The matrix[1] team is working on an axolotl implementation meant to be used pluggably: https://matrix.org/git/olm/

---

[1] https://matrix.org/

I searched for axolotl and got some cute pictures but not much information. Why this thing rather than OTR?

OTR has some major shortcomings - in the classic implementation, it doesn't do group chat and it requires both parties to be online at the same time to synchronise the cryptographic ratchet. The best explanation of why Axolotl is better is https://whispersystems.org/blog/advanced-ratcheting - or if you prefer a more comprehensive spec, we've published one at https://matrix.org/docs/spec/olm.html.

Anyone wanting to know more about Olm & Matrix's Axolotl support might be interested to flip to the end of https://matrix.org/~matthew/2015-06-26%20Matrix%20Jardin%20E...

(p.s. hi!)

Hi indeed.

Are there any plans for formal standardisation, review or the like? The docs look cool but at this point I'm suspicious of any single-vendor cryptography.

yup, we will get it properly reviewed once complete.

There's just an inherent conflict there, because your DMs are indexed+searchable just like any other message, and really, you want them that way.

The only obvious solution, right now, is running your own private server if you want private indexes.

But the One True Way to solve this problem, in the fullness of time, is for every enterprise to run their own little PaaS with a standard API, and for SaaS providers to launch their app instances into the enterprise's PaaS using that API. This would be the cloud equivalent of the SaaS-provider selling the enterprise an "appliance" they can keep within their data-center. The enterprise gets full control of the data: their PaaS can be set up to not allow the SaaS-provider any way to exfiltrate the data the app creates, to determine rollout schedule for new app versions, etc.

(And note that when I say "enterprise", I could just as well mean that any individual user could own their own completely-automated black-box micro-PaaS, living "across" various IaaS providers and migrating to new ones as necessary, brought into existence for them by the first SaaS vendor to try launching something into it. Effectively, the ultimate evolution of a personal VPS, providing you with a "management interface" that looks like a cross between Heroku's dashboard and the Windows "Programs and Features" pane.)

For the usecase I see these to be useful, I don't see lack of e2e such a huge concern. I would assume that in most cases the server would be more or less trusted in the context they are used in, so TLS style client-server security would be adequate.

In other words, if I really wanted to have discussion secret enough to warrant e2e I probably wouldn't be using company/project chat for that no matter what sort of promises it gives.

That being said, of course e2e chat would be beneficial addition, and might help especially in larger enterprise deployments.

For less important things, I agree, run of the mill TLS is enough. But for things that are critical to the business, trade secrets, strategy, SWOT analysis of a recent breach, etc, I think every company should have an e2ee chat/file sharing app in their toolkit.

>if I really wanted to have discussion secret enough to warrant e2e I probably wouldn't be using company/project chat for that no matter what sort of promises it gives.

Why not, though? Assuming logging is disabled by both parties and the E2E is working as intended, you have something that's almost as secure as in-person conversation. The only weakness is if someone has malware actively on their machine recording the conversation as it's occurring... but then you also have many other issues.

Maybe give balboa.io a try, it's the closest I can think of. Not just DMs but also file storage and transfer. Kind of similar UI to slack.

Also, peerio.com, but they don't have a 'channels-like' interface, so maybe not what you're looking for.

The ones that support XMPP can probably have an OTR plugin built for them. Might be able to develop an Axolotl plugin too.

Does Slack even have e2e encryption?

Rocket.Chat does have an open issue with discussion about this: https://github.com/RocketChat/Rocket.Chat/issues/36