17 ms·

Briar: Peer-to-Peer Encrypted Messaging

424 points by matthewmorgan 4y ago

dang 4y ago
Related: Briar Project – Secure messaging, everywhere - https://news.ycombinator.com/item?id=33412171 https://news.ycombinator.com/item?id=33412171 - Oct 2022 (7 comments) Briar has been removed from Google Play - https://news.ycombinator.com/item?id=30498924 https://news.ycombinator.com/item?id=30498924 - Feb 2022 (85 comments) Briar Desktop for Linux - https://news.ycombinator.com/item?id=30023169 https://news.ycombinator.com/item?id=30023169 - Jan 2022 (84 comments) Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks - https://news.ycombinator.com/item?id=29227754 https://news.ycombinator.com/item?id=29227754 - Nov 2021 (110 comments) Secure Messaging, Anywhere - https://news.ycombinator.com/item?id=27649123 https://news.ycombinator.com/item?id=27649123 - June 2021 (63 comments) Briar Project - https://news.ycombinator.com/item?id=24031885 https://news.ycombinator.com/item?id=24031885 - Aug 2020 (185 comments) Briar and Bramble: A Vision for Decentralized Infrastructure - https://news.ycombinator.com/item?id=18027949 https://news.ycombinator.com/item?id=18027949 - Sept 2018 (11 comments) Briar Project - https://news.ycombinator.com/item?id=17888920 https://news.ycombinator.com/item?id=17888920 - Aug 2018 (10 comments) Briar: Peer-to-peer encrypted messaging and forums - https://news.ycombinator.com/item?id=16948438 https://news.ycombinator.com/item?id=16948438 - April 2018 (1 comment) Darknet Messenger Briar Releases Beta, Passes Security Audit - https://news.ycombinator.com/item?id=14825019 https://news.ycombinator.com/item?id=14825019 - July 2017 (85 comments)
bawolff 4y ago
> The adversary has a limited ability to monitor short-range communication channels (Bluetooth, WiFi, etc). That seems like a pretty big assumption. From what i understand there already exists deployment of wifi hot spots to track people (both for advertising purposes and for spying purposes) to the extent that phone providers started radomizing MAC addresses.
- snoopy_telex 4y ago
  Cisco’s meraki has that built into their devices. I run meraki in my home and have it enabled and it’s pretty powerful. If you see a wifi network, it most certainly can track you and if it’s not a residential network, I assume it is.
  - sixstringtheory 4y ago
    This is why I don’t like the automatically re-enabling wifi setting on iOS. Yes you can still turn it “really off” in settings (until the phone reboots again) and yes I put a shortcut on my home screen to turn wifi/bluetooth all the way off in one click, but probably barely anyone is doing those things because it’s inconvenient/they don’t know/they forget.
lsh123 4y ago
Building a completely p2p (no servers) e2ee messaging app is not hard except one big problem: contacts discovery. I looked through briar website and it seems the solution is to constantly ping all contacts and hope that everyone is online plus at least one of IPs stays the same between pings. Did I miss something more interesting?
- jmspring 4y ago
  And for mobile, network connectivity.
  - lsh123 4y ago
    If contacts discovery is somehow solved, then I can see potential options of using short range comms (eg bluetooth) for connectivity. Basically all ideas I have are: 1) somewhat central server(s) 2) always on plus constant updates (what briar seems to be doing) 3) every node knows large part of topology (not very scalable) I am wondering if I am missing something in briar’s architecture
- maqp 4y ago
  Tor hosts a directory service, a (de)centralized repository of rendezvous nodes from which the Onion Service (server) can be reached, thus the IP address is not lost, but since the circuit is rebuilt every 10 minutes or so, the connection will probably get cut every now and then. I'm not sure if this really works, but if it's a short message and you periodically check the server if there's a reply and the service responds with short reply, the Tor cell padding (to 500 bytes IIRC) would make it harder to observe metadata about when communication takes place. This all of course goes out the window if it's a large packet that requires multiple cells, or if it's the client that just POSTs the outgoing messages to the server over an established connection.
  - lsh123 4y ago
    Thanks, this is basically combination of somewhat central servers plus nearly always online model. I need to think about it - on the first glance I am not 100% sure the role Tor plays in this model. Is this described somewhere in more details? As I said, I clicked around but didn’t see any docs about this.
Ptchd 4y ago
Briar is nice, too bad they don't have a Linux app (only an Android app)... Also, it chews through battery in no time.
- maqp 4y ago
  It's a work in progress in terms of feature parity but there is: https://briarproject.org/download-briar-desktop/ https://briarproject.org/download-briar-desktop/
  - Ptchd 4y ago
    nice, thanks!
- anigbrowl 4y ago
  The battery is a bigger problem. You can work around OS issues but if yourun out of battery at the same time you are cut off from normal communications you now have two major problems, and your expedited/unexpected disappearance from the conversation creates unnecessary anxiety for others. I hope they make fixing this a priority, it's a serious shortcoming.
  - giphyman 4y ago
    They are working on a mailbox app to offload the constant background tor processes which use a lot of the battery life: https://code.briarproject.org/briar/briar-mailbox https://code.briarproject.org/briar/briar-mailbox
    - Ptchd 4y ago
      Great to hear that they are working on this issue. Who will host the mailbox though?
      - sebkur 4y ago
