antisocialist

> Now, there exists a minority of extremely technical computer user for which Signal is a nonstarter (because you need a smartphone and valid phone number to enroll in the first place). > there presently isn’t really a good recommendation for private messaging that meets their constraints.

You don't need a phone number or a phone for https://haven.xx.network and there are others.

If nothing is recommended, fine, but it's simplistic to not recommend or even consider the 3-4 apps that don't have those limitations. If you didn't have time to investigate or couldn't find anything else, say so.

Not if you disable your IPv6 stack.

Or you can be smart and "easily" address such probing attacks in your FW rules... https://nvd.nist.gov/vuln/detail/CVE-2024-50252

That's interesting - it turned out markets, as distorted by Obamacare and so on as they are, weren't off by a lot.

He couldn't find services he needed and decided to build it himself. But after many years of trying he couldn't build a sustaining biz that provided such service.

It may be valid against closed source apps, but I don't see how it can be more secure than build-and-self-host OSS apps for private messaging.

They say don't roll your own encryption protocol (if something similar or same already exists and it's maintained), but these guys just can't resist.

Using a secure decentralized messenger to share a download (or upload) location on a Hidden S3 Service or one of those decentralized S3 services can't possibly be worse than this.

To commenter in https://news.ycombinator.com/item?id=40289777: BitMessage doesn't solve anything, it uses broadcast and Bitcoin peer nodes that first get the message know where it came from. And BitMessage is not an illegal content hazard of any kind (what a ridiculous statement!).

Yep, whoever gets hold of those records can cross-reference logs from the same time to narrow down or even outright identify Signal chat participants.

In other words, Nostr can't do almost anything that matters.

> First, I want a replication strategy.

xx Network has message replication built in.

> Third, someone needs to delete some of these NIPS.

xx Network lets you delete messages.

> Fourth, it needs a dedicated blob store protocol.

For blobs, clients should be able to plug in to any 3rd party blob storage (e.g. Crust Network). This secondary storage is needed only for large attachments and isn't strictly required in messaging. If you think about it, you could upload large attachments anywhere and send links in messages. Look how Teams or Outlook work with One Drive.

Okay, let's think about this:

- Signal has stated they'll withdraw from the EU rather than cooperate

- That means the app won't exist in the official EU app stores (iOS, etc.). Users will have to load the app on their own (which 95% of users won't do)

- Next, because Signal is no longer providing services, Signal's EU gateways will not be operational. Now your messages are encrypted, but I've no idea if your Signal connects at all, and where (Signal gateways in some Five Eyes country, perhaps?).

tldr; you're still leaking metadata, and now to a country that has no obligation to not track your metadata (your IP, when you sent message, who received message around the same time, etc).

My suggestion would be get a proper decentralized messenger rather than spend time on these workarounds of questionable value.

I always get down-voted for "shilling", so I won't even make any suggestions this time. DYOD!

Supposedly it's about the children. Sao Paulo solved the problem:

> Many Brazilian states didn’t wait for the federal response. Sao Paulo, for example, temporarily hired 550 psychologists to attend to its public schools, and hired 1,000 private security guards.

https://apnews.com/article/brazil-school-violence-guns-attac...

This is what disgruntled poor people did in China, too, used a $5 hatchet. You don't even need to be able to afford a gun .

I don't see a (neo)Nazi angle in that crime, though. There's no clear motive for the attack yet and no connection to Telegram either (based on coverage in DW and The Guardian), so I'm guessing Lula is simply trying to crack down on free speech.

Users who want private comms with encryption and metadata cleansing can use decentralized blockchain based services such as xx Network's xxMessenger. xxMessenger can be blocked by the ISPs by blocking outgoing connections to xx gateways, but desktop-only Speakeasy Tech can use Tor Network (Tor Browser's Socks5 proxy or Arti) so it's likely to work better when telcos and ISPs are ordered to block connections or DNS lookups. There are other, similar networks, I just don't know enough about them to make specific recommendations.

Disclosure: I own xx coins.

I agree. The web app itself can run locally in QubeOS or Docker, and the browser using it as well.

"Supports some feature" vs. "suitable for specific use case" are two very different things.

Does the foundation claim their application is suitable for such use cases?

They have no choice but to assist the government with whatever info they may have.

https://tech.hindustantimes.com/mobile/news/recent-court-fil...

I agree SecureDrop is complex (in fact I mentioned that in another comment). It's way more complex than sending a file with Signal or other modern privacy apps, but at least all parts are private and secure (as far as we know) so it's up to the user to not make mistakes. With Signal we know that Signal itself may be compelled to provide information about its users and I think that's why they wouldn't recommend their application for such use cases.

Who ever told you Signal provides anonymity to the sender or recipient?

Of course they will, because their security and privacy features would be misleading and rendered useless by this legislation. They have no choice.

Resident crypto-haters can hate coin-based privacy networks all they want, but fully decentralized encrypted messaging will remain the only way to get E2EE private messaging and chat in free speech hellholes such as Iran, China, the UK, and the EU.

Those organizations have no entity that does business anywhere (including the UK), and doesn't need anyone's permit to make its endpoints accessible to anyone.

Gateway operators are paid to successfully process data (which they can do if they stay online, have a fast connection to the Internet, and so on - not a shitty Raspberry Pi)

Gateway operators are paid to store data

Gateway operators are paid to mix client-side encrypted messages and shred message metadata

Gateway operators are staking their nodes to ensure cryptographically correct operation

If you want to see more, spend some time reading how blockchain-based networks with incentives work.

That is a laughable claim. What happens if no one pays?

