antisocialist

> Now, there exists a minority of extremely technical computer user for which Signal is a nonstarter (because you need a smartphone and valid phone number to enroll in the first place). > there presently isn’t really a good recommendation for private messaging that meets their constraints.

You don't need a phone number or a phone for https://haven.xx.network and there are others.

If nothing is recommended, fine, but it's simplistic to not recommend or even consider the 3-4 apps that don't have those limitations. If you didn't have time to investigate or couldn't find anything else, say so.

Not if you disable your IPv6 stack.

Or you can be smart and "easily" address such probing attacks in your FW rules... https://nvd.nist.gov/vuln/detail/CVE-2024-50252

That's interesting - it turned out markets, as distorted by Obamacare and so on as they are, weren't off by a lot.

He couldn't find services he needed and decided to build it himself. But after many years of trying he couldn't build a sustaining biz that provided such service.

So many SJWs, so little time!

Who would have thought the people who can't stand free speech may not be an "asset" on a social networking platform...

Hope they're employing mods from the Third World otherwise that low price of theirs may need an adjustment...

It may be valid against closed source apps, but I don't see how it can be more secure than build-and-self-host OSS apps for private messaging.

They say don't roll your own encryption protocol (if something similar or same already exists and it's maintained), but these guys just can't resist.

Using a secure decentralized messenger to share a download (or upload) location on a Hidden S3 Service or one of those decentralized S3 services can't possibly be worse than this.

To commenter in https://news.ycombinator.com/item?id=40289777: BitMessage doesn't solve anything, it uses broadcast and Bitcoin peer nodes that first get the message know where it came from. And BitMessage is not an illegal content hazard of any kind (what a ridiculous statement!).

There are private chat apps that don't use phone numbers, but not many and all have other challenges.

https://privacy-checkup.info/en/recommendations/messenger

xx Messenger hasn't used phone numbers (it's optional) ever, but unfortunately although it still works it's no longer updated because development has been focused on a more modern approach which is desktop-only (https://alpha.speakeasy.tech/). Because of that xx Messenger still lacks other features such as group chats and file attachment support which exist but is unstable and limited in terms of attachment size.

Speakeasy supports DM & group chats, and Echoexx (https://echoexx.tech/) is DM only (currently in closed alpha testing; open alpha starts late this month). Both are browser-only for now and require WASM support. Speakeasy supports native (cMixx) device-independent crypto identity, Echoexx supports ENS (.eth) ID and will add support for native cMixx identity later.

Given that no feature-rich app with strong privacy will ever match features of low-privacy apps (if for no other reason, simply because secure & private alternatives cost a lot more to develop and therefore fund, while simultaneously removing ways to recoup those costs), people should simply use multiple apps for different purposes.

Yep, whoever gets hold of those records can cross-reference logs from the same time to narrow down or even outright identify Signal chat participants.

How many of core contributors are CCP members?

In other words, Nostr can't do almost anything that matters.

> First, I want a replication strategy.

xx Network has message replication built in.

> Third, someone needs to delete some of these NIPS.

xx Network lets you delete messages.

> Fourth, it needs a dedicated blob store protocol.

For blobs, clients should be able to plug in to any 3rd party blob storage (e.g. Crust Network). This secondary storage is needed only for large attachments and isn't strictly required in messaging. If you think about it, you could upload large attachments anywhere and send links in messages. Look how Teams or Outlook work with One Drive.

I don't agree with many points from that blog post, but I agree with your comment about phone numbers.

xx Messenger doesn't require user's phone number (it's optional, if the user wants to make it easier to be found by phone number).

Messaging clients on some other networks also don't require phone numbers, but that makes it harder to find people. xx Messenger allows the creation and use of network nicknames that can be ported to other apps.

Source code:

https://github.com/xxfoundation/elixxir-xx-Messenger-Android

https://github.com/xxfoundation/elixxir-xx-messenger-iOS

(Mobile app hasn't been updated for a while; the reason is development of a unified Web-based desktop and mobile client is going on here - https://github.com/xxfoundation/elixxir-speakeasy-web/tree/d... - and it may eventually replace xx Messenger).

xx Network allows 3rd party clients. There's an SDK - https://xx.network/developers-mixnet/ - to make that easier.

Disclosure: I own xx coins.

Okay, let's think about this:

- Signal has stated they'll withdraw from the EU rather than cooperate

- That means the app won't exist in the official EU app stores (iOS, etc.). Users will have to load the app on their own (which 95% of users won't do)

- Next, because Signal is no longer providing services, Signal's EU gateways will not be operational. Now your messages are encrypted, but I've no idea if your Signal connects at all, and where (Signal gateways in some Five Eyes country, perhaps?).

tldr; you're still leaking metadata, and now to a country that has no obligation to not track your metadata (your IP, when you sent message, who received message around the same time, etc).

My suggestion would be get a proper decentralized messenger rather than spend time on these workarounds of questionable value.

I always get down-voted for "shilling", so I won't even make any suggestions this time. DYOD!

