12 ms·

Briar: Peer to Peer Encrypted Messaging

450 points by CobaltFire 2y ago

ajr0 2y ago
this seems interesting and I (very briefly) installed to check it out but never actually used. I just noticed there is no IOS version? bit strange no? also no update on their blog since 2023? would be interested to read whats going on recently, is there another place to look?
- CobaltFire 2y ago
  I noted that as well. Honestly given the target audience and the limited dev resources I (as an iOS user) do think focusing on Android is probably the right choice here.
- unethical_ban 2y ago
  iOS doesn't allow apps to stay active in the background to listen for messages like Android can. And since Briar very much does not rely on the vendor push services that is a showstopper.
  - mmwelt 2y ago
    Indeed, this is very much a limitation for all apps on iOS that don't want to rely on centralised services, such as a push notification server other than Apple's. See also: https://developer.apple.com/forums/thread/685525 https://developer.apple.com/forums/thread/685525
- tredre3 2y ago
  They explain the iOS situation here: https://code.briarproject.org/briar/briar/-/wikis/FAQ#will-there-be-an-ios-version-of-briar https://code.briarproject.org/briar/briar/-/wikis/FAQ#will-t...
  - throwawayq3423 2y ago
    Is there an iOS alternative?
- ploum 2y ago
  [flagged]
  - VertanaNinjai 2y ago
    I’m not sure where you’re pulling “backdoored” from, but if Apple markets their devices as private then it seems reasonable that end users expect a private device.
    - johnisgood 2y ago
      > if Apple markets their devices as private then it seems reasonable Not really.
      - ploum 2y ago
        > if Apple markets their devices as private then it seems reasonable So they are people reading hackernews who really think that marketing is honest and good faith? Yes, the "care" about our privacy. That’s what they wrote. It must be true then…
    - maqp 2y ago
      There's probably not a backdoor in the device. At least I haven't seen any news about that. But. Apple has been an NSA PRISM-partner since 2012: https://en.wikipedia.org/wiki/PRISM#/media/File:Prism_slide_5.jpg https://en.wikipedia.org/wiki/PRISM#/media/File:Prism_slide_... Also, apparently they had 100% success rate installing malware on the devices: https://www.forbes.com/sites/erikkain/2013/12/30/the-nsa-reportedly-has-total-access-to-your-iphone/ https://www.forbes.com/sites/erikkain/2013/12/30/the-nsa-rep... It's been close to 12 years since Snowden. Who knows how the defense has improved. Who knows how the offense has improved.
hkt 2y ago
Briar is a nice idea, but last time I used it I couldn't find peers, if memory serves. I tried adding a friend who was interested and we sat and waited for our messages. They never arrived. In the end, we went back to using DeltaChat.
- maqp 2y ago
  PGP stopped being the recommendation in 2004 when OTR became a thing with its forward secrecy. I really do not get the charm of repackaging PGP as a messenger, especially when it still has no forward secrecy: https://delta.chat/en/help#pfs https://delta.chat/en/help#pfs I mean, if you're not using Tor, your IP and thus identity will leak to the server anyway. So you should probably just use Signal that has double ratchet giving you forward secrecy and break-in key recovery. Today, PGP's safest use-cases are digital signatures and airgapped comms. But, you'd probably do the latter with TFC as it has much better key/pt exfiltration guarantee.
  - hkt 2y ago
    People have thought about how to do forward secrecy with PGP: https://sequoia-pgp.org/talks/2018-08-moving-forward/moving-forward.pdf https://sequoia-pgp.org/talks/2018-08-moving-forward/moving-... https://sequoia-pgp.gitlab.io/openpgp-dr/openpgp_dr/index.html https://sequoia-pgp.gitlab.io/openpgp-dr/openpgp_dr/index.ht... https://github.com/stealth/opmsg https://github.com/stealth/opmsg https://github.com/autocrypt/autocrypt/issues/444 https://github.com/autocrypt/autocrypt/issues/444 There's a lot going on in the space. It is more innovative than you're giving it credit for, especially around double ratchet. Not there yet, but there's a good reason why I don't mind: control. Multi client support (DeltaChat desktop, hallelujah) and the fact that email remains federation-first. My identity definitely leaks to my server because I pay it's bill. Not only that, but most of my contacts run their own email or borrow it from me or someone else. Our data does not leave any EU countries apart from the UK. We have IM that doesn't involve any Americans. Some might imagine we feel terribly smug about that right now :)
Calwestjobs 2y ago
Why invent wheel when we already have Reticulum network which provides integrity and confidentiality on OSI Layer 2 ? So for every packet. It is not better to build "apps" on top of a secure network? That way even if "app" does accidental bad thing, your private content is not exposed to anyone who listens to your network traffic. By default not by "just use another VPN with exit nodes full of network inspection tools, dns redirection services etc" ?
- pona-a 2y ago
  > Why reinvent the wheel when we already have Reticulum network Assuming README is among the first files created in a project, here's the date of the first commit for each: markqvist/Reticulum: Apr 4, 2018 briar/briar: Nov 9, 2015
  - _rdvw 2y ago
    Briar is actually even older than that! 2011: https://sourceforge.net/p/briar/mailman/message/27393146/ https://sourceforge.net/p/briar/mailman/message/27393146/
- genpfault 2y ago
  > Reticulum network https://reticulum.network/index.html https://reticulum.network/index.html https://github.com/markqvist/reticulum https://github.com/markqvist/reticulum
- mempko 2y ago
  I built my own p2p software back in 2014 (https://firestr.com https://firestr.com) and briar came out in 2015. Reticulum started in 2018. Timing is the reason.
  - _rdvw 2y ago
    Briar started in 2011: https://sourceforge.net/p/briar/mailman/message/27393146/ https://sourceforge.net/p/briar/mailman/message/27393146/
- 2y ago
genpfault 2y ago
"Can I use the same account with several devices?"[1] [1]: https://code.briarproject.org/briar/briar/-/wikis/FAQ#can-i-use-the-same-account-with-several-devices https://code.briarproject.org/briar/briar/-/wikis/FAQ#can-i-...
- remram 2y ago
  SimpleX has the same limitation. I hate how all those apps with modern networking or modern crypto can't get those important usability things right.
- HeatrayEnjoyer 2y ago
  Identity is tied to the physical Bluetooth MAC if I recall correctly.
  - taskforcegemini 2y ago
    can't that be spoofed/overwritten?
  - tredre3 2y ago
    The BT MAC is shared with peers so they can find you (as well as a list of your IP addresses) but I don't think identity is tied to it. Identity seems entirely tied to a public certificate. But I could be wrong.
- maqp 2y ago
  Briar runs a Tor Onion Service on your device. I'm unsure how well Tor supports having multiple devices acting as the server. One option could be to have a main program that's always on, to which your messages are received, and other clients can then use the Onion Service to fetch a copy of the conversation. It would add another link in the chain and increase latency so I'm not surprised if that's not being done.