        you'll actually need to host it yourself. It's going to be a one-to-one relationship between mailboxes and briar users on purpose to avoid centralization of any kind (think techies hosting mailboxes for many friends etc.). To make hosting rather easy, the mailbox can be run on a spare (old) Android device, ideally plugged into a power outlet and connected to Wifi. Setup will include installing the app onto the Android and going through a pairing procedure by scanning a QR-code from the mailbox app from the briar settings screen.
maqp 4y ago
Briar is one of the most important secure messaging projects currently. Not only does it remove the need to trust the vendor about content (like with all E2EE messaging apps), you also get to keep the metadata about communication to yourself as data transits from one Tor Onion Service to another. The downside is of course, you need to keep the endpoint powered on when you want to be reachable so it will increase the battery drain on your phone. Note: There's also a desktop client if that's easier to keep online https://briarproject.org/download-briar-desktop/ https://briarproject.org/download-briar-desktop/ One extremely important thing Briar is doing, is it's using the P2P as means to host alternative social interaction formats, like forums and blogs. Similar to Signal/WhatsApp stories (which is somewhat similar to microblogs/FB wall), it's a way to indirectly share information. You could pretty much emulate any social media platform on top of E2EE protocol with ~zero infrastructure cost and without having to worry about data mining. I'd argue what Briar's innovating on here is one of the most important aspects in what's left for secure messaging. Finally a small caveat: Briar will share your Bluetooth MAC address with all peers so it can automatically use that when you're in close proximity with your peer. Thus sharing your Briar ID publicly is not a good idea for two reasons: 1) major global adversaries may have access to the leaking Bluetooth MAC (e.g. if Google aggregates it) which can deanonymize your account. This also allows slightly technical person to confirm identity of briar account if they suspect it's you (a bit wonky threat model but still). 2) it ties everything you do across your accounts on same device together, so there's strong linkability even if you rotate the identity key by reinstalling the app. Briar is pretty clear about this in it's FAQ, but it's still not very well known although it definitely should be. --- That being said, if you want similar Onion Service based communication with no such linkability, there's https://cwtch.im/ https://cwtch.im/ which is a fantastic project. There's also https://www.ricochetrefresh.net/ https://www.ricochetrefresh.net/ Both are spiritual successors to John Brooks' `Ricochet` application which pioneered the whole Onion Service based instant messaging in 2014. You can also chat and share files (among other things) with https://onionshare.org/ https://onionshare.org/ (And finally, you can get remote exfiltration security for keys/plaintexts with TFC https://github.com/maqp/tfc https://github.com/maqp/tfc (my personal work), at the cost of losing some features like message forwarding etc that the architecture prevents you from doing.)
- martin82 4y ago
willnonya 4y ago
Briar, for when security and deliverability of your messages aren't really the point...
- blendergeek 4y ago
  I understand why you don't think Briar has good deliverability. But what makes you think that the security of Briar messages is suspect?
  - martin1975 4y ago
    If he had an argument, he'd have presented it in his post.
kevinfiol 4y ago
Just wanna say this app saved my family and I when we went on a cruise. Normally, we would had had to pay to use the chat service via the ship's paid-only Wi-Fi (since we get no phone reception on the seas). Without needing to pay for the Wi-Fi, we were all able to use Briar to communicate whilst connected to the network, which made coordinating and finding each other on the ship way easier. It was great and worked really well. So thanks, Briar!
- zikduruqe 4y ago
  Check out https://berty.tech https://berty.tech for direct off network communications when you do not have internet.
  - MuffinFlavored 4y ago
    How does this work? Do the two devices still need to be on some sort of net work accessible to each other? Two cell phones not on the same Wi-Fi are going to have a hard time talking to each other buy anything other than Bluetooth, no?
    - lelandfe 4y ago
      It is Bluetooth (Low Energy), yep. https://berty.tech/features https://berty.tech/features
  - huhtenberg 4y ago
    The site has some hard dependency of AMP, takes a long time to load when ampproject.org is blocked and then renders broken. It looks very cool regardless, thanks for mentioning it.
  - goodpoint 4y ago
    It uses only BLE. What's the point when Briar is a better alternative?
    - retrobox 4y ago
californiadreem 4y ago
My wife and I use Briar for household communication because of subsidiarity rather than any direct privacy concerns. Out of all the messenger projects that we've tried, Briar actually works for local communication. It's actually instant messaging without any client hiccups or latency (looking at you, Signal). We've tried a ton of other options, but we keep ending up back at Briar. There are points of UX friction in the name of good opsec that are inconvenient but totally understandable given the project goals. The big ones being that you have to manually login after any reboots and notifications are intentionally sparse, so good luck using a smartwatch for reading or replying. Otherwise, the forums and blogs are great for managing household projects, IM is a dream, and as a bonus, anyone willing to install and use it probably has a large enough values overlap that we can use it as a social pre-filter for close friends. The only other option that has come even remotely close to being as functional as Briar is DeltaChat. The only issue that stops us from using DeltaChat (or email in general) is that we both have email hosting in Europe while we live in the US, so neither of us, being frugal in principal, wants to send information to Europe and back in order to tell the person 100 ft away to come help bring in the groceries.
