ioc.exchange is one of the many independent Mastodon servers you can use to participate in the fediverse.
INDICATORS OF COMPROMISE (IOC) InfoSec Community within the Fediverse. Newbies, experts, gurus - Everyone is Welcome! Instance is supposed to be fast and secure.

Administered by:

Server stats:

1.3K
active users

You should use Signal. Seriously. There are other encrypted messaging apps out there, but I don’t have as much faith in their longevity. In particular I have major concerns about the sustainability of for-profit apps in our new “AI” world.

Matthew Green

I have too many reasons to worry about this but that’s not really the point. The thing I’m worried about is that, as the only encrypted messenger people seem to *really* trust, Signal is going to end up being a target for too many people.

Signal was designed to be a consumer-grade messaging app. It’s really, really good for that purpose. And obviously “excellent consumer grade” has a lot of intersection with military-grade cryptography just because that’s how the world works. But it is being asked to do a lot!

Right now a single technical organization is being asked to defend (at least) one side in a major regional war, the political communications of the entire US administration, the comms of anyone opposed to them globally, big piles of NGOs, and millions of “ordinary” folks to boot.

(There is no such thing as “ordinary user” cryptography BTW. Those ordinary users include CEOs, military folks, people doing many-million-dollar crypto trades through the app, etc. It’s a lot to put on one app and one non-profit.)

On top of this, it’s only a matter of time until governments (maybe in the US or Europe) start putting pressure on the infrastructure that Signal uses — which is mostly operated by US companies. I’m not sure how this will go down but it’s inevitable.

I guess my takeaway (1) is: no matter what people say, actual privacy is one of the most valuable services in the entire world, (2) network effects ensure a winner, yet (3) it is a totally unstable balancing act for for-profit companies to provide this, long term.

So there is one Signal Foundation doing the work that a dozen companies should be doing. No idea what to do about any of that.

@matthew_d_green As someone on the edge of this, we found it really hard to fund secure (especially decentralised) software.

I know Wire took a long time to find a funding model that is anything resembling stable, Matrix is still trying to, cwtch hasn't.

So my contention is that there probably are a dozen companies trying to do this (serving different threat models) - but funding for them is lacking.

There is (IMHO) some hope of an ecosystem if MLS allows interoperability between them.

@matthew_d_green Govt's historic desire to break encryption has a huge share of the blame of this.

For example, we talked to a telco about embedding our solution in their IoT products. They said something to the effect of - 'we can't sell e-2-e encrypted products '

@steely_glint
Interoperability is the keyword that is far too few used

@matthew_d_green

@steely_glint @matthew_d_green I don't really understand the sustainability argument yet. Maybe I'm missing something. That being said, @threemaapp is building on a sustainable funding model for over 10 years now.

@f09fa681 well both wire and signal were funded on a tiny slice of the profits of the sale of their precursors (Skype and WhatsApp respectively) - I grant you threema has found a model, but matrix and cwtch have not.

@steely_glint Yes, absolutely. Perhaps the transition from that model to a sustainable model is way harder than the way Threema went (sustainable almost from the ground up).

And I want to add that, of course, there was also some luck involved to be able to get where Threema is today (Snowden leaks, Facebook buying WhatsApp, etc.).

(Still, my brain is trying to understand the concerns from Matthew, also with regards to "AI" but is currently failing.)

@matthew_d_green

Funders need to start paying for infrastructure. Millions spent on software development but as soon as it needs hosting somewhere, there is no money for "overhead" or whatever the excuse is.

@matthew_d_green ...good point, the big vulnerabilities of Signal are the people and infrastructure located in the US.

@binaykia @matthew_d_green @simplex
Our company still use Signal with clients, but internally, we are moving to XMPP with OMEMO, and a selection of extensions, set up on our own server.

@sintrenton @matthew_d_green @simplex I ran an XMPP server more that a decade ago. Since been using Google mail chat and meet.

I am thinking of self hosted matrix and jisti to replace it. Did you guys consider it?

@binaykia @matthew_d_green @simplex
I belong to a couple of groups on Matrix, and have heard some of the admins saying it works, but tend to gather bloat quite a bit over time.
We've used Jitsi a few times and it works pretty well, in general.It is still an option half on the table.

@binaykia @matthew_d_green @simplex Yeah, SimpleX checks all the trustworthy boxes. Signal doesn't deserve much trust since it's centralized, depends on phone numbers, can't be self-hosted, and the server isn't even open source anymore.

@matthew_d_green id add to this wild list of ordinary users women escaping domestic violence. It's one of the most complicated threat models out there.

@matthew_d_green
Everyone should donate to the Signal Foundation. That's the only way we have a chance

@matthew_d_green This is exactly why I suggest people use Matrix over Signal. Signal is awesome, but the centralization is an issue.