Supposedly it's about the children. Sao Paulo solved the problem:

> Many Brazilian states didn’t wait for the federal response. Sao Paulo, for example, temporarily hired 550 psychologists to attend to its public schools, and hired 1,000 private security guards.

https://apnews.com/article/brazil-school-violence-guns-attac...

This is what disgruntled poor people did in China, too, used a $5 hatchet. You don't even need to be able to afford a gun .

I don't see a (neo)Nazi angle in that crime, though. There's no clear motive for the attack yet and no connection to Telegram either (based on coverage in DW and The Guardian), so I'm guessing Lula is simply trying to crack down on free speech.

Users who want private comms with encryption and metadata cleansing can use decentralized blockchain based services such as xx Network's xxMessenger. xxMessenger can be blocked by the ISPs by blocking outgoing connections to xx gateways, but desktop-only Speakeasy Tech can use Tor Network (Tor Browser's Socks5 proxy or Arti) so it's likely to work better when telcos and ISPs are ordered to block connections or DNS lookups. There are other, similar networks, I just don't know enough about them to make specific recommendations.

Disclosure: I own xx coins.

I agree. The web app itself can run locally in QubeOS or Docker, and the browser using it as well.

> From home page, “Nodes Worldwide: 361” to me sounds like it would be extremely easy to control the network.

Well, it's not entirely free to stand up a node. It's similar to other Substrate chains - one would have to stake nodes (around $100K per node) in order to get elected.

$100K per node isn't a whole lot, but it'd cost a lot more if anyone tried to acquire enough coins to stake dozens of nodes. It'd cost a lot more to nominate 100 validator nodes than it costs to stand up 3,000 Tor containers (32 VMs at $10/h, maybe?).

> Have there been any published third party security audits of the related code?

Some have been done, but not all (I think due to the cost of funding audits). These two:

1) Chain - https://twitter.com/xx_network/status/1449012190833426434 and https://blog.chainsafe.io/sprint-toward-mainnet-83937c3e6194

2) Wallet - https://twitter.com/myaksetig/status/1545404294186377216

The rest of main components:

3) Speakeasy is in alpha (almost beta) now so no audits yet. Source: https://git.xx.network/elixxir/speakeasy-web and (WASM) https://github.com/xxfoundation/elixxir-xxdk-WASM.

4) xx Messenger - no wallet in it, so it just uses cMix,and the source (Android) can be found at https://github.com/xxfoundation/elixxir-xx-Messenger-Android

You can ping them directly at https://twitter.com/xx_network/ or reach out to https://twitter.com/rcarback over Twitter or Nostr.

> Lastly, do you have any affiliation to the projects mentioned?

I do own native network coins as ideological investment. I don't promote or mention the coin to others because the coin is not required to use the network and there are no tiers that would give coin-holders any advantage on cMix. The use doesn't require registration, coin ownership, phone number, email or anything else - that's all by design.

I mentioned there are other modern alternatives (for example there's Session) and I wouldn't hesitate to recommend them if I knew more about them both technically and otherwise. I'm also aware of Briar and another, smaller project, but it seems both of them are not blockchain based and require all parties to be online while messaging which is inconvenient and probably increases risks.

"Supports some feature" vs. "suitable for specific use case" are two very different things.

Does the foundation claim their application is suitable for such use cases?

They have no choice but to assist the government with whatever info they may have.

https://tech.hindustantimes.com/mobile/news/recent-court-fil...

I agree SecureDrop is complex (in fact I mentioned that in another comment). It's way more complex than sending a file with Signal or other modern privacy apps, but at least all parts are private and secure (as far as we know) so it's up to the user to not make mistakes. With Signal we know that Signal itself may be compelled to provide details on you and I think that's why they shouldn't recommend their application for such use cases.

1) SecureDrop is secure and very well documented, but complicated to implement and use, which makes it much less secure than the sum of its parts

2) It could be simplified by sending documents using a message mixing system such as cMix [1] or alternatives. Tor can still be used, but a lot of the SecureDrop stack could be eliminated which would lower risks and increase the likelihood of receiving information.

Anyone who isn't an IT security expert should be scared shitless when going through the steps required to make SecureDrop work. Nine out of 10 people should know they'd make mistakes and many probably give up.

cMix is currently used by xx Messenger (https://elixxir.io/, OSS) and Speakeasy (browser-based, currently in Alpha, also OSS). A third party crypto wallet is evaluating it for transaction broadcast mixing, and some other potential use cases can be found at [2].

SecureDrop could be replaced by simple file send over Speakeasy once the Private File Transfer feature gets added later this quarter [3]. Until then, xx Messenger and Speakeasy are probably a safer way to chat (because it's harder to make a mistake), even if documents are later uploaded via SecureDrop.

If anyone wants to kick tires on Speakeasy: you can't use Incognito/Private Mode or Tor browser because it uses WASM. So just start a browser using a non-default profile without add-ons and connect with Socks 5. JS is required (WASM) but doesn't load external crap (and for that it can use Tor).

[1] https://xx.network/wp-content/uploads/2021/10/xxcMixwhitepap...

