News for hackers. Stuff that matters.
Re:Code from the FBI’s Anom encrypted messaging app by xt00 on Thursday July 07, 2022 @11:40AM (#32015467)
I wish somebody would create some scheme to like self host the backend of an app.. like you launch Signal and it has a button to type in the name of your own server, where that server runs a VM that you configure and setup on your own PC locally then upload to AWS or something and has some facility to constantly report to you the hash of the memory and disk contents, along with some contract from AWS that states that Amazon cannot alter the results of the hash function results sent to you under any circumstances. Plus there would be some facility to validate the contents of what runs in that VM at any instant in time. Basically the idea is you can’t trust anybody at all. I guess pgp would maybe solve this for direct messaging?
Re:Code from the FBI’s Anom encrypted messaging app by spongechameleon on Thursday July 07, 2022 @11:55AM (#32015652)
I think something like Ricochet (if it were still actively maintained) could be a good solution.

https://github.com/ricochet-im/ricochet

Every user is their own Tor onion service, so you get E2E encryption and no centralized servers. The whole thing hinges on the security of Tor itself which is probably a safe enough bet.

Re:Code from the FBI’s Anom encrypted messaging app by blepyzdiec on Thursday July 07, 2022 @08:17PM (#32021429)
Briar https://briarproject.org/ is similar, plus, AFAIK, it's using E2E on top of Tor service. However, looking at massively caught Tor services, I believe, to keep it truly secure, you have to rotate your service address, aka reinstall the app, losing all your history of communication.
Re:Code from the FBI’s Anom encrypted messaging app by throwaway1777 on Thursday July 07, 2022 @03:27PM (#32018237)
You could still have holes in a self hosted setup. The self hosted version could forward stuff on to someone else… so you could setup a firewall. But is it really blocking everything or is it just telling you it’s blocking things. This can go on forever, it all depends on the threat model and how far down the rabbit hole you have time to go.
Re:Code from the FBI’s Anom encrypted messaging app by danielschonfeld on Thursday July 07, 2022 @01:39PM (#32016980)
There’s plenty of that stuff. Jabber and XMPP. And also more up to date is Matrix.org which nobody seems to want to use and I’m not sure why.

The problem though is that you’re still trusting the code. Nothing stops self hosted from rotting on you unless you look and read the code yourself.

Re:Code from the FBI’s Anom encrypted messaging app by MattJ100 on Thursday July 07, 2022 @02:28PM (#32017577)
In case anyone is in doubt after reading your comment, I want to clarify that XMPP is "up to date" and has an active community and ecosystem of software projects, open-source and commercial.

Matrix is similar in many ways, and certainly younger, but also has a vastly different design at the protocol layer. It's more akin to a distributed JSON database/log, while XMPP is more focused on message routing and synchronization. Therefore each has different strengths/weaknesses for different use cases.

Despite these differences, both protocols indeed have IM apps and a whole lot of other software built on top of them.

Re:Code from the FBI’s Anom encrypted messaging app by proto_lambda on Thursday July 07, 2022 @01:59PM (#32017235)
> Matrix.org which nobody seems to want to use and I’m not sure why

Lots of people are using it (and probably more every day), but there are also some quite vocal haters. Of course it has its share of problems (availability of non-Electron clients and different servers among then), but many of them constantly improve as the ecosystem grows.

Re:Code from the FBI’s Anom encrypted messaging app by cwoolfe on Thursday July 07, 2022 @12:08PM (#32015794)
It's pretty easy to host your own chat server. https://twitter.com/inputmice/status/1170651869359804416
Re:Code from the FBI’s Anom encrypted messaging app by Ashoat on Thursday July 07, 2022 @04:11PM (#32018714)
We're basically working on this at Comm: https://github.com/CommE2E/comm