3 ms·
Moxie Marlinspike - and Whisper Systems - have assumed a variety of concerning positions over the years. Concerning, because their flaws are obvious, yet Moxie
by dTal 4y ago
Moxie Marlinspike - and Whisper Systems - have assumed a variety of concerning positions over the years. Concerning, because their flaws are obvious, yet Moxie - a very smart guy - pretends not to notice them.
For example, Moxie defended discontinuing encrypted SMS on the grounds that it leaked metadata to telcos - yet failed to emphasize that this was merely the same metadata leaked to Whisper Systems, or justify why we should trust Whisper Systems more. "Just trust us" policies are worrying.
Moxie's defense of failing to provide any alternative to downloading Signal/TextSecure from Google Play also contained a number of very eye raising frank admissions, including that Whisper Systems was motivated by the ability to silently push updates and monitor its users (there's that "just trust us" again). Followed by the very weird assertion that "Avoiding Play alone is not a privacy win", which is a bit like saying there's no point wearing a seatbelt because you might get injured in other ways.
Whisper Systems is notoriously hostile to any use of Signal that doesn't involve their official client, going through servers they administrate (servers which run code they release infrequently if at all). Signal has made no attempt to bootstrap a federated system, even though this would save them money. They are extremely keen to maintain ironclad control over both the app and the server, and are willing to take unusual security postures in service of this.
I've read enough stuff from Moxie that makes me say "what, that doesn't make sense" to make me very suspicious.
- anonym29 4y agoThe SMS support that was discontinued was for plain SMS to/from other plain SMS numbers from within the Signal app - it was not encrypted.
- kyledrake 4y agoI'm not necessarily agreeing with his positions you mentioned, except to note that his focus on Signal was making an encrypted messenger that was easy enough to use that normal people would actually use it, which is a different goal than being the most secure possible and that does inevitably involve compromises and tradeoffs. He has written extensively on the problems with decentralized systems and the added complexity that makes people not adopt them, and as someone that's done extensive work in the dweb space, his arguments are quite sound and not suspicious to me in the slightest. https://moxie.org/2022/01/07/web3-first-impressions.html https://moxie.org/2022/01/07/web3-first-impressions.html If someone wants to send encrypted messages in a decentralized way I suppose they can use PGP with Tor (a project that has also received US government funding btw) on top of a P2P network or something similarly strange, but good luck getting the non ultra tech literate friends to use any of it. They will just resort to going back to SMS because they can't figure it out, or because it's slow and doesn't work, or because a malicious actor figures out how to blast the entire network with spam messages, and then we're right back to the original problem with no improvements. As a thought experiment here to make this conversation more constructive, what is the actually most secure way to send messages between two parties, and how many of the non tech friends has someone convinced to actually use it?