3 ms·

How about switching to Matrix? (I already did and am happy.)

tptacek 3y ago
Matrix doesn't have the same threat model as Signal, and isn't a 1:1 replacement for it. Matrix is great (maybe optimal) for things that would otherwise be Slack channels.
- fsflover 3y ago
  I don't understand which different threat model you mean. Could you elaborate? To me, it's the same: private, end-to-end encrypted chat with rooms.
  - tptacek 3y ago
    Signal: * Gives the servers virtually no control over communications between parties. * Goes through huge pains to minimize serverside metadata storage. * Is a sealed system end-to-end; the client and the server are part of a single coherent design that together make promises about privacy and security that apply to every user of the system; Matrix is a protocol ecosystem. A good example of this is group messaging: Matrix servers control group membership. In Matrix, group membership is key management; a Matrix server decides who can decrypt your group messages. That's not how Signal works! But I don't think anybody seriously thinks Signal is a replacement for a large Slack.
    - fsflover 3y ago
      > * Goes through huge pains to minimize serverside metadata storage. And yet uses AWS: https://news.ycombinator.com/item?id=39414322 https://news.ycombinator.com/item?id=39414322
      - tptacek 3y ago
        And? It could run on NSA servers and it shouldn't in theory much of a difference. (I would not use Signal if it ran on NSA servers). The threat model assumes attackers have maximal control of the server environment.
        baq 3y ago
        Assume US AWS servers are NSA servers.
        tptacek 3y ago
        You get that it's the literal opposite, right? There are actual rules, whether you believe NSA follows them or not, about NSA interfering with US servers. Not only are there no rules applying to overseas servers, but interfering with those servers is literally NSA's chartered mission.
        baq 3y ago
        I’m not in a position to know anything except unconfirmed rumors about the NSA. Hence my position remains unmoved.
        tptacek 3y ago
        Ok! Either way: immaterial to Signal.
        greyface- 3y ago
        Rules historically have not been an impediment to the NSA. Worst case, they can be ignored, best case, they can be interpreted with extreme creativity. Five Eyes partners are not subject to the same rules, and information can be shared freely with them. This continued insistence (widespread - not just you!) on the benevolence and good faith of US intelligence, post-Snowden, doesn't make any sense to me.
        tptacek 3y ago
windexh8er 3y ago
For users who want strong security in messaging, yet an easy way for anyone to use the platform Signal has a much better user experience. Over 95% of my messaging is on Signal. Almost none of those users will benefit in any way by switching to Matrix. While it's a great ecosystem, it's also too much work for people who don't want those features or flexibility.
- autoexec 3y ago
  For users who want strong security is messaging signal should not be considered because they lie to users about their risks, and they store sensitive data in the cloud. It's easy to use and not a bad chat/IM system, but I would never trust it to protect your data.
  - egberts1 3y ago
    Given that you post same diatribe on a common theme, you clearly lack ways to back up your veiled allegations without any evidence. https://eprint.iacr.org/2016/1013.pdf https://eprint.iacr.org/2016/1013.pdf
    - fsflover 3y ago
      Here comes the evidence: https://news.ycombinator.com/item?id=39414322 https://news.ycombinator.com/item?id=39414322
      - egberts1 3y ago
        In the spirit of CALEA, sealed sender basically pushes law enforcement back to good ol' days of "got the time", "got the IP addy", but "we don't know what was said".
        fsflover 3y ago
        > but "we don't know what was said https://www.nybooks.com/online/2014/05/10/we-kill-people-based-metadata/ https://www.nybooks.com/online/2014/05/10/we-kill-people-bas...
tapoxi 3y ago
My parents, in-laws, grandmother-in-law, and entire extended family is on Signal. It's the extended family group chat, video calls with grandparents/great grandparents, and the baby photo feed. That's mostly because you just install it and it works. I have no idea how to get my extended family on a Matrix homeserver without extensive handholding. I can barely figure it out myself and I was a huge XMPP nerd that ran my own ejabberd server for years.

