News for hackers. Stuff that matters.
Re:Cross-signing and end-to-end encryption by default by godelski on Thursday May 07, 2020 @05:13PM (#23108425)
On HN I'm always seeing a fight between Signal and Matrix. Can someone explain this to me? As far as I see it: Signal replaces SMS; Matrix replaces Slack/IRC. These seem like different products that work in different spaces.
Re:Cross-signing and end-to-end encryption by default by tptacek on Thursday May 07, 2020 @05:46PM (#23108729)
Among technologists, the two most divisive aspects of Signal are that it requires phone numbers, and that it isn't (and likely won't ever be) federated --- that is, you can't run your own Signal server and be accessible to people using ordinary Signal clients.

Matrix doesn't use phone numbers, and is federated (that's what makes Matrix interesting), so it's naturally the "antidote" suggestion on threads when people bring up these aspects of Signal.

The fact is that they're not really comparable projects; they have different audiences and different goals. People have an innate narrative bias that constant hunts for horse races to spectate, and so you'll see a lot of "Signal vs. Matrix" arguments, but it's an artifact, not anything substantive.

Re:Cross-signing and end-to-end encryption by default by atomicnumber3 on Thursday May 07, 2020 @11:20PM (#23111078)
I know you're just citing the arguments, but I can't help but respond.

I always see Signal as being "really good" crypto. Bulletproof? No, surely not. That doesn't exist. If I were a dissident or something I would be using gpg religiously and all that jazz.

But is signal significantly better than basically every mainstream sms-like thing? Absolutely! imessage, sms, mms, whatapp, facebook messenger, whatever google's current chat app is, etc. All of them don't even try to be a secure/privacy-respecting chat tool and reall y make no secret that they're usually totally the opposite (facebook messenger....).

So when it comes to getting my parents onto something that sends videos of the kids real good and also will make dragnet state surveillance efforts a bit harder, I pick Signal.

Re:Cross-signing and end-to-end encryption by default by tptacek on Friday May 08, 2020 @12:48AM (#23111491)
The cryptography in Signal is substantially better than that of GPG. You would have a very hard time finding a cryptography engineer that disagreed with that.
Re:Cross-signing and end-to-end encryption by default by CameronNemo on Thursday May 07, 2020 @06:10PM (#23108946)
>The fact is that they're not really comparable projects; they have different audiences and different goals.

Agree on the second part, but two messaging solutions can and should be compared. 1-to-1 (text/voice/video) messaging is entirely possible with both Signal and Matrix, and evaluating that narrow use case is a reasonable way to compare the two.

Re:Cross-signing and end-to-end encryption by default by tptacek on Thursday May 07, 2020 @06:18PM (#23109011)
Lots of technologists believe that everyone should use IRC, or some next-gen IRC-alike, to communicate. Anything you can do with a specialized messaging app you can do with a messaging relay network. But, of course, specialized messaging apps outstrip messaging relay networks by orders of magnitude; IRC itself has usage that is a rounding error of WhatsApp's. Most people do not perceive any value from being part of a federated relay network; the audiences are not, in fact, the same.
Re:Cross-signing and end-to-end encryption by default by CameronNemo on Thursday May 07, 2020 @07:57PM (#23109794)
Again, I agree with you that the audiences are not the same. I specifically agreed with that statement in my comment.
Re:Cross-signing and end-to-end encryption by default by tptacek on Thursday May 07, 2020 @09:12PM (#23110347)
Oh, I misread "the second part". Sure, you can compare anything, but I'd dispute that it's always productive to do so.
Re:Cross-signing and end-to-end encryption by default by iknowstuff on Thursday May 07, 2020 @08:25PM (#23109984)
Well, actually, given the end to end encryption in Matrix, nothing is stopping users from completely replacing Signal with a Matrix client which acts exactly like it.
Re:Cross-signing and end-to-end encryption by default by ryukafalz on Thursday May 07, 2020 @05:45PM (#23108722)
There's nothing about the Matrix protocol that makes it better for one or the other though; it's a pretty general messaging protocol. Riot looks more like Slack, yes, but there are other clients that look more like SMS apps, e.g.: https://dittochat.org/
Re:Cross-signing and end-to-end encryption by default by goatsi on Thursday May 07, 2020 @07:35PM (#23109657)
That's a really great example for showing the difference between federated protocols and what Signal is doing, since according to their roadmap support for end-to-end encryption is still in the planning stages: https://ditto.upvoty.com/b/feature-requests/end-to-end-encry...
Re:Cross-signing and end-to-end encryption by default by godelski on Thursday May 07, 2020 @05:47PM (#23108738)
THANKS! This actually clears things up better than the other comments. Is there a list of these things somewhere so I can learn more?
Re:Cross-signing and end-to-end encryption by default by ryukafalz on Thursday May 07, 2020 @06:03PM (#23108891)
This is probably the best place to start: https://matrix.org/clients

