4 ms·

In 2024, I want to start recommending a secure and open solution for real-time text&photo chats (person-to-person and group) for techies and non-techies alike.

by neilv 3y ago

In 2024, I want to start recommending a secure and open solution for real-time text&photo chats (person-to-person and group) for techies and non-techies alike. Something we can confidently recommend to friends, family, people we just started dating, etc., and they will be happy with it on the their phones, tablets, and desktops. I'm currently leaning towards recommending Matrix and whatever are the most easy-to-use apps at the time. Unless Element is giving off concerning signals, or something better comes along. A serious IETF standard with much the same properties as Matrix would be nice. (I haven't entirely ruled out Signal, as a stopgap measure, but the current proprietary-ness isn't something I want to recommend, and I really don't like that it can only be active on one mobile device at a time.)

uoaei 3y ago
It was as if millions of techies cried out "network effect" and were suddenly silenced.
_rs 3y ago
The new Element X clients are a huge leap forward, definitely making me consider using it with more non-techie friends
hedora 3y ago
Lack of support for backups and moving accounts between android and iOS are my biggest issues with signal. One device at a time is a close second. (It sort of works on multiple devices though. It works on my phone, watch and ipad.)
blendergeek 3y ago
Matrix is an IETF standard now if I remember correctly.
celtoid 3y ago
I've been using SimpleX [0] with a couple of friends recently. It appears to work as advertised. [0] https://simplex.chat https://simplex.chat
JimDabell 3y ago
Signal totally lost my confidence with the Chinese IME debacle. They were told repeatedly for a year that Chinese Signal users were vulnerable and needed a warning in the app. They intentionally ignored the problem because the wrong type of person was reporting it. Then once enough white men repeated the complaint, they put the warning in. Prejudice is a security vulnerability if it makes you ignore vulnerability reports. Signal have demonstrated that they have this security vulnerability and as far as I can see they haven’t taken any steps to close it.
- vinay_ys 3y ago
  Interesting. Totally missed this news. Could you edit/post some links to this coverage?
  - JimDabell 3y ago
    A summary, because it’s a bit spread out over a few places: - It’s extremely common for Chinese people to use third-party keyboards. - If they do this, all security Signal provides is undermined. - Signal tells people it’s a secure way of communicating. People in China believe this and use Signal without realising they aren’t secure. - It’s fair to expect Signal – an organisation founded and run by Americans – to not be aware that Chinese people use their phones in a very different way to westerners. - A Chinese woman has been telling them about this problem for years and asking for a warning to be put into Signal so that Chinese users are aware they can’t use Signal securely in this way. - Signal conspicuously ignored her for a very long time. Things like Moxie blocking her on Twitter, misrepresenting the request as a “boiling the ocean” type request, saying she was just attention-seeking, saying that people should decompile keyboards to prove they are transmitting keystrokes, etc. Have you ever heard a security professional say that they need evidence that something is being actively exploited before they will do anything about it? - Finally after a year of this, he replied to a man on Twitter saying “Totally, if this is the thing people want, that's np.” – as if this hasn’t been brought up over and over again by her to the point of him blocking her because she was annoying him too much. - At this point people point out that this is what she has been asking for for years. So he apologises. To the men he’s talking to, not her. - And just recently, it turns out insecure keyboard leaking is something that has been affecting hundreds of millions of Chinese users. So it was absolutely a real problem that Chinese Signal users needed to be aware of, and it was a major security fuckup that Signal delayed warning people for over a year. Unsurprisingly, she’s less than polite when talking about Signal. And she’s a provocative person in general. But the fact remains that she was telling Signal about a real problem for a long time, and they were conspicuously ignoring it when it came from her but finally acted on the problem when she got a few white men to repeat the complaint for her. I get that she rubs some people up the wrong way, but if you’re a person from the west being told by a Chinese person that there’s something particular to their demographic that is wrecking your security, you should pay attention, not do everything you can to avoid them. I don’t trust software to be secure if they disregard security issues because they don’t like who is reporting them, and nobody else should either. Here are some links: https://www.technologyreview.com/2023/08/21/1078207/sogou-keyboard-app-security-loophole/ https://www.technologyreview.com/2023/08/21/1078207/sogou-ke... https://twitter.com/RealSexyCyborg/status/1197695344575799296 https://twitter.com/RealSexyCyborg/status/119769534457579929... https://twitter.com/RealSexyCyborg/status/1351006604565557249 https://twitter.com/RealSexyCyborg/status/135100660456555724... https://community.signalusers.org/t/signal-should-warn-users-who-are-likely-using-insecure-ime-apps/10272/127 https://community.signalusers.org/t/signal-should-warn-users... https://twitter.com/moxie/status/1351205613645258756 https://twitter.com/moxie/status/1351205613645258756
