This article makes some good points generally, but it is ultimately marketing for a commercial snakeoil service which has a gigantic backdoor in its very threat model: when a tutanota users send an “end to end encrypted email” to a non-tutanota user what actually happens is that they receive a link to a web page which they type the encryption key in to.
Even if the javascript on that page is open source and audited, it is not possible (even for sophisticated users) to verify that the server is actually sending the correct javascript each time that a user accesses it. So, the server can easily target specific users and circumvent their encryption. The same applies to tutanota users emailing eachother when one of them is using the webmail interface.
This effectively reduces the security of their e2ee to “it works as long as the server remains honest”. But, if you fully trust the server to always do what it says it will, why bother with e2ee at all? They may as well just promise not to read your email.
I am removing this from !privacy@lemmy.ml with the reason “advertising for snakeoil”. (If you’re reading this on another instance and the post isn’t deleted, ask your instance admins to upgrade… outdated versions of lemmy had a bug which prevents some moderation actions from federating.)
where you insert yourself as an expert on what Open Source is/not is
this is not really a controversial topic; assuming you were just confused, I linked to the definition and (in another comment you replied to) to the list of governments and other entities which all agree about it. i again encourage you to read those links as it sounds like you haven’t.
since you’ve declined to remove the inaccurate statement “The Software is open-source” from your post here in !privacy@lemmy.ml I am removing the post. (since I am an admin rather than a mod of the community, the moderation action will only federate to instances running the latest version of lemmy, which your instance isn’t, but fyi it should be removed from lemmy.ml and any other instances running updated software.)
fwiw i think this is the first time i’ve used my admin privileges to remove something in a discussion i participated in myself, which tbh feels a little weird, but since this is a clear case of someone declining to remove a post making an objectively false claim, i’m going to.
Still i would argue that it is open source, since it is open for everyone to see.
You are mistaken. Please read The Open Source Definition and the Open-source software wikipedia article, and then kindly edit your post to remove the inaccurate statement “The Software is open-source”.
yes, as i said, it is not free software.
it is also not open source software.
hey @ToxicWaste@lemm.ee can you please edit your post to remove the inaccurate statement “The Software is open-source”? you could say it is “source-visible software” or some other 🤡 term, but “open source” has a definition and this software’s license aint it.
(See this post about NIST’s PQC standardization process…)
What stops them from being able to? They could actually infer a lot of the metadata just from the encrypted network traffic, without even looking inside the VMs at their execution state. But, they can also see inside, so they can keep the kind of logs (outside the VM) which Signal [says that they] wouldn’t.
They say that they don’t, and I think it is extremely likely that Signal employees are entirely sincere when they say that.
But, even if they truly don’t keep metadata, they can’t actually know what their hosting provider (Amazon) is doing. And, their cryptographic “sealed sender” thing doesn’t really solve the problem. If someone with the right access at Amazon really wants the Signal metadata, they can get it, and if they can, anybody who can coerce, compel, or otherwise compromise those people (or their computers) can get it too.
One can say they’re confident that the kind of adversaries they care to protect against don’t have that kind of capability, but it isn’t reasonable to say that Signal’s no-logging policy protects metadata without adding the caveat that routing all the traffic through Amazon makes the metadata of the protocol’s entire userbase available in a single place for the kind of adversaries that do.
It’s tragicomic how some people trust Telegram specifically because they perceive CEO Pavel Durov to be an enemy of the Russian government, while others trust Telegram because they think it is actually a Russian company and thus won’t share data with western governments. (Durov talking about the facts that Signal has received millions from the US government’s Radio Free Asia and sends all messages through Amazon servers helps with this second perception).
I assume Durov’s relationship status with various governments is it’s complicated but also cordial. IMO it would be prudent to assume that intelligence and law enforcement agencies from lots of countries, including ones that are adversaries of each other, are all getting lots of data from Telegram both with and without the company’s cooperation.
There is literally no e2ee for most messages, and new devices can be added and authenticated by SMS, so, even the weakest of adversaries can play with it. Telegram really democratizes surveillance capabilities.
Like telegram, threema insists on making up their own 🤡-crypto constructions which (unsurprisingly) are not very good: https://breakingthe3ma.app/ (see also The Register’s summary, and/or here for some earlier research).