In most jurisdictions you're supposed to report it to the police, so that they can identify who has accessed it and who attempts to access it next.

No, which is why it lacks incentives i.e. no economic reason to run relay nodes to store and transmit data.

> But this isn't an alternative to Mastodon or Twitter, it's an alternative to Berty, Cwtch, Speek, Briar, Anonymous Messenger, and maybe Matrix

And (not maybe) xx Network.

Nostr isn't an alternative to these messaging and chat apps because it has weak anonymity and privacy. Take a look at how those other apps/platforms work, and then compare them with Nostr.

> As such, it comes to no surprise that the free speech warriors from the crypto community are the main drivers of this protocol.

Nostr has weak privacy protections compared to most of of the above mentioned platforms, so I don't think it's something free speech advocates should feel comfortable promoting - anyone who truly needs free speech and uses Nostr won't last long.

Nostr "relay" nodes have no economic incentive to relay and store data.

Because of that, authors and readers of least popular opinions - which may be legal content that's censored elsewhere - are most likely to be easily identified and tracked.

No incentive to store data, no incentive to relay data, weak privacy, no censorship resistance, relay nodes may be legally responsible for knowingly relaying data from accounts censored by the rest of the network, etc.

For Nostr relay nodes it's like running a Tor Exit node where you may be the only exit node for illegal content.

And for users it's like using Tor to browse the Internet thinking your metadata isn't being captured, without knowing there's just 1 or 2 exit nodes out there.

There are no privacy and pseudo-anonymity advantages over "Twitter over Tor".

Yes.

Blockchain-based OSS regularly gets negative comments here on HN, but they do implement such workarounds (personally I think xx Network is well-protected), as do non-blockchain based Open Source projects. The problem for the latter is no funding for devs and independent, decentralized infrastructure.

- Don't use WhatsSignalGram if it's incorporated in a country where this is possible

- Don't create a platform where arbitrary changes can be made

- Don't use a platform which can make arbitrary changes that decrease privacy

It amazes me that people try to read this stuff, and even worse, tend to believe some or all of it!

Last time I checked shitposting on social media wasn't mandatory for the average person, and employees who didn't like their job or thought they weren't paid enough could quit.

Am I missing something?

Yes, it's got critical mass.

I haven't looked at Telegram's blockchain thing yet, but the non-blockchain version is not very private (and the same applies to Signal).

xx Messenger (https://elixxir.io/; source https://git.xx.network/elixxir/) has very solid encryption, metadata protection and decentralized gateways. But it's less polished, blockchain-based, and has few users.

People complain about the use of blockchain in messengers, but they offer no solutions on how to address app sustainability or eliminate metadata centralization, censorship, or risk of having your data handed to the government by the organization running the network. We'll see how sustainable your centralized donation-ware is.

Btw somebody mentioned "only" 1:1 encrypted chats: who does it better?

xx Messenger can do group chats but you can't add people to a chat after the group has been created.

Landline is even worse. Do they rent burner landlines?

xx Messenger also doesn't require any identification. And unlike Threema:

- it's open source (https://git.xx.network/elixxir/); Android users can build it on their own and load from F-Droid

- it uses blockchain

- no big attachments for time being, but once they come (in 2 months, I hope) they'll be affordable and stored encrypted on IPFS

- no data collection of any kind

- (my guess) better privacy and security

- less polished

- optionally searchable by in-app nick or phone number, or not, in which case you get a cryptographic ID. Identity can be backed up to SFTP and restored from it

Unlike Telegram, xx Messenger app has a publisher, but the app can be installed independently (F-Droid) and there's no centralized entity that runs messaging gateways that can deliver any data about your identity or communications.

Not related to parent comment, but I see some people are bitching about the use of blockchains as if they've figured out a way for Signal or Telegram to provide for their messaging needs without selling ads or metadata.

If funding free messengers was easy and blockchain merely a distraction, Signal wouldn't have those pop-ups that reminder you to donate.

I just checked their Web sign-up page at https://www.tchap.gouv.fr/#/register: "This password is too weak. It must include a lower-case letter, an upper-case letter, a number and a symbol and be at a minimum 8 characters in length."

If eight chars is the minimum, guess how complex and secure are most of Tchat users' passwords :-)).

Telegram is convenient, the bot feature's great. But some things about it suck and they're prone to government interference privacy-wise.

One of the more recent E2EE private messaging apps with metadata shredding and no registration requirement for is https://xx.network/messenger

It's available for Android & iOS.

F-Droid users can build Android version from the source (https://git.xx.network/elixxir/) and load it themselves.

There's no registration and the app doesn't collect your phone number, device ID and similar crap. Is it mature and polished? No, it has its quirks and rough corners. But it won't let you down on security and encryption.

No.

You can't deprecate a project on its Github page if you can't access it. That's even mentioned in a comment from the page you submitted (but perhaps didn't bother to read).

> There's no one around to merge PRs, so it's not possible to add a note to the Readme.

When something is shared one of frequent questions is how it compares to something else. I provided information relevant to potential users.

If you had something useful to say regarding OP or my comment, that'd be fine. What are your comments (yours and the one your responded to) if not comment spam?

If you don't like a comment and have nothing to say on the topic, feel free to downvote it, hide it and/or move on.

Last time they tried to roll their own secure messaging (Tchap based on Matrix), it was a disaster.

https://techcrunch.com/2019/04/19/security-flaw-in-french-go...

Secure messaging doesn't have to be that lousy. Download XX messenger from your phone app store, or build it yourself from source.

https://xx.network/messenger/

Awesome idea.

You'd have no idea how many accounts they have, who they're talking to, and about what. Perfect privacy!