Secure Messaging, Anywhere | Hacker News Reader

Secure Messaging, Anywhere

briarproject.org

127 pointsTomte63 comments

Can this work just as IM over Bluetooth? I've often wanted to message people who are nearby, but with no WiFi (e.g. trains, planes, and conference halls).

I haven't tested it, but that's precisely what it's supposed to do, using a kind of gossip protocol.

It does. I use it exactly the way you described. Biggest issue for me is that it is impossible to transfer existing account to another device, so you lose all your contacts on anew device.

While not exactly as straightforward i assume you can back it up from a device using standard adb commands.

Neat. I remember wanting something like this years ago when a friend and I were on the same flight but we're sitting ~10 rows apart.

That last bit sounds like a feature.

I've also connected one phone to another phone's WiFi in hotspot mode, even though they didn't have an internet connection over WiFi.

It allows you to send messages to each other P2P at slightly longer range than Bluetooth.

If your messenger doesn't support both ios and Android, it's DOA.

Nothing on the Briar side prevents anyone from developing an iOS implementation of their protocol. Also not everywhere you find iPhones, in my popular neighborhood i don't believe i know people using iPhones (probably because nobody can afford it), making your claim inappropriate.

Even assuming that's true, surely people in your neighborhood communicate with people outside of it, some of whom have iPhones? That would mean using two different messaging apps, an annoyance that most people won't want to deal with unless the app has some sort of killer feature they can't find anywhere else. Just from a quick look at Briar's site, their main selling point appears to be security, which is a problem when Signal is an established brand with multiplatform support.

The local P2P aspect is cool, but seems like it would only appeal to a very niche set of users.

> That would mean using two different messaging apps, an annoyance that most people won't want to deal with...

FWIW, most "normal" people I know (as in, not technologists who carry complex opinions about chat protocols and applications in general) seem to just use a ton of messaging apps to communicate with random people for various purposes? They do have a friction with respect to installing one they don't have yet, as it involves work that maybe they can avoid, but everyone seems to have and use and communicate using Facebook, Snapchat, SMS, and at least one account (if not multiple) on each of Instagram and TikTok. (Additionally, people I know who have international contacts -- whether due to being "professionals" or by way of family -- generally have WhatsApp.) It really is only a few techies I know (honestly, including me at times, though for what I think/hope are slightly different reasons: my issues often come down to how critical it is that I can have long-term log retention in useful searchable mechanisms... a big reason I refuse to use Signal as it doesn't even support backup correctly on iOS) who seem to get sad about using multiple apps (which should make sense, as if you know even only two people who are super picky then they probably just fail to communicate with each other at all because they end up in disjoint cliques: your "neighborhood"--which needs to include all your contacts, really, and so quickly knots together with "the world"--isn't going to settle on a single chat app... "normal people" find that level of "sorry: I only use X" stubborn and a-pragmatic ;P).

In my day to day life I use Telegram, WhatsApp, Google Chat, Slack and sometimes Signal. Luckily, I've been able to do away with Messenger, MMS/SMS, Skype, Allo and Hangouts, but I've had those apps installed for ages. I've wrapped most of the clients I use together using Matrix bridges, which keeps the app bloat to a minimum for me.

For video calls, I use Google Meet, Teams, Zoom, and, if I have anything to say about it, Jitsi.

In a country where everyone has WhatsApp, you're always using multiple apps if your friends don't want to deal with Facebook. iPhone users seem to mostly use WhatsApp here, I'm guessing because iMessage is extremely limited for talking to most people and everyone has WhatsApp anyway, always delivering the full experience.

Briar will need to get some foothold on Android before developing for iOS even matters. I know that the US is mostly iPhone centric, but based on the names of the contributors, I'm guessing that's not where most of the development takes place.

Lastly, Briar is developed under GPL 3 so it cannot be released on the iOS app store. If all contributors give permission it may be possible for the project to dual license the code especially for an iOS release, but that can be a serious challenge.