  - 0xDEFACED 2y ago
    Briar offers a companion ”mailbox” app for the exact reason you describe (i assume) where did you read that it hosts an onion service? i guessed that's how it worked but couldn't find anything in their docs that said so.
crossroadsguy 2y ago
Even now, when I see Briar's name anywhere, I think of this as "ah, that Android only app" and that imho is saying something for a privacy messaging app. I am not saying it has not reason (Apple's unsound, unfair, and consumer hostile tight control is the reason! [1]) to be Android only, I am just saying - it's very unfortunate and unfortunately defeating. [1] In the name of privacy theatre which they have actually been able to defend by spending both on PR and lawyers.
- forty 2y ago
  The simple fact that you generally need to have Apple hardware to make iOS apps is a reason enough
  - vips7L 2y ago
    Looks like a lot of it is JVM based, which makes it hard for iOS since they disallow running JITs.
- maqp 2y ago
  Yup, from what I hear, the problem is Apple doesn't allow process forking which means Tor would have to run inside the same process as the messaging app which is ridiculous.
- jszymborski 2y ago
  I always think "Ah, that one E2EE chat app that made a cameo on Mr. Robot"
- celsoazevedo 2y ago
  iOS vs Android is a bit like ChromeOS vs Windows/MacOS/most Linux distros. There are benefits to more restrictive operating systems. For example, iOS not allowing apps to run in the background essentially stops any apps with malware from doing stuff in the background, but it also stops apps like Briar, Syncthing, etc, from working well. I assume Android isn't a problem for most Briar's users. They're likely running a deGoogled Android version (GrapheneOS, LineageOS, etc) and downloading/updating the app via F-Droid or something like that. They don't rely on Google (or Apple) to run anything.
mempko 2y ago
It's kind of interesting to see P2P coming back! I'm happy to see more P2P projects popping up. When the Snowden leaks came out, there was a brief interest in P2P encrypted messaging. I wonder if the political climate now is bringing interest back. Back in 2014 (I believe briar started in 2015) I wrote a realtime P2P application platform. Not only could you send encrypted messages between people, but you can also send files, play games, and write and share programs together, all within the application. The use case for mine is different than briar's. https://firestr.com/ https://firestr.com/ https://github.com/mempko/firestr https://github.com/mempko/firestr P2P is really fun but also important and I'm happy to see interest in P2P apps coming back!
- ianopolous 2y ago
  G'day mempko, I remember firestr! Very nice! You might remember around the same time (2013) I started Peergos. We're still working on it! https://peergos.org https://peergos.org
vindarel 2y ago
Anyone tried https://getsession.org/ https://getsession.org/ seriously? - desktop and mobile clients, cross-platform (with an AppImage that installs on old systems) - end to end encryption - onion routing, based on the Oxen Service Nodes [0], which also propels Lokinet that allows to anonymously browse the web - no phone number or email required - group chats, voice messages, voice and video calls (webRTC), attachments, emojis https://docs.oxen.io/oxen-docs/about-the-oxen-blockchain/oxen-service-nodes https://docs.oxen.io/oxen-docs/about-the-oxen-blockchain/oxe... https://lokinet.org/ https://lokinet.org/
- maqp 2y ago
  No forward secrecy in 2025. Lokinet is tiny compared to Tor's 9229 nodes https://nusenu.github.io/OrNetStats/w/misc/all.html https://nusenu.github.io/OrNetStats/w/misc/all.html The last time I checked, a lot of the nodes are just run in Hetzner's data centers meaning there's not too many actors. I can't even find that list anymore so if anyone has one, I'd like to update my knowledge.
- johnisgood 2y ago
  Yes, Session seems nice. For hard-core privacy people, use Ricochet Refresh, other than that, Briar and Session are great.
- tasuki 2y ago
  Not seriously, no. But I was completely amazed by the UX: get the app, create an account by clicking a button: no email/phone nor any other "verification". Back up the seed phrase so as not to lose your account. It just works!
LWIRVoltage 2y ago
I recently took a flight with family- on a budget airline that did not have Wifi, so we could not hop on WiFi and message each other using Signal. I wondered what other options there would be in the air- and remembered Bluetooth Communication apps- and had everyone install Briar- it came in haandy! I like the built in Bridge option as well, (when the app communicates over the internet) to help avoid revealing the traffic is Tor traffic. I have been impressed by the range of Briar- with a clear line of site, easily hundreds and hundreds of feet- i tested it to well over 500 outside- and on the plane , my family was scattered, but that was no issue at all. (More recently though i've detected my own Bluetooth MotoTag trackers from my luggage in Cargo holds while on planes, so Bluetooth indeed works well on planes.) -I have heard of but have never used BridgeFy, which I know was a well known famous Bluetooth app that competed with Briar in the past. To my understanding it isn't quite as secure or open source. There is a informative post here https://old.reddit.com/r/Briar/comments/gxiffy/what_exactly_are_the_capabilities_and/ https://old.reddit.com/r/Briar/comments/gxiffy/what_exactly_... where a developer noted Briar's capabilities at that time- it seems due to some changes on the OS/phone Hardware end, and whatnot- and due to the phones only passing messages to contact nearby - Briar is not a true mesh networking app. It is a shame- i feel a true Bluetooth mesh networking app would be unstoppable in availability -though it might be a bit of a battery drain. It is a shame Briar isn't on iOS also - I also wish Signal would eventually consider communicating over any medium accessible- they would probably run into similar issue Briar has. What will it take to get a Peer-to-Peer capable Bluetooth/Wifi/Celluar network using/(more possibly in the future)- proper optional mesh networking, Tor capable, VPN friendly, wholly end to end encrypted ,perfect forward secrecy including, fully open source App providing messaging (with the 'accounts' that Briar uses?), for Android and ios?(And Let's throw in PC Mac and Linux, so laptops could have a extremely user friendly user accessible way of doing this as well.) Better yet, add Calling capability- i don't know how rough doing video calls would be over some methods like modern day Bluetooth- but even a rough capability would be used a little and be worth adding to the collection of things one could do(Briar is only Messaging at the time of this post- which is something notable for sure,as very few apps let you transmit solely thru Bluetooth<I have not heavily looked into the shared Wifi communication abilities of Briar at this point in time> - but more could be added in some form...I observe apps do exist that allow for Bluetooth calling or act like "Bluetooth" Walkie Talkies)
waltercool 2y ago
[dead]
maqp 2y ago
