Hacker News Reader

Comment by nlitened | Hacker News Reader

I remember that Skype, before it was bought and ruined by Microsoft, had P2P chat history sync that worked the following way: once two of your devices were online at the same time, they synchronized chat history among the two running instances flawlessly. It was super reliable and predictable.

I am sure that Signal could implement the same peer-to-peer sync scheme with full end-to-end encryption without any secrecy compromises.

View on HN

Pre-MS skype was so far peak IM.

Don't forget about when IM networks actually used open standards instead of closed proprietary protocols. Managing all of my accounts through pidgin was a breeze, and didn't leave me swapping between half a dozen different programs trying to remember which networks somebody would typically use.

That was never a thing: Pidgin & the rest had to write their own implementation for many of those protocols, starting with AIM.

There was a tiny period, somewhere in 2006, when many services were XMPP, maybe even federated, but due to the lack of good clients - compared to skype -, it never manifested as good as it should have.

There are now many nice XMPP clients, but the big players now all moved into proprietary territory.

Good point, I am misremembering.

I also remember a period in time when I could use Trillian to connect to ICQ, MSM, AIM and have it all in one convenient chat client without having to fire up all the individual ones. Granted it sometimes broke when the protocols updated, but for a moment it was pretty cool.

This is actually working very bad in most practical situations. The way to go is Telegrams way, where you store all data on the server and happily sync ut easily between devices. Just do it on your own server using xmpp. E2ee helps mostly against server owner, and you eliminate this risk by being your own server owner.

You run your own datacenter?

XMPP is extremely light, you can use a moderately powered personal computer to handle traffic from several users. I don't have the numbers with me but last I'd heard, the number was in the hundreds.

ejabberd can host ~2k active connections on $2/month server.

Where can I get this $2/month server?

The nice thing about client-side/end-to-end security is that the service provider matters less.

Also, $2/month is $2 more than many people would be willing to pay for private messaging, and I can't message people on a network they're not on, no matter how much I pay.

Ionos.com

And if you're privacy is worth less than $2/month, just use Telegram. It works way better than these messenges obsessed with privacy, precisely because it does not have encryption for most messages

> Ionos.com

That looks a lot like a server hosted by somebody else in a data center.

It's also way more hassle than almost all of my contacts would be willing to go through, and if only I self-host but they don't, it'll be Gmail all over. (Almost all emails go through Gmail because that's what at least one of the parties in an exchange is likely using.)

Point-to-point encryption is not enough for messaging in today's network topology.

> just use Telegram

No thanks, I'll continue using one actually spending some effort on not being able to read the messages their users send.

Fortunately most people in my country do. Ironically it's only a couple of people in my circle of friends worried about the privacy of said messenger switching to Telegram "because it's encrypted"...

> E2ee helps mostly against server owner, and you eliminate this risk by being your own server owner.

Unfortunately you only eliminate it by being your own server owner _and_ your recipient being their own server owner. Take a look at email: I might not want to use e2ee because I self-host, but the second I send an email to a friend hosted on gmail, Google gets all the content.

I think federation does have its place (for different reasons) but it unfortunately isn't enough for privacy.

> Just do it on your own server

What if I don't have and don't want my own server?

One of the features of the Signal protocol is that each message is signed with a different key so that if one message is somehow compromised it's still impossible to retrieve the others. I think this would break with P2P sync.

First people want full security, but when they encounter inconveniences that come with true full security, they start wanting convenience. What works best is a very very very good promise of security without e2ee, as shown by Telegram. It's users just know that Telegram is the most protected messages, and they are happy with it's advanced features.

Your Signal client has all the messages stored unencrypted (this is true because you can read them all, and search all the local messages).

What's preventing the client from dumping all the messages to a single file, encrypt it with a public key of the other running instance of Signal logged in to the same account, and send it, so that your other device can decrypt the file and import all the messages?

Reply on news.ycombinator.com