Could you explain a bit? I see main issue with Signal (though I’m not an expert, and they’re not strictly related to security): it’s centralized (and the server isn’t even open-source).
The question is also a lot about your threat model right?
The encryption being crap really does not depend on the threat model. Sure, in some threat models you may not need it at all but in that case, what’s wrong with WhatsApp?
The issue with XMPP is that security really was an afterthought. Not only is e2ee an optional extension, but there are actually 2 incompatible extensions, each with multiple versions. Then you have some clients not implementing either, some clients implementing the older, less secure one. Some implement the newer one but older version of the spec with known issues. And of course, the few clients that implement it well become incompatible with other clients if you enable e2ee, so it is disabled by default.
That is all before you start looking into security audits or metadata harveating.
DreamlandLividity@lemmy.world 1 day ago
Tell me you don’t know anything about security without telling me you don’t know anything about security.
ewenak@jlai.lu 1 day ago
Could you explain a bit? I see main issue with Signal (though I’m not an expert, and they’re not strictly related to security): it’s centralized (and the server isn’t even open-source).
The question is also a lot about your threat model right?
DreamlandLividity@lemmy.world 1 day ago
The encryption being crap really does not depend on the threat model. Sure, in some threat models you may not need it at all but in that case, what’s wrong with WhatsApp?
The issue with XMPP is that security really was an afterthought. Not only is e2ee an optional extension, but there are actually 2 incompatible extensions, each with multiple versions. Then you have some clients not implementing either, some clients implementing the older, less secure one. Some implement the newer one but older version of the spec with known issues. And of course, the few clients that implement it well become incompatible with other clients if you enable e2ee, so it is disabled by default.
That is all before you start looking into security audits or metadata harveating.
Vanilla_PuddinFudge@infosec.pub 20 hours ago
Your reasoning would hold up if 80% of xmpp wasn’t running on Conversations or forks of it, that all support OMEMO and OpenPGP.
Your criticisms are too broad. What makes extensions powerful is that they can easily change the rules without breaking the underlying system.
Clients? That’s the clients problem, and you have choices, and if your problem is metadata, whoooo boy.
news.ycombinator.com/item?id=32780665
github.com/matrix-org/synapse/issues/9133
reddit.com/…/is_matrix_still_a_metadata_disaster/
diealex@lemmy.world 1 day ago
I guess that sucks because I make a living working in cyber security. What do I know, amirite? 🤷