3 ms·
I just can't help but wonder if RFC9420 has had enough time to mature enough to offer sufficient features to be adopted by/replace say Signal (Whatsapp, iMessag
by isodev 3y ago
I just can't help but wonder if RFC9420 has had enough time to mature enough to offer sufficient features to be adopted by/replace say Signal (Whatsapp, iMessage) and similar solutions. The group key security sounds nice, but the lack of end to end authentication or message integrity/sender signing does not feel very reassuring.
It feels like some design decisions and compromises have been made in order to optimize the use-case for large group chats at the expense of some safety aspects that exist today in current protocols.
- ekr____ 3y agoMLS provides end-to-end integrity via signatures. https://www.rfc-editor.org/rfc/rfc9420.html#name-content-authentication https://www.rfc-editor.org/rfc/rfc9420.html#name-content-aut...
- camgunz 3y agoAFAIK at least Element/Matrix are actively working on adopting it.
- Arathorn 3y agohttps://arewemlsyet.com https://arewemlsyet.com for the Matrix progress
- monocasa 3y agoGiven what I saw at the MLS working group meeting at IETF last week (as in what'll be all of MLS, not just RFC9420), it's actively being worked on by people who share your concerns. The higher levels of the stack concerned with "what are all of the options for what's inside an actual message" are under active development, both code and standards work. Those writing code will almost certainly have to change their implementation to be interoperable with the final standards there, but IMO bless them for coming to these meetings with "I tried to implement it, it's broken for these reasons you can see in code here".