Comment by southerntofu | Hacker News Reader

Comment by southerntofu | Hacker News Reader

Parent Full thread

This Olvid looks like bullshit.

1) there's no source code. Security via obscurity is not a feature for software (but it's a first line of defense for networks).

2) Olvid is distributed via malicious repos Apple AppStore and Google Play Store

3) Olvid is distributed with spyware: https://reports.exodus-privacy.eu.org/en/reports/io.olvid.me...

4) They insist on "French tech", which is an ultra nationalist startup-nation label which does not imply any form of security, but rather that they report to french intelligence services (DGSI/DGSE) not USA intelligence services

5) They claim on the website that they're the first messenger certified by ANSSI, which is true but misleading. ANSSI has previously certified other secure messaging components (such as PGP implementations), and has very likely been involved in approving (though not certifying for private use) the french government's fork of Element matrix client (Tchap) as the official secure messenger application of the French government.

All in all, it's just a french startup making claims to make money. Nothing to see there, unlike Session which has some actual source code and novel approaches to show off (despite my reluctance due to blockchain tech).

1) it isn't open source yet because of reduced team https://olvid.io/faq/is-olvid-open-source/ it'll change soon

2) If you consider AppStore and PlayStore as malicious repos you can stop using Android or Apple phone i think ...

3) if you search "network.loki.messenger" app on exodus you can find "Loki Messenger" (old name of Session ) with two "spyware" inside too

4) & 5) ok but i trust the very skilled person behind this software (https://dblp.org/pid/f/MatthieuFiniasz.html) that worked 6 years on this project.

I think Session is just another textsecure implementation (https://en.wikipedia.org/wiki/TextSecure) that limit meta data nothing new under the sun.

> it isn't open source yet

I've heard that claim so many times, yet very few startups hold their promise to open the source code. Especially for something branded as a secure messenger, how to give it any credibility without being able to inspect/audit the source?

> you can stop using Android or Apple phone i think

I use deblobbed android without google services -> replicant.us

> you can find "Loki Messenger" (old name of Session ) with two "spyware" inside too

I pointed it out in another comment so i'm aware. However these trackers have been removed in the meantime, and Session is actually free software which you can build from source.

> i trust the very skilled person

Good to see they've got a competent cryptographer, however competent cryptographers does not necessarily make a successful and secure decentralized messenger. See also Wire who had serious crypto and promises to open source everything, but to my knowledge the server side was never released, and Wire more or less failed as yet-another encrypted centralized messenger like Signal. Or GNU/Net who also has some solid research and practical applications [0], yet didn't grow so much over the years.

> Session is just another textsecure implementation

In fact not. It's certainly a TextSecure fork, but the only TextSecure implementation left is silence.im, whose maintainer is an employee of La Quadrature du Net from what i understand. But being SMS-based, silence.im leaks a lot of metadata (unique identifiers + timestamps).

And contrary to other TextSecure forks (like Signal), Session does not rely on a centralized infrastructure or sketchy "secure enclaves". Like i said i'm very critical of relying on a blockchain at all, but i have to admit Session looks (from a quick look) like a serious project.

[0] https://www.gnunet.org/en/news/2021-05-DISSENS.html

> See also Wire who had serious crypto and promises to open source everything, but to my knowledge the server side was never released

The wire server code is open source AFAIK [0]

> This repository contains the source code for the Wire server. It contains all libraries and services necessary to run Wire.

[0] https://github.com/wireapp/wire-server

You are correct, thanks for pointing it out! I may have confused Wire with Threema or something else entirely.

Do you have any news about the open federation they announced in 2017 when they open sourced the server code? [0]

[0] https://wireapp.medium.com/open-sourcing-wire-server-code-ef...

Reply on news.ycombinator.com