[HN Gopher] Secure Messaging, Anywhere
___________________________________________________________________
Secure Messaging, Anywhere
Author : Tomte
Score : 117 points
Date : 2021-06-27 06:26 UTC (16 hours ago)
(HTM) web link (briarproject.org)
(TXT) w3m dump (briarproject.org)
| edent wrote:
| Can this work just as IM over Bluetooth? I've often wanted to
| message people who are nearby, but with no WiFi (e.g. trains,
| planes, and conference halls).
| southerntofu wrote:
| I haven't tested it, but that's precisely what it's supposed to
| do, using a kind of gossip protocol.
| older wrote:
| It does. I use it exactly the way you described. Biggest issue
| for me is that it is impossible to transfer existing account to
| another device, so you lose all your contacts on anew device.
| southerntofu wrote:
| While not exactly as straightforward i assume you can back it
| up from a device using standard adb commands.
| ohazi wrote:
| Neat. I remember wanting something like this years ago when a
| friend and I were on the same flight but we're sitting ~10
| rows apart.
| smeej wrote:
| I've also connected one phone to another phone's WiFi in
| hotspot mode, even though they didn't have an _internet_
| connection over WiFi.
|
| It allows you to send messages to each other P2P at slightly
| longer range than Bluetooth.
| quartzic wrote:
| Anywhere except iOS, apparently
| Jiejeing wrote:
| iOS only has high market share in the US, even in other,
| similarly rich western countries, Android dominates.
|
| Additionally, iOS prevents you from keeping a background
| connection, which means anything else than polling or (apple-
| controled) push notification is a no go. Briar mostly works
| through Tor, which cannot work properly on standard iOS, due to
| the previously described limitations.
|
| If you want software on iOS, complain to apple about their dumb
| policies, not on HN comment threads.
| teorema wrote:
| Yes, here you have Briar bumping up against the inability to
| run _any_ fully decentralized mobile communication software
| on iOS. Seems like a serious limitation on the part of iOS at
| this point given trends towards decentralization in general.
| Jiejeing wrote:
| The worst part is that an inactive background TCP
| connection is mostly free (of course, a Tor client is
| slightly more involved), so there is exactly 0 reason to
| forbid it, as long as apps are reviewed properly for
| abusive behavior (they are not).
| southerntofu wrote:
| It's not their fault that you can't use programs of your choice
| on iOS, that you have to pay Apple for a developer account for
| submitting apps to the App Store, and that the App Store T&C
| explicitly forbids free-software.
| dariosalvi78 wrote:
| There are several FOSS apps on the app store
| pta2002 wrote:
| Nitpicking a bit, but it doesn't. It forbids redistribution
| of apps downloaded from the app store, which is a requirement
| of the GPL, and so the app store "license" and the GPL (not
| free software in general) are incompatible.
|
| None of this matters much though because if you own the
| copyright to the code you can relicense it however you want,
| which is why VLC for example is on the app store.
| southerntofu wrote:
| Nitpicking a bit, but what works for a single association
| like Videolan (editor of VLC) may not work for a program
| that was developed by hundreds of contributors over the
| years, who would all have to give their approval for a re-
| licensing.
| mmwelt wrote:
| Yup[1], it's a pity because it will greatly reduce the network
| effect needed to get enough people using the app.
|
| [1]
| https://code.briarproject.org/briar/briar/-/wikis/FAQ#will-t...
| fishmaster wrote:
| Many, _many_ more people use Android than IOS.
| chrismorgan wrote:
| I'd rephrase that: _nowhere_ except _Android_.
|
| Android and iOS aren't the only games in town. Windows, macOS,
| various Linuxes desktop, various Linuxes mobile, Firefox OS and
| its successors...
|
| I get fed up with things where your options are: (a) a
| commonly-clunky web system where you have to log in, possibly
| with tedious 2FA, every time you want to touch it, and (b) a
| sleek task-focused Google-Android/iOS app where you don't.
| Banking is an example of an area where this is the norm. I want
| to use this improved process on a laptop, or perhaps on a
| mobile device where I can't install their iOS or Google Play
| Store app.
| blendergeek wrote:
| There is Briar GTK [0] that runs on Linux Desktop/Mobile.
|
| [0] https://code.briarproject.org/briar/briar-gtk
| Aachen wrote:
| Last I checked it also doesn't support MS-DOS or Amiga. The
| "anywhere" doesn't refer to OS support.
| remram wrote:
| How does this compare to all the other messengers that were on HN
| recently, like Berty, Cwtch, Matrix, etc?