- rand0mx1 4y ago
  You may like this app Meshenger (P2P Voice- and video phone App.) https://f-droid.org/packages/d.d.meshenger/ https://f-droid.org/packages/d.d.meshenger/
  - hanniabu 4y ago
    Sean Connery approves
    - anon400232 4y ago
      "I'll take anal bum cover for $7000." -fake Sean Connery on SNL Jeopardy, selecting from the "An Album Cover" category
- KennyBlanken 4y ago
  > It's actually instant messaging without any client hiccups or latency (looking at you, Signal). This is almost certainly poor wifi / cell coverage, not Signal having "hiccups" or "latency." I routinely have real-time texting conversations with friends and I can see the messages are "seen" almost instantaneously, half-way across the US. I've also never had an issue with voice chat. It's been flawless, and very high quality audio. As good or better than Facetime. Also, unlike Briar, Signal is available for iOS, which is superior if you care about digital privacy, allowing users to disable a slew of data reporting (particularly location data) back to Apple that Android forces you to give Google.
jacooper 4y ago
I am waiting for Matrix's P2P support, once its out, its going to crush everything else. Supposedly its should come out with the improved mobile apps too, which are sorely needed.
- palata 4y ago
  Is it close to being released? Or is that all theoretical?
  - mlok 4y ago
    https://arewep2pyet.com/ https://arewep2pyet.com/
    - palata 4y ago
      TL;DR: "Not yet."
  - KoftaBob 4y ago
    You can test it on their Element client's TestFlight beta: https://testflight.apple.com/join/Tgh2MEk6 https://testflight.apple.com/join/Tgh2MEk6
- Ptchd 4y ago
  Matrix is so buggy right now without p2p, so I doubt it... specially when it comes to decryption
  - jacooper 4y ago
    Bugs in a frontend implementation ≠ bugs in the protocol
- avnigo 4y ago
  I am too, but the Matrix implementation feels quite complex with many moving parts, when apps like Briar, Berty, or keet.io [0] show up and look more straightforward to use. I don't know if that will be its downfall or ultimately actually make it more robust, but I'm rooting for it. As convenient as it'd be for one implementation to crush everything else and become better because of it, I think different choices are good in terms of having alternatives and competing for features and niches. [0]: https://keet.io/ https://keet.io/
neilv 4y ago
Briar's "F-Droid" installation option wants you to add a new package distribution repo to the F-Droid app. Rather than the usual way, which is to have F-Droid verify the source build of each version, and distribute through the official F-Droid repo. (And normally that "Get it on F-Droid" button links to F-Droid's page for the app, rather than to another page of the project.)
- slim 4y ago
  They want to sign their software themselves that's ok. Everybody learned their lesson from the Signal vs Fdroid drama
  - CameronNemo 4y ago
    F-Droid purposefully makes it convenient to use multiple repos. I have F-Droid, microG, and Briar enabled right now.
- orblivion 4y ago
  It's still in the normal F-Droid repository: https://f-droid.org/en/packages/org.briarproject.briar.android/ https://f-droid.org/en/packages/org.briarproject.briar.andro... Last update a month ago.
nullc 4y ago
Since the protocol appears to use adhoc synchronization, the authors might be interested in https://github.com/sipa/minisketch/ https://github.com/sipa/minisketch/ which is a library that implements a data structure (pinsketch) that allows two parties to synchronize their sets of m b-bit elements which differ by c entries using only b*c bits. A naive protocol would use m*b bits instead, which is potentially much larger. I'd guess that under normal usage the message densities probably don't justify such efficient means-- we developed this library for use in bitcoin targeting rates on the order of a dozen new messages per second and where every participant has many peers with potentially differing sets--, but it's still probably worth being aware of. The pinsketch is always equal or more efficient than a naive approach, but may not be worth the complexity. The somewhat better known IBLT data structure has constant overheads that make it less efficient than even naive synchronization until the set differences are fairly large (particular when the element hashes are small); so some applications that evaluated and eschewed IBLT might find pinsketch applicable.
matthewmorgan 4y ago
Useful in warzones I'd imagine
DoItToMe81 4y ago
Why this, and not something with a proven record of stability like Tox?
- goodpoint 4y ago
  Is that sarcasm? Tox came out from 4chan and has a very questionable security record.
- maqp 4y ago
  Tox doesn't anonymize by default. You're leaking your IP address to every peer, and you're leaking metadata about to whom you communicate to every entity in the backbone. Also, feel free to participate in the social experiment of '4chan writes a secure messaging app with the CVE programming language', I know I never will.
ofrzeta 4y ago
Related: Are there any standards, APIs, best practices for p2p peer discovery? I found this https://github.com/status-im/bigbrother-specs/blob/master/data_sync/p2p-data-sync-comparison.md https://github.com/status-im/bigbrother-specs/blob/master/da... (mentions Gossip and Kademlia) but it is several years old and doesn't contain much info on peer discovery.
