9 ms·
Berty: Privacy-first messaging app
- lrvick 4y agoI cannot take a privacy product seriously that only works on proprietary operating systems and does chat support exclusively over Discord.
- jhasse 4y agoShouldn't it work on Replicant?
- tecleandor 4y agoAs I noted to another commenter, they have a go CLI client ( that I haven't tested ) [1] and their site says they're going to be available also for Mac, Windows and Linux. https://github.com/berty/berty https://github.com/berty/berty
- aaravchen 4y agoThis. If your primary source of information and development is Discord, and you're a secure chat app, I'm done looking. In most cases in fact if your sole source of information is _a chat app_, I'm done looking because you've declared you don't have anything but real time support, which is on par with me calling you on the phone (it ain't happening). Chat isn't feasibly searchable in a support context, even when archived, and is completely useless for anything but real time communication. I don't get how everyone keeps complaining about it and having the problem shoved in their face daily ("too many messages, can someone summarize?") yet insist on it as a historical record and asynchronous communication medium. Using chat as your only support is a clear declaration you would rather answer the same questions repeatedly rather than work on your project at all.
- bongobingo1 4y ago> 100% Decentralized > Just like blockchain technologies, Berty doesn’t pass your data through central servers - the place where internet service providers, hackers, and governments can intercept your data. Instead, Berty’s network is distributed, based on P2P direct messaging. I know it's just marketing spiel, but kind of funny to read, as if "just like blockchain technologies" actually means anything to 99% of google play store users beyond "uhh bitcoin?" (or really means anything in this context too). Maybe it does incorporate some shared ledger, but sounds like its just plain old P2P (which is fine!).
- rakoo 4y agoIt's also funny considering that blockchain absolutely uses central servers. The bulk of mining is still done on big datacenter farms and you can't really be part of the game without joining a pool.
- rhn_mk1 4y ago> you can't really be part of the game without joining a pool. What do you mean by that? Is there a ban on independent mining? Or has starting a new pool become forbidden?
- rakoo 4y agoYou absolutely can [start your own pool], it just takes a lot of work to become profitable. Which is the only reason PoW blockchains still exist.
- deleted 4y ago[deleted]
- tmikaeld 4y agoHow is abuse/spam handled? What prevents anyone from registering thousands of accounts and send messages to a single user until the account becomes unusable?
- ranger_danger 4y agohow is that handled in other p2p apps like Briar, Status or Session?
- giphyman 4y agoI responded to a similar question in the recent Briar thread: https://news.ycombinator.com/item?id=33686094#33692201 https://news.ycombinator.com/item?id=33686094#33692201
- Tepix 4y agoYou could use a system like hashcash to approve new unknown contacts if that starts being a real issue.
- weberer 4y agoIt is peer-to-peer. If someone keeps spamming you from the same IP address, then you can block that address. If you're getting spammed from multiple IP addresses, then you're essentially getting DDOS'd and there's nothing you can do aside from blocking unknown senders.
- 1vuio0pswjnm7 4y agohttps://github.com/berty/berty/tree/master/docs/protocol https://github.com/berty/berty/tree/master/docs/protocol On the subject of rendezvous, some years ago I came across a personal P2P project where the author provided an unusual, additional, alternative method for a peer to succinctly and confidentially provide another peer with their address via any arbitrary web page, e.g., a pastebin. Unfortunately I cannot seem to find this project again. Running one's own rendezvous server that only serves up peer addresses and passes no traffic between peers is relatively easy and inexpensive, but it does involve some maintenance. This author had thought about other possible means of exchanging addresses over the public internet. IME that is unusual in P2P projects.
- shingle 4y agoWas it Retroshare, perhaps? https://retrosharedocs.readthedocs.io/en/latest/user-guide/first-steps/ https://retrosharedocs.readthedocs.io/en/latest/user-guide/f...