Briar is really interesting from the PoV of its forum and blog features, that try to use the messaging platform as infrastructure to build private services. There's a lot of discussion about alternatives here so I'm going to drop one more: https://cwtch.im https://cwtch.im It has wider range of clients and some unique features, like the ability to run multiple, password protected identities trivially, to appear online selectively.
- 9dev 2y ago
  Sounds like a cool project, but the name is such a bad idea, despite the cleverness of word choice. An app for a niche use case has it hard enough, doesn’t help that nobody can spell correctly even when reading it.
  - maqp 2y ago
    Oh Cwtch is like Cutch, and like the project says, the word rhymes with "butch".
- zelphirkalt 2y ago
  I just wish one could delete or edit on briar's forums. Without that, I feel like I have to be super careful not to make a mistake, if I want an orderly forum. Also in latest versions the ability to fold forum threads is gone? Makes forums annoying to read. The indentation for a sublevel being sooo thin also doesn't help at all.
gunalx 2y ago
The main rason for me to like vriar over other stuff is its insane privscy focus, and the bluetooth relay stuff for fully offlibe communication
- aryan14 2y ago
  Are the typos on purpose for opsec reasons?
  - gunalx 2y ago
    No, im just a terrible writer.
ajsnigrutin 2y ago
The idea is great, but the adoption rate is way to low for any P2P thing to actually work (unless with agreed upon meetings). Meshtastic is a better option, because it uses LoRa (thus requires additional hardware), but with a good location, many kilometers can be covered and mesh networking extends this a lot further. Meshcore is supposedly the next "generation" of meshtastic, but not popular enough over here to actually test it.
jszymborski 2y ago
Not immediately apparent to me: does Briar use a double-ratchet these days?
- makeworld 2y ago
  I'm not sure, a quick search of the specs don't mention "ratchet". But it does claim to have forward secrecy so it should be good anyway.
apitman 2y ago
> If the Internet’s down, Briar can sync via Bluetooth, Wi-Fi or memory cards I'd like to see more "peer to peer" projects take things this seriously.
- DonsDiscountGas 2y ago
  What's the use case? I'm assuming one is trying to send a message to someone far away so it seems like the alternatives wouldn't necessarily help.
  - rsolva 2y ago
    Other phones with Briar installed can carry your (encrypted) messages, as in a game of whisper. This works best if enough people between you and the recipient had Briar installed ... but most people don't. But I see how this feature could be very helpful if a state shuts down internet connectivity or during war or a natural catastrophe. The nifty thing is that the app can be shared from one device to another, so you are not dependent on having the app in advance of an emergency. Ideally, everyone should have this installed as an insurance :)
    - deleted 2y ago
      [deleted]
    - N2yhWNXQN3k9 2y ago
      > Other phones with Briar installed can carry your (encrypted) messages Sounds like an excellent target for DoS
      - AnthonyMouse 2y ago
        DoS by local users on local networks? This is that thing where you solve the cryptography problem with the $5 wrench but only slightly different, right?
        N2yhWNXQN3k9 2y ago
fdb345 2y ago
Briar was funded by the CIA. Partly.
- johnisgood 2y ago
  Source?
  - jazzyjackson 2y ago
    I haven't heard this particular rumor, not like they have In-Q-Tel connections a la Wickr, but they do take funding from the Open Technology Fund [0] which some of the more righteously paranoid take issue with, being US State Department and all. Same parent as Radio Free Asia, Radio Free Europe, Voice of America [1]. [0] https://briarproject.org/news/2018-1.0-released-new-funding/ https://briarproject.org/news/2018-1.0-released-new-funding/ [1] https://en.m.wikipedia.org/wiki/U.S._Agency_for_Global_Media https://en.m.wikipedia.org/wiki/U.S._Agency_for_Global_Media
    - johnisgood 2y ago
      Do we have any reasons for concern? The source code is available here: https://code.briarproject.org/briar/briar/tree/master https://code.briarproject.org/briar/briar/tree/master
- dustyharddrive 2y ago
  If this is about OTF, do you also distrust Let's Encrypt, Quad9, Tails, F-Droid, Signal, and Tor?
  - fdb345 2y ago
    Yeah Signal is fucking rotten. You think its just allowed to exist in the USA? come on man!
    - Forbo 2y ago
      Care to expound on that?
dang 2y ago
Related: Confronting Briar with Disasters - https://news.ycombinator.com/item?id=39174518 https://news.ycombinator.com/item?id=39174518 - Jan 2024 (2 comments) Briar Mailbox released to improve connectivity - https://news.ycombinator.com/item?id=36541798 https://news.ycombinator.com/item?id=36541798 - June 2023 (11 comments) Indian government bans 14 messenger apps including Element, Briar and Threema - https://news.ycombinator.com/item?id=35769203 https://news.ycombinator.com/item?id=35769203 - May 2023 (78 comments) Briar: Peer-to-Peer Encrypted Messaging - https://news.ycombinator.com/item?id=33686094 https://news.ycombinator.com/item?id=33686094 - Nov 2022 (141 comments) Briar Project – Secure messaging, everywhere - https://news.ycombinator.com/item?id=33412171 https://news.ycombinator.com/item?id=33412171 - Oct 2022 (7 comments) Briar has been removed from Google Play - https://news.ycombinator.com/item?id=30498924 https://news.ycombinator.com/item?id=30498924 - Feb 2022 (85 comments) Briar Desktop for Linux - https://news.ycombinator.com/item?id=30023169 https://news.ycombinator.com/item?id=30023169 - Jan 2022 (84 comments) Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks - https://news.ycombinator.com/item?id=29227754 https://news.ycombinator.com/item?id=29227754 - Nov 2021 (110 comments) Briar Project - https://news.ycombinator.com/item?id=24031885 https://news.ycombinator.com/item?id=24031885 - Aug 2020 (185 comments) Briar and Bramble: A Vision for Decentralized Infrastructure - https://news.ycombinator.com/item?id=18027949 https://news.ycombinator.com/item?id=18027949 - Sept 2018 (11 comments) Briar Project - https://news.ycombinator.com/item?id=17888920 https://news.ycombinator.com/item?id=17888920 - Aug 2018 (10 comments) Darknet Messenger Briar Releases Beta, Passes Security Audit - https://news.ycombinator.com/item?id=14825019 https://news.ycombinator.com/item?id=14825019 - July 2017 (85 comments) Is Briar really the next step of the crypto messenger evolution? - https://news.ycombinator.com/item?id=11690607 https://news.ycombinator.com/item?id=11690607 - May 2016 (1 comment)
dang 2y ago
I guess the current thread and this other ongoing one are duals: Cwtch – Privacy Preserving Messaging - https://news.ycombinator.com/item?id=43367012 https://news.ycombinator.com/item?id=43367012 - March 2025 (21 comments)
jumploops 2y ago
I once built a version of this that strictly allowed you to add contacts via QR code only. The idea was simple: you can only exchange keys in person, therefore no central server involvement at all.
- jazzyjackson 2y ago
  Tin Foil Chat is in this variety - mailboxes are tor hidden services identified by their public key. https://github.com/maqp/tfc https://github.com/maqp/tfc
  - maqp 2y ago