- klabb3 4y ago
  Check out libp2p, they're fairly mature and has discovery, relays, gossiping etc.
  - anonymousDan 4y ago
    I think this is what Ethereum's gossip network uses.
- rakoo 4y ago
  Pretty much any bittorrent library implements peer discovery through DHT (global database of who is interested in what hash), PEX (Peer exchange, ie if you and a peer are interested in the same content you can both exchanges other peers each side is connected to)
braingenious 4y ago
This is super cool! I’m assuming that there is nothing on iOS that’s comparable, which is a bummer.
ementally 4y ago
Well... P2P isn't the best when it comes to messaging https://github.com/simplex-chat/simplex-chat/blob/stable/docs/SIMPLEX.md#comparison-with-p2p-messaging-protocols https://github.com/simplex-chat/simplex-chat/blob/stable/doc...
- huhtenberg 4y ago
  P2P is not an exact term. It is widely used to refer to direct communication between two nodes, via LAN, VPN, Bluetooth, etc., i.e. without any mesh routing involved. From the looks of it Briar is that way + it can also route via Tor.
- maqp 4y ago
  Simplex isn't what you want https://www.reddit.com/r/privacy/comments/vwje57/comment/iftve86/?utm_source=share&utm_medium=web2x&context=3 https://www.reddit.com/r/privacy/comments/vwje57/comment/ift...
dijit 4y ago
Note: on iOS's App Store searching for Briar shows Signal for me. https://i.imgur.com/5YiR1Xk.jpg https://i.imgur.com/5YiR1Xk.jpg
- ale42 4y ago
  that's probably some "intelligent" thing by the App Store showing you similar applications to what you are looking for... unless Signal has "briar" as a keyword but I'd doubt
- Teckla 4y ago
  Same here. Searching for Briar shows Signal. I can't find Briar on the iOS app store at all.
anonymousDan 4y ago
How does it handle spam?
- giphyman 4y ago
  Briar uses a rendevouz system for adding contacts over the internet: https://code.briarproject.org/briar/briar-spec/blob/master/protocols/BRP.md https://code.briarproject.org/briar/briar-spec/blob/master/p... And a 2-party QR code protocol for adding contacts in person: https://code.briarproject.org/briar/briar-spec/blob/master/protocols/BQP.md https://code.briarproject.org/briar/briar-spec/blob/master/p... In short, both these methods of adding contacts require both parties to actively add each other in the same time period. So even if you post your briar contact code publicly, only the contacts you are adding as well will be able to connect with you.
  - anonymousDan 4y ago
    Thanks. I meant more with respect to users spamming forums - to send a message to a particular forum do I just have to know of its existence? Or is it that each user only sees messages from its contacts on each forum?
    - giphyman 4y ago
      A Briar user can either create a new forum, or get invited via a Briar contact that is already in an existing forum. There's some more info on this topic in Briar's user manual if you're interested: https://briarproject.org/manual/ https://briarproject.org/manual/ Briar also has the ability to introduce contacts to each other, so while it doesn't support totally public forums, you can spread information between contacts fairly effectively.
lgxz 4y ago
Are there similar iOS Apps?
- jokowueu 4y ago
  https://berty.tech/ https://berty.tech/
oska 4y ago
Keet (still in Alpha) is also doing P2P encrypted messaging (and video calls). https://keet.io/ https://keet.io/
lrvick 4y ago
The biggest privacy problem of Briar is it requires iOS or Android to use. If you cannot control your endpoint, you cannot control your keys or your privacy. Briar will become useful to me when it can run on open platforms like a Pinephone, Librem 5, Precursor, etc.
- giphyman 4y ago
  There is a WIP desktop client which is targeting linux phones: https://code.briarproject.org/briar/briar-desktop#design-goals https://code.briarproject.org/briar/briar-desktop#design-goa...
upofadown 4y ago
You can verify identities in person by scanning a QR code. That's completely solid. Otherwise you can send someone a link. It should be made clearer in the documentation that that link might end up with someone other than who you expect and the potential downside of that.
puntofisso 4y ago
What I find interesting is that such p2p comms applications return with a certain recurrence. I think one of the first was Nokia Sensor (2005?), and there was one that was famous during the Arab Spring/Hong Kong protests.
deleted 4y ago
[deleted]
LibertyBeta 4y ago
I want to like Brair, but I have yet to find any one who does use it. Which is a shame, really.
LoganDark 4y ago
Another mobile-only messaging app. If I wanted to use my phone, I'd just use SMS or RCS!
- giphyman 4y ago
  The desktop app is currently in development: https://briarproject.org/download-briar-desktop/ https://briarproject.org/download-briar-desktop/
  - LoganDark 4y ago
    Interesting - the Java version runs on Windows[0][1]! I suppose I'll check it out, then. [0]: if you drop a dependency into the jar - https://github.com/JetBrains/skiko/releases/download/v0.7.40/skiko-awt-runtime-windows-x64-0.7.40.jar https://github.com/JetBrains/skiko/releases/download/v0.7.40... (you want the DLL, the checksum, and the .dat) [1]: https://cdn.upload.systems/uploads/RC0uthIY.png https://cdn.upload.systems/uploads/RC0uthIY.png
    - giphyman 4y ago
      Are you able to get messaging working on Windows? Their website says they only support linux currently.
      - LoganDark 4y ago
        Well, it's a Java app. It just works everywhere. I was able to create an account just fine, though I don't have any contacts to message. I don't have any reason to believe it wouldn't work fine, though.
exabrial 4y ago
Most of the world uses Android, so I can understand the reason why it's an Android project. I just wish there was an iOS port too!