doublepg23 3y ago
I’ve had the best results converting normies with Telegram first and Signal as a second. while I do love the values of Matrix it’s still reallly rough. Matrix 2.0 seems to be changing a lot of that however.
- leesalminen 3y ago
  Telegram is not E2EE by default. Red flag. When E2EE is enabled they rolled their own crypto. Another red flag. Telegram is owned by Russian nationals living in United Arab Emirates. Another red flag. Don’t recommend Telegram.
  - doublepg23 3y ago
    Why would E2EE matter for something like Matrix when you're trusting third party servers anyway?
    - tcfhgj 3y ago
      Because you arent?
foresto 3y ago
I landed on Matrix a couple years ago. My requirements were: - free - open source - decentralized - good cross-platform support (linux, mac, windows, ios, android) - multi-device synchronization - offline message delivery - group chats - end-to-end encryption - well-understood crypto ciphers & protocols - mature enough for a reasonable expectation of security & privacy - some way to protect metadata (e.g. self-hosting) - anonymous signup - easy enough for most computer users - getting enough traction to seem (eventually) viable as a general-purpose contact channel As far as I know, there is still no other service that satisfies all those needs. It has some rough edges that are less important to me for now, but I think they're on the roadmap: Some bits of metadata, like (IIRC) reactions and avatar images, aren't e2e encrypted yet. Occasional encryption errors and notification failures, but I think those are solved in the beta client code (currently available in Element X) and at least some alternative clients. I suggest introducing a few technical (or patient) friends to Matrix today, and bringing more people in once the new client code graduates from Element X into the main reference clients. Here's where you can explore alternative clients: (I like Nheko's compact mode.) https://matrix.org/ecosystem/clients/ https://matrix.org/ecosystem/clients/ Here's where you can read weekly progress reports: https://matrix.org/blog/ https://matrix.org/blog/ The native group voice/video feature, currently in testing as Element Call, has a design that looks particularly interesting for its ability to scale beyond a few participants without requiring a large/expensive central media server. https://element.io/blog/tag/voip/ https://element.io/blog/tag/voip/ They're actively working toward IETF MIMI and MLS support, which bodes well for future interoperability: https://matrix.org/blog/2023/07/a-giant-leap-with-mls/ https://matrix.org/blog/2023/07/a-giant-leap-with-mls/ The project lead often answers questions here on HN when Matrix-related articles pop up. Searching his past comments (username Arathorn) is worthwhile if you want a deeper view into the project.
- neilv 3y ago
  Thanks, very valuable comments. I'll look into it more.
TheHappyOddish 3y ago
Signal is a great choice for non tech people, it looks and works like what they already know. Matrix is definitely better, but we're quite a few steps away from the required UX for grandma.
- defrost 3y ago
  Speaking as a grandparent that wrote a chunk of the backend of the first iteration of [-1] I reckon I can handle it. Hell, even great grandmothers can breeze through that stuff [e] [-1] http://magma.maths.usyd.edu.au/magma/ http://magma.maths.usyd.edu.au/magma/ [e] https://research-repository.uwa.edu.au/en/persons/cheryl-praeger https://research-repository.uwa.edu.au/en/persons/cheryl-pra...
  - TheHappyOddish 3y ago
    That's very cool and well beyond my skillset! However I think the generalisation is still fair. The experience of most Matrix clients and concepts is not great for those who do not have an IT background, or users who find technology difficult (correlated in this case with those who didn't grow up with it). The median boomer or older is likely to find it more difficult than a millenial.
    - neilv 3y ago
      Wouldn't hurt to find new shorthand terms for different kinds of users. "Grandma" has all sorts of positive connotations, but some discussions in HCI and product design have loaded it to mean not good at some things, when that's not necessarily even generally true. And I suppose the idea, casually propagated, could be a little insulting, or even professionally harmful to people. Maybe a mental exercise to make this intuitive is to imagine a workplace meeting, and someone calling a colleague "grandma", while meaning pretty much what is meant here. They'd rightly get smacked across the room, figuratively, with a chance of literally.

by neilv 3y ago

uoaei 3y ago

It was as if millions of techies cried out "network effect" and were suddenly silenced.

