Hacker News Reader

Comment by foobarbazetc | Hacker News Reader

Don’t suppose anyone knows why the Signal protocol wasn’t chosen?

Because Signal is centralized. With Matrix they can deploy different servers across the gouvernement which interoperate. And potentially open it to the wider Matrix ecosystem

Signal, the service is centralized, but there's no reason that Signal, the protocol can't be. In fact before Moxie went on his silly "only I can do security right" rampage, Signal was federated with a server hosted by CyanogenMod.

The E2EE in matrix is actually based on the double ratchet from the Signal protocol. So you could think of the E2E in matrix as just a federated version of Signal. :)

A point in moxie's favor is that the e2ee ux in matrix is currently extremely painful. I'm willing to use it on a couple rooms that consist entirely of geeks, but don't want to subject non-geeks to the whole verification process.

Not only UX, but there seem to be some subtle timing (in non-crypto/non-security meaning) issues.

I ran Synapse on a resource-limited machine, so it had sort of "lagged behind" (or something like that) a little bit now and then. And I saw a number of "error decrypting image" and similar issues. It had self-resolved somehow after a while (saw the message decrypted the next day) but that's still a problem.

Haven't reported this because I have no idea how to collect any useful information.

Why do your non-geek friends have to verify? None of mine do.

>In fact before Moxie went on his silly "only I can do security right" rampage

Do you have link or source for that? (I'm always interested in listening or watching stuff from Moxie)

Probably https://signal.org/blog/the-ecosystem-is-moving/

>Nothing about any of the protocols we’ve developed requires centralization; it’s entirely possible to build a federated Signal Protocol-based messenger, but I no longer believe that it is possible to build a competitive federated messenger at all.

Moxie is probably annoyed by the slow pace in which federated protocols move. Having it centralized he can move it a lot faster.

Fortunately there are solutions that incentivize modern features in federated protocols too, like SSLLabs HTTPS checker or https://conversations.im/compliance/ for XMPP.

The posts that really left me disappointed are:

https://signal.org/blog/the-ecosystem-is-moving/

https://whispersystems.discoursehosting.net/t/how-to-get-sig...

https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

I suppose "only I can do security right" is perhaps overly harsh, but my take away was that he considered a walled garden that could be iterated on by his team preferable to allowing even forks of his team's own client to communicate with users on the OWS network.

Because when you build something like this, you shouldn't:

- requiere a phone

- build on s3 & a lot of other services without the option of a self hosted alternative.

Look up the signal server requirements.

Yup. Signal sounds great but I can't use it because I don't have (or want) a smartphone with a phone number. I use Matrix clients instead.

Reply on news.ycombinator.com