5 ms·

> The fingerprint is computed at key exchange, you can't change it after the fact without warnings about it. Compromised apps can very much silence such warnin

> The fingerprint is computed at key exchange, you can't change it after the fact without warnings about it. Compromised apps can very much silence such warnings. > If you assume the clients are compromised, E2EE or federation or other network properties won't help, so this discussion is meaningless. Federation absolutely helps. If you get your service and your (preferably open-source) software from different sources, the chances that you'll be attacked via software backdoors is significantly reduced, especially when there are many competing apps. If you run the server yourself, the chance to be compromised becomes infinitely small.

hiq 5y ago
> Compromised apps can very much silence such warnings. Again, this is not a useful take since this equally applies to any other app, federated or not. > If you get your service and your (preferably open-source) software from different sources, the chances that you'll be attacked via software backdoors is significantly reduced No, you just need one of the trusted component to be compromised to lose your security guarantees. You're suggesting to increase your attack surface instead of reducing it.
- Andrew_nenakhov 5y ago
  > this equally applies to any other app, federated or not. Wrong. If your client software and service come from different vendors, it is by far harder to attack your privacy via compromised apps - especially if there are multiple vendors of client software and reputable open source repositories like f-droid who build apps from sources. > No, you just need one of the trusted component to be compromised to lose your security guarantees While this looks to be true, in real world practice it is completely not so. It is far harder sneaking a backdoor into a F-droid app, with far bigger reputation risks, than doing it in Signal app - especially if the attacker knows which account should be affected. And in a federated environment the attacker might not even know your account name.
  - hiq 5y ago
    Whether the protocol is federated or not (which is the topic of the article) doesn't say anything about the clients and how they're distributed. Even with respect to Signal, which is open-source, can be rebuilt from source and has several clients, including 3rd-party ones. > It is far harder sneaking a backdoor into a F-droid app, with far bigger reputation risks, than doing it in Signal app We'll have to agree to disagree.

hiq 5y ago

> Compromised apps can very much silence such warnings. Again, this is not a useful take since this equally applies to any other app, federated or not. > If you get your service and your (preferably open-source) software from different sources, the chances that you'll be attacked via software backdoors is significantly reduced No, you just need one of the trusted component to be compromised to lose your security guarantees. You're suggesting to increase your attack surface instead of reducing it.

Andrew_nenakhov 5y ago
> this equally applies to any other app, federated or not. Wrong. If your client software and service come from different vendors, it is by far harder to attack your privacy via compromised apps - especially if there are multiple vendors of client software and reputable open source repositories like f-droid who build apps from sources. > No, you just need one of the trusted component to be compromised to lose your security guarantees While this looks to be true, in real world practice it is completely not so. It is far harder sneaking a backdoor into a F-droid app, with far bigger reputation risks, than doing it in Signal app - especially if the attacker knows which account should be affected. And in a federated environment the attacker might not even know your account name.
- hiq 5y ago
  Whether the protocol is federated or not (which is the topic of the article) doesn't say anything about the clients and how they're distributed. Even with respect to Signal, which is open-source, can be rebuilt from source and has several clients, including 3rd-party ones. > It is far harder sneaking a backdoor into a F-droid app, with far bigger reputation risks, than doing it in Signal app We'll have to agree to disagree.