Hacker News Reader

If an adversary is within bluetooth range of a Briar user what if any data or meta data they are able to gain?

For example, say there is a protest and law enforcement is running devices to capture the Briar data and meta data, what would they be able to record and would it be possible to playback (decrypt) the data at a later point if they were able to capture keys; my understanding is Signal counters playback attacks, but lacks P2P Bluetooth support.

Worth noting that Briar’s Bluetooth support appears to forward data, but not in real-time, so it’s technically not a mesh network; though not sure what you would call what it supports, maybe an asynchronous network?

You may like this app Meshenger (P2P Voice- and video phone App.) https://f-droid.org/packages/d.d.meshenger/

Sean Connery approves

"I'll take anal bum cover for $7000." -fake Sean Connery on SNL Jeopardy, selecting from the "An Album Cover" category

I'd like to hear more how you use forums/blogs for managing household projects.

> we both have email hosting in Europe while we live in the US, so neither of us, being frugal in principal, wants to send information to Europe and back in order to tell the person 100 ft away to come help bring in the groceries.

I like the frugality in principle. However, AFAICT, Briar uses Tor onion services, Bluetooth or WiFi to communicate. Does using Tor onion services for out-the-home IM violate the principle?

> The only issue that stops us from using DeltaChat (or email in general) is that we both have email hosting in Europe while we live in the US, so neither of us, being frugal in principal, wants to send information to Europe and back in order to tell the person 100 ft away to come help bring in the groceries.

The Briar page seems to suggest messages are routed through Tor:

> Briar uses the Tor network to prevent eavesdroppers from learning which users are talking to each other.

How different is that?

The page says that messages are also transported via wifi and Bluetooth. Presumably, the app can send messages locally when they are 100 feet away.

> we both have email hosting in Europe

If this is for privacy reasons, I have to point it out that the GDPR protects the data of people that are physically in the EU. I'm not a lawyer, but I'm not sure this applies to non-EU citizens that just happen to deposit some of their data in the EU without being physically here. Maybe you should delve in this corner case deeper, or if you did, I'm curious to know the answer.

He probably uses protonmail

Seems like Briar might be good for messaging to young kids. I could give them an old phone without a sim card, and run Briar on it.

What is your motivation for the "without a sim card" part? If the phone is connected to Wifi then they're either at home or at school--isn't the point being able to reach them no matter where they are?

I'm not too keen on my kids being on the internet all day. In my case the opposite solution seems better, a dumbphone so I can reach them, but TikTok can't.

They're mainly not online, and not signed up to online services, but it'd still be nice to be able to message the rest of the family, listen to music, share photos, etc.

Shared custody? I like being able to communicate, send/receive pictures/videos, do videocalls with my daughters when they are in their mother's place without having to ask her to share her phone for that.

I am actually travelling 10 thousands kilometers away from them for a month, having an instant messaging app is a saver for both me and my daughters.

We are currently using deltachat for this with email accounts I set up for them. They don't even have access to these accounts outside of deltachat yet and they can't be reached by others like they would with whatsapp.

Awesome idea.

You'd have no idea how many accounts they have, who they're talking to, and about what. Perfect privacy!

> It's actually instant messaging without any client hiccups or latency (looking at you, Signal).

This is almost certainly poor wifi / cell coverage, not Signal having "hiccups" or "latency." I routinely have real-time texting conversations with friends and I can see the messages are "seen" almost instantaneously, half-way across the US.

I've also never had an issue with voice chat. It's been flawless, and very high quality audio. As good or better than Facetime.

Also, unlike Briar, Signal is available for iOS, which is superior if you care about digital privacy, allowing users to disable a slew of data reporting (particularly location data) back to Apple that Android forces you to give Google.

Can you give more info on the data reporting options that we should be disabling?

> This is almost certainly poor wifi / cell coverage, not Signal having "hiccups" or "latency."

Signal is very finicky about that, though. I have friends who prefer Whatsapp simply because they don’t have to worry about connection stability. With Signal, you sometimes don’t even know if messages actually arrived or not.

Especially on Signal Desktop, its more reliable to close the app and reopen it than wait for it to reconnect to the server.

Meanwhile Element reconnects to Matrix super quick...

Element + Matrix. *chefs kiss*

I have never had the message delivery status icon be different than reality. Sometimes, rarely, things don't show as delivered for some time. But I have never had anyone tell me the message was delivered when the checkmark said otherwise.

Have you had the checkmark be inaccurate?

> available on iOS too

Ah yes, the two operating systems: Android + iOS. You can't have an account without registering a primary device on one of those OSs. No KaiOS, no Linux phones, no desktop machines, no web-only options. I'm mad about these mobile-duopoly-app-first services because you can't participate in alternative lifestyles when it Cowes to phone usage.

Amen to this. I bank with Starling and having decided to minimise my phone usage am having to move away from them. Likewise a variety of other services.

Honestly my banking situation + Signal is the biggest barriers to me switching. I pushed pretty hard to get friends and family to successfully switch off Messenger, LINE, and SMS for Signal (and now they're confused why the need a separate messaging app for SMS--thanks Moxie). I suppose I could write my own front-end wrapper around the bank, but they ain't paying me for that and would likely shut it down as insecure if they found out (even though there's no responsive design, they don't allow you to copy-paste or right-click, or use commas and other punctuation because the web system is built with TIS encoding I think, and they log you out with a meta refresh after 15 or 20 minutes of activity with no pop-up to save your work (in case you were trying to reformat another complaint message without puncuation in their messaging system), and I saw code checking for IE4 and Netscape Navigator 4).

comes* to phone useage

nicely said

Well, while not officially endorsed, there is `signald`. With mautrix-signal, I'm able to bridge my Signal and Matrix accounts. I can also make signald my primary device.

https://signald.org/

https://github.com/mautrix/signal

>iOS, which is superior for digital privacy

False dichotomy. GrapheneOS, LineageOS, you have options on (some) Android handsets. You have no options on iOS. Further, much of Apple's walled-garden ecosystem is closed source.