And of course more broadly, Matrix as a whole isn't even limited to only messaging apps, although that's where most of the focus has been thus far. There have been some fun demos/projects in the past though:

- Synchronized presentation slides: https://github.com/Half-Shot/matrix-presents

- MIDI over Matrix: https://github.com/McOmghall/midi-over-matrix

- VR videoconferencing: https://matrix.org/docs/projects/other/matrix-vr-demo

Re:Cross-signing and end-to-end encryption by default by MayeulC on Thursday May 07, 2020 @06:21PM (#23109044)
Well, https://matrix.org is a good place to start (but could use a face-lift for non-techies). There's a good list of clients, servers, SDKs, etc at https://matrix.org/docs/projects/try-matrix-now

And of course, there is the Matrix spec itself, but I learned most of what I know idling in matrix channels (#matrix:matrix.org and #synapse:matrix.org) and hosting my own synapse instance.

Re:Cross-signing and end-to-end encryption by default by remir on Thursday May 07, 2020 @06:32PM (#23109137)
Damn, this looks good! Thanks for the link!
Re:Cross-signing and end-to-end encryption by default by ryukafalz on Thursday May 07, 2020 @11:28PM (#23111130)
Fair warning, that one’s fairly early in development. What is implemented works well, but I wouldn’t say it’s a Riot replacement quite yet.

FluffyChat is similar, and seems to be a bit further along (it has basic e2e crypto support for example) -https://christianpauly.gitlab.io/fluffychat-website/en/

Re:Cross-signing and end-to-end encryption by default by remir on Friday May 08, 2020 @12:13AM (#23111325)
Thanks for the suggestion. It looks awesome!
Re:Cross-signing and end-to-end encryption by default by hutzlibu on Thursday May 07, 2020 @05:27PM (#23108568)
But maybe people don't want to use different software for the same purpose: sending text to other people. No matter they are on a PC or smartphone. That's what botters me with Signal. Bound to a phone (number).

But Signal just works and is fast (though not as fast as WhatsApp)

Matrix in the default login also works, but when you choose the default open Matrix Server ... it is slow.

So I also will continue to use .. not only 2 but 6 different text sending applications. But in the future I would love to just use the Matrix protocol and one software.

Re:Cross-signing and end-to-end encryption by default by godelski on Thursday May 07, 2020 @05:36PM (#23108659)
I guess the difference I see is that texting I find useful for one on one conversation, or a small group. Slack I find good for big groups. I actually like to have two different apps for these because it lets me better compartmentalize my socialization, especially since the latter tends to be associated with work (I like to compartmentalize work from my social life).
Re:Cross-signing and end-to-end encryption by default by oehtXRwMkIs on Thursday May 07, 2020 @05:24PM (#23108542)
I see Matrix as a sort of generalization of Signal. It's federated and decentralized, and they literally had to scale up the E2E system that Signal came up with. I use it for every form of digital communication (bridges are nice) including 1-to-1 but I think most would use it for group chats or organizations.
Re:Cross-signing and end-to-end encryption by default by Well_hello on Saturday May 09, 2020 @01:08PM (#23126430)
Well, I consider this a pretty accurate description.