moxie

13 ms·

61.
by moxie 10y ago
What's more, HTTP's recent movement is arguably only because the web experience has centralized so much around Google. Google already had the top two most popular websites in the world, so once Google Chrome also became the most p
62.
by moxie 10y ago
I hesitate to get all Clay Shirkey here, but I think this is fundamentally different from media conglomerates and Bell Systems, given that now anyone has the ability to build their own overlay service with relatively minimal investment. Par
63.
by moxie 10y ago
The source code is for generating the QR code is online here: https://github.com/WhisperSystems/libsignal-protocol-java/bl...
64.
by moxie 10y ago
Most users probably aren't worried about targeted attacks from adversaries who've compromised SS7, either. But the ones that are have an easy option.
65.
by moxie 10y ago
How would apps running on Sandstorm avoid the problems with federation in today's world outlined in the blog post?
66.
by moxie 10y ago
Check out the image at the top of the post: https://whispersystems.org/blog/whatsapp-complete/
67.
by moxie 10y ago
This article glosses over a few important details. The reason that end to end encryption exists is precisely because man in the middle attacks are possible, and always will be. This kind of attack is devastating for Telegram, because by def
68.
by moxie 10y ago
You're right, Fred doesn't work at Open Whisper Systems. He's a student at EPFL, and is doing a summer internship at Apple this year. Since the article mentions Signal, I think the author just wanted to make it clear that Fre
69.
by moxie 10y ago
If you want to look at the Android APK, you can use apktool to get back Java source. Hacked clients like WhatsApp+ even build new derivative products using that output, and spammers do it to get code they can use to inject messages onto th
70.
by moxie 10y ago
> which declined to allow their E2E code to be audited. Could you cite this? The Signal Protocol implementations they're using are both open source and well audited.
71.
by moxie 10y ago
Yes, it is. It's linked directly from the paper ( https://www.whatsapp.com/security/WhatsApp-Security-Whitepap... ) that documents their use of the protocol. It's the exact same code we use in Signal: https:&
72.
by moxie 11y ago
Signal Desktop messages aren't routed through your mobile device, so it's the best of both worlds. Once you've installed Signal Desktop, you can use it when your mobile device is turned off, and vice versa.
73.
by moxie 11y ago
Correct, you need to have Chrome or Chromium (if you want something fully OSS) installed. Once you do, it functions like a native app (integrates directly with your OS's launcher), rather than like an extension (something attached to
74.
by moxie 11y ago
We've never used GCM in conjunction with the desktop app, so I'm not sure where you were looking. Writing and maintaining three different fully native apps for Windows, OSX, and Linux is a non-starter for most organizations these
75.
by moxie 11y ago
Works perfectly with Chromium if you'd like a fully open source alternative.
76.
by moxie 11y ago
It's a Chrome packaged app, not an extension. It integrates with your OS to function just like any other stand alone application (visible in your native launcher, etc).
77.
by moxie 11y ago
There is no difference, WhatsApp and Signal both use the Signal Protocol, and the same code: https://github.com/whispersystems/libsignal-protocol-java
78.
by moxie 11y ago
https://github.com/whispersystems/libsignal-protocol-java
79.
by moxie 11y ago
By default, Telegram stores a plaintext copy of every message you've ever sent or received on their servers. WhatsApp does end to end encryption using the Signal Protocol by default, and doesn't store anything server side.
80.
by moxie 11y ago
WhatsApp uses a shared identity across text and voice, so Signal Protocol is used to secure both connections. We've long planned to do the same thing in Signal, but WhatsApp is ahead of Signal here. Axolotl is now called Signal Protoc
81.
by moxie 11y ago
Correct. The only people who can read a message (or hear a voice call) are their intended recipients.
82.
by moxie 11y ago
> They seem to have replaced TLS/SSL between client and server with "Noise Pipes". WhatsApp was already using a custom protocol instead of TLS. We worked with them to transition over to Noise Pipes, which has some advanta
83.
by moxie 11y ago
Open Whisper Systems • San Francisco • Full Time • ONSITE Open Whisper Systems is making private communication simple. Our technology is used by hundreds of millions of people, and everything we produce is open source. What it's like t
84.
by moxie 11y ago
> All else equal...having a college degree in CS is an advantage in getting hired over being self-taught. I don't think this is uncontroversial. I've done hundreds of interviews at companies large and small, and nobody else has
85.
by moxie 11y ago
Some bad signs: 1. Hosted in Switzerland is advertised as a security feature. The point of e2e is that the servers are untrusted. If you need a "good jurisdiction" for your servers, it means they must be trusted. That's a p
86.
In the Bay Area? Join an emergency rally in defense of crypto tonight(twitter.com)
3 points by moxie 11y ago|0 comments
87.
by moxie 11y ago
Open Whisper Systems • San Francisco • Full Time • ONSITE Open Whisper Systems is making private communication simple. Our technology is used by hundreds of millions of people, and everything we produce is open source. What it's like t
88.
by moxie 11y ago
It's actually the exact opposite. Telegram has made design decisions that prevent them from ever being able to provide private messaging by default without radically altering their design and re-writing all of their clients. The Teleg
89.
by moxie 11y ago
The author definitely knows about it, since the thesis of the article is that Signal would be near-perfect if the multi-device flow were usable but "..the process for setting it up is annoying." It's fine if the author hasn&#
90.
by moxie 11y ago
Wait, have you actually used Signal multi-device? Your thesis is that it's not usable because you have to scan a QR code once, as opposed to Telegram where you have to receive an SMS on your device and manually type it in on your desk

More ›