Privacy

33560 readers

360 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS

[email protected]

154

Signal Server is effectively closed source software right now (lemmy.ml)

submitted 4 years ago by [email protected] to c/[email protected]

133 comments fedilink hide all child comments

The Signal Server repository hasn't been updated since April 2020. There are a bunch of links about this here but I found this thread the most interesting.

To me, this is unforgivable behaviour. Signal always positioned themselves as "open source", and the Server itself is under the best license for server software (AGPLv3 -- which raises questions about the legality of this situation).

Signal's whole approach to open source has constantly been underwhelming to say the least. Their budget-Apple attitude (secrecy, i.e. "we can never engage the community directly", "we will never merge/accept PRs", etc) has lead to its logical conclusion here, I guess. I have been somewhat of a "Signal apologist" thus far (I almost always defend them & I think a lot of criticism they get it very unfair) but yeah I'm over Signal now.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] -3 points 4 years ago (2 children)

What about Tox?

[–] [email protected] 4 points 4 years ago* (last edited 4 years ago) (2 children)

I had high hopes on Tox, but now a days I no longer do. Its security status hadn't change for a while: https://github.com/TokTok/c-toxcore See there:

This is an experimental cryptographic network library. It has not been formally audited by an independent third party that specializes in cryptography or cryptanalysis. Use this library at your own risk.

The underlying crypto library NaCl provides reliable encryption, but the security model has not yet been fully specified. See issue 210 for a discussion on developing a threat model. See other issues for known weaknesses (e.g. issue 426 describes what can happen if your secret key is stolen)

And the 2 issues highlighted there are scary:

https://github.com/TokTok/c-toxcore/issues/210

https://github.com/TokTok/c-toxcore/issues/426

To me experimental, as highlighted in the github repo, is not enough, as mentioned in the 2nd issue.

I really had high hopes on Tox, given its peer-to-peer distributed nature (much better to me than just decentralized by self hosting or so) but I don't see it improving unfortunately...

Briar is similar, but a 3rd party is just adding support for desktops, and as well as Tox, and I'd guess as any peer-to-peer distributed messaging mechanism, it's really battery hungry, and phones don't survive even half a day with them active. I don't like Briar's reliance on Tor btw: https://briarproject.org/how-it-works

And on such peer-to-peer distributed systems, it seems really hard to get multi-devices support or syncing. But I'd guess there's no other choice for some people other than Briar. I'm still looking for a distributed peer-to-peer messenger, not consuming the whole battery at least in a day, and that somehow, through mechanisms like the one keybase uses, allow some sync between devices... But the most important thing of course is battery life... Hopefully supporting as well voice/video calls, and some other common stuff to avoid needing other meesengers to support them...

[–] [email protected] 0 points 4 years ago (1 children)

qTox

[–] [email protected] 2 points 4 years ago* (last edited 4 years ago)

qTox is just a desktop client. The Tox protocol implemented by c-toxcore is the one with security issues. BTW, part of the issue is precisely that the Tox protocol is not an e2ee one, and in one of the issues referred the axolotl protocol is shown as an example... So, no matter the client, the Tox protocol is lagging behind in terms of security.

[–] [email protected] -2 points 4 years ago

Oh, I hope it improves. Personally I want my IM client to send and receive e2ee text. Rest should be handled by other programs.

[–] [email protected] 0 points 4 years ago

Tox has a terrible security track record. At the same time, developers are still making wild claims that Tox can protect your from nation-state sponsored attacks:

Whether it's corporations or governments, digital surveillance today is widespread. Tox is easy-to-use software that connects you with friends and family without anyone else listening in.

This is not a code problem.