UX on iOS would likely to be terrible, since I don't think you're allowed to keep an active connection to Tor in the background on iOS, which is necessary to receive messages due to the P2P nature of Briar (and is the main driver of battery consumption of the app[0])

[0]: https://code.briarproject.org/briar/briar/-/issues/44

Distributing FLOSS on the Apple apppstore is impossible.

There are workarounds, for example by dual licensing, but you're totally right. This is a problem nobody in the open source community seems to care about, but then again most open source license violations are ignored in practice.

> This is a problem nobody in the open source community seems to care about

It's not so much we don't care about it. It's more like there's nothing we can do about it. We've been campaigning against giving away our rights as computer users to private corporations for decades, but when users actually do it it's beyond our powers to intervene.

If you know low-level hackers who would be happy to setup a community project to reverse-engineer the iPhone bootloader and setup a free system on there, a lot of people would be happy. A person on Reddit booting their iPhone to ubuntu had a lot of attention, but to my knowledge there's no serious collective project with such goals, because it's complicated takes resources and places people from certain countries in a delicate legal situation (with regards to RE/hacking laws).

So if you know people working at Apple or who have deep knowledge of iPhones, please tell them to get involved, leak low-level firmware code and documentation and/or participate in such developments. But the burden can't be placed on "open source community" for a sad situation they haven't created.

> This is a problem nobody in the open source community seems to care about

The open source community does care about it. However, the solutions are strictly on Apple. If they don't change their behaviour and terms, there is nothing the community can do.

And that license violations are often ignored in practice is different from actively encouraging them, which is what you are doing. Since that kind of thing is illegal in most places, Apple surely won't hesitate to kick such software from the appstore.

In the US.

Yup. Android dominates globally, and IMO Briar's strong suit compared to other similar messenger apps is avoiding both capital surveillance AND state surveillance, or in other words it's good for fighting autocratic regimes. The US isn't really in the tier 1 target group. Yet.

That is not true. There are parts of the world where Iphone use is quite low. For instance in India which is expected to have more than 820 million smart phone users by 2022, the percentage of IOS users is around 3%.

https://www.statista.com/statistics/262157/market-share-held...

In China with over 850+ million smart phone users, IPhone users are about 13%. https://www.counterpointresearch.com/china-smartphone-share/

Can you name any "popular" messaging client that doesn't have an iOS client?

Sharechat app which is very popular in India (160+ million active monthly users) was first launched only on Android in 2015 and the IOS app was launched as late as May 2019. So yes, there was a period of around 3+ years where a major messaging app didn't have an IOS app. Their IOS app would not have added more than a couple of percentage points in terms of additional users.

If your messenger client is targeting only one country, with the exception of China, it is DOA.

Again, not true.

Sharechat app which is quite popular in India (160+ million active monthly users) launched their Android app in Oct 2015 and I believe their IOS app was only launched in May 2019.

In this circle[1] where more than half of the world's population lives, ios marketshare is probably < 10%.

[1]https://en.wikipedia.org/wiki/Valeriepieris_circle#/media/Fi...

The wealthiest (per capita) nation in that circle is Japan, where iOS' market share is 67%.

If you think you are going to make money from a messenger, you are in for a shock.

Yeah, those WhatsApp investors sure lost their shirts…

WhatsApp was doing well charging $1 off 100 mil users.

Regrettably selling off paid even better.

I agree, iOS market share is too large to ignore. In that space, Jami seems to be the better option at this point in time.

"Secure Messaging, Anywhere"

Well that isn't quite true, is it?

So Apple's choice of no-sideloading has, through network effects, placed them in the role of arbiter of which messengers are viable, restricting choice for even non-Apple users.

Like iMessage?

No; iMessage accommodates Android* by seamlessly falling back to SMS.

* and stubborn idealists (https://news.ycombinator.com/item?id=24388283)

That's not a conventional messenger, it's specifically targeted at journalists and other niche professionals: https://briarproject.org/how-it-works/

If you're in such a profession that requires that degree of decentralisation, privacy and anonymity, you are very likely not using iPhones.

lol so if Apple decides not to support privacy enabling features like back ground services, we just can't have them? give me a break

Digital Communications Protocols (comparison) :

https://docs.google.com/spreadsheets/d/1-UlA4-tslROBDS9IqHal...