Apple is HORRIBLE for user privacy, only marginally less horrible than Google. The difference is that Google isn't a tyrant who insists on making devices that MUST run their own OS. Ironically, Pixel devices have some of the best support for flashing other OS's, modded ROMs, rooting, etc.

>GrapheneOS, LineageOS, you have options on (some) Android handsets

These are not normal approaches used by the common person. Apple is not horrible for privacy, they simply help prevent certain types of surveillance capitalism.

Apple absolutely is horrible for privacy. To insist otherwise suggests you might either be uninformed, willfully ignorant, falling victim to Apple's sham marketing around privacy, experiencing stockholm syndrome, or an apple employee.

Examples include: - Apple surreptitiously recording conversations without user consent (https://www.politico.eu/wp-content/uploads/2020/05/Public-St...) - Apple approving apps in the app store that have libraries ostensibly singly focused on the violation of privacy, complete with behavior that would be expected from those with suspicious or questionable motives, like uploading in the middle of the night (https://www.oregonlive.com/opinion/2019/05/its-3-am-do-you-k...) - Misleading users into thinking that their wifi and bluetooth may be disabled when they actually aren't - a UI control that merely disconnects the radios from APs / remote devices, rather than turning the radios off (https://www.theguardian.com/technology/2017/sep/21/ios-11-ap...) - iPhones send a ton of data (including call logs) to Apple servers, which participated in the illegal PRISM mass surveillance scandal, and conceivably report to similar secret programs that the public is not aware of to this day (https://theintercept.com/2016/11/17/iphones-secretly-send-ca...) - iMessage reports back to Apple every phone number you've ever entered into it, data that Apple probably shares with law enforcement (https://theintercept.com/2016/09/28/apple-logs-your-imessage...) - iCloud is enabled by default. All of your pictures, videos, documents, etc are NSA-accessible, but also rendered vulnerable to anyone with your credentials. This was the root cause of the celebrity nude photo leaks several years ago. - Mac computers had routinely sent files stored on encrypted disks to Apple servers without user permission ever being prompted for or granted (https://www.theguardian.com/technology/2014/nov/04/apple-dat...) - Here's a great analysis of all the snooping Apple did on Yosemite with all privacy features enabled (https://github.com/fix-macosx/yosemite-phone-home) - More various articles (https://arstechnica.com/gadgets/2014/05/new-guidelines-outli...), (https://www.theguardian.com/technology/2014/jul/23/iphone-ba...), (https://finance.yahoo.com/blogs/the-exchange/privacy-advocat...).

And these are just privacy concerns. This doesn't even begin to delve into the realms of DRM, downgrade prevention, planned obsolescence, dark patterns, censorship, or open collaboration with inhumane, authoritarian regimes.

>To insist otherwise suggests you might either be uninformed, willfully ignorant, falling victim to Apple's sham marketing around privacy, experiencing stockholm syndrome, or an apple employee.

No, it means I'm optimizing for the average user who will not go out of their way to LARP a paranoid opsec level.

The average user's probably got their SSN, DoB, address, full name, employment history, credit card track 2's, passport details, and more spread across multiple breaches, being sold across multiple darkweb markets, precisely because they have zero regard for privacy.

Suggesting that usage of GrapheneOS is "LARP"ing a "paranoid" opsec level is dismissive of the very-real threats facing domestic abuse victims, whistleblowers, journalists & political activists/dissidents in repressive, authoritarian regimes, and countless others.

Just because you live in a safe, privacy-respecting, liberal democracy doesn't mean everyone else does, and it absolutely isn't reasonable justification to demean those who don't by painting them as irrationally paranoid. That's gaslighting real victims who actually have to be concerned about these companies handing out their data to countries that will put them through, in extreme cases, excruciating torture, before killing them or imprisoning them for life.

Not everyone is lucky enough to live your life, so stop assuming your threat model is automatically the "right" one for everyone else, and that any more intensive threat models than yours are inherently "irrational", "unrealistic", or "paranoid".

Privacy is not a one dimensional thing. Just like security, it exists in context, relative to a threat model.

Think about the threat model for an "everyday" person. It is different than an American journalist contacting sources in the United States, which is different than a journalist in Russia or China.

That only supports the above statement. Apple is particularly bad for everyday privacy at population scale.

"This is almost certainly poor wifi / cell coverage, not Signal having "hiccups" or "latency." I routinely have real-time texting conversations with friends and I can see the messages are "seen" almost instantaneously, half-way across the US."

Here in europe not so much. Most of the time it works somewhat instantly, but it too often happend, that a single message arrived a unknown time later.

It seems signal is optimizing for real time chat, so people do not notice, but sending a single message can be delayed. The thing is, it happened too many times already, that it arrived hours or days later, up to the point that I would not use Signal anymore for any important, time critical message.

Yeah, Signal is definitely not a reliable messenger. I've also had messages arrive with hours of delay.

iMessage is way more reliable in my experience.

Here in Australia I can send a message from one phone in onee hand to the other phone in the other hand. Most of the time I can unlock the second phone and open signal before the message arrives. Fast enough for me but not instant.