- mfbx9da4 4y agoThis one? https://github.com/twosixlabs/coffeebreak https://github.com/twosixlabs/coffeebreak
- sebo2000 4y agoAnyone who wants to meet secretly having Bluetooth on leaves massive digital trail behind, every major city has Bluetooth scanners all over to record those MACs. Additionally covid made evey cell searching for bluetooth MACs....
- sliken 4y agoWhich argues that clients should randomly change their MACs, and you could share your PRNG with friends so they could recognize you, even if it changes often.
- derelicta 4y agoIm confused by the difference between berty and briar. Is it all about this new IPFS-thingy?
- janandonly 4y agoThe one saving grace of the Berty app is that is has an iOS versio, unlike Briar which only works on Android.
- anotherhue 4y agoUnfortunately homophonic with Ireland's former PM who (during corruption investigations) claimed that he did not have a bank account. (To be fair, he was merely the minister for finance at the time) https://en.m.wikipedia.org/wiki/Bertie_Ahern https://en.m.wikipedia.org/wiki/Bertie_Ahern
- kristjank 4y agoThis looks really interesting. If cryptography holds up, this could be a great alternative to Signal, especially considering the unwarranted and opinionated design choices they have started forcing upon their users lately (dropping SMS, cryptocurrency integration, stories, and cloud backups). The removal of deanonymizing verification process is also to be applauded. Using a decentralized transport is a good idea in theory, however, remembering the P2P-induced asynchronicity of Tox, I will definitely remain a sceptic until I see it working at a comparable rate to Signal.
- pixel_tracing 4y agoYou realize SMS is not E2E encrypted?
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- stavros 4y agoOh man, I know this is shallow dismissal, but if I see something is based on IPFS, to me it's shorthand for "doesn't work well".
- rklaehn 4y agoI am working on iroh, a rust implementation of ipfs. I have to say that while this dismissal is shallow, it is ...not entirely incorrect... . There is certainly a lot of room for improvement in the current state of ipfs. We would love to change your mind about ipfs performance and reliability. Once we got a version of iroh that is ready for production, we would be quite happy to let you try it out and get your feedback. As far as I can see there is no fundamental reason why a set of protocols for content-addressed storage like ipfs can not be fast and reliable.
- stavros 4y agoI agree, I think IPFS-the-idea is fantastic, but IPFS-the-implementation is terrible. I created https://www.eternum.io https://www.eternum.io (the first IPFS pinning service) a while ago, and it has been an endless slog to run. Even basic UX things (like managing pins like a torrent client, ie asynchronously/listing pin progress/etc) haven't had any progress for YEARS. I really hope your project can improve things, I'd be glad to try it out.
- rklaehn 4y agoWe will reach out to you once we think iroh is usable enough for your use case. Not before.
- codethief 4y ago> # Goals of Berty > Be resilient against mass surveillance by minimizing metadata leakage While that's an admirable goal, it's also a really difficult-to-solve problem in the context of P2P, so simply mentioning a goal says nothing about the actual state of security of Berty or about whether it's achievable in the first place. By default (i.e. without any countermeasures like onion routing), a p2p network will expose more metadata to the 3-letter agencies than a centralized app with Sealed Sender[0] like Signal. The people at GNUnet have spent more several man decades trying to solve this issue and last time I checked they were still not happy with their solution. [0]: https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/
- upofadown 4y ago>Sealed Sender I have never understood how that works in practice. The server knows the IP addresses (and source ports) of where they are sending and receiving things. How can the server not know who is talking to who? Also, Signal Messenger Protocol requires a server to store and forward prekeys. Why can't that server just record who shows up to pick up who's prekeys?
- ementally 4y agohttps://www.ndss-symposium.org/ndss-paper/improving-signals-sealed-sender/ https://www.ndss-symposium.org/ndss-paper/improving-signals-... explains it
- all2 4y agoIs there not a "One ticket West" algorithm for distributed networks? The message would arrive at a server and tell the server "I'm going this way." and the server forwards the message in a direction rather on a specific path to some destination. I'm not sure how one would apply the concept of "direction" to a communications graph. Also some means of discerning arrival would need to be provided for.