Rather than a messaging app could you build encyrpted messaging as a mobile keyboard that works over any existing messaging service, even SMS for example? Like PGP for email but implemented as a software keyboard input device?

Technically I guess you could. It would be a bit odd though as the keyboard app would need to display the plaintext as well, so the user can check it for typos.

But what about output?

This exists for iOS (not sure for iPadOS, but should work there as well), it's called PGP Everywhere[1]

[1] https://www.pgpeverywhere.com/

I have been developing that for a while now: http://www.anomie.tech/

Thread model: https://code.briarproject.org/briar/briar/-/wikis/threat-mod...

Seems somewhat concerning what local/remote attackers can do, especially over "linkable transports".

How does this compare to all the other messengers that were on HN recently, like Berty, Cwtch, Matrix, etc?

It works with or without internet : Bluetooth is enough. Check their "How it works" page.

How does it compare apart from that feature, that I'm probably not going to use often (if at all)?

It's similar to Matrix's experimental Pinecone overlay network.

https://matrix.org/blog/2021/05/06/introducing-the-pinecone-...

This looks really interesting, thank you for sharing.

Has this received any kind of formal security audit? How does it fare against Signal?

When will avalaible for IOS?

Anywhere except iOS, apparently

Last I checked it also doesn't support MS-DOS or Amiga. The "anywhere" doesn't refer to OS support.

It's not their fault that you can't use programs of your choice on iOS, that you have to pay Apple for a developer account for submitting apps to the App Store, and that the App Store T&C explicitly forbids free-software.

Nitpicking a bit, but it doesn't. It forbids redistribution of apps downloaded from the app store, which is a requirement of the GPL, and so the app store "license" and the GPL (not free software in general) are incompatible.

None of this matters much though because if you own the copyright to the code you can relicense it however you want, which is why VLC for example is on the app store.

Nitpicking a bit, but what works for a single association like Videolan (editor of VLC) may not work for a program that was developed by hundreds of contributors over the years, who would all have to give their approval for a re-licensing.

Wouldn't Briar have to be reimplemented anyway to build an iOS app? If they did it would be dual-licensed from the start so it shouldn't be an issue.

There are several FOSS apps on the app store

Yup[1], it's a pity because it will greatly reduce the network effect needed to get enough people using the app.

[1] https://code.briarproject.org/briar/briar/-/wikis/FAQ#will-t...

Many, many more people use Android than IOS.

I’d rephrase that: nowhere except Android.

Android and iOS aren’t the only games in town. Windows, macOS, various Linuxes desktop, various Linuxes mobile, Firefox OS and its successors…

I get fed up with things where your options are: (a) a commonly-clunky web system where you have to log in, possibly with tedious 2FA, every time you want to touch it, and (b) a sleek task-focused Google-Android/iOS app where you don’t. Banking is an example of an area where this is the norm. I want to use this improved process on a laptop, or perhaps on a mobile device where I can’t install their iOS or Google Play Store app.

There is Briar GTK [0] that runs on Linux Desktop/Mobile.

[0] https://code.briarproject.org/briar/briar-gtk

iOS only has high market share in the US, even in other, similarly rich western countries, Android dominates.

Additionally, iOS prevents you from keeping a background connection, which means anything else than polling or (apple-controled) push notification is a no go. Briar mostly works through Tor, which cannot work properly on standard iOS, due to the previously described limitations.

If you want software on iOS, complain to apple about their dumb policies, not on HN comment threads.

Yes, here you have Briar bumping up against the inability to run any fully decentralized mobile communication software on iOS. Seems like a serious limitation on the part of iOS at this point given trends towards decentralization in general.

The worst part is that an inactive background TCP connection is mostly free (of course, a Tor client is slightly more involved), so there is exactly 0 reason to forbid it, as long as apps are reviewed properly for abusive behavior (they are not).

Reply on news.ycombinator.com