    Well not quite :) Wrt what upper post said: It used to be the case you could only exchange keys in person, but X25519 was introduced in 2016, and it was bumped to X448 in 2019. You can of course still exchange PSKs as it's currently the only post-quantum key exchange it can offer. QR-codes are not used, instead, imported strings are split into small segments that are typed manually. The program then does what it can do, to help the user identify typos.
- thomasdeleeuw 2y ago
  I did something similar, share contact via QR code, offline, but with a dedicated encryption/decryption device to realize the airgap: www.qryptr.com
2Gkashmiri 2y ago
Does this still require signup to their server before using p2p app ? Meaning it cant be shared offline and used ?
- ivanmontillam 2y ago
  As per their website, the account is local to the phone. It just cannot be backed up, unfortunately.
CaffeineLD50 2y ago
[flagged]
- ivanmontillam 2y ago
  Well, it's kind of the same thing with P2P money exchanges. Legitimately you may need to exchange crypto into fiat, since there's no "regular" exchange that does that. The trick is that for it to escape regulation just have to do it in a way looks like money-laundery. Legit use cases that (unfortunately) also enable criminals.
reffaelwallen 2y ago
Logo reminds me of the old slack logo
keepamovin 2y ago
The threat model is excellent, except: “The adversary can’t break standard cryptographic primitives” Let’s assume they can and you can swap in non standard crypto models to frustrate and vex ‘the adversary.’ (Lol: “the adversary”… religious) More info, the threat model: All long-range communication channels (internet, phone network, etc) are comprehensively monitored by the adversary. The adversary can block, delay, replay and modify traffic on long-range communication channels. The adversary has a limited ability to monitor short-range communication channels (Bluetooth, WiFi, etc). The adversary has a limited ability to block, delay, replay and modify traffic on short-range communication channels. The adversary can deploy an unlimited number of devices running Briar. There are some users who can keep their devices secure - those who can’t are considered, for the purposes of the threat model, to be controlled by the adversary. The adversary has a limited ability to persuade users to trust the adversary’s agents - thus the number of social connections between the adversary’s agents and the rest of the network is limited. The adversary can’t break standard cryptographic primitives
- schoen 2y ago
  "The adversary" is standard terminology in analyzing cryptographic security. It would be interesting to figure out who introduced it. I looked briefly on Google Scholar, and I see it's used in the modern sense as early as Yao (1982), but it might have been used much earlier. It doesn't appear in the Diffie-Hellman (1976) or RSA (1977) papers.
  - keepamovin 2y ago
    Well either way it's an appropriate name, lol!
  - pessimizer 2y ago
    "Adversary" is simply a standard English word. It is neither religious or jargon. My assumption is that the reason it is often used in cryptography papers is because "attacker" rings a bit harshly when you repeat it over and over again.
    - 2y ago
kragen 2y ago
It's on F-Droid. I hadn't realized it supported message-passing over Bluetooth like FireChat! Not just Tor.
dav 2y ago
I spent a little time ~2012 trying to think how to create a system like this that would work with iPhones at burning man. Never really got anywhere with the idea, but I’m excited to try this!
jeffparsons 2y ago
Serious question for whoever actually understands this: what is the legal status of true, peer-to-peer, attack-resistant encrypted messaging in the "western" world? I'm particularly interested in the USA, the UK, Australia, New Zealand, and whatever European countries you care to throw into the mix. I've occasionally tinkered with building software (but never released said software) that uses encrypted peer-to-peer connections as the _sole_ way of communicating, because it seemed like the most natural way to build said software _and_ the most interesting technically. (And I have zero interest in hosting servers for FOSS side projects.) If I were to actually release one of these projects and it were to become popular, should I expect to be shut down by law enforcement on the grounds that it's already unambiguously illegal? Or would I likely receive a "Technical Assistance Notice" at some point, effectively requiring me to sneak a back door into the software? Or is it actually fine? I seem to recall all sorts of stories about law enforcement and "TLA agencies" pressuring vendors of secure messaging software to make the software unavailable or to add back doors, including at least one who chose to shut down their business rather than lying to their users about the security of the product. But somehow in all this I failed to glean whether or not it's actually meant to be legal, even on paper.
- WorldPeas 2y ago
  I would look into wassenar if I were you, an artifact of the cold war, encryption can be treated like a munition. Nothing stricter than that from what I’ve seen. Yet.
- gardnr 2y ago
  In the Five-eyes jurisdiction, it is legally allowed to use strong end-to-end encryption. Any potential laws that are contrary to that would come up against some serious 4th amendment issues. The idea of cryptography as a munitions was largely set aside in the name of capitalism. Tor was funded by the U.S. Department of State. Signal and WhatsApp are end to end encrypted. Sign up for EFF's mailing list and donate money to them. Check out their Secure Messaging Scorecard: https://www.eff.org/pages/secure-messaging-scorecard https://www.eff.org/pages/secure-messaging-scorecard We, as a society, are under constant attacks on our ability to maintain our privacy. As we've seen in large political and technological shifts, it only becomes more important to maintain your privacy. Deep fakes used in scamming relatives is one good example. Please do release your software and ideas that make information more secure.
ein0p 2y ago
Those "journalists" they claim to protect could get into serious trouble for merely using Tor. From there it's a trivial matter of rubber hose cryptanalysis to defeat the rest of the "protection". The danger with such tools is someone without proper training thinks they're a super spy, and then they draw attention of the people who actually understand such things, and can put a bag over their head and deliver them to a black site.
rmac 2y ago
love briar!!! please add p2p discovery / pairing without qr-code
Klaus23 2y ago
I have tried it and it is very usable, if a little bare-bones. Unfortunately, Bluetooth doesn't work for me, but everything else works fine. Development seems to have slowed down a little, which is a shame. There is still no good widespread application for peer-to-peer communication. In terms of functionality, I miss a "one to many" feature. For activism, disaster management, or even just organising a slightly larger group, it would be immensely useful to have a channel that people can subscribe to (but not write to) and that syncs via trusted contacts, without having to manually reblog everything. Forums are also a bit problematic without moderation and when anyone can invite new users.