Their response to those findings was to reinvent and replace everything (again). It seems like a pretty safe bet that their new amateur cryptographic constructions will get broken too, just as soon as the next bored researcher gets around to looking closely at it.
I’m not sure what exactly you mean by “always active desktop sessions” but for any definition I could imagine it is possible to do that while having e2ee. Many e2ee messengers have multi-device support nowadays.
Telegram doesn’t need to have e2ee because they’ve pulled some trick of becoming widely perceived as being privacy friendly despite not actually offering any e2ee in most cases, and offering only some 🤡-protocol in the few cases where they do.
Another reason for them not to implement e2ee is that they’re most likely monetizing their users content data as well as the metadata (and in more ways than just charging some types of police for access to it, which is presumably only a small fraction of their revenue).
🤔
both require phone numbers, and both concentrate metadata in a central location (Amazon servers, in the case of signal).
both sort of pretend to be free open source software, and sort of are but with a lot of caveats.
telegram doesn’t even have end-to-end encryption (except for some wacky not-peer-reviewed thing in 1:1 ‘secret chats’ which are rarely used); at least signal has it beat there.
https://simplex.chat/ is a new messenger which doesn’t have any of the above problems and seems quite promising imo.
I’m deleting this (from lemmy.ml) because people are flagging it as an ad and after a couple of minutes looking at their site and github my impression is that, while they have published some source code, this is not a thing you can actually self-host or use without paying them. If I’m mistaken feel free to make a new post linking to the install instructions instead of the signup instructions.
Well I hear Duckduckgo’s new browser something new finally instead of based off an existing browser
Where did you hear that? According to wikipedia DuckDuckGo’s browser uses the operating system’s rendering engine on mobile (chromium’s on android, and safari’s on ios), and the mac version also uses webkit (safari’s engine).
The windows version doesn’t appear to even be open source but I would be surprised if it isn’t also using chromium’s rendering engine.
is the databag protocol/design documented somewhere? does it claim to have forward secrecy?
from a quick glance I see here they’re generating an AES key from a passphrase and using it to encrypt an RSA private key, which is… not a good sign.
fwiw https://simplex.chat is another thing which seems to have similar goals and functionality but is better documented.
when you send an SMS, all of the metadata imaginable is retained by default… as is the content of the message, in many cases.
besides law enforcement and other government agencies, numerous telco employees also have access to this data, and, in many countries at least, some of it is also sold to data brokers.
you can’t get much less private than SMS.
Use free/libre software, running on your own server, and don’t use any 3rd party services besides the payment processor(s).
The site you’re referring to appears to be built using WordPress with https://en.wikipedia.org/wiki/WooCommerce btw.
they still load for me… also, the first 3 are on archive.org:
- https://web.archive.org/web/20230323043434/https://discord.com/jobs/6590671002
- https://web.archive.org/web/20230314182529/https://discord.com/jobs/5806068002
- https://web.archive.org/web/20230314182529/https://discord.com/jobs/6588400002
(and the last one says it is saving there now but hasn’t yet)
Discord says they aren’t selling user data, but from the job descriptions they’re currently hiring for you can see that they are clearly collecting and analyzing a lot of it:
- •
- edri.org
- •
- 10M
- •
The current link in this post goes to a year-old story about the online translation feature… here is the same site’s coverage of this week’s news - which is that there is now offline translation support: https://www.ghacks.net/2022/05/30/firefox-translations-firefoxs-offline-translate-feature-is-making-progress/ (i assume this is what OP actually meant to post). (edit: OP fixed the post’s link)
Here is a web page that loads their wasm translation engline and does the actual translation offline (and it does work in the stable release of Firefox). It’s irritating that the extension still requires a nightly firefox build, as I’d like to use it in my daily browsing but I don’t want to use nightly all the time.
Not in this case. I suggest you read the open letter (which is signed by 335 scientists and researchers from 32 countries so far).
Or, do you consider it to be corporate abuse when Mozilla prevents governments from using their certificate authorities to launch MITM attacks and impersonate websites for the purpose of intercepting internet traffic? Because that is what we’re talking about.