Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Moxie Marlinspike, of Open Whisper Systems, had some pretty pessimistic things to say about how stagnant federated protocols become, and why they avoided that approach with Signal. https://signal.org/blog/the-ecosystem-is-moving/

End result: Signal is a real, usable tool, the recommendation of which is fully actionable security and privacy advice you can share with anyone who is capable of using WhatsApp.

Here's some HN discussion on the post, and a piece with counter arguments. The latter, I feel, misses the entire point of how urgent the need for usable privacy and security tools is.

https://news.ycombinator.com/item?id=11668912 https://gultsch.de/objection.html



There are definitely some good arguments on either side of the federation discussion, though I personally tend to lean more towards the Moxie side than the optimistic one.

That being said, a big part of me wonders if (assuming you could find lawmakers with enough technical literacy to propose it, which would be a pretty huge ask!) you might be able to get the best of both worlds by requiring sites like facebook to expose an API for programmatic access. That would solve the stangancy problems that Moxie highlights (not to mention sidestepping the need to get everyone to agree on any one protocol), whilst simultaneously forcing a whole lot of things to open up.

Alternatively: part of the reason these walled gardens exist is that they control the concept of identity. Not necessarily in the sense of "this is my profile", but more in the sense of authentication and authorization. If you moved that somewhere else -- say, in the browser -- it would make it much easier to build systems that are interoperable.


The problem with that approach is that while did result in fast delivery of a good product for the 12 people using signal, it’s not going to grow.

The problem with all newer systems is that they are identity based, which doesn’t scale down to all of the device/station use cases that phones exist for.


Yes, that is the problem, and someone is hopefully working on it.

But if you start looking at those '12 users', you should notice that that the need is extreme.

This includes drug people and at-risk populations like sex workers: I'm not happy until drugs and sex work are decriminalized globally, so I want to protect sellers and buyers, a partial reason why I participate as a Tor relay admin. Then there are journalists and politicians. Apps like Signal, Wickr, Wire and Threema aren't as much the ecosystem we want as the silos we deserve.

That said, you'd be surprised how easy a sell Signal is in some cases.

I've gotten a bunch of friends over to Signal, from the likewise end-to-end encrypted Whatsapp. And after a family crisis, where a friend of the family died, I explained how the metadata of a mostly dormant Whatsapp group lighting up suddenly could be interpreted.

Facebook knows we're a family of aging parents and grown-up, mostly independent 25+ kids, so there might be a crisis or emotions whenever there are big bursts of activity. A crisis might make people more susceptible to predatory ads.

This was enough to convince my folks. So, family chats are now on Signal. The app is good enough. Granted, my parents and siblings are active in professions related to either legal or social services, so they understand the need for privacy and my overall desire to curb stomp the online tracking industry.


I am guessing that you don't do street drugs, because signal is immensely popular with young people. I'm in the middle of millennial ages, and have dozens of contacts in my phone alone that are on signal. Often the first thing a new "guy" will ask is if the buyer has signal. Signal has absolutely normalized encryption for anyone that buys illicit things or does protest/organizing work.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: