[HN Gopher] Secure Messaging, Anywhere
       ___________________________________________________________________
        
       Secure Messaging, Anywhere
        
       Author : Tomte
       Score  : 117 points
       Date   : 2021-06-27 06:26 UTC (16 hours ago)
        
 (HTM) web link (briarproject.org)
 (TXT) w3m dump (briarproject.org)
        
       | edent wrote:
       | Can this work just as IM over Bluetooth? I've often wanted to
       | message people who are nearby, but with no WiFi (e.g. trains,
       | planes, and conference halls).
        
         | southerntofu wrote:
         | I haven't tested it, but that's precisely what it's supposed to
         | do, using a kind of gossip protocol.
        
         | older wrote:
         | It does. I use it exactly the way you described. Biggest issue
         | for me is that it is impossible to transfer existing account to
         | another device, so you lose all your contacts on anew device.
        
           | southerntofu wrote:
           | While not exactly as straightforward i assume you can back it
           | up from a device using standard adb commands.
        
           | ohazi wrote:
           | Neat. I remember wanting something like this years ago when a
           | friend and I were on the same flight but we're sitting ~10
           | rows apart.
        
         | smeej wrote:
         | I've also connected one phone to another phone's WiFi in
         | hotspot mode, even though they didn't have an _internet_
         | connection over WiFi.
         | 
         | It allows you to send messages to each other P2P at slightly
         | longer range than Bluetooth.
        
       | quartzic wrote:
       | Anywhere except iOS, apparently
        
         | Jiejeing wrote:
         | iOS only has high market share in the US, even in other,
         | similarly rich western countries, Android dominates.
         | 
         | Additionally, iOS prevents you from keeping a background
         | connection, which means anything else than polling or (apple-
         | controled) push notification is a no go. Briar mostly works
         | through Tor, which cannot work properly on standard iOS, due to
         | the previously described limitations.
         | 
         | If you want software on iOS, complain to apple about their dumb
         | policies, not on HN comment threads.
        
           | teorema wrote:
           | Yes, here you have Briar bumping up against the inability to
           | run _any_ fully decentralized mobile communication software
           | on iOS. Seems like a serious limitation on the part of iOS at
           | this point given trends towards decentralization in general.
        
             | Jiejeing wrote:
             | The worst part is that an inactive background TCP
             | connection is mostly free (of course, a Tor client is
             | slightly more involved), so there is exactly 0 reason to
             | forbid it, as long as apps are reviewed properly for
             | abusive behavior (they are not).
        
         | southerntofu wrote:
         | It's not their fault that you can't use programs of your choice
         | on iOS, that you have to pay Apple for a developer account for
         | submitting apps to the App Store, and that the App Store T&C
         | explicitly forbids free-software.
        
           | dariosalvi78 wrote:
           | There are several FOSS apps on the app store
        
           | pta2002 wrote:
           | Nitpicking a bit, but it doesn't. It forbids redistribution
           | of apps downloaded from the app store, which is a requirement
           | of the GPL, and so the app store "license" and the GPL (not
           | free software in general) are incompatible.
           | 
           | None of this matters much though because if you own the
           | copyright to the code you can relicense it however you want,
           | which is why VLC for example is on the app store.
        
             | southerntofu wrote:
             | Nitpicking a bit, but what works for a single association
             | like Videolan (editor of VLC) may not work for a program
             | that was developed by hundreds of contributors over the
             | years, who would all have to give their approval for a re-
             | licensing.
        
         | mmwelt wrote:
         | Yup[1], it's a pity because it will greatly reduce the network
         | effect needed to get enough people using the app.
         | 
         | [1]
         | https://code.briarproject.org/briar/briar/-/wikis/FAQ#will-t...
        
           | fishmaster wrote:
           | Many, _many_ more people use Android than IOS.
        
         | chrismorgan wrote:
         | I'd rephrase that: _nowhere_ except _Android_.
         | 
         | Android and iOS aren't the only games in town. Windows, macOS,
         | various Linuxes desktop, various Linuxes mobile, Firefox OS and
         | its successors...
         | 
         | I get fed up with things where your options are: (a) a
         | commonly-clunky web system where you have to log in, possibly
         | with tedious 2FA, every time you want to touch it, and (b) a
         | sleek task-focused Google-Android/iOS app where you don't.
         | Banking is an example of an area where this is the norm. I want
         | to use this improved process on a laptop, or perhaps on a
         | mobile device where I can't install their iOS or Google Play
         | Store app.
        
           | blendergeek wrote:
           | There is Briar GTK [0] that runs on Linux Desktop/Mobile.
           | 
           | [0] https://code.briarproject.org/briar/briar-gtk
        
         | Aachen wrote:
         | Last I checked it also doesn't support MS-DOS or Amiga. The
         | "anywhere" doesn't refer to OS support.
        