- codethief 4y agoWhat if that server were under the control of the NSA? In any case, your description > The message would arrive at a server and tell the server "I'm going this way." and the server forwards the message in a direction rather on a specific path to some destination. pretty much matches the idea of the IP protocol built on top of point-to-point connections. The problem is that you still need to specify a direction and that helps an attacker identify and track messages from sender to receiver. Look at it from a different angle: The most extreme version of a "one ticket west" algorithm would be one where your message would get broadcast to (or eventually pass by) all participants of the network and all of them would check whether the message is meant for them (e.g. by trying to decrypt it). Needless to say, this doesn't scale well at all, especially not for sending anything bigger than pure text. OTOH this is certainly the broadest sense of direction one could possibly think of and there would be no possible way for Eve to discern to whom Alice is sending her message. Contrast this with direct 1-to-1 connections between Alice and Bob. Any eavesdropper would immediately see Alice's and Bob's IP address. Now in between these two extremes lie "semi-direct" messages where the path that the message takes is – at the word says – not direct but instead gets obfuscated by some algorithm. (Your idea being one version of that.) Unfortunately, coming up with a good algorithm is anything but simple and the danger is that a nation state actor with sufficient power would still be able to "hack" the algorithm and undo the obfuscation. This is precisely what the people at Tor and GNUnet are concerned with.
- sebo2000 4y agobigegst single feature that makes this realy attractive: You can create quick adhock private communicator betweenynlimited # of people without anytrace: Node on VM with VPN server let cliens conenct communicate then kill it and there would be no trace of anyhting, and it all takes literally no time.
- mlatu 4y agohmm... based in paris, france? doesnt france have laws to undermine cryptography? i seem to remember something in this direction
- rcMgD2BwE72F 4y agoI don't believe so. But please find a source that says that cryptography is at risk in France. It's easier to prove that laws are undermining than not.
- mlatu 4y agoold info, france used to restrict it somehow until 2004/2011 (idk what to make of this data) but it seems only exporting and importing is somehow regulated/special nowadays
- Tepix 4y agoIt's apparently a project that originates out of École 42.
- infinitezest 4y agoWhy use this instead of Matrix?
- kristjank 4y agoMatrix is not decentralized, but merely federated. As far as I understand it, you still need a home server, that has access to a lot of metadata, which implies that you have to trust the network operator not to log and share all that sensitive information. It's still an awesome alternative to say, Discord and Slack.
- driminicus 4y agoMatrix is working on a P2P version, there have been a few demos but it's currently still very much WIP. See also https://arewep2pyet.com/ https://arewep2pyet.com/
- newscracker 4y agoI was glad to note that this is available on iOS too, but it seems like it needs more time to mature and be trustworthy. The site clearly states that a security audit hasn’t been done and that it’s planned in the future. The makers caution people not to trust it completely at this point, especially in war situations.
- csw-001 4y agoHow is photo/video sharing handled? I am looking for an e2e encryption channel to share family photos in a group chat style messager with grandparents and groups of friends.
- b6dybuyv 4y agoI don't think it's possible (yet). Here's what they write about BLE (Bluetooth Low Energy) that they use for connection: > BLE has the advantage of being compatible between different platforms, but it is extremely slow. It may be suitable for sending small text messages, but it is totally unsuitable for exchanging photos, let alone videos. However, alternatives exist. We will develop this point below.
- antisocialist 4y ago[flagged]
- balderdash 4y agoI can barely get people to use signal, let alone a new more obscure messenger
- kornhole 4y agoAdoption and change is a major problem exacerbated by the many protocol options. Once you get people on Signal, it will be more difficult to get many to change again to something anonymous and decentralized when situations or threat models change.
- deleted 4y ago[deleted]
- psic4t 4y ago> not open source > privacy-first Thanks, but no.
- heliostatic 4y agoPretty sure it is? https://github.com/berty/berty https://github.com/berty/berty
- masterof0 4y agoI says it in the home page: Open Source. ... read it, fork it, improve it. https://berty.tech/ https://berty.tech/
- LoganDark 4y agoOK, but when will there be a privacy-respecting messaging app that I can use from my computer? The proliferation of mobile-only apps is making me sick.
