News for hackers. Stuff that matters.
Re:Cross-signing and end-to-end encryption by default by tptacek on Thursday May 07, 2020 @05:46PM (#23108729)
Among technologists, the two most divisive aspects of Signal are that it requires phone numbers, and that it isn't (and likely won't ever be) federated --- that is, you can't run your own Signal server and be accessible to people using ordinary Signal clients.

Matrix doesn't use phone numbers, and is federated (that's what makes Matrix interesting), so it's naturally the "antidote" suggestion on threads when people bring up these aspects of Signal.

The fact is that they're not really comparable projects; they have different audiences and different goals. People have an innate narrative bias that constant hunts for horse races to spectate, and so you'll see a lot of "Signal vs. Matrix" arguments, but it's an artifact, not anything substantive.

Re:Cross-signing and end-to-end encryption by default by atomicnumber3 on Thursday May 07, 2020 @11:20PM (#23111078)
I know you're just citing the arguments, but I can't help but respond.

I always see Signal as being "really good" crypto. Bulletproof? No, surely not. That doesn't exist. If I were a dissident or something I would be using gpg religiously and all that jazz.

But is signal significantly better than basically every mainstream sms-like thing? Absolutely! imessage, sms, mms, whatapp, facebook messenger, whatever google's current chat app is, etc. All of them don't even try to be a secure/privacy-respecting chat tool and reall y make no secret that they're usually totally the opposite (facebook messenger....).

So when it comes to getting my parents onto something that sends videos of the kids real good and also will make dragnet state surveillance efforts a bit harder, I pick Signal.

Re:Cross-signing and end-to-end encryption by default by tptacek on Friday May 08, 2020 @12:48AM (#23111491)
The cryptography in Signal is substantially better than that of GPG. You would have a very hard time finding a cryptography engineer that disagreed with that.
Re:Cross-signing and end-to-end encryption by default by CameronNemo on Thursday May 07, 2020 @06:10PM (#23108946)
>The fact is that they're not really comparable projects; they have different audiences and different goals.

Agree on the second part, but two messaging solutions can and should be compared. 1-to-1 (text/voice/video) messaging is entirely possible with both Signal and Matrix, and evaluating that narrow use case is a reasonable way to compare the two.

Re:Cross-signing and end-to-end encryption by default by tptacek on Thursday May 07, 2020 @06:18PM (#23109011)
Lots of technologists believe that everyone should use IRC, or some next-gen IRC-alike, to communicate. Anything you can do with a specialized messaging app you can do with a messaging relay network. But, of course, specialized messaging apps outstrip messaging relay networks by orders of magnitude; IRC itself has usage that is a rounding error of WhatsApp's. Most people do not perceive any value from being part of a federated relay network; the audiences are not, in fact, the same.
Re:Cross-signing and end-to-end encryption by default by CameronNemo on Thursday May 07, 2020 @07:57PM (#23109794)
Again, I agree with you that the audiences are not the same. I specifically agreed with that statement in my comment.
Re:Cross-signing and end-to-end encryption by default by tptacek on Thursday May 07, 2020 @09:12PM (#23110347)
Oh, I misread "the second part". Sure, you can compare anything, but I'd dispute that it's always productive to do so.
Re:Cross-signing and end-to-end encryption by default by iknowstuff on Thursday May 07, 2020 @08:25PM (#23109984)
Well, actually, given the end to end encryption in Matrix, nothing is stopping users from completely replacing Signal with a Matrix client which acts exactly like it.