Re:Show HN: ChatSecure iOS v4.0 – OMEMO and Signal Protocol
by gtirloni on Tuesday January 17, 2017 @08:35PM
(#13423291)
The list of features at conversations.im is impressive. Despite the fact that nobody I know is using it, I wanted to have a quick look but it's a paid app (I know, GPL, etc). And one I know I won't be actively using. There is too much friction to try it out.
Re:Show HN: ChatSecure iOS v4.0 – OMEMO and Signal Protocol
by BuuQu9hu on Wednesday January 18, 2017 @02:08AM
(#13424668)
Asking for money in return for binaries of GPL/FLOSS apps uploaded to the app stores of proprietary platforms seems like a decent way to fund FLOSS development. Folks there are used to paying anyway. Folks interested in FLOSS will be using platforms like Cydia, F-Droid or Debian/Fedora anyway.
Re:Show HN: ChatSecure iOS v4.0 – OMEMO and Signal Protocol
by gtirloni on Wednesday January 18, 2017 @07:52AM
(#13425961)
I'm not arguing about the validity of the method that was chosen. I agree it's a valid method.
What I'm saying is that, if the goal is widespread usage, there are little small roadblocks before users can actually be using the app.
I cannot ask my family and friends to install F-droid or pay for an app that I'm not even sure they will like. So realistically, I will never mention it to them.
Maybe I misunderstood what is the target audience from the beginning. You're telling me it is the 0.0001℅ of the population that uses 3rd-party app stores, Linux, etc. That's fine too but it comes with its own limitations.
Re:Show HN: ChatSecure iOS v4.0 – OMEMO and Signal Protocol
by LukeShu on Tuesday January 17, 2017 @10:43PM
(#13423791)
I'm not familiar with ChatSecure, but from what I can tell:
It ChatSecure is an XMPP client; XMPP being an open federated protocol.
Signal uses Google infrastructure; while this isn't an issue for security purposes (because everything is encrypted), some people don't like it, some people like to run their own servers. With a "centralized" protocol like Signal, running your own server means you are cut off from everyone on the main server; with a "federated" protocol like XMPP your server can communicate with the other servers, so you can chat with users on other servers.
The innovation with ChatSecure over other XMPP clients is that it has implemented an XMPP extension (XMPP is an extensible protocol) called "OMEMO" that implements encryption, by borrowing substantially from the Signal protocol. This is an improvement over OTR, the status-quo way of doing encrypted XMPP, which the linked page explains was designed around desktop usage and doesn't work well with phones.
Re:Show HN: ChatSecure iOS v4.0 – OMEMO and Signal Protocol
by chrisballinger on Wednesday January 18, 2017 @01:00AM
(#13424393)
That's correct. Our main differentiator from Signal/WhatsApp/Wire/Telegram/etc is that we have no centralized messaging infrastructure. Users are free to run their own servers, or connect to any 3rd party providers they trust. We also have integrated Tor support, but plan to remove that once iCepa reaches maturity.
Re:Show HN: ChatSecure iOS v4.0 – OMEMO and Signal Protocol
by chrisballinger on Wednesday January 18, 2017 @02:53AM
(#13424822)
Most public servers are pretty bad in terms of modern XMPP features [1]. Trust is also a big issue, but one of our goals is to solve this problem by making it much easier to run your own server. We currently default to Dukgo for new registrations but they don't support many of the XEPs required for a good mobile experience (0198, 0313, 0357).
Basically ChatSecure is a nice clean XMPP client (turns out XMPP is not actually that scary, and choosing a network is no worse than choosing an e-mail provider), that supports OTR (and now OMEMO, which is much better). For Android, there's conversations.im, which was the first one to really support OMEMO.
Basically means you can choose your client, networks handle the messages, and it's up to the client each person is using to handle the crypto.
Re:Show HN: ChatSecure iOS v4.0 – OMEMO and Signal Protocol
by chrisballinger on Tuesday January 17, 2017 @05:13PM
(#13421936)
Thanks! It's been quite the rollercoaster. We're extremely grateful that Moxie resolved the App Store / GPL license issue with their Signal Protocol libraries.
Re:Show HN: ChatSecure iOS v4.0 – OMEMO and Signal Protocol
by chrisballinger on Wednesday January 18, 2017 @02:04PM
(#13429261)
Thanks for testing so thoroughly. Some of these problems are likely related to server incompatibilities, but others are definitely client bugs like the QR code stuff. Please report individual issues here [1]. Thank you!