424 points by matthewmorgan 4y ago

dang 4y ago

Related: Briar Project – Secure messaging, everywhere - https://news.ycombinator.com/item?id=33412171 https://news.ycombinator.com/item?id=33412171 - Oct 2022 (7 comments) Briar has been removed from Google Play - https://news.ycombinator.com/item?id=30498924 https://news.ycombinator.com/item?id=30498924 - Feb 2022 (85 comments) Briar Desktop for Linux - https://news.ycombinator.com/item?id=30023169 https://news.ycombinator.com/item?id=30023169 - Jan 2022 (84 comments) Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks - https://news.ycombinator.com/item?id=29227754 https://news.ycombinator.com/item?id=29227754 - Nov 2021 (110 comments) Secure Messaging, Anywhere - https://news.ycombinator.com/item?id=27649123 https://news.ycombinator.com/item?id=27649123 - June 2021 (63 comments) Briar Project - https://news.ycombinator.com/item?id=24031885 https://news.ycombinator.com/item?id=24031885 - Aug 2020 (185 comments) Briar and Bramble: A Vision for Decentralized Infrastructure - https://news.ycombinator.com/item?id=18027949 https://news.ycombinator.com/item?id=18027949 - Sept 2018 (11 comments) Briar Project - https://news.ycombinator.com/item?id=17888920 https://news.ycombinator.com/item?id=17888920 - Aug 2018 (10 comments) Briar: Peer-to-peer encrypted messaging and forums - https://news.ycombinator.com/item?id=16948438 https://news.ycombinator.com/item?id=16948438 - April 2018 (1 comment) Darknet Messenger Briar Releases Beta, Passes Security Audit - https://news.ycombinator.com/item?id=14825019 https://news.ycombinator.com/item?id=14825019 - July 2017 (85 comments)

bawolff 4y ago

> The adversary has a limited ability to monitor short-range communication channels (Bluetooth, WiFi, etc). That seems like a pretty big assumption. From what i understand there already exists deployment of wifi hot spots to track people (both for advertising purposes and for spying purposes) to the extent that phone providers started radomizing MAC addresses.

snoopy_telex 4y ago
Cisco’s meraki has that built into their devices. I run meraki in my home and have it enabled and it’s pretty powerful. If you see a wifi network, it most certainly can track you and if it’s not a residential network, I assume it is.
- sixstringtheory 4y ago
  This is why I don’t like the automatically re-enabling wifi setting on iOS. Yes you can still turn it “really off” in settings (until the phone reboots again) and yes I put a shortcut on my home screen to turn wifi/bluetooth all the way off in one click, but probably barely anyone is doing those things because it’s inconvenient/they don’t know/they forget.

lsh123 4y ago

Building a completely p2p (no servers) e2ee messaging app is not hard except one big problem: contacts discovery. I looked through briar website and it seems the solution is to constantly ping all contacts and hope that everyone is online plus at least one of IPs stays the same between pings. Did I miss something more interesting?

jmspring 4y ago
And for mobile, network connectivity.
- lsh123 4y ago
  If contacts discovery is somehow solved, then I can see potential options of using short range comms (eg bluetooth) for connectivity. Basically all ideas I have are: 1) somewhat central server(s) 2) always on plus constant updates (what briar seems to be doing) 3) every node knows large part of topology (not very scalable) I am wondering if I am missing something in briar’s architecture
maqp 4y ago
Tor hosts a directory service, a (de)centralized repository of rendezvous nodes from which the Onion Service (server) can be reached, thus the IP address is not lost, but since the circuit is rebuilt every 10 minutes or so, the connection will probably get cut every now and then. I'm not sure if this really works, but if it's a short message and you periodically check the server if there's a reply and the service responds with short reply, the Tor cell padding (to 500 bytes IIRC) would make it harder to observe metadata about when communication takes place. This all of course goes out the window if it's a large packet that requires multiple cells, or if it's the client that just POSTs the outgoing messages to the server over an established connection.
- lsh123 4y ago
  Thanks, this is basically combination of somewhat central servers plus nearly always online model. I need to think about it - on the first glance I am not 100% sure the role Tor plays in this model. Is this described somewhere in more details? As I said, I clicked around but didn’t see any docs about this.

Ptchd 4y ago

Briar is nice, too bad they don't have a Linux app (only an Android app)... Also, it chews through battery in no time.

maqp 4y ago
It's a work in progress in terms of feature parity but there is: https://briarproject.org/download-briar-desktop/ https://briarproject.org/download-briar-desktop/
- Ptchd 4y ago
  nice, thanks!
anigbrowl 4y ago
The battery is a bigger problem. You can work around OS issues but if yourun out of battery at the same time you are cut off from normal communications you now have two major problems, and your expedited/unexpected disappearance from the conversation creates unnecessary anxiety for others. I hope they make fixing this a priority, it's a serious shortcoming.
- giphyman 4y ago
  They are working on a mailbox app to offload the constant background tor processes which use a lot of the battery life: https://code.briarproject.org/briar/briar-mailbox https://code.briarproject.org/briar/briar-mailbox
  - Ptchd 4y ago
    Great to hear that they are working on this issue. Who will host the mailbox though?
    - sebkur 4y ago
      you'll actually need to host it yourself. It's going to be a one-to-one relationship between mailboxes and briar users on purpose to avoid centralization of any kind (think techies hosting mailboxes for many friends etc.). To make hosting rather easy, the mailbox can be run on a spare (old) Android device, ideally plugged into a power outlet and connected to Wifi. Setup will include installing the app onto the Android and going through a pairing procedure by scanning a QR-code from the mailbox app from the briar settings screen.