450 points by CobaltFire 2y ago

ajr0 2y ago

this seems interesting and I (very briefly) installed to check it out but never actually used. I just noticed there is no IOS version? bit strange no? also no update on their blog since 2023? would be interested to read whats going on recently, is there another place to look?

CobaltFire 2y ago
I noted that as well. Honestly given the target audience and the limited dev resources I (as an iOS user) do think focusing on Android is probably the right choice here.
unethical_ban 2y ago
iOS doesn't allow apps to stay active in the background to listen for messages like Android can. And since Briar very much does not rely on the vendor push services that is a showstopper.
- mmwelt 2y ago
  Indeed, this is very much a limitation for all apps on iOS that don't want to rely on centralised services, such as a push notification server other than Apple's. See also: https://developer.apple.com/forums/thread/685525 https://developer.apple.com/forums/thread/685525
tredre3 2y ago
They explain the iOS situation here: https://code.briarproject.org/briar/briar/-/wikis/FAQ#will-there-be-an-ios-version-of-briar https://code.briarproject.org/briar/briar/-/wikis/FAQ#will-t...
- throwawayq3423 2y ago
  Is there an iOS alternative?
ploum 2y ago
[flagged]
- VertanaNinjai 2y ago
  I’m not sure where you’re pulling “backdoored” from, but if Apple markets their devices as private then it seems reasonable that end users expect a private device.
  - johnisgood 2y ago
    > if Apple markets their devices as private then it seems reasonable Not really.
    - ploum 2y ago
      > if Apple markets their devices as private then it seems reasonable So they are people reading hackernews who really think that marketing is honest and good faith? Yes, the "care" about our privacy. That’s what they wrote. It must be true then…
  - maqp 2y ago
    There's probably not a backdoor in the device. At least I haven't seen any news about that. But. Apple has been an NSA PRISM-partner since 2012: https://en.wikipedia.org/wiki/PRISM#/media/File:Prism_slide_5.jpg https://en.wikipedia.org/wiki/PRISM#/media/File:Prism_slide_... Also, apparently they had 100% success rate installing malware on the devices: https://www.forbes.com/sites/erikkain/2013/12/30/the-nsa-reportedly-has-total-access-to-your-iphone/ https://www.forbes.com/sites/erikkain/2013/12/30/the-nsa-rep... It's been close to 12 years since Snowden. Who knows how the defense has improved. Who knows how the offense has improved.

hkt 2y ago

Briar is a nice idea, but last time I used it I couldn't find peers, if memory serves. I tried adding a friend who was interested and we sat and waited for our messages. They never arrived. In the end, we went back to using DeltaChat.

maqp 2y ago
PGP stopped being the recommendation in 2004 when OTR became a thing with its forward secrecy. I really do not get the charm of repackaging PGP as a messenger, especially when it still has no forward secrecy: https://delta.chat/en/help#pfs https://delta.chat/en/help#pfs I mean, if you're not using Tor, your IP and thus identity will leak to the server anyway. So you should probably just use Signal that has double ratchet giving you forward secrecy and break-in key recovery. Today, PGP's safest use-cases are digital signatures and airgapped comms. But, you'd probably do the latter with TFC as it has much better key/pt exfiltration guarantee.
- hkt 2y ago
  People have thought about how to do forward secrecy with PGP: https://sequoia-pgp.org/talks/2018-08-moving-forward/moving-forward.pdf https://sequoia-pgp.org/talks/2018-08-moving-forward/moving-... https://sequoia-pgp.gitlab.io/openpgp-dr/openpgp_dr/index.html https://sequoia-pgp.gitlab.io/openpgp-dr/openpgp_dr/index.ht... https://github.com/stealth/opmsg https://github.com/stealth/opmsg https://github.com/autocrypt/autocrypt/issues/444 https://github.com/autocrypt/autocrypt/issues/444 There's a lot going on in the space. It is more innovative than you're giving it credit for, especially around double ratchet. Not there yet, but there's a good reason why I don't mind: control. Multi client support (DeltaChat desktop, hallelujah) and the fact that email remains federation-first. My identity definitely leaks to my server because I pay it's bill. Not only that, but most of my contacts run their own email or borrow it from me or someone else. Our data does not leave any EU countries apart from the UK. We have IM that doesn't involve any Americans. Some might imagine we feel terribly smug about that right now :)

Calwestjobs 2y ago

Why invent wheel when we already have Reticulum network which provides integrity and confidentiality on OSI Layer 2 ? So for every packet. It is not better to build "apps" on top of a secure network? That way even if "app" does accidental bad thing, your private content is not exposed to anyone who listens to your network traffic. By default not by "just use another VPN with exit nodes full of network inspection tools, dns redirection services etc" ?

pona-a 2y ago
> Why reinvent the wheel when we already have Reticulum network Assuming README is among the first files created in a project, here's the date of the first commit for each: markqvist/Reticulum: Apr 4, 2018 briar/briar: Nov 9, 2015
- _rdvw 2y ago
  Briar is actually even older than that! 2011: https://sourceforge.net/p/briar/mailman/message/27393146/ https://sourceforge.net/p/briar/mailman/message/27393146/
genpfault 2y ago
> Reticulum network https://reticulum.network/index.html https://reticulum.network/index.html https://github.com/markqvist/reticulum https://github.com/markqvist/reticulum
mempko 2y ago
I built my own p2p software back in 2014 (https://firestr.com https://firestr.com) and briar came out in 2015. Reticulum started in 2018. Timing is the reason.
- _rdvw 2y ago
  Briar started in 2011: https://sourceforge.net/p/briar/mailman/message/27393146/ https://sourceforge.net/p/briar/mailman/message/27393146/
2y ago

genpfault 2y ago

"Can I use the same account with several devices?"[1] [1]: https://code.briarproject.org/briar/briar/-/wikis/FAQ#can-i-use-the-same-account-with-several-devices https://code.briarproject.org/briar/briar/-/wikis/FAQ#can-i-...

remram 2y ago
SimpleX has the same limitation. I hate how all those apps with modern networking or modern crypto can't get those important usability things right.
HeatrayEnjoyer 2y ago
Identity is tied to the physical Bluetooth MAC if I recall correctly.
- taskforcegemini 2y ago
  can't that be spoofed/overwritten?
- tredre3 2y ago
  The BT MAC is shared with peers so they can find you (as well as a list of your IP addresses) but I don't think identity is tied to it. Identity seems entirely tied to a public certificate. But I could be wrong.
maqp 2y ago
Briar runs a Tor Onion Service on your device. I'm unsure how well Tor supports having multiple devices acting as the server. One option could be to have a main program that's always on, to which your messages are received, and other clients can then use the Onion Service to fetch a copy of the conversation. It would add another link in the chain and increase latency so I'm not surprised if that's not being done.
- 0xDEFACED 2y ago
  Briar offers a companion ”mailbox” app for the exact reason you describe (i assume) where did you read that it hosts an onion service? i guessed that's how it worked but couldn't find anything in their docs that said so.

