Hacker News Reader

Comment by mehrdada | Hacker News Reader

The only tool that's free software and doesn't use shady crypto at the moment seems to be Signal (TextSecure) which is not a great messaging app UI-wise. Perhaps a couple more do exist as well, but I don't see a plethora of actually secure tools around. Remember, Telegram and similar crap do not actually count as secure tools.

Therefore, I disagree. There is still no tool with iMessage-quality UI that facilitates messaging and has an explicit key exchange step that a journalist can easily use, so please carry on with writing usable secure messaging/encryption tools or contributing to the existing one(s?).

View on HN

I want a WP, browser and desktop based version of Signal. I use it on my phone and it's good enough, but I need an integrated experience with my computer.

I really don't think people should write new tool, but contribute to existing ones, otherwise we'll end up with a fragmented space that no one uses.

My point is, I think the area is too immature at the moment and needs a lot more innovation before we call for standardization.

Security in particular is an area that often requires breaking away from compatibility (not just in the technical sense, but in the social and network sense as well) to actually work. I worry that we would lose great ideas if we call for standardization too early and stick to the way we do things today, which sucks.

(Also, empirically, fragmentation in other domains, even relatively late in the game, like social networks did not prevent from one clear winner to emerge. I don't see fragmentation as a big issue long term. Perhaps it's even good to some degree for security.)

Perhaps the conclusion is that we need to focus on a proper secure implementation of the underlying communication. If a standardized decentralised p2p communication overlay network exists, we can build tools on top of that, including IM and practically any other tool that can be implemented with messages.

Why isn't there a tool with iMessage-quality UI? I find it hard to understand why the demand is not being met. Could it be that a core tenet of a secure app is being open source and open source is less profitable, thus removing incentive. The article suggests it is because efforts are fragmented, which ostensibly is true. Maybe a combination of the two? What am I missing?

This [...is less profitable, thus removing incentive] is probably true, unfortunately. I personally seriously considered this space and actually wrote a quite complete prototype with this exact goal more than a year ago, but eventually decided to not move forward with it at the time. One problem is that it is really hard for an average user to distinguish BS security claims from proper crypto. An average user would likely consider Snapchat to be more secure than an E2E app.

Mulling on this a bit more - the profitability is further impacted from the inability to mine customer data on a secure app. Anecdotally, when presented with a free unsecure app vice a paid secure app, average Joe will go with the free app. Maybe there isn't a true demand like eps mentions

Because, realistically speaking, there's no notable demand.

On iPhone, is it even possible to distribute software that's open source in the sense of being verifiable? It's all binaries coming from a central server. And the operating system code is secret. Maybe all your keystrokes are sent directly to Obama so he can scan them for terrorism.

It is now possible to compile your own binaries and deploy it yourself without paying $99.

As for trusting the OS, it is true, but I would argue it is no better than running on an Android phone that you don't compile and deploy the OS for. There can be a hardware backdoor in your phone too. At some point, you will have to trust your infrastructure to a degree.

Yeah. I guess if you have Xcode installed it's even quite easy. Of course, push notifications won't work.

It's hard to trust anything after Snowden. I don't know why my smart phone wouldn't be spying on everything I say. If not now then next year.

Maybe for messaging, what's most important is decentralized anonymity. We can use code language to conceal secrets. For actual documents, we can use more trustworthy platforms, at the very least ones with non-secret operating systems.

I'm often wondering if something like a mixture of the organizational setups of e.g. the Mozilla foundation, Kickstarter and Wikipedia could work for efforts like these?

Companies are the de-facto vehicle to do something interesting and worthwhile together while making a living out of it as well.

Why not take that some steps further and divorce the concept from the often more mindless than not "we have to make a profit!" shareholder value yaddayadda...?

> Signal (TextSecure) which is not a great messaging app UI-wise.

I've been using it recently on android and it seems nice, are there some nice UI things I'm missing but don't expect to have? Maybe some other problems I've not run into?

Don't know about the Android version, but the iOS version repeatedly crashed on me and was nowhere as nice as iMessage to be honest.

The main problem I have with Signal is that it's funded by the US government (see https://news.ycombinator.com/item?id=8106721), which was the main reason for me to switch to Threema.

wow, wasn't aware of that. certainly doesn't inspire confidence. will check out threema right away.

Reply on news.ycombinator.com