privacyguides/privacytools.io
Archived
1
0
Fork 0
Code Issues 304 Pull Requests 47 Activity

🆕 Software Suggestion | Rocket.chat #999

New Issue
Closed
opened 2019-06-18 13:13:10 +00:00 by zlbabe · 12 comments
zlbabe commented 2019-06-18 13:13:10 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Basic Information

Name: Rocket.chat
Category: software
URL: https://rocket.chat/
Github: https://github.com/RocketChat

Description

The ultimate Free Open Source Solution for team communications.

## Basic Information **Name:** Rocket.chat **Category:** software **URL:** https://rocket.chat/ **Github:** https://github.com/RocketChat ## Description The ultimate **Free Open Source** Solution for team communications.
👍 1
danarel commented 2019-06-18 20:58:16 +00:00 (Migrated from github.com)
Copy Link
Copy Source

I second Rocket.Chat

Good software that can be self-hosted. Great alternative to Slack.

I second Rocket.Chat Good software that can be self-hosted. Great alternative to Slack.
zlbabe commented 2019-06-19 13:35:51 +00:00 (Migrated from github.com)
Copy Link
Copy Source

I still don't know why people keep using slack, that's mad !!

I still don't know why people keep using slack, that's mad !!
Mikaela commented 2019-06-20 22:03:24 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Edit 2019-07-30: Original comment is still below, but Rocket.chat does federate and even that doesn't safe it for being usable for 1:1 IM.

I think we would need a new category for Rocket.chat as I am under impression that it's currently centralized service, even if open source and you would need to selfhost it and get all your contacts onto it for it to be useful.

Edit 2019-07-30: Original comment is still below, but Rocket.chat does federate and even that doesn't safe it for being usable for 1:1 IM. * https://rocket.chat/docs/administrator-guides/federation/#federation * * * * * I think we would need a new category for Rocket.chat as I am under impression that it's currently centralized service, even if open source and you would need to selfhost it and get all your contacts onto it for it to be useful.
👍 1
danarel commented 2019-06-20 22:11:28 +00:00 (Migrated from github.com)
Copy Link
Copy Source

It's not really a chat app like SIgnal, so the contacts you're moving there are work ones. It's a replacement for Slack. So it's good for team collaboration chats.

It's not really a chat app like SIgnal, so the contacts you're moving there are work ones. It's a replacement for Slack. So it's good for team collaboration chats.
jonah commented 2019-06-21 02:49:17 +00:00
Copy Link
Copy Source

I agree this would probably require a new category if it were added, like "Team Collaboration". Not the best fit for general Instant Messaging.

I agree this would probably require a new category if it were added, like "Team Collaboration". Not the best fit for general Instant Messaging.
danarel commented 2019-06-21 02:51:15 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Maybe under productivity tools?

Maybe under productivity tools?
jonah commented 2019-06-21 03:40:13 +00:00
Copy Link
Copy Source

Perhaps, although I feel like if we wanted to do alternatives to Slack, Mattermost, Google Hangouts for Business, etc., there might be enough alternatives to warrant a separate category?

  • Rocket.Chat of course
  • Zulip
  • Riot.im is kind of in a gray area between IM and this but could be listed twice
  • Mattermost?

...maybe there aren't as many as I thought but that's just off the top of my head. Or I suppose these could be added to Productivity under a Real-Time Chat header or something, whatever works.

Perhaps, although I feel like if we wanted to do alternatives to Slack, Mattermost, Google Hangouts for Business, etc., there might be enough alternatives to warrant a separate category? - Rocket.Chat of course - Zulip - Riot.im is kind of in a gray area between IM and this but could be listed twice - Mattermost? ...maybe there aren't as many as I thought but that's just off the top of my head. Or I suppose these could be added to Productivity under a Real-Time Chat header or something, whatever works.
👍 1
blacklight447 commented 2019-07-21 10:45:25 +00:00 (Migrated from github.com)
Copy Link
Copy Source

I would say that we should make a new category.