Matrix doesn't have the same threat model as Signal, and isn't a 1:1 replacement for it. Matrix is great (maybe optimal) for things that would otherwise be Slack channels.

fsflover 3y ago
I don't understand which different threat model you mean. Could you elaborate? To me, it's the same: private, end-to-end encrypted chat with rooms.
- tptacek 3y ago
  Signal: * Gives the servers virtually no control over communications between parties. * Goes through huge pains to minimize serverside metadata storage. * Is a sealed system end-to-end; the client and the server are part of a single coherent design that together make promises about privacy and security that apply to every user of the system; Matrix is a protocol ecosystem. A good example of this is group messaging: Matrix servers control group membership. In Matrix, group membership is key management; a Matrix server decides who can decrypt your group messages. That's not how Signal works! But I don't think anybody seriously thinks Signal is a replacement for a large Slack.
  - fsflover 3y ago
    > * Goes through huge pains to minimize serverside metadata storage. And yet uses AWS: https://news.ycombinator.com/item?id=39414322 https://news.ycombinator.com/item?id=39414322
    - tptacek 3y ago
      And? It could run on NSA servers and it shouldn't in theory much of a difference. (I would not use Signal if it ran on NSA servers). The threat model assumes attackers have maximal control of the server environment.
      - baq 3y ago
        Assume US AWS servers are NSA servers.
        tptacek 3y ago
        You get that it's the literal opposite, right? There are actual rules, whether you believe NSA follows them or not, about NSA interfering with US servers. Not only are there no rules applying to overseas servers, but interfering with those servers is literally NSA's chartered mission.
        baq 3y ago
        I’m not in a position to know anything except unconfirmed rumors about the NSA. Hence my position remains unmoved.
        tptacek 3y ago
        Ok! Either way: immaterial to Signal.
        greyface- 3y ago
        Rules historically have not been an impediment to the NSA. Worst case, they can be ignored, best case, they can be interpreted with extreme creativity. Five Eyes partners are not subject to the same rules, and information can be shared freely with them. This continued insistence (widespread - not just you!) on the benevolence and good faith of US intelligence, post-Snowden, doesn't make any sense to me.
        tptacek 3y ago

windexh8er 3y ago

For users who want strong security in messaging, yet an easy way for anyone to use the platform Signal has a much better user experience. Over 95% of my messaging is on Signal. Almost none of those users will benefit in any way by switching to Matrix. While it's a great ecosystem, it's also too much work for people who don't want those features or flexibility.

autoexec 3y ago
For users who want strong security is messaging signal should not be considered because they lie to users about their risks, and they store sensitive data in the cloud. It's easy to use and not a bad chat/IM system, but I would never trust it to protect your data.
- egberts1 3y ago
  Given that you post same diatribe on a common theme, you clearly lack ways to back up your veiled allegations without any evidence. https://eprint.iacr.org/2016/1013.pdf https://eprint.iacr.org/2016/1013.pdf
  - fsflover 3y ago
    Here comes the evidence: https://news.ycombinator.com/item?id=39414322 https://news.ycombinator.com/item?id=39414322
    - egberts1 3y ago
      In the spirit of CALEA, sealed sender basically pushes law enforcement back to good ol' days of "got the time", "got the IP addy", but "we don't know what was said".
      - fsflover 3y ago
        > but "we don't know what was said https://www.nybooks.com/online/2014/05/10/we-kill-people-based-metadata/ https://www.nybooks.com/online/2014/05/10/we-kill-people-bas...

tapoxi 3y ago

My parents, in-laws, grandmother-in-law, and entire extended family is on Signal. It's the extended family group chat, video calls with grandparents/great grandparents, and the baby photo feed. That's mostly because you just install it and it works. I have no idea how to get my extended family on a Matrix homeserver without extensive handholding. I can barely figure it out myself and I was a huge XMPP nerd that ran my own ejabberd server for years.