_rs 3y ago

The new Element X clients are a huge leap forward, definitely making me consider using it with more non-techie friends

hedora 3y ago

Lack of support for backups and moving accounts between android and iOS are my biggest issues with signal. One device at a time is a close second. (It sort of works on multiple devices though. It works on my phone, watch and ipad.)

blendergeek 3y ago

Matrix is an IETF standard now if I remember correctly.

celtoid 3y ago

I've been using SimpleX [0] with a couple of friends recently. It appears to work as advertised. [0] https://simplex.chat https://simplex.chat

JimDabell 3y ago

Signal totally lost my confidence with the Chinese IME debacle. They were told repeatedly for a year that Chinese Signal users were vulnerable and needed a warning in the app. They intentionally ignored the problem because the wrong type of person was reporting it. Then once enough white men repeated the complaint, they put the warning in. Prejudice is a security vulnerability if it makes you ignore vulnerability reports. Signal have demonstrated that they have this security vulnerability and as far as I can see they haven’t taken any steps to close it.

vinay_ys 3y ago
Interesting. Totally missed this news. Could you edit/post some links to this coverage?
- JimDabell 3y ago
  A summary, because it’s a bit spread out over a few places: - It’s extremely common for Chinese people to use third-party keyboards. - If they do this, all security Signal provides is undermined. - Signal tells people it’s a secure way of communicating. People in China believe this and use Signal without realising they aren’t secure. - It’s fair to expect Signal – an organisation founded and run by Americans – to not be aware that Chinese people use their phones in a very different way to westerners. - A Chinese woman has been telling them about this problem for years and asking for a warning to be put into Signal so that Chinese users are aware they can’t use Signal securely in this way. - Signal conspicuously ignored her for a very long time. Things like Moxie blocking her on Twitter, misrepresenting the request as a “boiling the ocean” type request, saying she was just attention-seeking, saying that people should decompile keyboards to prove they are transmitting keystrokes, etc. Have you ever heard a security professional say that they need evidence that something is being actively exploited before they will do anything about it? - Finally after a year of this, he replied to a man on Twitter saying “Totally, if this is the thing people want, that's np.” – as if this hasn’t been brought up over and over again by her to the point of him blocking her because she was annoying him too much. - At this point people point out that this is what she has been asking for for years. So he apologises. To the men he’s talking to, not her. - And just recently, it turns out insecure keyboard leaking is something that has been affecting hundreds of millions of Chinese users. So it was absolutely a real problem that Chinese Signal users needed to be aware of, and it was a major security fuckup that Signal delayed warning people for over a year. Unsurprisingly, she’s less than polite when talking about Signal. And she’s a provocative person in general. But the fact remains that she was telling Signal about a real problem for a long time, and they were conspicuously ignoring it when it came from her but finally acted on the problem when she got a few white men to repeat the complaint for her. I get that she rubs some people up the wrong way, but if you’re a person from the west being told by a Chinese person that there’s something particular to their demographic that is wrecking your security, you should pay attention, not do everything you can to avoid them. I don’t trust software to be secure if they disregard security issues because they don’t like who is reporting them, and nobody else should either. Here are some links: https://www.technologyreview.com/2023/08/21/1078207/sogou-keyboard-app-security-loophole/ https://www.technologyreview.com/2023/08/21/1078207/sogou-ke... https://twitter.com/RealSexyCyborg/status/1197695344575799296 https://twitter.com/RealSexyCyborg/status/119769534457579929... https://twitter.com/RealSexyCyborg/status/1351006604565557249 https://twitter.com/RealSexyCyborg/status/135100660456555724... https://community.signalusers.org/t/signal-should-warn-users-who-are-likely-using-insecure-ime-apps/10272/127 https://community.signalusers.org/t/signal-should-warn-users... https://twitter.com/moxie/status/1351205613645258756 https://twitter.com/moxie/status/1351205613645258756

doublepg23 3y ago

I’ve had the best results converting normies with Telegram first and Signal as a second. while I do love the values of Matrix it’s still reallly rough. Matrix 2.0 seems to be changing a lot of that however.