Re:Show HN: ChatSecure iOS v4.0 – OMEMO and Signal Protocol
by antihero on Wednesday January 18, 2017 @04:38AM
(#13425171)
Yay! Amazing! I literally checked out ChatSecure yesterday due to the WhatsApp issues and looked at the GitHub issues to see if it supported OMEMO, and here we are! Thank you so much, it's like Christmas :)
Re:Show HN: ChatSecure iOS v4.0 – OMEMO and Signal Protocol
by upofadown on Wednesday January 18, 2017 @08:30AM
(#13426149)
Last I heard was that the past Android version of chatsecure was being abandoned. Conversations would become the new Android client. Any future work on the original Android chatsecure will go to the Zom project:
Re:Show HN: ChatSecure iOS v4.0 – OMEMO and Signal Protocol
by chrisballinger on Wednesday January 18, 2017 @02:46AM
(#13424795)
MAM will be in 4.1, but there's currently no timeline for that release yet. We plan to do a 4.0.1 release soon to resolve some bugs, and then start working on 4.1. If you signed up for the 4.0 beta, you'll get notifications for the next beta as soon as its ready.
What I'm saying is that, if the goal is widespread usage, there are little small roadblocks before users can actually be using the app.
I cannot ask my family and friends to install F-droid or pay for an app that I'm not even sure they will like. So realistically, I will never mention it to them.
Maybe I misunderstood what is the target audience from the beginning. You're telling me it is the 0.0001℅ of the population that uses 3rd-party app stores, Linux, etc. That's fine too but it comes with its own limitations.
What makes ChatSecure a better choice? What can I do with it that they can't?
It ChatSecure is an XMPP client; XMPP being an open federated protocol.
Signal uses Google infrastructure; while this isn't an issue for security purposes (because everything is encrypted), some people don't like it, some people like to run their own servers. With a "centralized" protocol like Signal, running your own server means you are cut off from everyone on the main server; with a "federated" protocol like XMPP your server can communicate with the other servers, so you can chat with users on other servers.
The innovation with ChatSecure over other XMPP clients is that it has implemented an XMPP extension (XMPP is an extensible protocol) called "OMEMO" that implements encryption, by borrowing substantially from the Signal protocol. This is an improvement over OTR, the status-quo way of doing encrypted XMPP, which the linked page explains was designed around desktop usage and doesn't work well with phones.
BTW, for anyone wanting to setup a modern XMPP server, check out this:
http://www.enricozini.org/blog/2017/debian/modern-and-secure... http://www.trueelena.org/computers/howto/modern_xmpp_server....
1. https://gultsch.de/compliance.html
https://copperhead.co/android/docs/usage_guide
Basically ChatSecure is a nice clean XMPP client (turns out XMPP is not actually that scary, and choosing a network is no worse than choosing an e-mail provider), that supports OTR (and now OMEMO, which is much better). For Android, there's conversations.im, which was the first one to really support OMEMO.
Basically means you can choose your client, networks handle the messages, and it's up to the client each person is using to handle the crypto.
DuckDuckGo: Adding people doesn't seem to work via QR code, at all. And the client gets weird when trying to delete the account.
evil.im: Adder never gets notified that they have been "accepted", so can't view the conversation except via notification.
null.pm: Adding works fine, but OMEMO just stays at yellow exclamation marks.
dismail.de (supposedly has a fully green bar): No QR code adding, no notification of accepted contact request, OMEMO is fucked.
talker.to Basically the same as dismail.de.
So is there an actual server that is reliable and supports the requisite features set to make this a usable experience?
Are these client bugs?
Because otherwise this is going nowhere. I'm sitting next to my mate and cannot actually find a server that allows us to communicate normally.
I'm trying to set up a Jabber prosody server and I think it's working. I have no idea how to test if it is really. I got A/A on the server test thing.
How do they compile a list like this?
https://gultsch.de/compliance_ranked.html
Do they have a suite that I can run against my own server?
Most probably yes, you should report such things to the issue tracker at https://github.com/ChatSecure/ChatSecure-iOS
Do they have a suite that I can run against my own server?
The compliance testing is performed by https://github.com/iNPUTmice/ComplianceTester
You should also be able to ask Daniel (iNPUTmice) in the Conversations chart room at https://yax.im/i/#[email protected]?join <xmpp:[email protected]?join>
1. https://github.com/chatsecure/chatsecure-ios/issues
[1] https://github.com/guardianproject/ChatSecureAndroid
* https://github.com/zom/zom-android