| j-james wrote:
| It's similar to Matrix's experimental Pinecone overlay network.
|
| https://matrix.org/blog/2021/05/06/introducing-the-pinecone-...
| mlok wrote:
| It works with or without internet : Bluetooth is enough. Check
| their "How it works" page.
| [deleted]
| dannyw wrote:
| If your messenger doesn't support both ios and Android, it's DOA.
| uselpa wrote:
| I agree, iOS market share is too large to ignore. In that
| space, Jami seems to be the better option at this point in
| time.
| pkphilip wrote:
| That is not true. There are parts of the world where Iphone use
| is quite low. For instance in India which is expected to have
| more than 820 million smart phone users by 2022, the percentage
| of IOS users is around 3%.
|
| https://www.statista.com/statistics/262157/market-share-held...
|
| In China with over 850+ million smart phone users, IPhone users
| are about 13%. https://www.counterpointresearch.com/china-
| smartphone-share/
| nipponese wrote:
| Can you name any "popular" messaging client that doesn't have
| an iOS client?
| Barrin92 wrote:
| In this circle[1] where more than half of the world's
| population lives, ios marketshare is probably < 10%.
|
| [1]https://en.wikipedia.org/wiki/Valeriepieris_circle#/media/Fi
| ...
| tpush wrote:
| The wealthiest (per capita) nation in that circle is Japan,
| where iOS' market share is 67%.
| xfer wrote:
| If you think you are going to make money from a messenger,
| you are in for a shock.
| djrogers wrote:
| Yeah, those WhatsApp investors sure lost their shirts...
| huhtenberg wrote:
| WhatsApp was doing well charging $1 off 100 mil users.
|
| Regrettably selling off paid even better.
| MikeUt wrote:
| So Apple's choice of no-sideloading has, through network
| effects, placed them in the role of arbiter of which messengers
| are viable, restricting choice for even non-Apple users.
| brnt wrote:
| In the US.
| zksmk wrote:
| Yup. Android dominates globally, and IMO Briar's strong suit
| compared to other similar messenger apps is avoiding both
| capital surveillance AND state surveillance, or in other
| words it's good for fighting autocratic regimes. The US isn't
| really in the tier 1 target group. Yet.
| approxim8ion wrote:
| Like iMessage?
| southerntofu wrote:
| Nothing on the Briar side prevents anyone from developing an
| iOS implementation of their protocol. Also not everywhere you
| find iPhones, in my popular neighborhood i don't believe i know
| people using iPhones (probably because nobody can afford it),
| making your claim inappropriate.
| pseudo0 wrote:
| Even assuming that's true, surely people in your neighborhood
| communicate with people outside of it, some of whom have
| iPhones? That would mean using two different messaging apps,
| an annoyance that most people won't want to deal with unless
| the app has some sort of killer feature they can't find
| anywhere else. Just from a quick look at Briar's site, their
| main selling point appears to be security, which is a problem
| when Signal is an established brand with multiplatform
| support.
|
| The local P2P aspect is cool, but seems like it would only
| appeal to a very niche set of users.
| saurik wrote:
| > That would mean using two different messaging apps, an
| annoyance that most people won't want to deal with...
|
| FWIW, most "normal" people I know (as in, not technologists
| who carry complex opinions about chat protocols and
| applications in general) seem to just use a ton of
| messaging apps to communicate with random people for
| various purposes? They do have a friction with respect to
| installing one they don't have yet, as it involves work
| that maybe they can avoid, but everyone seems to have and
| use and communicate using Facebook, Snapchat, SMS, and at
| least one account (if not multiple) on each of Instagram
| and TikTok. (Additionally, people I know who have
| international contacts -- whether due to being
| "professionals" or by way of family -- generally have
| WhatsApp.) It really is only a few techies I know
| (honestly, including me at times, though for what I
| think/hope are slightly different reasons: my issues often
| come down to how critical it is that I can have long-term
| log retention in useful searchable mechanisms... a big
| reason I refuse to use Signal as it doesn't even support
| backup correctly on iOS) who seem to get sad about using
| multiple apps (which should make sense, as if you know even
| only two people who are super picky then they probably just
| fail to communicate with each other at all because they end
| up in disjoint cliques: your "neighborhood"--which needs to
| include all your contacts, really, and so quickly knots
| together with "the world"--isn't going to settle on a
| single chat app... "normal people" find that level of
| "sorry: I only use X" stubborn and a-pragmatic ;P).
