Comment by Arathorn | Hacker News Reader

Comment by Arathorn | Hacker News Reader

Parent Full thread

Just a few clarifications:

* Olm isn't a replacement for 'Signal protocol' - it's just an independent (Apache license) implementation of the same 'double ratchet' cryptographic ratchet that Signal protocol uses under the hood for generating message keys.

* Megolm provides the higher layer semantics for using Olm for group conversations in Matrix, and diverges significantly from Signal Protocol as far as I know.

* There's already an experimental FDroid ready build of Vector Android (following the HN discussion on Friday) at https://matrix.org/jenkins/job/VectorAndroidDevelop/lastSucc... - feedback welcome on just how badly the polling-based push mechanism performs on your hardware & network. We're looking at alternative push mechanisms like microG - or just using a more efficient push transport for Matrix to provide notifs.

Thanks @Arathorn. That's great to hear an FDroid candidate's available. Great turn around! The only device I'd have to test it on right at the moment, unfortunately doesn't take 3rd party APKs (FDroid's been signed, but I'm reluctant to otherwise open that particular device). Will see what else I can pull together. I could sign the APK with my own OS build, but then I'd miss OTA updates (so a different security risk). MicroG sounds a good option. As for Copperhead specifically, I don't think MicroG will be on the table for a while though. Another push would be ideal I suppose (but I know you need to balance priorities).

Hi @Arathorn, the battery drain of that experimental build is certainly noticeable, but not disastrous. In 18 hours on a new Nexus 6p, it's drained the battery 30%. Conversations.IM by comparison had only drained 1%. The next biggest battery drain on that device to Vector, had only taken 3%. I think it's still viable enough for an early release to FDroid for the time being, but with a warning. The fact that you can also turn its background sync on or off, means it's quite fine for the casual reading use case, without notifications one.

On second look, MicroG won't be a good option at all.

It requires signature spoofing.

(i.e. security to be broken in various ways. Opens it up to all sorts of other attacks, plus to even install, forces rooting the device, or running Xposed, or applying dodgy kernel hacks and prevents using verified boot, which is a sensible security requirement).

https://github.com/microg/android_packages_apps_GmsCore/wiki

Reply on news.ycombinator.com