Conversation

Notices

1. Embed this notice
   Fish of Rage (sun@shitposter.world)'s status on Wednesday, 14-Aug-2024 21:25:37 JST Fish of Rage
   that furry cryptographer is talented
   • Embed this notice
     тняэдт™ (threat@ryona.agency)'s status on Wednesday, 14-Aug-2024 22:26:51 JST тняэдт™

     in reply to

     • :suya:
     @newt @sun at first i didn't want to read the furry nonsense, but the articles are well done. personally i don't have a problem with the signal-shilling but i can see how it's annoying.
     Fish of Rage likes this.
   • Embed this notice
     :suya: (newt@stereophonic.space)'s status on Wednesday, 14-Aug-2024 22:26:53 JST :suya:

     in reply to
     @sun except that he's a furry and openly shills for signal
   • Embed this notice
     :suya: (newt@stereophonic.space)'s status on Thursday, 15-Aug-2024 00:38:18 JST :suya:

     in reply to

     • тняэдт™
     @threat @sun I think he exaggerates the threat of many of those vulnerabilities. The timing attack on libolm is virtually impossible except in the most perfect conditions where the host is on the same network, there is no congestion or packet loss, and the victim doesn't have any other processes running.
     
     I agree though that deprecating libolm out of the blue was a cunt move on the matrix devs part. Someone ought to fork and continue its maintenance, at least when it comes to security issues.
     Fish of Rage likes this.
   • Embed this notice
     Fish of Rage (sun@shitposter.world)'s status on Thursday, 15-Aug-2024 01:38:25 JST Fish of Rage

     in reply to

     • :suya:
     • тняэдт™
     @threat @newt is it true though that these mistakes should have been easy to catch?
   • Embed this notice
     тняэдт™ (threat@ryona.agency)'s status on Thursday, 15-Aug-2024 01:38:26 JST тняэдт™

     in reply to

     • :suya:

     @newt @sun i too felt the timing attack was hyperbole. just because a vector is possible doesn't mean it's probable. it's sort of like when sudo was rekt. if someone has remote access on my machine via ssh or some sort of breakout from a pid then i deserve what i have coming to me, the bigger problem being my access control and ids/ips system vs sudo being broke.

     a balance of paranoia and practicality always worked well for me.

   • Embed this notice
     Fish of Rage (sun@shitposter.world)'s status on Thursday, 15-Aug-2024 01:49:14 JST Fish of Rage

     in reply to

     • :suya:
     • тняэдт™
     • Schizo McFuckface (Previously Maijčika)
     @faggotracist1488 @threat @newt thanks guys this is far outside my competency so I can't evaluate his writing myself.
   • Embed this notice
     Schizo McFuckface (Previously Maijčika) (faggotracist1488@mrhands.horse)'s status on Thursday, 15-Aug-2024 01:49:24 JST Schizo McFuckface (Previously Maijčika)

     in reply to

     • :suya:
     • тняэдт™
     @newt @threat @sun I would generally agree, while he brings up good points he seems to make the biggest deal out of very little for the sole matter of not doing things exactly how signal does it. matrix is a pretty easy target everybody knows its had shit security in forever, but his xmpp article definitely was a pretty blatant case of bias. like he even referenced the signal docs agreeing at a point but stated its still bad because it wasn't justified well enough, and he made a mistake in the article but refused to correct it only leaving a note blaming writing quality. these types of trumped up non issues are fucking insufferable.
     i haven't read the latest matrix article yet but i am sure this will have no affect on my opinion of him, mostly smart, but insufferable and a shill. both in personality any in focus.
     
     to quote the article of this devout signal evangelist,
     > But in return, I really don’t appreciate unsolicited evangelism towards any technology.
   • Embed this notice
     :suya: (newt@stereophonic.space)'s status on Thursday, 15-Aug-2024 01:50:02 JST :suya:

     in reply to

     • тняэдт™
     @sun @threat the main mistake there was matrix devs rolling out their own crypto. AES has multiple portable and proven to be secure implementations. There was literally no need for writing it from scratch.
     Fish of Rage likes this.
   • Embed this notice
     Fish of Rage (sun@shitposter.world)'s status on Thursday, 15-Aug-2024 01:54:11 JST Fish of Rage

     in reply to

     • :suya:
     • тняэдт™
     • Schizo McFuckface (Previously Maijčika)
     @newt @faggotracist1488 @threat I believe his main critique is that any application that offers E2EE should ONLY offer E2EE.
   • Embed this notice
     :suya: (newt@stereophonic.space)'s status on Thursday, 15-Aug-2024 01:54:12 JST :suya:

     in reply to

     • тняэдт™
     • Schizo McFuckface (Previously Maijčika)
     @faggotracist1488 @threat @sun with xmpp, he just reinterated a well-known critique, namely that it's a shitshow of a protocol and poor compatibility. But this has been known for decades and this is why XMPP died out as a federated chat protocol even before modern E2EE was invented.
     