maqp 4y ago

Briar is one of the most important secure messaging projects currently. Not only does it remove the need to trust the vendor about content (like with all E2EE messaging apps), you also get to keep the metadata about communication to yourself as data transits from one Tor Onion Service to another. The downside is of course, you need to keep the endpoint powered on when you want to be reachable so it will increase the battery drain on your phone. Note: There's also a desktop client if that's easier to keep online https://briarproject.org/download-briar-desktop/ https://briarproject.org/download-briar-desktop/ One extremely important thing Briar is doing, is it's using the P2P as means to host alternative social interaction formats, like forums and blogs. Similar to Signal/WhatsApp stories (which is somewhat similar to microblogs/FB wall), it's a way to indirectly share information. You could pretty much emulate any social media platform on top of E2EE protocol with ~zero infrastructure cost and without having to worry about data mining. I'd argue what Briar's innovating on here is one of the most important aspects in what's left for secure messaging. Finally a small caveat: Briar will share your Bluetooth MAC address with all peers so it can automatically use that when you're in close proximity with your peer. Thus sharing your Briar ID publicly is not a good idea for two reasons: 1) major global adversaries may have access to the leaking Bluetooth MAC (e.g. if Google aggregates it) which can deanonymize your account. This also allows slightly technical person to confirm identity of briar account if they suspect it's you (a bit wonky threat model but still). 2) it ties everything you do across your accounts on same device together, so there's strong linkability even if you rotate the identity key by reinstalling the app. Briar is pretty clear about this in it's FAQ, but it's still not very well known although it definitely should be. --- That being said, if you want similar Onion Service based communication with no such linkability, there's https://cwtch.im/ https://cwtch.im/ which is a fantastic project. There's also https://www.ricochetrefresh.net/ https://www.ricochetrefresh.net/ Both are spiritual successors to John Brooks' `Ricochet` application which pioneered the whole Onion Service based instant messaging in 2014. You can also chat and share files (among other things) with https://onionshare.org/ https://onionshare.org/ (And finally, you can get remote exfiltration security for keys/plaintexts with TFC https://github.com/maqp/tfc https://github.com/maqp/tfc (my personal work), at the cost of losing some features like message forwarding etc that the architecture prevents you from doing.)

martin82 4y ago

willnonya 4y ago

Briar, for when security and deliverability of your messages aren't really the point...

blendergeek 4y ago
I understand why you don't think Briar has good deliverability. But what makes you think that the security of Briar messages is suspect?
- martin1975 4y ago
  If he had an argument, he'd have presented it in his post.

kevinfiol 4y ago

Just wanna say this app saved my family and I when we went on a cruise. Normally, we would had had to pay to use the chat service via the ship's paid-only Wi-Fi (since we get no phone reception on the seas). Without needing to pay for the Wi-Fi, we were all able to use Briar to communicate whilst connected to the network, which made coordinating and finding each other on the ship way easier. It was great and worked really well. So thanks, Briar!

zikduruqe 4y ago
Check out https://berty.tech https://berty.tech for direct off network communications when you do not have internet.
- MuffinFlavored 4y ago
  How does this work? Do the two devices still need to be on some sort of net work accessible to each other? Two cell phones not on the same Wi-Fi are going to have a hard time talking to each other buy anything other than Bluetooth, no?
  - lelandfe 4y ago
    It is Bluetooth (Low Energy), yep. https://berty.tech/features https://berty.tech/features
- huhtenberg 4y ago
  The site has some hard dependency of AMP, takes a long time to load when ampproject.org is blocked and then renders broken. It looks very cool regardless, thanks for mentioning it.
- goodpoint 4y ago
  It uses only BLE. What's the point when Briar is a better alternative?
  - retrobox 4y ago

californiadreem 4y ago

My wife and I use Briar for household communication because of subsidiarity rather than any direct privacy concerns. Out of all the messenger projects that we've tried, Briar actually works for local communication. It's actually instant messaging without any client hiccups or latency (looking at you, Signal). We've tried a ton of other options, but we keep ending up back at Briar. There are points of UX friction in the name of good opsec that are inconvenient but totally understandable given the project goals. The big ones being that you have to manually login after any reboots and notifications are intentionally sparse, so good luck using a smartwatch for reading or replying. Otherwise, the forums and blogs are great for managing household projects, IM is a dream, and as a bonus, anyone willing to install and use it probably has a large enough values overlap that we can use it as a social pre-filter for close friends. The only other option that has come even remotely close to being as functional as Briar is DeltaChat. The only issue that stops us from using DeltaChat (or email in general) is that we both have email hosting in Europe while we live in the US, so neither of us, being frugal in principal, wants to send information to Europe and back in order to tell the person 100 ft away to come help bring in the groceries.