- hmhrex 4y agoSignal works on desktop nicely, but you still need the mobile app on a smart phone in order for it to work.
- LoganDark 4y agoI'm still looking for one that doesn't require a mobile phone at all. Let me know if you find one. :) I love Discord, but you know... Discord isn't really... anything privacy at all.
- kornhole 4y agoMatrix and XMPP are a couple E2EE decentralized protocols that can work only on desktop and do not require a phone or phone number.
- digitallyfree 4y agoMy family uses Matrix. The default Element interface works in the browser, on desktop, and on mobile app. It was chosen as it's pretty much the only solution that is open-source, supports all devices, has E2EE, supports text/voice/video, and can be selfhosted.
- Semaphor 4y agoClunkier story, but XMPP checks all those boxes as well, but there are better clients (sadly also crappier clients which is part of the issue) and it's far older.
- digitallyfree 4y agoI mean you can use SIP too, but the fact about Matrix and Element is that it's a seamless experience. Point users to the app, issue accounts, provide the server address, and they're good to go. The interface and experience is just like a commercial chat app so there's little resistance.
- FollowingTheDao 4y agoAll these applications are useless. If it is on your phone it is not private. It is more private, yes. Maybe we need to change our behavior, like not needing to talk to each other all the time, or saving our personal conversations for times when we are sitting next to the other in person. Is this a solution in search of a problem? Or even a solution that is causing a problem?
- danrl 4y agoWhat kills each of these occasionally popping up alternative messengers for me is the lack of usage by my actual social network. As long as people use WhatsApp, I will have to use it, too. And since I got everyone there, why install another app? I have too many apps already. If only RCS wasn’t such a mess…
- b6dybuyv 4y agoI stopped using WhatsApp about two years ago. It wasn't an easy decision to delete my WhatsApp account because I feared losing access to several friends. Here's what I did. I checked who my friends were that I couldn't find on Signal or Telegram. I had sent them a message explaining that I would stop using WhatsApp and the reasons why I preferred to avoid using it. I also mentioned on which other platforms I was available and if they would consider being available there too. To my great surprise, most of these people made the move. (Particularly the ones I had often contact with.) For the rest, I'd sent another message in a few weeks saying that I'm uninstalling the app and asking them to send me an email to my email address so that I'd have their addresses. I find that it's our responsibility to help non tech-savvy people understand their digital choices and set a good example through our very own choices.
- jhoechtl 4y agoIs there anything comparable which doesn't require a smartphone? On the laptop and runs Linux? I don't trust the large closed hardware blobs on my smartphone. ps: does anything technically prevent berty from being used as an application on a computer?
- giphyman 4y agoin beta still but https://briarproject.org/download-briar-desktop/ https://briarproject.org/download-briar-desktop/ is worth a look
- tecleandor 4y agoWell, in fact they have a CLI client ( that I haven't tested ) [1] and their site says they're going to be available also for Mac, Windows and Linux. https://github.com/berty/berty https://github.com/berty/berty
- antisocialist 4y ago
- brokenmachine 4y agoMatrix/Element is great. https://matrix.org/clients/ https://matrix.org/clients/
- jhoechtl 4y agoI understood that P2P is delivered by the Pinecone overlay network which is in the makings and none of the available clients yet provide P2P communication?
- agluszak 4y agoDoes it federate with any other messaging app? If not, who am I going to exchange messages with?
- als0 4y agoNo links to their Github on the main pages. Here it is to save you effort http://github.com/berty/berty http://github.com/berty/berty Personally, I find the "Stargazers over time" graph on the README to be a massive turn off. Why are so many people obsessed about Github stars.
- ethanbond 4y agoProbably because it's one of the few positive signals you get back as an OSS contributor. Seems to me most other feedback they get is complaining and whining, often about things that are extremely peripheral to the core work they're putting out into the world.