I would say that we should make a new category.
five-c-d commented 2019-07-21 16:52:16 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Please not three categories. We already have IM category and VoIP category, with most of the tools in both areas doing something that can be categorized as "voice-chat or at least voice-notes" and pretty much ALL of the tools handling basic IM-type-stuff.

If we add a third category for "productivity-chat" that is going to make things more difficult, not less. RocketChat is aimed at teams, just like WirePro and RiotIM and whatsapp4biz, but you can use signalapp for groupchats as well (in a corporate environment where the firm provides all employees with BoringPhones or work phones or whatever).

It is a distinction, but it is a distinction in how things are used (and what they are optimized for), not one that is a tool-category-distinction methinks. The category is "messengers" and the subcategories are

  1. "IM" aka 1-on-1 chat
  2. "teams" aka groupchat / "productivity-chat"
  3. "VoIP" aka quasi-realtime-audio&video chat (though voiceNotes are a fallback)
  4. "confcalls" aka N-way quasi-realtime-audio&video chat

There is a separate category for file-transfer tools, because although you can transfer files with messengers, it is not optimal (and there are usually strict size-caps). You are better off transferring a large file using a dedicated tool like firefoxSend or magicWormhole, and then using your messenger-app to send the URL of that file-transfer.

If there have to be two categories, I would suggest one of them be "one-on-one messengers" that encompasses IM+VoIP between two humans (each having multiple devices that sync together). The other category would be "N-way messengers" which would cover groupchats and confcalls. Almost every one-on-one messenger can do some kind of voice-chat, and some kind of groupchat, but it is rare to see N-way end2end encrypted video-confcalls.

Please not three categories. We already have IM category and VoIP category, with most of the tools in both areas doing **something** that can be categorized as "voice-chat or at least voice-notes" and pretty much ALL of the tools handling basic IM-type-stuff. If we add a third category for "productivity-chat" that is going to make things more difficult, not less. RocketChat is aimed at teams, just like WirePro and RiotIM and whatsapp4biz, but you can use signalapp for groupchats as well (in a corporate environment where the firm provides all employees with BoringPhones or work phones or whatever). It is a distinction, but it is a distinction in how things are used (and what they are optimized for), not one that is a tool-category-distinction methinks. The category is "messengers" and the subcategories are 1. "IM" aka 1-on-1 chat 2. "teams" aka groupchat / "productivity-chat" 3. "VoIP" aka quasi-realtime-audio&video chat (though voiceNotes are a fallback) 4. "confcalls" aka N-way quasi-realtime-audio&video chat There is a separate category for file-transfer tools, because although you **can** transfer files with messengers, it is not optimal (and there are usually strict size-caps). You are better off transferring a large file using a dedicated tool like firefoxSend or magicWormhole, and then using your messenger-app to send the URL of that file-transfer. If there have to be two categories, I would suggest one of them be "one-on-one messengers" that encompasses IM+VoIP between two humans (each having multiple devices that sync together). The other category would be "N-way messengers" which would cover groupchats and confcalls. Almost every one-on-one messenger can do *some* kind of voice-chat, and **some** kind of groupchat, but it is rare to see N-way end2end encrypted video-confcalls.
Mikaela commented 2019-07-30 16:26:52 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Sorry @five-c-d, #1065

Warning to Rocket.chat: End-to-end encryption is currently in alpha and not supported on mobile.

Sorry @five-c-d, #1065 Warning to Rocket.chat: [End-to-end encryption is currently in alpha and not supported on mobile](https://rocket.chat/docs/user-guides/end-to-end-encryption/).
five-c-d commented 2019-08-05 16:25:48 +00:00 (Migrated from github.com)
Copy Link
Copy Source

RocketChat stores the quasi-end2end keys, server-side. And does not implement perfect forward secrecy. More like protonmail's security-model than like signalapp. https://github.com/RocketChat/Rocket.Chat/issues/9999#issuecomment-380319382 Basically, if your decrypt-passphrase is every compromised (either by a trojan or a compromised server... or just, by you logging in from a browser or OS that is vulnerable to the badguys) then the badguys get your entire messaging-history, and that of every team you are on, correct?