     Throwing stones at XMPP is like punching babies. Waaaaaay too easy.
   • Embed this notice
     Fish of Rage (sun@shitposter.world)'s status on Thursday, 15-Aug-2024 01:59:31 JST Fish of Rage

     in reply to

     • :suya:
     • тняэдт™
     • Schizo McFuckface (Previously Maijčika)
     @newt @faggotracist1488 @threat I don't know what he would say about this, I think you make a perfectly valid point and the "it HAS to be fully E2EE" argument is overstated. If you can't figure out on Telegram if you're using the E2EE mode, you are exceptionally stupid and already an opsec risk.
   • Embed this notice
     :suya: (newt@stereophonic.space)'s status on Thursday, 15-Aug-2024 01:59:32 JST :suya:

     in reply to

     • :suya:
     • тняэдт™
     • Schizo McFuckface (Previously Maijčika)
     @sun @faggotracist1488 @threat also, until MLS was invented, E2EE had O(n^2) complexity, where n is the number of devices. MLS brings this down to O(n*log n), I think. Matrix is in the process of migrating to it.
   • Embed this notice
     :suya: (newt@stereophonic.space)'s status on Thursday, 15-Aug-2024 01:59:33 JST :suya:

     in reply to

     • тняэдт™
     • Schizo McFuckface (Previously Maijčika)
     @sun @faggotracist1488 @threat yeah, no. In a group chat of over a certain size - a few dozen people or more - it's useless. Someone will just leak the data.
     
     We learned this the hard way organising parties during kung flu lockdowns. Opsec cannot be solved by encryption only!
   • Embed this notice
     Fish of Rage (sun@shitposter.world)'s status on Thursday, 15-Aug-2024 02:03:45 JST Fish of Rage

     in reply to

     • :suya:
     • тняэдт™
     • Schizo McFuckface (Previously Maijčika)
     @newt @faggotracist1488 @threat sure I just mean though that it's very easy to tell if you're using the E2EE mode or not because they make it look completely different. The main argument against mixing is it confuses people and they make opsec mistakes.
   • Embed this notice
     :suya: (newt@stereophonic.space)'s status on Thursday, 15-Aug-2024 02:03:46 JST :suya:

     in reply to

     • тняэдт™
     • Schizo McFuckface (Previously Maijčika)
     @sun @faggotracist1488 @threat telegram is a separate problem. Their E2EE implementation is borked on purpose and made unusable except in very specific conditions. There is literally no reason why telegram couldn't have E2EE by default in all one-to-one chats or even small groups.
     
     If you want my opinion, Telegram is incredibly sus
   • Embed this notice
     Schizo McFuckface (Previously Maijčika) (faggotracist1488@mrhands.horse)'s status on Thursday, 15-Aug-2024 02:04:49 JST Schizo McFuckface (Previously Maijčika)

     in reply to

     • :suya:
     • тняэдт™
     @sun @threat @newt to be fair the telegram e2ee has some sketchy shit in it aswell, but for the day to day user who is not targetted i'm sure its fine. but i wouldn't put the most trust after they straight up inserted an obvious backdoor and then removed after everybody pointed it out
     Fish of Rage likes this.
   • Embed this notice
     Fish of Rage (sun@shitposter.world)'s status on Thursday, 15-Aug-2024 02:07:06 JST Fish of Rage

     in reply to

     • :suya:
     • feld
     • тняэдт™
     • Schizo McFuckface (Previously Maijčika)
     @feld @faggotracist1488 @threat @newt ultimately it's a UI issue imo. Telegram does it ok but no XMPP client does.
   • Embed this notice
     feld (feld@bikeshed.party)'s status on Thursday, 15-Aug-2024 02:07:07 JST feld

     in reply to

     • :suya:
     • тняэдт™
     • Schizo McFuckface (Previously Maijčika)
     @sun @faggotracist1488 @threat @newt cruel but true
   • Embed this notice
     Schizo McFuckface (Previously Maijčika) (faggotracist1488@mrhands.horse)'s status on Thursday, 15-Aug-2024 02:14:05 JST Schizo McFuckface (Previously Maijčika)

     in reply to

     • :suya:
     • feld
     • тняэдт™
     @sun @feld @threat @newt its honestly partially an architectural issue in that regard. telegram has the e2ee and regular chats as seperate, whilst in xmpp they are necessary one and the same with the encryption overlaid and can be mixed freely. the XMPP clients dont do it that great but such sharp a division wouldn't really be too easy or accurate to what your actually doing. i feel like it could be better but the red messages or noticable red locks if somebody sends unencrypted messages when you were encrypted are a pretty reasonable way of doing this. personally i would prefer if there were better controls for the the end to end encryption. there's the obvious issues with like dead users and groupchats and shit, but i mean, if issues do come up and things dont go through or cant send at the very least you could give an actual button to reset the encryption there, change up the private keys, all that good shit, new ratchet. but there's really no way to interact directly on most clients and generally it merely boils down to whether you trust or not a billion different fucking keys a shitty client generates
     Fish of Rage likes this.