Hacker News Reader

Comment by deepstack | Hacker News Reader

https://app.wire.com already has that feature and it is based on signal protocol.

Wire uses MLS [1], it has nothing to do with the Signal protocol.

[1]: https://messaginglayersecurity.rocks/

afaik Wire works on MLS like many others do - but according to Wikipedia Wire uses the Signal Protocol. Your "source" does not back up your claim

I just read the Wikipedia page and it says, emphasis mine:

> Wire's instant messages are encrypted with Proteus, a protocol that Wire Swiss developed based on the Signal Protocol.

That doesn't sound like "Wire uses the Signal Protocol" to me.

Has it been audited by external, independent security researchers?

https://wire.com/en/security/#audits

Yes, with published reports, but it looks like they haven't published new ones in a few years.

Yes, it's open source and anyone can look at the source code instead of appealing to authority.

That's not what I asked. Generally laypeople are not going to be good judges of whether or not an encryption protocol is sufficiently secure.

Has it been audited by security researchers?

You're assuming it takes considerable skill to fuzz an algorithm or look for back doors and easter eggs? To answer your question, I don't know if Wire's been audited by paid researchers. I personally prefer a customer-exposed product whose each commit you can look up rather than the remote promise of security in a locked and hidden program.

> You're assuming it takes considerable skill to fuzz an algorithm or look for back doors and easter eggs?

This is usually a good assumption.

Why can't it be both?

Bitwarden is open-source (both the server and clients) AND has been independently audited for a security review.

It is not impossible to create code which looks like it does one thing while simultaneously doing ya-mother.

http://underhanded-c.org/

"look" is a weak word. Anyone with eyes can look.

Reply on news.ycombinator.com