| jeroenhd wrote:
| In my day to day life I use Telegram, WhatsApp, Google
| Chat, Slack and sometimes Signal. Luckily, I've been able
| to do away with Messenger, MMS/SMS, Skype, Allo and
| Hangouts, but I've had those apps installed for ages. I've
| wrapped most of the clients I use together using Matrix
| bridges, which keeps the app bloat to a minimum for me.
|
| For video calls, I use Google Meet, Teams, Zoom, and, if I
| have anything to say about it, Jitsi.
|
| In a country where everyone has WhatsApp, you're always
| using multiple apps if your friends don't want to deal with
| Facebook. iPhone users seem to mostly use WhatsApp here,
| I'm guessing because iMessage is extremely limited for
| talking to most people and everyone has WhatsApp anyway,
| always delivering the full experience.
|
| Briar will need to get some foothold on Android before
| developing for iOS even matters. I know that the US is
| mostly iPhone centric, but based on the names of the
| contributors, I'm guessing that's not where most of the
| development takes place.
|
| Lastly, Briar is developed under GPL 3 so it cannot be
| released on the iOS app store. If all contributors give
| permission it may be possible for the project to dual
| license the code especially for an iOS release, but that
| can be a serious challenge.
| corty wrote:
| Distributing FLOSS on the Apple apppstore is impossible.
| jeroenhd wrote:
| There are workarounds, for example by dual licensing, but
| you're totally right. This is a problem nobody in the open
| source community seems to care about, but then again most
| open source license violations are ignored in practice.
| southerntofu wrote:
| > This is a problem nobody in the open source community
| seems to care about
|
| It's not so much we don't care about it. It's more like
| there's nothing we can do about it. We've been
| campaigning against giving away our rights as computer
| users to private corporations for decades, but when users
| actually do it it's beyond our powers to intervene.
|
| If you know low-level hackers who would be happy to setup
| a community project to reverse-engineer the iPhone
| bootloader and setup a free system on there, a lot of
| people would be happy. A person on Reddit booting their
| iPhone to ubuntu had a lot of attention, but to my
| knowledge there's no serious collective project with such
| goals, because it's complicated takes resources and
| places people from certain countries in a delicate legal
| situation (with regards to RE/hacking laws).
|
| So if you know people working at Apple or who have deep
| knowledge of iPhones, please tell them to get involved,
| leak low-level firmware code and documentation and/or
| participate in such developments. But the burden can't be
| placed on "open source community" for a sad situation
| they haven't created.
| Deathmax wrote:
| UX on iOS would likely to be terrible, since I don't think
| you're allowed to keep an active connection to Tor in the
| background on iOS, which is necessary to receive messages due
| to the P2P nature of Briar (and is the main driver of battery
| consumption of the app[0])
|
| [0]: https://code.briarproject.org/briar/briar/-/issues/44
| gregd wrote:
| "Secure Messaging, Anywhere"
|
| Well that isn't quite true, is it?
| dartharva wrote:
| That's not a conventional messenger, it's specifically targeted
| at journalists and other niche professionals:
| https://briarproject.org/how-it-works/
|
| If you're in such a profession that requires that degree of
| decentralisation, privacy and anonymity, you are very likely
| not using iPhones.
| deadalus wrote:
| Digital Communications Protocols (comparison) :
|
| https://docs.google.com/spreadsheets/d/1-UlA4-tslROBDS9IqHal...
| jimlikeslimes wrote:
| Rather than a messaging app could you build encyrpted messaging
| as a mobile keyboard that works over any existing messaging
| service, even SMS for example? Like PGP for email but implemented
| as a software keyboard input device?
| layer8 wrote:
| But what about output?
| SirGiggles wrote:
| This exists for iOS (not sure for iPadOS, but should work there
| as well), it's called PGP Everywhere[1]
|
| [1] https://www.pgpeverywhere.com/
| ajb wrote:
| Technically I guess you could. It would be a bit odd though as
| the keyboard app would need to display the plaintext as well,
| so the user can check it for typos.
| dooglius wrote:
| Thread model:
| https://code.briarproject.org/briar/briar/-/wikis/threat-mod...
|
| Seems somewhat concerning what local/remote attackers can do,
| especially over "linkable transports".
| 3gg wrote:
| This looks really interesting, thank you for sharing.
|
| Has this received any kind of formal security audit? How does it
| fare against Signal?
| [deleted]
___________________________________________________________________
(page generated 2021-06-27 23:03 UTC)