News for hackers. Stuff that matters.
Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by rdl on Tuesday September 19, 2017 @08:14AM (#15283917)
It's frustrating that there are now so many "secure messengers" but none of them is so much better than the others to cause consolidation. I end up needing to communicate over 20-30 of them with different people.

Signal has the worst app (on iOS) and worst UX of anything I regularly use. There's unlikely to be a desktop client which is actually usable (doesn't depend on a phone, works on platforms I care about). The app is less buggy on iOS than it used to be, but it's still not great. Also doesn't work well with groups. And tied to PSTN identities, and the "talk to a new person on the street" interaction sucks. But, the most widely audited crypto, a good development model, and good adoption within some activist communities.

Wire is great, although it's a little "game-like" vs. professional for certain UX. I know the developers and really like it, and it's great for group chat and desktop, but doesn't have much adoption. But, one big global system, too.

Riot/Matrix and Mattermost are nice because you can run them on private networks. Nice apps. I've not seen as much analysis of their security as Signal.

Whatsapp, Telegram, etc. have massive adoption. Whatsapp is now solid security for user to user.

Apple's stuff is great but is Apple-only, and I'm wary, even if I trust the security model, to let a single company own my OS (and update whenever, without really auditing it) and my "end to end encrypted" apps -- way too easy to slip in any kind of backdoor there if they want.

etc. I'd happily trade in 50 ok to good systems for one great standard and then OS/other-application integration -- but it seems like we don't do standards anymore.

Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by amedvednikov on Tuesday September 19, 2017 @08:43AM (#15284103)
> There's unlikely to be a desktop client which is actually usable

Check out eul, it's a native desktop client for all major messaging platforms. Signal support is coming in October. It's only 4 MB, and it can handle thousands of messages without lag.

https://eul.im

Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by faitswulff on Tuesday September 19, 2017 @09:26AM (#15284353)
This reminds me of when I used Trillian IM/Pidgin/Meebo back in the day. Everything old is new again!
Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by amedvednikov on Tuesday September 19, 2017 @11:17AM (#15285367)
And Miranda!
Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by StavrosK on Tuesday September 19, 2017 @11:36AM (#15285573)
Man, Miranda was so fantastic. Miranda and Winamp are the only two programs I miss from my Windows days.
Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by Toast_25 on Tuesday September 19, 2017 @01:41PM (#15286849)
Music Bee is pretty good. Not sure if it's still around though, I mostly listen to music on my phone/youtube nowadays and work doesn't let me download music to my computer.
Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by Dolores12 on Tuesday September 19, 2017 @11:36AM (#15285563)
still using miranda-ng with OTR plugin.
Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by StavrosK on Tuesday September 19, 2017 @11:35AM (#15285560)
Seems to only be 4 MB because it downloads 100 MB of "embedded browser" when you first run it. I smell an Electron.
Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by amedvednikov on Tuesday September 19, 2017 @12:58PM (#15286412)
It's about 40 MB compressed, and it's only used for authentication. The app will work without it.

I'm really sad it has to be downloaded, but there's no other way to do authentication. Will switch to Servo once it's ready, it's only ~20 MB.

Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by mi100hael on Tuesday September 19, 2017 @12:08PM (#15285879)
"native"

> doctor_evil_quote_fingers.jpg

Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by problems on Tuesday September 19, 2017 @10:39AM (#15285017)
Yeah, just go ahead and use some random closed-source IM tool for your secure messaging - seems like a great idea.
Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by anc84 on Tuesday September 19, 2017 @10:18AM (#15284804)
How do you plan to maintain it? No ads, full privacy, how will you eat? Why is it not free and open-source?
Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by dTal on Tuesday September 19, 2017 @10:57AM (#15285197)
Agreed. The polish, development schedule, and binary-only distribution all say "commercial software", but the lack of license or obvious commercial strategy say "what's going on here".

Looking at your comment history (on both your accounts), you say you plan to open-source it, but you're not sure under what license, and you also hope to make money off it but you're not sure how - possibly through a "paid option"? I commend your effort, but until the exact nature of the project is settled, I would expect confusion and reluctance on the part of your potential users.

Personally, I would never use a secure messenger I couldn't compile myself.

Some previous threads: https://news.ycombinator.com/item?id=14778263 https://news.ycombinator.com/item?id=15209790 https://news.ycombinator.com/item?id=15081269

Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by amedvednikov on Tuesday September 19, 2017 @11:21AM (#15285404)
Good points, I'll make the strategy more clear now that I also have a more clear picture.
Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by amedvednikov on Tuesday September 19, 2017 @11:17AM (#15285371)
There is going to be a freemium model. I'm working on setting up a company, this should be done by the end of the month.
Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by rdl on Tuesday September 19, 2017 @01:47PM (#15286920)
This sounds great; I'm sure people on HN would be happy to help out if you have any questions.
Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by superkuh on Tuesday September 19, 2017 @10:36AM (#15284988)
> all major platforms

No IRC.

Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by amedvednikov on Tuesday September 19, 2017 @11:16AM (#15285362)
Yes IRC! It's just not listed on the home page, I'll fix that.
Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by blubb-fish on Tuesday September 19, 2017 @09:43AM (#15284493)
> Whatsapp is now solid security for user to user.

WA communicates your address book to Facebook.

Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by uoaei on Tuesday September 19, 2017 @11:15PM (#15290514)
WhatsApp also has the glaring vulnerability that Facebook could at any time reset your key to a compromised one without your knowledge, and WhatsApp will resend any hanging messages automatically upon the change, making any undelivered messages available to the one who has the decryption capability associated with that new key. It's possible they've put in a method to do this without notifying the user. Also, this "automatic resend" behavior means that a physical attack can be made simply by switching SIMs on the phone before the message is sent. It requires some careful timing to be a real vulnerability and anyone using a phone to communicate will certainly opt for a more secure platform for critical applications.
Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by solarwind on Tuesday September 19, 2017 @10:34AM (#15284956)
https://medium.freecodecamp.org/why-i-asked-my-friends-to-st...

This article explains a lot better than I can some of the security tradeoffs with Whatsapp, particularly in regard to metadata and data collection.

Also, the worst UX? IMO Signal looks and feels much better and less cluttered than WhatsApp, Wire and Hangouts. Only Telegram has a superior UX (and a really nice QT native desktop app), IMO.

Re:Signal’s Moxie Marlinspike calls out Telegram founder Pav... by 3pt14159 on Tuesday September 19, 2017 @09:47AM (#15284528)
> to let a single company own my OS (and update whenever, without really auditing it) and my "end to end encrypted" apps -- way too easy to slip in any kind of backdoor there if they want.

Strange. We have opposite conclusions from the same data. I figure I need to minimize the amount of people that "have root" so to speak. If I can't trust Apple, it doesn't matter if I trust Signal. Apple controls what actually gets downloaded to my phone.

I use signal for a different reason: mark certain conversations as "phone only" so notifications don't come up at inopportune times like when I'm at thanksgiving dinner with my extended family.