Hacker News Reader

Comment by solaarphunk | Hacker News Reader

Its WeChat. Did she really feel like she had a guarantee of anonymity using a Chinese messaging app? That seems seriously naïve.

View on HN

WeChat didn't use end-2-end encryption at all, at least up till 2016. [1]

[1]: https://cointelegraph.com/news/skype-wechat-snapchat-thrashe...

At this point, what messaging app is truly OTR? Signal doesn’t allow third parties to build the source, Telegram is compromised for sure, same with WhatsApp.

> Signal doesn’t allow third parties to build the source

No. Signal is GPLv3.

They don't allow third parties to distribute modified binaries that connect to their servers. You can argue if that is a good idea, but don't misrepresent the situation.

The only way I can get a Signal binary is through OWS. Why should I trust them?

The whole spirit of GPL and FOSS is to be able to examine the source, modify it, and distribute it freely. It’s a form of DRM to restrict who can and cannot distribute the Signal binary.

That's... that's really weird. I definitely argue that it's not a good idea, and I'd also argue it puts quite a few nails in the coffin in terms of my trusting it as a good protocol.

Maybe this is an unpopular opinion, but IMO the fact that Facebook "trust" it means that I have a lot of reserve about using it myself.

It's not that weird from their point of view. "I was using Signal, but my messages were intercepted anyway" - "But were you using original Signal, or a third-party build with ads and malware?"

(if that's the rule anyway - I couldn't find confirmation for that)

Additionally, you end up with crap like Noise (a Signal fork that uses the main servers) where features inconsistently work or are available and the devs of Noise don't actually pull down new code very often, resulting in a two tiered network that has many unreliably working features.

Hence why Moxie doesn't think federation is practical with an evolving communications protocol.

Good point. This is really hard :/

Ok so they can build them but they can’t use them. I think the OP’s hyperbole might be excused.

You say that, but Noise and Signal-CLI work just fine. Not that either actually keeps current with features, which is mainly why Moxie has stated he doesn't like people using unmaintained forks of Signal on OWS's servers.

One that’s open source, on servers and devices only you and your correspondents control. Or you could speak face to face.

I recommend matrix[1] which has a fairly nice set of clients in Riot[2]. It's better than OTR in that it supports e2e group chat and multiple devices.

[1] https://matrix.org [2] https://riot.im

I think Riot has a terrible UX with respect to key management in group chats.

Can I have a chat with you about this? I'm looking to help Riot improve their UX

Yeah no worries. I'm @arj:matrix.org, or if you want to try other avenues my keybase profile is listed in my hn profile

Reply on news.ycombinator.com