leesalminen 3y ago
Telegram is not E2EE by default. Red flag. When E2EE is enabled they rolled their own crypto. Another red flag. Telegram is owned by Russian nationals living in United Arab Emirates. Another red flag. Don’t recommend Telegram.
- doublepg23 3y ago
  Why would E2EE matter for something like Matrix when you're trusting third party servers anyway?
  - tcfhgj 3y ago
    Because you arent?

foresto 3y ago

I landed on Matrix a couple years ago. My requirements were: - free - open source - decentralized - good cross-platform support (linux, mac, windows, ios, android) - multi-device synchronization - offline message delivery - group chats - end-to-end encryption - well-understood crypto ciphers & protocols - mature enough for a reasonable expectation of security & privacy - some way to protect metadata (e.g. self-hosting) - anonymous signup - easy enough for most computer users - getting enough traction to seem (eventually) viable as a general-purpose contact channel As far as I know, there is still no other service that satisfies all those needs. It has some rough edges that are less important to me for now, but I think they're on the roadmap: Some bits of metadata, like (IIRC) reactions and avatar images, aren't e2e encrypted yet. Occasional encryption errors and notification failures, but I think those are solved in the beta client code (currently available in Element X) and at least some alternative clients. I suggest introducing a few technical (or patient) friends to Matrix today, and bringing more people in once the new client code graduates from Element X into the main reference clients. Here's where you can explore alternative clients: (I like Nheko's compact mode.) https://matrix.org/ecosystem/clients/ https://matrix.org/ecosystem/clients/ Here's where you can read weekly progress reports: https://matrix.org/blog/ https://matrix.org/blog/ The native group voice/video feature, currently in testing as Element Call, has a design that looks particularly interesting for its ability to scale beyond a few participants without requiring a large/expensive central media server. https://element.io/blog/tag/voip/ https://element.io/blog/tag/voip/ They're actively working toward IETF MIMI and MLS support, which bodes well for future interoperability: https://matrix.org/blog/2023/07/a-giant-leap-with-mls/ https://matrix.org/blog/2023/07/a-giant-leap-with-mls/ The project lead often answers questions here on HN when Matrix-related articles pop up. Searching his past comments (username Arathorn) is worthwhile if you want a deeper view into the project.

neilv 3y ago
Thanks, very valuable comments. I'll look into it more.

TheHappyOddish 3y ago

Signal is a great choice for non tech people, it looks and works like what they already know. Matrix is definitely better, but we're quite a few steps away from the required UX for grandma.

defrost 3y ago
Speaking as a grandparent that wrote a chunk of the backend of the first iteration of [-1] I reckon I can handle it. Hell, even great grandmothers can breeze through that stuff [e] [-1] http://magma.maths.usyd.edu.au/magma/ http://magma.maths.usyd.edu.au/magma/ [e] https://research-repository.uwa.edu.au/en/persons/cheryl-praeger https://research-repository.uwa.edu.au/en/persons/cheryl-pra...
- TheHappyOddish 3y ago
  That's very cool and well beyond my skillset! However I think the generalisation is still fair. The experience of most Matrix clients and concepts is not great for those who do not have an IT background, or users who find technology difficult (correlated in this case with those who didn't grow up with it). The median boomer or older is likely to find it more difficult than a millenial.
  - neilv 3y ago
    Wouldn't hurt to find new shorthand terms for different kinds of users. "Grandma" has all sorts of positive connotations, but some discussions in HCI and product design have loaded it to mean not good at some things, when that's not necessarily even generally true. And I suppose the idea, casually propagated, could be a little insulting, or even professionally harmful to people. Maybe a mental exercise to make this intuitive is to imagine a workplace meeting, and someone calling a colleague "grandma", while meaning pretty much what is meant here. They'd rightly get smacked across the room, figuratively, with a chance of literally.