crossroadsguy 2y ago

Even now, when I see Briar's name anywhere, I think of this as "ah, that Android only app" and that imho is saying something for a privacy messaging app. I am not saying it has not reason (Apple's unsound, unfair, and consumer hostile tight control is the reason! [1]) to be Android only, I am just saying - it's very unfortunate and unfortunately defeating. [1] In the name of privacy theatre which they have actually been able to defend by spending both on PR and lawyers.

forty 2y ago
The simple fact that you generally need to have Apple hardware to make iOS apps is a reason enough
- vips7L 2y ago
  Looks like a lot of it is JVM based, which makes it hard for iOS since they disallow running JITs.
maqp 2y ago
Yup, from what I hear, the problem is Apple doesn't allow process forking which means Tor would have to run inside the same process as the messaging app which is ridiculous.
jszymborski 2y ago
I always think "Ah, that one E2EE chat app that made a cameo on Mr. Robot"
celsoazevedo 2y ago
iOS vs Android is a bit like ChromeOS vs Windows/MacOS/most Linux distros. There are benefits to more restrictive operating systems. For example, iOS not allowing apps to run in the background essentially stops any apps with malware from doing stuff in the background, but it also stops apps like Briar, Syncthing, etc, from working well. I assume Android isn't a problem for most Briar's users. They're likely running a deGoogled Android version (GrapheneOS, LineageOS, etc) and downloading/updating the app via F-Droid or something like that. They don't rely on Google (or Apple) to run anything.

mempko 2y ago

It's kind of interesting to see P2P coming back! I'm happy to see more P2P projects popping up. When the Snowden leaks came out, there was a brief interest in P2P encrypted messaging. I wonder if the political climate now is bringing interest back. Back in 2014 (I believe briar started in 2015) I wrote a realtime P2P application platform. Not only could you send encrypted messages between people, but you can also send files, play games, and write and share programs together, all within the application. The use case for mine is different than briar's. https://firestr.com/ https://firestr.com/ https://github.com/mempko/firestr https://github.com/mempko/firestr P2P is really fun but also important and I'm happy to see interest in P2P apps coming back!

ianopolous 2y ago
G'day mempko, I remember firestr! Very nice! You might remember around the same time (2013) I started Peergos. We're still working on it! https://peergos.org https://peergos.org

vindarel 2y ago

Anyone tried https://getsession.org/ https://getsession.org/ seriously? - desktop and mobile clients, cross-platform (with an AppImage that installs on old systems) - end to end encryption - onion routing, based on the Oxen Service Nodes [0], which also propels Lokinet that allows to anonymously browse the web - no phone number or email required - group chats, voice messages, voice and video calls (webRTC), attachments, emojis https://docs.oxen.io/oxen-docs/about-the-oxen-blockchain/oxen-service-nodes https://docs.oxen.io/oxen-docs/about-the-oxen-blockchain/oxe... https://lokinet.org/ https://lokinet.org/

maqp 2y ago
No forward secrecy in 2025. Lokinet is tiny compared to Tor's 9229 nodes https://nusenu.github.io/OrNetStats/w/misc/all.html https://nusenu.github.io/OrNetStats/w/misc/all.html The last time I checked, a lot of the nodes are just run in Hetzner's data centers meaning there's not too many actors. I can't even find that list anymore so if anyone has one, I'd like to update my knowledge.
johnisgood 2y ago
Yes, Session seems nice. For hard-core privacy people, use Ricochet Refresh, other than that, Briar and Session are great.
tasuki 2y ago
Not seriously, no. But I was completely amazed by the UX: get the app, create an account by clicking a button: no email/phone nor any other "verification". Back up the seed phrase so as not to lose your account. It just works!

LWIRVoltage 2y ago

I recently took a flight with family- on a budget airline that did not have Wifi, so we could not hop on WiFi and message each other using Signal. I wondered what other options there would be in the air- and remembered Bluetooth Communication apps- and had everyone install Briar- it came in haandy! I like the built in Bridge option as well, (when the app communicates over the internet) to help avoid revealing the traffic is Tor traffic. I have been impressed by the range of Briar- with a clear line of site, easily hundreds and hundreds of feet- i tested it to well over 500 outside- and on the plane , my family was scattered, but that was no issue at all. (More recently though i've detected my own Bluetooth MotoTag trackers from my luggage in Cargo holds while on planes, so Bluetooth indeed works well on planes.) -I have heard of but have never used BridgeFy, which I know was a well known famous Bluetooth app that competed with Briar in the past. To my understanding it isn't quite as secure or open source. There is a informative post here https://old.reddit.com/r/Briar/comments/gxiffy/what_exactly_are_the_capabilities_and/ https://old.reddit.com/r/Briar/comments/gxiffy/what_exactly_... where a developer noted Briar's capabilities at that time- it seems due to some changes on the OS/phone Hardware end, and whatnot- and due to the phones only passing messages to contact nearby - Briar is not a true mesh networking app. It is a shame- i feel a true Bluetooth mesh networking app would be unstoppable in availability -though it might be a bit of a battery drain. It is a shame Briar isn't on iOS also - I also wish Signal would eventually consider communicating over any medium accessible- they would probably run into similar issue Briar has. What will it take to get a Peer-to-Peer capable Bluetooth/Wifi/Celluar network using/(more possibly in the future)- proper optional mesh networking, Tor capable, VPN friendly, wholly end to end encrypted ,perfect forward secrecy including, fully open source App providing messaging (with the 'accounts' that Briar uses?), for Android and ios?(And Let's throw in PC Mac and Linux, so laptops could have a extremely user friendly user accessible way of doing this as well.) Better yet, add Calling capability- i don't know how rough doing video calls would be over some methods like modern day Bluetooth- but even a rough capability would be used a little and be worth adding to the collection of things one could do(Briar is only Messaging at the time of this post- which is something notable for sure,as very few apps let you transmit solely thru Bluetooth<I have not heavily looked into the shared Wifi communication abilities of Briar at this point in time> - but more could be added in some form...I observe apps do exist that allow for Bluetooth calling or act like "Bluetooth" Walkie Talkies)

waltercool 2y ago

[dead]

maqp 2y ago

Briar is really interesting from the PoV of its forum and blog features, that try to use the messaging platform as infrastructure to build private services. There's a lot of discussion about alternatives here so I'm going to drop one more: https://cwtch.im https://cwtch.im It has wider range of clients and some unique features, like the ability to run multiple, password protected identities trivially, to appear online selectively.