       | remram wrote:
       | How does this compare to all the other messengers that were on HN
       | recently, like Berty, Cwtch, Matrix, etc?
        
         | j-james wrote:
         | It's similar to Matrix's experimental Pinecone overlay network.
         | 
         | https://matrix.org/blog/2021/05/06/introducing-the-pinecone-...
        
         | mlok wrote:
         | It works with or without internet : Bluetooth is enough. Check
         | their "How it works" page.
        
         | [deleted]
        
       | dannyw wrote:
       | If your messenger doesn't support both ios and Android, it's DOA.
        
         | uselpa wrote:
         | I agree, iOS market share is too large to ignore. In that
         | space, Jami seems to be the better option at this point in
         | time.
        
         | pkphilip wrote:
         | That is not true. There are parts of the world where Iphone use
         | is quite low. For instance in India which is expected to have
         | more than 820 million smart phone users by 2022, the percentage
         | of IOS users is around 3%.
         | 
         | https://www.statista.com/statistics/262157/market-share-held...
         | 
         | In China with over 850+ million smart phone users, IPhone users
         | are about 13%. https://www.counterpointresearch.com/china-
         | smartphone-share/
        
           | nipponese wrote:
           | Can you name any "popular" messaging client that doesn't have
           | an iOS client?
        
         | Barrin92 wrote:
         | In this circle[1] where more than half of the world's
         | population lives, ios marketshare is probably < 10%.
         | 
         | [1]https://en.wikipedia.org/wiki/Valeriepieris_circle#/media/Fi
         | ...
        
           | tpush wrote:
           | The wealthiest (per capita) nation in that circle is Japan,
           | where iOS' market share is 67%.
        
             | xfer wrote:
             | If you think you are going to make money from a messenger,
             | you are in for a shock.
        
               | djrogers wrote:
               | Yeah, those WhatsApp investors sure lost their shirts...
        
               | huhtenberg wrote:
               | WhatsApp was doing well charging $1 off 100 mil users.
               | 
               | Regrettably selling off paid even better.
        
         | MikeUt wrote:
         | So Apple's choice of no-sideloading has, through network
         | effects, placed them in the role of arbiter of which messengers
         | are viable, restricting choice for even non-Apple users.
        
         | brnt wrote:
         | In the US.
        
           | zksmk wrote:
           | Yup. Android dominates globally, and IMO Briar's strong suit
           | compared to other similar messenger apps is avoiding both
           | capital surveillance AND state surveillance, or in other
           | words it's good for fighting autocratic regimes. The US isn't
           | really in the tier 1 target group. Yet.
        
         | approxim8ion wrote:
         | Like iMessage?
        
         | southerntofu wrote:
         | Nothing on the Briar side prevents anyone from developing an
         | iOS implementation of their protocol. Also not everywhere you
         | find iPhones, in my popular neighborhood i don't believe i know
         | people using iPhones (probably because nobody can afford it),
         | making your claim inappropriate.
        
           | pseudo0 wrote:
           | Even assuming that's true, surely people in your neighborhood
           | communicate with people outside of it, some of whom have
           | iPhones? That would mean using two different messaging apps,
           | an annoyance that most people won't want to deal with unless
           | the app has some sort of killer feature they can't find
           | anywhere else. Just from a quick look at Briar's site, their
           | main selling point appears to be security, which is a problem
           | when Signal is an established brand with multiplatform
           | support.
           | 
           | The local P2P aspect is cool, but seems like it would only
           | appeal to a very niche set of users.
        
             | saurik wrote:
             | > That would mean using two different messaging apps, an
             | annoyance that most people won't want to deal with...
             | 
             | FWIW, most "normal" people I know (as in, not technologists
             | who carry complex opinions about chat protocols and
             | applications in general) seem to just use a ton of
             | messaging apps to communicate with random people for
             | various purposes? They do have a friction with respect to
             | installing one they don't have yet, as it involves work
             | that maybe they can avoid, but everyone seems to have and
             | use and communicate using Facebook, Snapchat, SMS, and at
             | least one account (if not multiple) on each of Instagram
             | and TikTok. (Additionally, people I know who have
             | international contacts -- whether due to being
             | "professionals" or by way of family -- generally have
             | WhatsApp.) It really is only a few techies I know
             | (honestly, including me at times, though for what I
             | think/hope are slightly different reasons: my issues often
             | come down to how critical it is that I can have long-term
             | log retention in useful searchable mechanisms... a big
             | reason I refuse to use Signal as it doesn't even support
             | backup correctly on iOS) who seem to get sad about using
             | multiple apps (which should make sense, as if you know even
             | only two people who are super picky then they probably just
             | fail to communicate with each other at all because they end
             | up in disjoint cliques: your "neighborhood"--which needs to
             | include all your contacts, really, and so quickly knots
             | together with "the world"--isn't going to settle on a
             | single chat app... "normal people" find that level of
             | "sorry: I only use X" stubborn and a-pragmatic ;P).
        
