9 ms·

Show HN: ChatSecure iOS v3.0 (OTR + Tor + XMPP)

74 points by chrisballinger 12y ago

higherpurpose 12y ago
Would it be possible for TextSecure and ChatSecure to interoperate (at least with chats)? Or would that create too much pain for both groups to support each other as they (possibly) diverge in features?
- chrisballinger 12y ago
  I'd love to make this happen, but it won't be possible unless they support open federation, which is currently impossible when using your phone number as the identifier. I do plan to support Axolotl in conjunction with our provider-agnostic push solution, which could potentially provide a bridge between the two platforms.
Mizza 12y ago
Great to see this finally get out there, it's been awesome to watch this project develop! This is also a particularly good release write-up, big ups to the team for writing about all of the components that have gone into this new release.
funcSoulBrother 12y ago
Pretty excited about the hidden TOR xmpp functionality in this version, since NAT won't ever be an issue.
laveur 12y ago
Does the fact that they use Tor make it more secure? It seems like the network has been getting hacked a lot lately.
- dewey 12y ago
  It's not "getting hacked a lot". What you are talking about is probably just the take-down of a few hidden services with poor operational security.
dewey 12y ago
Very excited for this, just from the GUI point of view it's a big step forward.
tyrion 12y ago
If you are so concerned about privacy and security, why use an iOS device at all? Note: I am not trolling. It is a serious question. I mean, probably no one would be using ChatSecure if it were not Free Software, rightly, because nobody could audit its source code, but then isn't it a security/privacy issue using it on top of a completely closed platform?
- chrisballinger 12y ago
  Most people don't choose their devices like a developer would and instead focus on things like ease of use (or the best marketing campaign). Just because a platform doesn't offer completely perfect theoretical security and privacy, users should still have access to tools that can help.
- LeoPanthera 12y ago
  Even if you don't use iOS, you may wish to communicate (relatively) securely with those who do.
- avree 12y ago
  Because there's a tradeoff between 'privacy and security' and 'convenience', and most people like to fall somewhere in the middle. It's like locking your doors on your house. Sure, a burglar could break the door down, smash a window, follow you around and steal your keys, etc., but it adds a level of security and precaution that keeps some of the bad guys out while not being insanely inconvenient. I care about the privacy and security of my home, but I'm not going to live in a bunker.
  - jakeogh 12y ago
    A closer analogy would address a group controlled by a few which has the resources to install people (whom believe that are doing good things) into positions that have access to your private keys. It's more like there is an automatically updated encrypted manifest of your house available. The bunker analogy is bad unless you think we should meet in the middle on infosec. At some point, this same conversation will be about hardware inside our heads, we already use these devices like second brains.
mrmondo 12y ago
I'd love to see Moxie review this!
- girvo 12y ago
  I'd rather see Signal have text messaging enabled first ;)
  - mrmondo 12y ago
    Yeah me too ;)
ex3ndr 12y ago
We in Actor.im tried to build tor-enabled messaging (on better and faster protocol), but for working tor engine need to download 1-3mb files every 4 hour period. So, this became useless in mobile environment. Tor need to do step forward to mobile before we can really use it.
- chrisballinger 12y ago
  I was excited about the possibility of federated XMPP over mobile hidden services, mainly because of the built-in NAT traversal. It could make creating a "good enough" XMPP server as simple as buying a cheap Android phone, installing an app, and keeping it plugged in somewhere.
magikarp 12y ago
Fantastic work, Chris! It's really great to see that ChatSecure has such an ambitious roadmap.
foobarqux 12y ago
Why not use Signal?
- xxdesmus 12y ago
  Signal doesn't do messaging on iOS right now, only phone calls.
  - chrisballinger 12y ago
    It will soon! After playing around with their latest Signal 2.0 beta that integrates TextSecure support, I honestly would recommend using Signal unless you specifically need Tor/OTR or want to host your own XMPP infrastructure.
    - xxdesmus 12y ago
      Oh nice, I'd love to give the Signal 2.0 beta a go if you have any invites into the beta testing? :)

Would it be possible for TextSecure and ChatSecure to interoperate (at least with chats)? Or would that create too much pain for both groups to support each other as they (possibly) diverge in features?

chrisballinger 12y ago
I'd love to make this happen, but it won't be possible unless they support open federation, which is currently impossible when using your phone number as the identifier. I do plan to support Axolotl in conjunction with our provider-agnostic push solution, which could potentially provide a bridge between the two platforms.