[2] https://xxfoundation.org/blog/xx-foundation-announces-the-xx...

[3] https://www.speakeasy.tech/roadmap/

Who ever told you Signal provides anonymity to the sender or recipient?

Of course they will, because their security and privacy features would be misleading and rendered useless by this legislation. They have no choice.

Resident crypto-haters can hate coin-based privacy networks all they want, but fully decentralized encrypted messaging will remain the only way to get E2EE private messaging and chat in free speech hellholes such as Iran, China, the UK, and the EU.

Those organizations have no entity that does business anywhere (including the UK), and doesn't need anyone's permit to make its endpoints accessible to anyone.

Gateway operators are paid to successfully process data (which they can do if they stay online, have a fast connection to the Internet, and so on - not a shitty Raspberry Pi)

Gateway operators are paid to store data

Gateway operators are paid to mix client-side encrypted messages and shred message metadata

Gateway operators are staking their nodes to ensure cryptographically correct operation

If you want to see more, spend some time reading how blockchain-based networks with incentives work.

That is a laughable claim. What happens if no one pays?

In most jurisdictions you're supposed to report it to the police, so that they can identify who has accessed it and who attempts to access it next.

No, which is why it lacks incentives i.e. no economic reason to run relay nodes to store and transmit data.

> But this isn't an alternative to Mastodon or Twitter, it's an alternative to Berty, Cwtch, Speek, Briar, Anonymous Messenger, and maybe Matrix

And (not maybe) xx Network.

Nostr isn't an alternative to these messaging and chat apps because it has weak anonymity and privacy. Take a look at how those other apps/platforms work, and then compare them with Nostr.

> As such, it comes to no surprise that the free speech warriors from the crypto community are the main drivers of this protocol.

Nostr has weak privacy protections compared to most of of the above mentioned platforms, so I don't think it's something free speech advocates should feel comfortable promoting - anyone who truly needs free speech and uses Nostr won't last long.

Nostr "relay" nodes have no economic incentive to relay and store data.

Because of that, authors and readers of least popular opinions - which may be legal content that's censored elsewhere - are most likely to be easily identified and tracked.

No incentive to store data, no incentive to relay data, weak privacy, no censorship resistance, relay nodes may be legally responsible for knowingly relaying data from accounts censored by the rest of the network, etc.

For Nostr relay nodes it's like running a Tor Exit node where you may be the only exit node for illegal content.

And for users it's like using Tor to browse the Internet thinking your metadata isn't being captured, without knowing there's just 1 or 2 exit nodes out there.

There are no privacy and pseudo-anonymity advantages over "Twitter over Tor".

Yes.

Blockchain-based OSS regularly gets negative comments here on HN, but they do implement such workarounds (personally I think xx Network is well-protected), as do non-blockchain based Open Source projects. The problem for the latter is no funding for devs and independent, decentralized infrastructure.

The users shouldn't use Storj if they mind the possibility of this happening.

Projects like Crust (decentralized encrypted interface to IPFS), for example.

https://medium.com/crustnetwork/crust-devlog-nov-16th-nov-30...

And if you exchange messages and "links" to your files using a network for private messaging (such as xx Network), it's hard to know who is using Crust.

Without decentralized and private data (such as Crust) storage and messaging (such as xx Messenger, Speakeasy) to be able to privately convey information about download links, for users in the West it's safer to encrypt content client-side and upload it to Yandex object storage.

Edit: see https://news.ycombinator.com/item?id=34193555 (comment in this thread) where a Storj dude says if links are shared then there's no privacy, there's only encryption:

> Storj can’t access data without the data owner sharing keys and access!

In the example I provided, messages on xx Network are encrypted by distributed, privately owned cMix nodes. There are no logs that say "this user or IP sent or received a message from that user" (let alone what was in it).

As another comment points out, xx Network developers could theoretically be ordered to release an update that would weaken or remove privacy but the network isn't developed by a US or EU company and that wouldn't work for past messages in any case.

- Don't use WhatsSignalGram if it's incorporated in a country where this is possible

- Don't create a platform where arbitrary changes can be made

- Don't use a platform which can make arbitrary changes that decrease privacy

It amazes me that people try to read this stuff, and even worse, tend to believe some or all of it!

Last time I checked shitposting on social media wasn't mandatory for the average person, and employees who didn't like their job or thought they weren't paid enough could quit.

Am I missing something?

Yes, it's got critical mass.

I haven't looked at Telegram's blockchain thing yet, but the non-blockchain version is not very private (and the same applies to Signal).

xx Messenger (https://elixxir.io/; source https://git.xx.network/elixxir/) has very solid encryption, metadata protection and decentralized gateways. But it's less polished, blockchain-based, and has few users.

People complain about the use of blockchain in messengers, but they offer no solutions on how to address app sustainability or eliminate metadata centralization, censorship, or risk of having your data handed to the government by the organization running the network. We'll see how sustainable your centralized donation-ware is.

Btw somebody mentioned "only" 1:1 encrypted chats: who does it better? xx Messenger can do group chats but you can't add people to a chat after the group has been created.