RocketChat stores the quasi-end2end keys, server-side. And does not implement perfect forward secrecy. More like protonmail's security-model than like signalapp. https://github.com/RocketChat/Rocket.Chat/issues/9999#issuecomment-380319382 Basically, if your decrypt-passphrase is every compromised (either by a trojan or a compromised server... or just, by you logging in from a browser or OS that is vulnerable to the badguys) then the badguys get your entire messaging-history, and that of every team you are on, correct?
Perelandra0x309 commented 2019-08-06 02:22:46 +00:00 (Migrated from github.com)
Copy Link
Copy Source

I could not find any detailed technical documents on their website so I went looking at the code. Here is where the key generation happens:
https://github.com/RocketChat/Rocket.Chat/blob/develop/app/e2e/client/helper.js

The generateAESKey function creates a AES-CBC 128 bit key to use for encrypting the message data. The generateRSAKey creates an RSA 2048 bit key that is used for a user's public/private key. Essentially what happens is the message gets encrypted with a AES key, then that AES key is encrypted for all participants in a room with their public RSA key.

I have concerns that these keys are not very strong by today's computing standards and probably will not be considered safe within 10 years. With the open source options we have today with elliptical curve shared secret generation, perfect forward secrecy and ratcheting keys using these older encryption methods is disappointing and potentially dangerous.

I could not find any detailed technical documents on their website so I went looking at the code. Here is where the key generation happens: https://github.com/RocketChat/Rocket.Chat/blob/develop/app/e2e/client/helper.js The generateAESKey function creates a AES-CBC 128 bit key to use for encrypting the message data. The generateRSAKey creates an RSA 2048 bit key that is used for a user's public/private key. Essentially what happens is the message gets encrypted with a AES key, then that AES key is encrypted for all participants in a room with their public RSA key. I have concerns that these keys are not very strong by today's computing standards and probably will not be considered safe within 10 years. With the open source options we have today with elliptical curve shared secret generation, perfect forward secrecy and ratcheting keys using these older encryption methods is disappointing and potentially dangerous.
This repo is archived. You cannot comment on issues.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
:mag:🤖 Search Engines
approved
approved, waiting for a PR
 dependencies
Pull requests that update a dependency file
 duplicate
feedback wanted
high priority
I2P
The Invisible Internet Project (I2P)
 iOS
low priority
OS
Operating Systems
 Self-contained networks
Social media
stale
A label for stalebot if it gets added
 streaming
Anything related to media streaming.
 todo
Tor
Anything covering the Tor network
 WIP
active work in progress, do not merge or PR (yet)!
 wontfix
Issues or bugs that will not be fixed and/or do not have significant impact on the project.
 XMPP
Extensible Messaging and Presence Protocol
 [m]
Matrix protocol
 ₿ cryptocurrency
ℹ️ help wanted
↔️ file sharing
⚙️ web extensions
Browser Extension related issues
 ✨ enhancement
❌ software removal
💬 discussion
🤖 Android
🐛 bug
💢 conflicting
📝 correction
Correction of content on the website
 🆘 critical
📧 email
🔒 file encryption
📁 file storage
🦊 Firefox
Firefox & forks, about:config etc.
 💻 hardware
🌐 hosting
🏠 housekeeping
Anything primarily related to site cleanup.
 🔐 password managers
🧰 productivity tools
🔎 research required
🌐 Social News Aggregators
🆕 software suggestion
👥 team chat
🔒 VPN
Virtual Private Network
 🌐 website issue
*Technical* issues with the website.
 🚫 Windows
👁️ browsers
🖊️ digital notebooks
🗄️ DNS
Domain Name System
 🗨️ instant messaging (im)
🇦🇶 translations
Anything covering a translated version of the site
No labels 🆕 software suggestion 👥 team chat
Milestone
No items
No Milestone
Assignees
Clear assignees
jonah
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: privacyguides/privacytools.io#999