Mizza 12y ago

Great to see this finally get out there, it's been awesome to watch this project develop! This is also a particularly good release write-up, big ups to the team for writing about all of the components that have gone into this new release.

funcSoulBrother 12y ago

Pretty excited about the hidden TOR xmpp functionality in this version, since NAT won't ever be an issue.

laveur 12y ago

Does the fact that they use Tor make it more secure? It seems like the network has been getting hacked a lot lately.

dewey 12y ago
It's not "getting hacked a lot". What you are talking about is probably just the take-down of a few hidden services with poor operational security.

dewey 12y ago

Very excited for this, just from the GUI point of view it's a big step forward.

tyrion 12y ago

If you are so concerned about privacy and security, why use an iOS device at all? Note: I am not trolling. It is a serious question. I mean, probably no one would be using ChatSecure if it were not Free Software, rightly, because nobody could audit its source code, but then isn't it a security/privacy issue using it on top of a completely closed platform?

chrisballinger 12y ago
Most people don't choose their devices like a developer would and instead focus on things like ease of use (or the best marketing campaign). Just because a platform doesn't offer completely perfect theoretical security and privacy, users should still have access to tools that can help.
LeoPanthera 12y ago
Even if you don't use iOS, you may wish to communicate (relatively) securely with those who do.
avree 12y ago
Because there's a tradeoff between 'privacy and security' and 'convenience', and most people like to fall somewhere in the middle. It's like locking your doors on your house. Sure, a burglar could break the door down, smash a window, follow you around and steal your keys, etc., but it adds a level of security and precaution that keeps some of the bad guys out while not being insanely inconvenient. I care about the privacy and security of my home, but I'm not going to live in a bunker.
- jakeogh 12y ago
  A closer analogy would address a group controlled by a few which has the resources to install people (whom believe that are doing good things) into positions that have access to your private keys. It's more like there is an automatically updated encrypted manifest of your house available. The bunker analogy is bad unless you think we should meet in the middle on infosec. At some point, this same conversation will be about hardware inside our heads, we already use these devices like second brains.

mrmondo 12y ago

I'd love to see Moxie review this!

girvo 12y ago
I'd rather see Signal have text messaging enabled first ;)
- mrmondo 12y ago
  Yeah me too ;)

ex3ndr 12y ago

We in Actor.im tried to build tor-enabled messaging (on better and faster protocol), but for working tor engine need to download 1-3mb files every 4 hour period. So, this became useless in mobile environment. Tor need to do step forward to mobile before we can really use it.

chrisballinger 12y ago
I was excited about the possibility of federated XMPP over mobile hidden services, mainly because of the built-in NAT traversal. It could make creating a "good enough" XMPP server as simple as buying a cheap Android phone, installing an app, and keeping it plugged in somewhere.

magikarp 12y ago

Fantastic work, Chris! It's really great to see that ChatSecure has such an ambitious roadmap.

foobarqux 12y ago

Why not use Signal?

xxdesmus 12y ago
Signal doesn't do messaging on iOS right now, only phone calls.
- chrisballinger 12y ago
  It will soon! After playing around with their latest Signal 2.0 beta that integrates TextSecure support, I honestly would recommend using Signal unless you specifically need Tor/OTR or want to host your own XMPP infrastructure.
  - xxdesmus 12y ago
    Oh nice, I'd love to give the Signal 2.0 beta a go if you have any invites into the beta testing? :)