9dev 2y ago
Sounds like a cool project, but the name is such a bad idea, despite the cleverness of word choice. An app for a niche use case has it hard enough, doesn’t help that nobody can spell correctly even when reading it.
- maqp 2y ago
  Oh Cwtch is like Cutch, and like the project says, the word rhymes with "butch".
zelphirkalt 2y ago
I just wish one could delete or edit on briar's forums. Without that, I feel like I have to be super careful not to make a mistake, if I want an orderly forum. Also in latest versions the ability to fold forum threads is gone? Makes forums annoying to read. The indentation for a sublevel being sooo thin also doesn't help at all.

gunalx 2y ago

The main rason for me to like vriar over other stuff is its insane privscy focus, and the bluetooth relay stuff for fully offlibe communication

aryan14 2y ago
Are the typos on purpose for opsec reasons?
- gunalx 2y ago
  No, im just a terrible writer.

ajsnigrutin 2y ago

The idea is great, but the adoption rate is way to low for any P2P thing to actually work (unless with agreed upon meetings). Meshtastic is a better option, because it uses LoRa (thus requires additional hardware), but with a good location, many kilometers can be covered and mesh networking extends this a lot further. Meshcore is supposedly the next "generation" of meshtastic, but not popular enough over here to actually test it.

jszymborski 2y ago

Not immediately apparent to me: does Briar use a double-ratchet these days?

makeworld 2y ago
I'm not sure, a quick search of the specs don't mention "ratchet". But it does claim to have forward secrecy so it should be good anyway.

apitman 2y ago

> If the Internet’s down, Briar can sync via Bluetooth, Wi-Fi or memory cards I'd like to see more "peer to peer" projects take things this seriously.

DonsDiscountGas 2y ago
What's the use case? I'm assuming one is trying to send a message to someone far away so it seems like the alternatives wouldn't necessarily help.
- rsolva 2y ago
  Other phones with Briar installed can carry your (encrypted) messages, as in a game of whisper. This works best if enough people between you and the recipient had Briar installed ... but most people don't. But I see how this feature could be very helpful if a state shuts down internet connectivity or during war or a natural catastrophe. The nifty thing is that the app can be shared from one device to another, so you are not dependent on having the app in advance of an emergency. Ideally, everyone should have this installed as an insurance :)
  - deleted 2y ago
    [deleted]
  - N2yhWNXQN3k9 2y ago
    > Other phones with Briar installed can carry your (encrypted) messages Sounds like an excellent target for DoS
    - AnthonyMouse 2y ago
      DoS by local users on local networks? This is that thing where you solve the cryptography problem with the $5 wrench but only slightly different, right?
      - N2yhWNXQN3k9 2y ago

fdb345 2y ago

Briar was funded by the CIA. Partly.

johnisgood 2y ago
Source?
- jazzyjackson 2y ago
  I haven't heard this particular rumor, not like they have In-Q-Tel connections a la Wickr, but they do take funding from the Open Technology Fund [0] which some of the more righteously paranoid take issue with, being US State Department and all. Same parent as Radio Free Asia, Radio Free Europe, Voice of America [1]. [0] https://briarproject.org/news/2018-1.0-released-new-funding/ https://briarproject.org/news/2018-1.0-released-new-funding/ [1] https://en.m.wikipedia.org/wiki/U.S._Agency_for_Global_Media https://en.m.wikipedia.org/wiki/U.S._Agency_for_Global_Media
  - johnisgood 2y ago
    Do we have any reasons for concern? The source code is available here: https://code.briarproject.org/briar/briar/tree/master https://code.briarproject.org/briar/briar/tree/master
dustyharddrive 2y ago
If this is about OTF, do you also distrust Let's Encrypt, Quad9, Tails, F-Droid, Signal, and Tor?
- fdb345 2y ago
  Yeah Signal is fucking rotten. You think its just allowed to exist in the USA? come on man!
  - Forbo 2y ago
    Care to expound on that?

dang 2y ago

Related: Confronting Briar with Disasters - https://news.ycombinator.com/item?id=39174518 https://news.ycombinator.com/item?id=39174518 - Jan 2024 (2 comments) Briar Mailbox released to improve connectivity - https://news.ycombinator.com/item?id=36541798 https://news.ycombinator.com/item?id=36541798 - June 2023 (11 comments) Indian government bans 14 messenger apps including Element, Briar and Threema - https://news.ycombinator.com/item?id=35769203 https://news.ycombinator.com/item?id=35769203 - May 2023 (78 comments) Briar: Peer-to-Peer Encrypted Messaging - https://news.ycombinator.com/item?id=33686094 https://news.ycombinator.com/item?id=33686094 - Nov 2022 (141 comments) Briar Project – Secure messaging, everywhere - https://news.ycombinator.com/item?id=33412171 https://news.ycombinator.com/item?id=33412171 - Oct 2022 (7 comments) Briar has been removed from Google Play - https://news.ycombinator.com/item?id=30498924 https://news.ycombinator.com/item?id=30498924 - Feb 2022 (85 comments) Briar Desktop for Linux - https://news.ycombinator.com/item?id=30023169 https://news.ycombinator.com/item?id=30023169 - Jan 2022 (84 comments) Briar 1.4 – Offline sharing, message transfer via SD cards and USB sticks - https://news.ycombinator.com/item?id=29227754 https://news.ycombinator.com/item?id=29227754 - Nov 2021 (110 comments) Briar Project - https://news.ycombinator.com/item?id=24031885 https://news.ycombinator.com/item?id=24031885 - Aug 2020 (185 comments) Briar and Bramble: A Vision for Decentralized Infrastructure - https://news.ycombinator.com/item?id=18027949 https://news.ycombinator.com/item?id=18027949 - Sept 2018 (11 comments) Briar Project - https://news.ycombinator.com/item?id=17888920 https://news.ycombinator.com/item?id=17888920 - Aug 2018 (10 comments) Darknet Messenger Briar Releases Beta, Passes Security Audit - https://news.ycombinator.com/item?id=14825019 https://news.ycombinator.com/item?id=14825019 - July 2017 (85 comments) Is Briar really the next step of the crypto messenger evolution? - https://news.ycombinator.com/item?id=11690607 https://news.ycombinator.com/item?id=11690607 - May 2016 (1 comment)

dang 2y ago

I guess the current thread and this other ongoing one are duals: Cwtch – Privacy Preserving Messaging - https://news.ycombinator.com/item?id=43367012 https://news.ycombinator.com/item?id=43367012 - March 2025 (21 comments)

jumploops 2y ago

I once built a version of this that strictly allowed you to add contacts via QR code only. The idea was simple: you can only exchange keys in person, therefore no central server involvement at all.

