Briar Project - Hackdot

Re:Briar Project by IgorPartola on Sunday August 02, 2020 @06:13PM (#24032237)

In before someone suggests storing encrypted messages in a public blockchain. This is a really good overview of the challenges with these messaging systems. Store and forward has been our MO since email and Usenet were invented because always on always connected devices that aren’t restricted by some network obstacle are not really feasible or even desirable most of the time. I do wonder what alternatives we have to something like a trusted online service to store and forward messages or a public blockchain. Some kind of crypto based system where nobody but the owner of a private key can even locate the message? A decentralized system where multiple copies of multiple fragments of your message are stored so nobody can piece together your (encrypted) message without controlling the majority of the nodes?

[ Parent | on HN ]

Re:Briar Project by aaravchen on Sunday August 02, 2020 @06:41PM (#24032418)

It seems like this might be the eventual intent of the Scuttlebutt protocol, and so far that's also the furthest along in approaching such a solution.

[ Parent | on HN ]

Re:Briar Project by fiddlerwoaroof on Sunday August 02, 2020 @08:28PM (#24032977)

Isn’t matrix basically all that’s needed? It even has out-of-band verification of your friend’s keys.

[ Parent | on HN ]

Re:Briar Project by maqp on Monday August 03, 2020 @10:36AM (#24038242)

If only the ecosystem had been built to use E2EE by default, always. They fucked up with the design allowing bridges and bots, left E2EE for later, and now they're in the vicious circle of downgrade attacks until all major clients switch to E2EE with no insecure fall-back option.

[ Parent | on HN ]

Re:Briar Project by Arathorn on Monday August 03, 2020 @02:09PM (#24041213)

there aren't downgrade attacks. we turned on E2EE by default in May for private rooms, and there's no negotiation involved. if you're on a client that supports E2EE (i.e. almost all major ones, now) and you try to DM someone, they simply won't be able to read you unless they support E2EE. i.e. they can't downgrade the convo.

[ Parent | on HN ]

Re:Briar Project by maqp on Monday August 03, 2020 @06:42PM (#24044346)

That's good. The last time I had a look at Matrix clients it was a mess. IIUC the E2EE isn't enabled by default for the old Riot client, only RiotX and Riot web have it.

What happens if someone with old Riot client creates a room and someone with e.g. RiotX joins it, will it force E2EE on? Or will it fall back to non-E2EE messaging?

[ Parent | on HN ]

Re:Briar Project by fiddlerwoaroof on Monday August 03, 2020 @07:04PM (#24044537)

The creator and admins of the room picks the encryption preferences, iiuc: if you have a client that doesn’t support E2EE, you might be able to create an encrypted room (?) but it would be pretty useless. The clients all clearly mark the encryption status of the room you’re in.

[ Parent | on HN ]

Re:Briar Project by maqp on Thursday August 06, 2020 @03:02AM (#24068748)

So if an ignorant/malicious user creates a room without E2EE and doesn't care to enable it even when requested, all users are forced to converse in effectively plaintext, and the solution is "clients tell users it's not E2EE".

IMO it should be the case that it's always E2EE, no other options. Until that's the case I think Matrix ecosystem isn't keeping up with centralized solutions like Signal.

[ Parent | on HN ]

Re:Briar Project by fiddlerwoaroof on Thursday August 06, 2020 @02:32PM (#24073995)

E2EE is really annoying, in lots of ways: if the users in the room want encryption, I’d rather they just create a new room.

[ Parent | on HN ]

Re:Briar Project by fiddlerwoaroof on Monday August 03, 2020 @02:32PM (#24041522)

Yeah, I really like the ability to have an unencrypted channel: easy bots and bridges are one of the main advantages for me of matrix vs. IRC.

My only big issue is that the iOS client doesn’t support multiple simultaneous identities.

[ Parent | on HN ]

Re:Briar Project by fiddlerwoaroof on Monday August 03, 2020 @06:24PM (#24044186)

I should have said “easy bots and bridges are one of the main advantages for me of matrix as a successor to IRC”

[ Parent | on HN ]

Re:Briar Project by myself248 on Sunday August 02, 2020 @08:58PM (#24033125)

I'm really intrigued by the Scuttlebutt protocol, but in practice it's super hard to get plugged into the community because, as a new user, nobody follows you. I haven't figured out how to just engage people in conversation -- I reply to their posts but nobody sees my replies.

If there are other applications that can run over the protocol, I'm interested in learning about them.

[ Parent | on HN ]

Re:Briar Project by grey_earthling on Monday August 03, 2020 @04:15PM (#24042815)

Yeah, that behaviour's designed to counter spam and unwanted bots, but it does mean newbies need to be invited into a community. Meanwhile it's lonely talking into the void.

You could connect to a pub — an automatically-friendly bot account; see a list at https://github.com/ssbc/ssb-server/wiki/Pub-Servers — scuttle.space seems to be active right now.

If you're happy posting your SSB ID publicly, I'll follow you, and that may help. Or you can use the #new-people tag if you want to introduce/announce yourself :)

[ Parent | on HN ]

Re:Briar Project by Forbo on Monday August 03, 2020 @11:55AM (#24039348)

The dealbreaker with Scuttlebutt for me was the inability to delete messages.

[ Parent | on HN ]

Re:Briar Project by raspyberr on Sunday August 02, 2020 @06:15PM (#24032246)

Do you have an opinion on Skype like centralised coordinator that then sets up P2P connections?

[ Parent | on HN ]

Re:Briar Project by IgorPartola on Sunday August 02, 2020 @06:42PM (#24032420)

This really isn’t my field, I am more of a full stack developer who mostly works on web apps with a heavy interest in networking. So definitely not an authority on the subject.

I think that’s basically the sort of system that most places employ. It’s nice because it’s easy to set up but you really need to trust Skype. Say they actually try to use end to end encryption. How does that work? Well, you could say “I am Alice and I want to establish a connection to Bob. Here is my public key he can use to send me messages and I’d like his public key so I can send him his.” That of course would need to happen in addition to establishing a network connection. So no if Skype is a good actor they will pass my public key to Bob, get his and send it to me as well as coordinate us establishing a direct connection.

But what if Skype is a bad actor? Well they could take my public key and send Bob one of their own. Then they could also send me their own. Now they can listen in on my conversation. They can also in a similar fashion make it seem like I’m connected directly to Bob’s networked device but really just relay the connection through their servers. Neither Bob nor I would have any way of knowing that without having exchanged public keys prior and having verified them. So this system is basically insecure against Skype wanting to listen to my conversations or being compelled to do so by a state actor.

[ Parent | on HN ]