Hacker News Reader

Comment by openplatypus | Hacker News Reader

It is great and I root for Signal.

I only wish Moxie was less polarizing and actually stepped down from being its face. He often makes subpar and inaccurate statements about other technologies. He is famous for his derogatory comments about PGP. His talk at recent CCC was anything but dismissive of others.

The thing is, Signal is not special. Matrix, Wire and others sorted problems of encryption while remaining open (Wire is commercial but that good for some).

So congratulations Signal. But we should think really hard whether we want another centralized behemoth. I would prefer donate to Matrix. Support project building client with great UX for masses on top of open, extensible protocol rather than hand over more control to centralized organization led by individual speaking in absolutes.

View on HN

His statements about PGP are right, though. It's using terrible, outdated cryptography. The odds of finding one who's actually got a setup that isn't full of holes for it is slim, even among programmers. It's barely been used. It's a UX and technical disaster.

Matrix still hasn't gotten E2E encryption rolled out by default, or something like half of the stuff they want to have done before doing it: https://github.com/vector-im/riot-web/issues/6779

Wire keeps track of everyone that every user has contacted for the entirety of the lifespan of their account (not to mention only released it as Free Software after someone found a bunch of glaring holes in their platform, including sending passwords to the server in plain text), and is a U.S. company that goes out of its way to store excessive amounts of metadata.

For that matter, actually, Signal's just as open as Wire. Wire's more or less as centralized, but with way greater risks in the event of Wire's datacenter getting raided.

Tox is the best thing trying to do a similar thing that Signal is doing, and even Tox isn't even very good.

We turned on E2E by default on Matrix a few weeks ago at FOSDEM on the develop branches: https://fosdem.org/2020/schedule/event/matrix/. The bug you quoted will get updated and closed once it gets released to stable in the coming weeks. See the last comments on the bug for the actual status :/

I read the last comment there! "on the develop branches" is way different from "on stable branches." The edits make it more clear, though, good job!

I definitely like what you're trying to do, though! I hope it goes smoothly!

> Wire keeps track of everyone that every user has contacted for the entirety of the lifespan of their account (not to mention only released it as Free Software after someone found a bunch of glaring holes in their platform, including sending passwords to the server in plain text),

Can you link to these issues you mention?

> and is a U.S. company that goes out of its way to store excessive amounts of metadata.

How did you arrive to this conclusion? It is registered in Switzerland https://wire.com/en/about/. Whole development takes place in either Switzerland or Germany. They have usual sales office in San Francisco.

https://forum.privacytools.io/t/wire-swiss-gmbh-is-now-owned...

Wire Swiss GmbH is owned by a U.S. company.

> Can you link to these issues you mention?

https://crysp.uwaterloo.ca/opinion/wire/

The Wire client authenticates with a central server in order to provide user presence information. (Wire does not attempt to hide metadata, other than the central server promising not to log very much information.) The Wire whitepapers spend an unusual amount of space discussing the engineering details of this part of the protocol. However, the method of authentication is the same as it is on the web: the Wire client sends the unencrypted, unhashed password to the central server over TLS, the server hashes the plaintext password with scrypt, and the hash is compared to the hash stored by the server. This process leaks the user's password to the central server; the server operators (or anyone who compromises the server) could log all of the plaintext passwords as users authenticate.

This particular report is what caused them to open up the server.

Thanks for links. The commenters on privacytools sites were insightful but sounds like they missed the key piece of information:

https://wire.com/en/blog/wire_business_update/

> In connection with the financing, our holding company moved from Luxembourg to the U.S., as we believe this will be helpful in future fundraising necessary to support our strong growth. Notwithstanding the foregoing, our current and future customers are licensed and serviced from Wire Switzerland, our software development team remains in Berlin, Germany, and our hosting is European-based. Our enterprise customers can deploy their own instance of Wire in their own data center.

If data, technology and control is subsidiary then Wire, as technology, data and its user still fall under Swiss law.

Holding company =!= all of its business is based in that country.

That said, I appreciate the murky approach to communicating this fact.

Holding company = they're still subject to U.S. law.

Yes, holding company is.

Subsidiary? Greatly depends on the control structure, agreed terms AND law in which subsidiary is incorporated.

Given that these details are not disclosed at this time accusing Wire Swiss GmbH of anything constitutes rumors and conspiracy theory.

I think we see in this that Signal's success is less about tech and more about some product-driven superiority, insofar as it actually reached users and is used a lot already.

It's the old mantra that you may need a Wozniak to do it but you need a Jobs to package it into a great product and sell it. I feel like Moxie is opinionated like a product leader, even more so than as a technologist. He's polarizing. And while it rubs everyone the wrong way on occasion, it's also the story of many a great success.

The Snowden endorsement sure helped.

Good thing Snowden thinks twice before recommending anything.

Reply on news.ycombinator.com