rand0mx1 4y ago
You may like this app Meshenger (P2P Voice- and video phone App.) https://f-droid.org/packages/d.d.meshenger/ https://f-droid.org/packages/d.d.meshenger/
- hanniabu 4y ago
  Sean Connery approves
  - anon400232 4y ago
    "I'll take anal bum cover for $7000." -fake Sean Connery on SNL Jeopardy, selecting from the "An Album Cover" category
KennyBlanken 4y ago
> It's actually instant messaging without any client hiccups or latency (looking at you, Signal). This is almost certainly poor wifi / cell coverage, not Signal having "hiccups" or "latency." I routinely have real-time texting conversations with friends and I can see the messages are "seen" almost instantaneously, half-way across the US. I've also never had an issue with voice chat. It's been flawless, and very high quality audio. As good or better than Facetime. Also, unlike Briar, Signal is available for iOS, which is superior if you care about digital privacy, allowing users to disable a slew of data reporting (particularly location data) back to Apple that Android forces you to give Google.

jacooper 4y ago

I am waiting for Matrix's P2P support, once its out, its going to crush everything else. Supposedly its should come out with the improved mobile apps too, which are sorely needed.

palata 4y ago
Is it close to being released? Or is that all theoretical?
- mlok 4y ago
  https://arewep2pyet.com/ https://arewep2pyet.com/
  - palata 4y ago
    TL;DR: "Not yet."
- KoftaBob 4y ago
  You can test it on their Element client's TestFlight beta: https://testflight.apple.com/join/Tgh2MEk6 https://testflight.apple.com/join/Tgh2MEk6
Ptchd 4y ago
Matrix is so buggy right now without p2p, so I doubt it... specially when it comes to decryption
- jacooper 4y ago
  Bugs in a frontend implementation ≠ bugs in the protocol
avnigo 4y ago
I am too, but the Matrix implementation feels quite complex with many moving parts, when apps like Briar, Berty, or keet.io [0] show up and look more straightforward to use. I don't know if that will be its downfall or ultimately actually make it more robust, but I'm rooting for it. As convenient as it'd be for one implementation to crush everything else and become better because of it, I think different choices are good in terms of having alternatives and competing for features and niches. [0]: https://keet.io/ https://keet.io/

neilv 4y ago

Briar's "F-Droid" installation option wants you to add a new package distribution repo to the F-Droid app. Rather than the usual way, which is to have F-Droid verify the source build of each version, and distribute through the official F-Droid repo. (And normally that "Get it on F-Droid" button links to F-Droid's page for the app, rather than to another page of the project.)

slim 4y ago
They want to sign their software themselves that's ok. Everybody learned their lesson from the Signal vs Fdroid drama
- CameronNemo 4y ago
  F-Droid purposefully makes it convenient to use multiple repos. I have F-Droid, microG, and Briar enabled right now.
orblivion 4y ago
It's still in the normal F-Droid repository: https://f-droid.org/en/packages/org.briarproject.briar.android/ https://f-droid.org/en/packages/org.briarproject.briar.andro... Last update a month ago.

nullc 4y ago

Since the protocol appears to use adhoc synchronization, the authors might be interested in https://github.com/sipa/minisketch/ https://github.com/sipa/minisketch/ which is a library that implements a data structure (pinsketch) that allows two parties to synchronize their sets of m b-bit elements which differ by c entries using only b*c bits. A naive protocol would use m*b bits instead, which is potentially much larger. I'd guess that under normal usage the message densities probably don't justify such efficient means-- we developed this library for use in bitcoin targeting rates on the order of a dozen new messages per second and where every participant has many peers with potentially differing sets--, but it's still probably worth being aware of. The pinsketch is always equal or more efficient than a naive approach, but may not be worth the complexity. The somewhat better known IBLT data structure has constant overheads that make it less efficient than even naive synchronization until the set differences are fairly large (particular when the element hashes are small); so some applications that evaluated and eschewed IBLT might find pinsketch applicable.

matthewmorgan 4y ago

Useful in warzones I'd imagine

DoItToMe81 4y ago

Why this, and not something with a proven record of stability like Tox?

goodpoint 4y ago
Is that sarcasm? Tox came out from 4chan and has a very questionable security record.
maqp 4y ago
Tox doesn't anonymize by default. You're leaking your IP address to every peer, and you're leaking metadata about to whom you communicate to every entity in the backbone. Also, feel free to participate in the social experiment of '4chan writes a secure messaging app with the CVE programming language', I know I never will.

ofrzeta 4y ago

Related: Are there any standards, APIs, best practices for p2p peer discovery? I found this https://github.com/status-im/bigbrother-specs/blob/master/data_sync/p2p-data-sync-comparison.md https://github.com/status-im/bigbrother-specs/blob/master/da... (mentions Gossip and Kademlia) but it is several years old and doesn't contain much info on peer discovery.

klabb3 4y ago
Check out libp2p, they're fairly mature and has discovery, relays, gossiping etc.
- anonymousDan 4y ago
  I think this is what Ethereum's gossip network uses.
rakoo 4y ago
Pretty much any bittorrent library implements peer discovery through DHT (global database of who is interested in what hash), PEX (Peer exchange, ie if you and a peer are interested in the same content you can both exchanges other peers each side is connected to)

braingenious 4y ago

This is super cool! I’m assuming that there is nothing on iOS that’s comparable, which is a bummer.

