Conversation

Notices

Embed this notice
Eleanor Saitta (dymaxion@infosec.exchange)'s status on Wednesday, 15-Jan-2025 20:31:06 JST Eleanor Saitta

Could people just stop trying to "improve" things they don't understand?
https://soatok.blog/2025/01/14/dont-use-session-signal-fork/
In conversation about 3 days ago from infosec.exchange permalink
Attachments
1. Domain not in remote thumbnail source whitelist: i0.wp.com
  
  Don’t Use Session (Signal Fork)
  
  from Soatok
  
  Last year, I outlined the specific requirements that an app needs to have in order for me to consider it a Signal competitor. Afterwards, I had several people ask me what I think of a Signal fork c…
- Embed this notice
  Michał "rysiek" Woźniak · 🇺🇦 (rysiek@mstdn.social)'s status on Wednesday, 15-Jan-2025 20:32:30 JST Michał "rysiek" Woźniak · 🇺🇦
  in reply to
  
  @dymaxion oh isn't that the blockchain-based thingamajig?
  Yeah, it smelled funny from the get-go.
  
  In conversation about 3 days ago permalink
- Embed this notice
  Eleanor Saitta (dymaxion@infosec.exchange)'s status on Wednesday, 15-Jan-2025 21:03:45 JST Eleanor Saitta
  in reply to
  - Michał "rysiek" Woźniak · 🇺🇦
  @rysiek
  Honestly, this is the first I've heard of it, and hopefully the last. If it's even dumber in other ways too.... Yeah. Lolsigh.
  
  In conversation about 3 days ago permalink
- Embed this notice
  Michał "rysiek" Woźniak · 🇺🇦 (rysiek@mstdn.social)'s status on Wednesday, 15-Jan-2025 21:03:45 JST Michał "rysiek" Woźniak · 🇺🇦
  in reply to
  
  @dymaxion I had some words with them / about them back in 2022:
  https://mstdn.social/@rysiek/109219781174331193
  https://mstdn.social/@rysiek/109245080584180308
  tl;dr they claim they are decentralized because blockchain, but the org reaping the big rewards is (was?) hard-coded. 🤡
  In conversation about 3 days ago permalink
  Attachments
  1. No result found on File_thumbnail lookup.
    
    Michał "rysiek" Woźniak · 🇺🇦 (@rysiek@mstdn.social)
    
    from Michał "rysiek" Woźniak · 🇺🇦
    
    Hey @session@mastodon.social , Session IM is running on the #Oxen network, right? From the docs: > The non for profit Oxen Privacy Tech Foundation receives a governance reward of 9240 $OXEN every 7 days. This reward is used to pay for development, marketing, and community projects, more information about how the Oxen treasury and governance reward is managed can be found on the OPTF website. https://docs.oxen.io/about-the-oxen-blockchain/oxen-token-economics If I am reading this right, this would mean that it is *hard-coded* that OPTF gets this reward. In other words, if I wanted to use #SessionIM, but for whatever reason had a problem with OPTF's politics or actions or whatever, it would be *impossible* for me to use Session (or, say, a compatible independent client) in a way that would preclude OPTF from getting this "governance reward"? Am I reading this right?
  2. No result found on File_thumbnail lookup.
    
    Michał "rysiek" Woźniak · 🇺🇦 (@rysiek@mstdn.social)
    
    from Michał "rysiek" Woźniak · 🇺🇦
    
    @session@mastodon.social that was not my question. My question was: if I move to Session and move all my friends there, and *then* the OPTF does something I strongly disagree with, will there be a way to continue to use Session *without* using nodes that financially support OPTF, without moving everyone over to some other solution? If an XMPP server operator does something bad, I can move but stay in touch. Same with fediverse instances. Is that possible at all with Session?
- Embed this notice
  scriptjunkie (sj@social.scriptjunkie.us)'s status on Thursday, 16-Jan-2025 04:35:24 JST scriptjunkie
  in reply to
  
  @dymaxion That post totally misunderstands signature schemes and how they are used.
  https://social.scriptjunkie.us/@sj/113834017119054709
  In conversation about 3 days ago permalink
  Attachments
  1. Domain not in remote thumbnail source whitelist: social.scriptjunkie.us
    
    scriptjunkie (@sj@social.scriptjunkie.us)
    
    from scriptjunkie
    
    Attached: 1 image The "Don't Use Session (Signal Fork)" post shows a tragic lack of understanding of basic cryptographic primitives and Session's protocol. The post claims the signature validation code of a message "reduced the utility of Ed25519 to that of a CRC32". But immediately following the quoted blob, you'll see that the message sender public key that validated the message is used to identify the sender. If you try to "forge" a message with your own key, it won't show up as from someone else or in their conversations, it will show up as from you! That's the literal basic use case of a signature. It proves who it came from. While a CRC32 could be calculated for any message, even with a forged sender. This shows the post completely misses the point of asymmetric cryptography signature schemes. The post may be correct with the AES encryption to public keys, however, so I'd still regard both Session and the post with suspicion until a more thorough analysis can be done. https://github.com/session-foundation/session-android/blob/75e2b87278cc378e21b77b27fa1a2aa773d25520/libsession/src/main/java/org/session/libsession/messaging/sending_receiving/MessageDecrypter.kt#L58-L62

Public

Conversation

Notices

Feeds