iOS I just give permission for an app to send critical alerts. It's a hard requirement for apps like PagerDuty.
    - 0xedd 5y ago
    - vorpalhex 5y ago
      They do not need superuser, they can just request the permission to bypass DND. I believe apps can't tell if you gave them the permission or not, so there is no way to "force" users into this.
  - unknown2374 5y ago
    they do not need super-user permissions. That would imply that the phone has to be rooted. over-coming certain settings that apply to regular apps? sure. but that's a very android/iOS specific feature-set that is exposed to all app developers.

2pEXgD0fZ5cF 5y ago

This sounds like a feature that spawned from good intentions, but it's obvious in what ways this would get abused once you scale up the amount of Wire users.

gowld 5y ago

> Mail me a pager, I'll turn it on when I'm up. What's the point of hiring someone to be on call, if they refuse to be on call?

fire 5y ago
IMO things change quite a bit if you're actually being paid to be on call
tasha0663 5y ago
> What's the point of hiring someone to be on call, if they refuse to be on call? Indeed. I've walked out of interviews over this. The list of things that are actually that critical is incredibly small.
xanaxagoras 5y ago
You quoted me saying I'd be on call ... ?

lucgommans 5y ago

> I have never heard of wire, I will check it out. Looks interesting on first glance. It's basically Signal but without the popularity, despite predating it. Why Signal took off and Wire stagnated, I am not sure. The network effect is one part of it, probably caused by Moxie being popular in the community, but another part is that Wire does not seem to care as much about doing cool stuff like private contact discovery that Signal put some real R&D into (and no other service (Threema/Wire/etc.) even bothered to even copy, let alone build upon). Main differences: - Signal is better with metadata - Wire needs no phone number - Wire treats devices equivalently. If you want two phones, that's fine (Signal supports only 1 mobile device and N slave desktop devices; can't have desktop without mobile or more than one mobile) and is mostly feature-complete on each platform (Signal misses e.g. gifs on desktop) - Signal's apps are a bit more polished than Wire's, slightly better UX - Now that Signal has been gaining popularity and Wire, um, not as far as I can tell, Wire seems to be focusing more on corporate use. But it's still possible to register free accounts: https://app.wire.com/auth/?hl=en#createaccount https://app.wire.com/auth/?hl=en#createaccount - I think Wire has a bots system that Signal does not (and is generally more open to integrations), but I could be wrong here

wolverine876 5y ago
The above discusses the marketed features, but essential to security is the implementation. Based on what I understand from people with actual IT security expertise (I have IT expertise, but not specifically in security), Signal is on a different level than the others, and really the only option if you want real security (depending, of course, on your needs).
- lucgommans 5y ago
  > The above discusses the marketed features The above discusses what I notice in practical terms. As a privacy nut, I want to use an encrypted messenger for my friends and family so I dove into the privacy aspect pretty deep. I work in security so I also understand the technical details. I also use Wire, Signal, Telegram, and Matrix/Element on a daily basis (and Threema ~weekly) so I know which practical pros and cons I run into for each of them. > what I understand from people with actual IT security expertise That would be me. Wire is solid. It's based on the same protocol as Signal and my employer (shortly before I started working there) audited the implementations and applications so I know the people that did this audit, and was later involved in a small architecture review as well. The reports are also open and available on the website of my employer as well as Wire's. Signal goes one step further and does innovative stuff like sealed sender and private contact discovery, but this does not impact the security of your messages or calls. It has more to do with privacy, aka how much Signal is able to do with your metadata. All of the measures they implemented can be broken if they wanted to (SGX vulns, traffic analysis, ...), so I am hesitant to consider it a solid advantage, but it's now harder to get your metadata so it's still worth something. On the other hand, there are the advantages (and disadvantages) I mentioned above. It's a trade-off and there's something to be said for each. (Of course I speak for myself and my employer may have a different opinion yada yada) > [Signal is] really the only option if you want real security That's not really true as a strong blanket statement. For message/call integrity and confidentiality: Wire and Signal are basically the same, because they use the same base protocol. If you (also) mean privacy, then... it depends: - Threema operates (app and infra) in a country with better privacy laws, and Cure53 audited them recently so their protocol should also be good. I'd go with them if I wanted the best privacy on a centralized service, though you don't get some of the fancier protocol features like plausible deniability (not that that's worth much, but it's nicer to have than not to have) - Signal does innovative stuff but requires a phone number (in my country that's linked to a government-issued identity) - Wire has infrastructure in the USA (big downside imo, I don't understand this choice) but their legal entity is iirc in Germany (which I would consider a similar jurisdiction as Threema's (Switzerland)) so that's still better than Signal in terms of coercion to hand over anything - Keybase has none of these advantages but still many people choose it for their integrations - Matrix-the-service I don't remember, but with federation it's fairly trivial to use your own home server so you're fully in control. This is obviously the best option, even if you'd not use e2ee and just encrypt-to-your-server because it's your server which can be in your house. Pick your poison on that front, or go decentralized. The aspect I cannot really speak to is exploitability, like how hard it would be to find an exploit that works on one of these apps. Best would be to have one that just shows plain text messages and doesn't do image parsing, video displaying, link resolving, peer to peer calling, etc. That is exactly none of the above and I assume that all of the above rely on system libraries for media/emoji/etc. parsing, so it should be about equal, but I don't know that for a fact.

unknown2374 5y ago

That convenience has to be let go when working on operations-critical services. This feature is an absolute necessity in a lot of cases, and of course employees can complain, but not resolving certain issues urgently can mean that an entire hospital's system stays inaccessible overnight, or worse.

brewdad 5y ago
Missed the point. If that operation is so critical, give me a workplace owned device to deal with it. My employer is not getting superuser access to my personal devices.
- Spivak 5y ago
  They need superuser on Android? On iOS I just give permission for an app to send critical alerts. It's a hard requirement for apps like PagerDuty.
  - 0xedd 5y ago
  - vorpalhex 5y ago
    They do not need superuser, they can just request the permission to bypass DND. I believe apps can't tell if you gave them the permission or not, so there is no way to "force" users into this.
- unknown2374 5y ago
  they do not need super-user permissions. That would imply that the phone has to be rooted. over-coming certain settings that apply to regular apps? sure. but that's a very android/iOS specific feature-set that is exposed to all app developers.