News for hackers. Stuff that matters.

throwaway1023

Re:Privacy is Power: Why the fight for privacy matters on Wednesday February 08, 2017 @10:47AM (#13599104)
Please DON'T recommend Signal.

Signal is nearly as bad as other messengers: They get your metadata, your contact list (the hashing is reversible, they even state so), and they don't do federation (= support other peoples servers). They don't even want other implementations of the Signal-Protocol to use their servers, which would cause a huge fragmentation of the user base even if someone implemented an alternative.

The solution? The protocol "Omemo" looks promising: It doesn't require Google Cloud Messaging on Android to implement some power saving features, it sits on top of XMPP which has features like groups or sending images, and it does Multi-Device support while still providing good encryption and deniability (OTR-like). Because it's just XMPP, you can use any Jabber-Server you want (your own, too), as long as it supports some newer fancy features (avatars might be needed, and image uploading if you want that, probably). This means your metadata should be less centralized than with Signal, Telegram or WhatsApp.

SecureChat and Conversations.im already support this protocol, so mobile phones and tablets have good candidates for installation. For PC, pidgin and gajim are beginning to have some prototypes for Omemo plugins out.

Check out https://omemo.top/ and https://conversations.im/omemo/ for more info.

I've personally tried conversations.im (I bought it. It's free and open source if you get it via fdroid or if you build it yourself) with friends and it works ok (single user + group chat). One of my friends used SecureChat on his iPhone and it seemed to work, too. Checking keys in conversations.im could be easier and the scanning function needs an app that requires too many privileges for my taste. It also seems like you need to announce your presence on Jabber if you want to add someone new (and they need to do so, too), but I'm not 100% certain about that. I haven't tested using multiple devices with the same account yet, but a friend told me that the plugins for Gajim and Pidgin weren't really working with that at the moment.

I really hope Omemo solves the messenger problem once and for all. It's 2017, after all.

Re:Is the Linux Desktop less secure than Windows 10? [pdf] on Monday February 06, 2017 @07:34AM (#13578856)
Just a small comment on why the desktop environment might need to parse such a file: How about sorting music files according to their real length? Many desktop environments support such a feature, and users like those features, too.