             | jeroenhd wrote:
             | In my day to day life I use Telegram, WhatsApp, Google
             | Chat, Slack and sometimes Signal. Luckily, I've been able
             | to do away with Messenger, MMS/SMS, Skype, Allo and
             | Hangouts, but I've had those apps installed for ages. I've
             | wrapped most of the clients I use together using Matrix
             | bridges, which keeps the app bloat to a minimum for me.
             | 
             | For video calls, I use Google Meet, Teams, Zoom, and, if I
             | have anything to say about it, Jitsi.
             | 
             | In a country where everyone has WhatsApp, you're always
             | using multiple apps if your friends don't want to deal with
             | Facebook. iPhone users seem to mostly use WhatsApp here,
             | I'm guessing because iMessage is extremely limited for
             | talking to most people and everyone has WhatsApp anyway,
             | always delivering the full experience.
             | 
             | Briar will need to get some foothold on Android before
             | developing for iOS even matters. I know that the US is
             | mostly iPhone centric, but based on the names of the
             | contributors, I'm guessing that's not where most of the
             | development takes place.
             | 
             | Lastly, Briar is developed under GPL 3 so it cannot be
             | released on the iOS app store. If all contributors give
             | permission it may be possible for the project to dual
             | license the code especially for an iOS release, but that
             | can be a serious challenge.
        
           | corty wrote:
           | Distributing FLOSS on the Apple apppstore is impossible.
        
             | jeroenhd wrote:
             | There are workarounds, for example by dual licensing, but
             | you're totally right. This is a problem nobody in the open
             | source community seems to care about, but then again most
             | open source license violations are ignored in practice.
        
               | southerntofu wrote:
               | > This is a problem nobody in the open source community
               | seems to care about
               | 
               | It's not so much we don't care about it. It's more like
               | there's nothing we can do about it. We've been
               | campaigning against giving away our rights as computer
               | users to private corporations for decades, but when users
               | actually do it it's beyond our powers to intervene.
               | 
               | If you know low-level hackers who would be happy to setup
               | a community project to reverse-engineer the iPhone
               | bootloader and setup a free system on there, a lot of
               | people would be happy. A person on Reddit booting their
               | iPhone to ubuntu had a lot of attention, but to my
               | knowledge there's no serious collective project with such
               | goals, because it's complicated takes resources and
               | places people from certain countries in a delicate legal
               | situation (with regards to RE/hacking laws).
               | 
               | So if you know people working at Apple or who have deep
               | knowledge of iPhones, please tell them to get involved,
               | leak low-level firmware code and documentation and/or
               | participate in such developments. But the burden can't be
               | placed on "open source community" for a sad situation
               | they haven't created.
        
           | Deathmax wrote:
           | UX on iOS would likely to be terrible, since I don't think
           | you're allowed to keep an active connection to Tor in the
           | background on iOS, which is necessary to receive messages due
           | to the P2P nature of Briar (and is the main driver of battery
           | consumption of the app[0])
           | 
           | [0]: https://code.briarproject.org/briar/briar/-/issues/44
        
         | gregd wrote:
         | "Secure Messaging, Anywhere"
         | 
         | Well that isn't quite true, is it?
        
         | dartharva wrote:
         | That's not a conventional messenger, it's specifically targeted
         | at journalists and other niche professionals:
         | https://briarproject.org/how-it-works/
         | 
         | If you're in such a profession that requires that degree of
         | decentralisation, privacy and anonymity, you are very likely
         | not using iPhones.
        
       | deadalus wrote:
       | Digital Communications Protocols (comparison) :
       | 
       | https://docs.google.com/spreadsheets/d/1-UlA4-tslROBDS9IqHal...
        
       | jimlikeslimes wrote:
       | Rather than a messaging app could you build encyrpted messaging
       | as a mobile keyboard that works over any existing messaging
       | service, even SMS for example? Like PGP for email but implemented
       | as a software keyboard input device?
        
         | layer8 wrote:
         | But what about output?
        
         | SirGiggles wrote:
         | This exists for iOS (not sure for iPadOS, but should work there
         | as well), it's called PGP Everywhere[1]
         | 
         | [1] https://www.pgpeverywhere.com/
        
         | ajb wrote:
         | Technically I guess you could. It would be a bit odd though as
         | the keyboard app would need to display the plaintext as well,
         | so the user can check it for typos.
        
       | dooglius wrote:
       | Thread model:
       | https://code.briarproject.org/briar/briar/-/wikis/threat-mod...
       | 
       | Seems somewhat concerning what local/remote attackers can do,
       | especially over "linkable transports".
        
       | 3gg wrote:
       | This looks really interesting, thank you for sharing.
       | 
       | Has this received any kind of formal security audit? How does it
       | fare against Signal?
        
       | [deleted]
        
       ___________________________________________________________________
       (page generated 2021-06-27 23:03 UTC)