- cross-posted to:
- tech@pawb.social
- cross-posted to:
- tech@pawb.social
This blog post, and some of its comments are pretty interesting and concerning at the same time. Not really sure if in the end that means that nothing other than centralized controlled messaging can be as cryptography safe.
Any comments?
I was in the specs before as well, just not as clearly spelled out.
As for the other reasons why Soatok thinks Signal is better, well those are cherry picked and highly opinionated. There are similar lists of reasons from equally respected security researchers (that have less of a e2ee tunnel vision), that rule out Signal as a serious option due to its centralised and single vendor approach.
Which brings me to the last point. Yes, Signal is a snake-oil vendor that tries to hide the various glaring security issues of their model behind a state of the art e2ee system. But that’s just a fig-leaf not really all that different from how WhatsApp claims to be secure due to them adopting e2ee.
Post-quantum encryption is an active R&D field with no proven to work solutions yet. In fact, solutions that are proudly announced as finally having solved it are regularly silently retracted as other researchers find that they actually offer less security than current state of the art encryption algorithms.
In the Signal article yes, by design those are his opinions on what the minimum requirements are for “beating Signal”, which are not all objective truths. These articles come from a response to people evangelizing one messenger or another to him, some of which have “stronger” security but negatives in other places that make them unacceptable for widespread use (especially for non-techies). In the XMPP article I think the remaining points are very fair in terms of how the XMPP ecosystem works today.
Okay, that’s enough of my time. These replies are for the benefit of others, and I hope I’ve said enough on that for people to make their judgments with more info that what you initially were responding with.