ementally 4y ago

Well... P2P isn't the best when it comes to messaging https://github.com/simplex-chat/simplex-chat/blob/stable/docs/SIMPLEX.md#comparison-with-p2p-messaging-protocols https://github.com/simplex-chat/simplex-chat/blob/stable/doc...

huhtenberg 4y ago
P2P is not an exact term. It is widely used to refer to direct communication between two nodes, via LAN, VPN, Bluetooth, etc., i.e. without any mesh routing involved. From the looks of it Briar is that way + it can also route via Tor.
maqp 4y ago
Simplex isn't what you want https://www.reddit.com/r/privacy/comments/vwje57/comment/iftve86/?utm_source=share&utm_medium=web2x&context=3 https://www.reddit.com/r/privacy/comments/vwje57/comment/ift...

dijit 4y ago

Note: on iOS's App Store searching for Briar shows Signal for me. https://i.imgur.com/5YiR1Xk.jpg https://i.imgur.com/5YiR1Xk.jpg

ale42 4y ago
that's probably some "intelligent" thing by the App Store showing you similar applications to what you are looking for... unless Signal has "briar" as a keyword but I'd doubt
Teckla 4y ago
Same here. Searching for Briar shows Signal. I can't find Briar on the iOS app store at all.

anonymousDan 4y ago

How does it handle spam?

giphyman 4y ago
Briar uses a rendevouz system for adding contacts over the internet: https://code.briarproject.org/briar/briar-spec/blob/master/protocols/BRP.md https://code.briarproject.org/briar/briar-spec/blob/master/p... And a 2-party QR code protocol for adding contacts in person: https://code.briarproject.org/briar/briar-spec/blob/master/protocols/BQP.md https://code.briarproject.org/briar/briar-spec/blob/master/p... In short, both these methods of adding contacts require both parties to actively add each other in the same time period. So even if you post your briar contact code publicly, only the contacts you are adding as well will be able to connect with you.
- anonymousDan 4y ago
  Thanks. I meant more with respect to users spamming forums - to send a message to a particular forum do I just have to know of its existence? Or is it that each user only sees messages from its contacts on each forum?
  - giphyman 4y ago
    A Briar user can either create a new forum, or get invited via a Briar contact that is already in an existing forum. There's some more info on this topic in Briar's user manual if you're interested: https://briarproject.org/manual/ https://briarproject.org/manual/ Briar also has the ability to introduce contacts to each other, so while it doesn't support totally public forums, you can spread information between contacts fairly effectively.

lgxz 4y ago

Are there similar iOS Apps?

jokowueu 4y ago
https://berty.tech/ https://berty.tech/

oska 4y ago

Keet (still in Alpha) is also doing P2P encrypted messaging (and video calls). https://keet.io/ https://keet.io/

lrvick 4y ago

The biggest privacy problem of Briar is it requires iOS or Android to use. If you cannot control your endpoint, you cannot control your keys or your privacy. Briar will become useful to me when it can run on open platforms like a Pinephone, Librem 5, Precursor, etc.

giphyman 4y ago
There is a WIP desktop client which is targeting linux phones: https://code.briarproject.org/briar/briar-desktop#design-goals https://code.briarproject.org/briar/briar-desktop#design-goa...

upofadown 4y ago

You can verify identities in person by scanning a QR code. That's completely solid. Otherwise you can send someone a link. It should be made clearer in the documentation that that link might end up with someone other than who you expect and the potential downside of that.

puntofisso 4y ago

What I find interesting is that such p2p comms applications return with a certain recurrence. I think one of the first was Nokia Sensor (2005?), and there was one that was famous during the Arab Spring/Hong Kong protests.

deleted 4y ago

[deleted]

LibertyBeta 4y ago

I want to like Brair, but I have yet to find any one who does use it. Which is a shame, really.

LoganDark 4y ago

Another mobile-only messaging app. If I wanted to use my phone, I'd just use SMS or RCS!

giphyman 4y ago
The desktop app is currently in development: https://briarproject.org/download-briar-desktop/ https://briarproject.org/download-briar-desktop/
- LoganDark 4y ago
  Interesting - the Java version runs on Windows[0][1]! I suppose I'll check it out, then. [0]: if you drop a dependency into the jar - https://github.com/JetBrains/skiko/releases/download/v0.7.40/skiko-awt-runtime-windows-x64-0.7.40.jar https://github.com/JetBrains/skiko/releases/download/v0.7.40... (you want the DLL, the checksum, and the .dat) [1]: https://cdn.upload.systems/uploads/RC0uthIY.png https://cdn.upload.systems/uploads/RC0uthIY.png
  - giphyman 4y ago
    Are you able to get messaging working on Windows? Their website says they only support linux currently.
    - LoganDark 4y ago
      Well, it's a Java app. It just works everywhere. I was able to create an account just fine, though I don't have any contacts to message. I don't have any reason to believe it wouldn't work fine, though.

exabrial 4y ago

Most of the world uses Android, so I can understand the reason why it's an Android project. I just wish there was an iOS port too!