News for hackers. Stuff that matters.
Re:Et Tu, Signal? by Andrew_nenakhov on Wednesday April 07, 2021 @09:37AM (#26724714)
Proper message sync is hardly possible with end-to-end encryption everyone so excited about (without fully understanding the implications of true secrecy). If you have e2ee and then sync messages via google drive (looking at you, Viber), you are kinda missing the point.
Re:Et Tu, Signal? by nlitened on Wednesday April 07, 2021 @09:43AM (#26724800)
I remember that Skype, before it was bought and ruined by Microsoft, had P2P chat history sync that worked the following way: once two of your devices were online at the same time, they synchronized chat history among the two running instances flawlessly. It was super reliable and predictable.

I am sure that Signal could implement the same peer-to-peer sync scheme with full end-to-end encryption without any secrecy compromises.

Re:Et Tu, Signal? by pmlnr on Wednesday April 07, 2021 @10:21AM (#26725353)
Pre-MS skype was so far peak IM.
Re:Et Tu, Signal? by MereInterest on Wednesday April 07, 2021 @10:47AM (#26725707)
Don't forget about when IM networks actually used open standards instead of closed proprietary protocols. Managing all of my accounts through pidgin was a breeze, and didn't leave me swapping between half a dozen different programs trying to remember which networks somebody would typically use.
Re:Et Tu, Signal? by pmlnr on Wednesday April 07, 2021 @10:52AM (#26725788)
That was never a thing: Pidgin & the rest had to write their own implementation for many of those protocols, starting with AIM.

There was a tiny period, somewhere in 2006, when many services were XMPP, maybe even federated, but due to the lack of good clients - compared to skype -, it never manifested as good as it should have.

There are now many nice XMPP clients, but the big players now all moved into proprietary territory.

Re:Et Tu, Signal? by ebrenes on Thursday April 08, 2021 @07:38PM (#26745111)
I also remember a period in time when I could use Trillian to connect to ICQ, MSM, AIM and have it all in one convenient chat client without having to fire up all the individual ones. Granted it sometimes broke when the protocols updated, but for a moment it was pretty cool.
Re:Et Tu, Signal? by MereInterest on Wednesday April 07, 2021 @02:28PM (#26728918)
Good point, I am misremembering.
Re:Et Tu, Signal? by Andrew_nenakhov on Wednesday April 07, 2021 @09:54AM (#26724974)
This is actually working very bad in most practical situations. The way to go is Telegrams way, where you store all data on the server and happily sync ut easily between devices. Just do it on your own server using xmpp. E2ee helps mostly against server owner, and you eliminate this risk by being your own server owner.
Re:Et Tu, Signal? by rakoo on Wednesday April 07, 2021 @12:10PM (#26726965)
> E2ee helps mostly against server owner, and you eliminate this risk by being your own server owner.

Unfortunately you only eliminate it by being your own server owner _and_ your recipient being their own server owner. Take a look at email: I might not want to use e2ee because I self-host, but the second I send an email to a friend hosted on gmail, Google gets all the content.

I think federation does have its place (for different reasons) but it unfortunately isn't enough for privacy.

Re:Et Tu, Signal? by lxgr on Wednesday April 07, 2021 @03:35PM (#26729962)
> Just do it on your own server

What if I don't have and don't want my own server?

Re:Et Tu, Signal? by mixedCase on Wednesday April 07, 2021 @11:13AM (#26726078)
You run your own datacenter?
Re:Et Tu, Signal? by approxim8ion on Wednesday April 07, 2021 @11:26AM (#26726284)
XMPP is extremely light, you can use a moderately powered personal computer to handle traffic from several users. I don't have the numbers with me but last I'd heard, the number was in the hundreds.
Re:Et Tu, Signal? by Andrew_nenakhov on Wednesday April 07, 2021 @11:36AM (#26726434)
ejabberd can host ~2k active connections on $2/month server.
Re:Et Tu, Signal? by lxgr on Wednesday April 07, 2021 @03:40PM (#26730029)
Where can I get this $2/month server?

The nice thing about client-side/end-to-end security is that the service provider matters less.

Also, $2/month is $2 more than many people would be willing to pay for private messaging, and I can't message people on a network they're not on, no matter how much I pay.

Re:Et Tu, Signal? by Andrew_nenakhov on Thursday April 08, 2021 @04:06AM (#26736249)
Ionos.com

And if you're privacy is worth less than $2/month, just use Telegram. It works way better than these messenges obsessed with privacy, precisely because it does not have encryption for most messages

Re:Et Tu, Signal? by lxgr on Thursday April 08, 2021 @04:45AM (#26736503)
> Ionos.com

That looks a lot like a server hosted by somebody else in a data center.

It's also way more hassle than almost all of my contacts would be willing to go through, and if only I self-host but they don't, it'll be Gmail all over. (Almost all emails go through Gmail because that's what at least one of the parties in an exchange is likely using.)

Point-to-point encryption is not enough for messaging in today's network topology.

> just use Telegram

No thanks, I'll continue using one actually spending some effort on not being able to read the messages their users send.

Fortunately most people in my country do. Ironically it's only a couple of people in my circle of friends worried about the privacy of said messenger switching to Telegram "because it's encrypted"...

Re:Et Tu, Signal? by robjan on Wednesday April 07, 2021 @09:53AM (#26724951)
One of the features of the Signal protocol is that each message is signed with a different key so that if one message is somehow compromised it's still impossible to retrieve the others. I think this would break with P2P sync.
Re:Et Tu, Signal? by nlitened on Wednesday April 07, 2021 @01:05PM (#26727694)
Your Signal client has all the messages stored unencrypted (this is true because you can read them all, and search all the local messages).

What's preventing the client from dumping all the messages to a single file, encrypt it with a public key of the other running instance of Signal logged in to the same account, and send it, so that your other device can decrypt the file and import all the messages?

Re:Et Tu, Signal? by Andrew_nenakhov on Wednesday April 07, 2021 @10:13AM (#26725247)
First people want full security, but when they encounter inconveniences that come with true full security, they start wanting convenience. What works best is a very very very good promise of security without e2ee, as shown by Telegram. It's users just know that Telegram is the most protected messages, and they are happy with it's advanced features.
Re:Et Tu, Signal? by rakoo on Wednesday April 07, 2021 @09:54AM (#26724978)
e2ee is a technical term, not a social term. It only means that 2 devices exchange bytes and no third-party can read them. Nowhere is there any obligation that the 2 devices belong to different people: it is perfectly possible to exchange history between your laptop and your smartphone with e2ee.
Re:Et Tu, Signal? by feanaro on Friday April 09, 2021 @11:45AM (#26752043)
Matrix features E2EE with proper message sync between clients: https://matrix.org/
Re:Et Tu, Signal? by lxgr on Wednesday April 07, 2021 @03:36PM (#26729978)
> Proper message sync is hardly possible with end-to-end encryption

iMessage (and soon WhatsApp) would beg to differ.

It is much more difficult, yes, but definitely not impossible.