“Without backdoors” wow, shots fired at Moxie “federation won’t work” Marlinspike’s secure honeypot Signal.
Digital Utopian2: I know, let's design our wire monkey to be 100% ethical and spread the word.
Digital Utopian1: Shots fired! Not only is your logic impeccable, there cannot possibly be any alternative to this course of action!
Digital Utopian2: Yay! I love our ethical technology.
Digital Utopian1: Yay! I love our love for our ethical technology.
Digital Utopian2: I love us.
Digital Utopian1: I love us more...
the two begin kissing, much to the chagrin of the other cafe patrons
Strawman 2: Yes, there aren't any technologies which care more about privacy and freedom, while still valuing good usability, because Element doesn't exist.
Strawman 1: The only chat client I use is one I created myself, based on my cryptography PhD research. Using it requires memorising over 100 command-line options.
Strawman 2: I would communicate with you using a copy of that client, but a chat network having two users would be too much mainstream adoption, which I hate.
everyone in the cafe starts clapping, out of respect for their intelligence and principles
[I think my story is about as convincing as yours, but yours was way hotter, well done.]
From a chat-room creation dialog in Element:
> Enable end-to-end encryption
> You can’t disable this later. Bridges & most bots won’t work yet.
That's a great option for backwards compatibility-- in fact I may end up trying it out for a public chat group at some point.
But it's difficult to take seriously an argument that Element cares more about privacy than Signal when they have that option for the user.
Well, it's hard to take seriously anything under a GP that yelled "honeypot!" at one of the applications under discussion.
Well... if E2EE is properly implemented, you could be broadcasting your messages on twitter and you'd still be safe.
Many people were angered by the recent update that forced users to have pins, which many didn't want. Doubly so since there's no recovery method.
The pin issue highlights that future updates could make things less secure and/or add backdoors. Various legal efforts in various legal jurisdictions are trying to enforce backdoors and it remains to be seen if whisper systems will pull out of a jurisdiction if forced to compromise on security.
He is basically saying the same as people who said "Let's accept self-signed, and broken SSL certificates, or "the unwashed masses" will not understand." Remember how it went.
> Remember, IT security doesn't have to be absolute.
The field of applied cryptography is absolutely reliant on near physical unbreakability of its algorithms, or it doesn't work at all. (you need n-times the life time of the universe to have a working bruteforce, and as much overwhelming mathematical proof of non-applicability of non-bruteforce approaches as possible.)
And it was actually found to be extremely hard to make crypto algos which are only "slightly" unreliable. Either they are a complete mathematical iron wall, or their deemed weakness is too glaring to be hidden.