jazzyjackson 2y ago
Tin Foil Chat is in this variety - mailboxes are tor hidden services identified by their public key. https://github.com/maqp/tfc https://github.com/maqp/tfc
- maqp 2y ago
  Well not quite :) Wrt what upper post said: It used to be the case you could only exchange keys in person, but X25519 was introduced in 2016, and it was bumped to X448 in 2019. You can of course still exchange PSKs as it's currently the only post-quantum key exchange it can offer. QR-codes are not used, instead, imported strings are split into small segments that are typed manually. The program then does what it can do, to help the user identify typos.
thomasdeleeuw 2y ago
I did something similar, share contact via QR code, offline, but with a dedicated encryption/decryption device to realize the airgap: www.qryptr.com

2Gkashmiri 2y ago

Does this still require signup to their server before using p2p app ? Meaning it cant be shared offline and used ?

ivanmontillam 2y ago
As per their website, the account is local to the phone. It just cannot be backed up, unfortunately.

CaffeineLD50 2y ago

[flagged]

ivanmontillam 2y ago
Well, it's kind of the same thing with P2P money exchanges. Legitimately you may need to exchange crypto into fiat, since there's no "regular" exchange that does that. The trick is that for it to escape regulation just have to do it in a way looks like money-laundery. Legit use cases that (unfortunately) also enable criminals.

reffaelwallen 2y ago

Logo reminds me of the old slack logo

keepamovin 2y ago

The threat model is excellent, except: “The adversary can’t break standard cryptographic primitives” Let’s assume they can and you can swap in non standard crypto models to frustrate and vex ‘the adversary.’ (Lol: “the adversary”… religious) More info, the threat model: All long-range communication channels (internet, phone network, etc) are comprehensively monitored by the adversary. The adversary can block, delay, replay and modify traffic on long-range communication channels. The adversary has a limited ability to monitor short-range communication channels (Bluetooth, WiFi, etc). The adversary has a limited ability to block, delay, replay and modify traffic on short-range communication channels. The adversary can deploy an unlimited number of devices running Briar. There are some users who can keep their devices secure - those who can’t are considered, for the purposes of the threat model, to be controlled by the adversary. The adversary has a limited ability to persuade users to trust the adversary’s agents - thus the number of social connections between the adversary’s agents and the rest of the network is limited. The adversary can’t break standard cryptographic primitives

schoen 2y ago
"The adversary" is standard terminology in analyzing cryptographic security. It would be interesting to figure out who introduced it. I looked briefly on Google Scholar, and I see it's used in the modern sense as early as Yao (1982), but it might have been used much earlier. It doesn't appear in the Diffie-Hellman (1976) or RSA (1977) papers.
- keepamovin 2y ago
  Well either way it's an appropriate name, lol!
- pessimizer 2y ago
  "Adversary" is simply a standard English word. It is neither religious or jargon. My assumption is that the reason it is often used in cryptography papers is because "attacker" rings a bit harshly when you repeat it over and over again.
  - 2y ago

kragen 2y ago

It's on F-Droid. I hadn't realized it supported message-passing over Bluetooth like FireChat! Not just Tor.

dav 2y ago

I spent a little time ~2012 trying to think how to create a system like this that would work with iPhones at burning man. Never really got anywhere with the idea, but I’m excited to try this!

jeffparsons 2y ago

Serious question for whoever actually understands this: what is the legal status of true, peer-to-peer, attack-resistant encrypted messaging in the "western" world? I'm particularly interested in the USA, the UK, Australia, New Zealand, and whatever European countries you care to throw into the mix. I've occasionally tinkered with building software (but never released said software) that uses encrypted peer-to-peer connections as the _sole_ way of communicating, because it seemed like the most natural way to build said software _and_ the most interesting technically. (And I have zero interest in hosting servers for FOSS side projects.) If I were to actually release one of these projects and it were to become popular, should I expect to be shut down by law enforcement on the grounds that it's already unambiguously illegal? Or would I likely receive a "Technical Assistance Notice" at some point, effectively requiring me to sneak a back door into the software? Or is it actually fine? I seem to recall all sorts of stories about law enforcement and "TLA agencies" pressuring vendors of secure messaging software to make the software unavailable or to add back doors, including at least one who chose to shut down their business rather than lying to their users about the security of the product. But somehow in all this I failed to glean whether or not it's actually meant to be legal, even on paper.

WorldPeas 2y ago
I would look into wassenar if I were you, an artifact of the cold war, encryption can be treated like a munition. Nothing stricter than that from what I’ve seen. Yet.
gardnr 2y ago
In the Five-eyes jurisdiction, it is legally allowed to use strong end-to-end encryption. Any potential laws that are contrary to that would come up against some serious 4th amendment issues. The idea of cryptography as a munitions was largely set aside in the name of capitalism. Tor was funded by the U.S. Department of State. Signal and WhatsApp are end to end encrypted. Sign up for EFF's mailing list and donate money to them. Check out their Secure Messaging Scorecard: https://www.eff.org/pages/secure-messaging-scorecard https://www.eff.org/pages/secure-messaging-scorecard We, as a society, are under constant attacks on our ability to maintain our privacy. As we've seen in large political and technological shifts, it only becomes more important to maintain your privacy. Deep fakes used in scamming relatives is one good example. Please do release your software and ideas that make information more secure.

ein0p 2y ago

Those "journalists" they claim to protect could get into serious trouble for merely using Tor. From there it's a trivial matter of rubber hose cryptanalysis to defeat the rest of the "protection". The danger with such tools is someone without proper training thinks they're a super spy, and then they draw attention of the people who actually understand such things, and can put a bag over their head and deliver them to a black site.

rmac 2y ago

love briar!!! please add p2p discovery / pairing without qr-code

Klaus23 2y ago

I have tried it and it is very usable, if a little bare-bones. Unfortunately, Bluetooth doesn't work for me, but everything else works fine. Development seems to have slowed down a little, which is a shame. There is still no good widespread application for peer-to-peer communication. In terms of functionality, I miss a "one to many" feature. For activism, disaster management, or even just organising a slightly larger group, it would be immensely useful to have a channel that people can subscribe to (but not write to) and that syncs via trusted contacts, without having to manually reblog everything. Forums are also a bit problematic without moderation and when anyone can invite new users.