Hacker News Reader

Comment by al_chemist | Hacker News Reader

> don't use desktop secure messengers at all. Desktop applications are incredibly risky, far more so than iOS mobile apps are.

It's risky to use an open source OS. If you are serious about security, use Android or iOS. Instead of direct ssl connection to XMPP server, it's much safer to send all your data with Google Cloud Messaging. /s

Desktop computers are currently the most open sourced, least opaque, least spyware, non gps tracking, non "microphone always listening for 'ok google'" computer average person has. Why do you suggest that iphone is much more private device?

View on HN

You have my upvote, but I imagine that tptacek means that iOS is very very well sandboxed, and has an extremely tight and well authenticated download and update system which is extremely difficult for a third party to monkey with.

This is security via centralization and trusting a benevolent capitalist dictator. As long as your personal interests are aligned with interests of the benevolent capitalist's shareholders, you should be fine.

It is my least favorite security model. But, in the case of iOS it seems to be working well (for now). My long-term hope is for a decentralized FOSS model, but for the time being, in the USA, on a multipurpose machine, the benevolent capitalist dictator beats it, especially on sandboxing and package/app authentication.

I like open source software as much as most people on HN, and have worked with it for most of my career. But help me understand how a decentralized FOSS model gets ordinary lawyers, reporters, and congressional campaign staffers the level of security that iOS does? What are the mechanisms that assure safety for users?

The closest I can come to seeing something like this work is a Chromebook, and Chromebooks are locked-down and get their security model from a central authority.

You're right and this is just the classic walled garden tradeoff - freedom for convenience. Depending who you are, this might be acceptable, and it's good that we have choices.

> What are the mechanisms that assure safety for users?

What are the mechanisms that assure safety for users of iOS? I understand that it's had a good track record so far, but the proprietary closed nature doesn't inherently inspire trust. Surely a decentralised FOSS model done right could be secure for lawyers &c.

As the old saying goes, "if you could have invented a secure open source desktop chat app, you would have developed a secure open source desktop chat app."

In practice, empirict results win over theoretically optimal designs.

I think that’s unfair; the Ghost.io post from a day or so ago is a good reminder of just how much harder it is to do things when you have to make them work in a decentralized fashion. Decentralization makes everything harder.

Doesn’t mean it’s the wrong thing to do! :)

And as the old saying continues, "...so instead you invented a proprietary one, with hidden code, and told everyone it's secure."

I'm pretty sure Signal doesn't send all your data through GCM.

Edit: https://support.signal.org/hc/en-us/articles/217524107

Its sad enough they use GCM at all. Android Apps can works perfectly well without GCM.

Signal merged support for devices without Play Services about a year ago. Is that what you're looking for?

In fact I am not looking for anything, as I am using conversations, but any unnecessary use of (Google) services is something I consider not privacy friendly, even if it is used just as signaling channel.

You should be far more worried that desktop apps don't require permission before eavesdropping on your conversations using the microphone (including 3rd level sub-dependencies of that NPM module you installed), than that Android or iOS is secretly recording your conversations under the guise of "ok Google" or "Hello Siri".

Regardless of the device form factor, if you don't want the OS to have access to the microphone then you have to physically disable the microphone (but if you are that paranoid you should probably live in the woods away from all electronic devices).

Reply on news.ycombinator.com