privacyguides
/
privacytools.io
Archived
1
0
Fork 0
Code Issues 304 Pull Requests 47 Activity

Redo of instant messenger section (centralized, federated, peer to peer) #1500

Merged
dngray merged 1 commits from pr-instant_messaging_refinement into master 2019-11-28 06:45:55 +00:00
Conversation 13 Commits 1 Files Changed 10 +262 -61
dngray commented 2019-11-17 14:14:14 +00:00 (Migrated from github.com)
Copy Link

I needed to add these icons because they did not exist.

The only one I needed to change was the XMPP logo, as it wasn't square, (only by a few pixels).

Matrix

I also edited the description for Matrix. Initially in https://github.com/privacytoolsIO/privacytools.io/issues/1377 I was going to mention about the privacy sprint. I think this might be a bit complex for new users and really unless they understand what those issues were about it serves little purpose in adding it.

Likewise the confusion between RiotX and regular Riot, I decided not to mention this as users should use what is generally available unless they know otherwise.

I also removed the Experimental E2EE badge as I do not believe that the previous description at all reflects the stability of E2EE in Riot currently which is pretty good, just need to remember to enable it.

XMPP

The original description is too complex so I decided to simplify that also. We won't talk about the bad XMPP clients just the ones we've handpicked.

Netlify preview: https://deploy-preview-1500--privacytools-io.netlify.com/software/real-time-communication/

I needed to add these icons because they did not exist. - XMPP: [XMPP_logo.svg](https://commons.wikimedia.org/wiki/File:XMPP_logo.svg) - Qtox: [qtox.svg](https://github.com/qTox/qTox/blob/master/img/icons/qtox.svg) - Jami: [jami.svg](https://git.jami.net/savoirfairelinux/docs.jami.net/blob/master/img/jami.svg) - Briar: [logo_circle.svg](https://code.briarproject.org/briar/briar/blob/master/briar-android/artwork/logo_circle.svg) - Matrix: [matrix favicon.svg](https://github.com/vector-im/logos/blob/master/matrix/matrix%20favicon.svg) The only one I needed to change was the XMPP logo, as it wasn't square, (only by a few pixels). ### Matrix I also edited the description for Matrix. Initially in https://github.com/privacytoolsIO/privacytools.io/issues/1377 I was going to mention about the [privacy sprint](https://vector-im.github.io/feature-dashboard/#/plan?label=privacy-sprint&repo=vector-im/riot-web&repo=vector-im/riot-ios&repo=vector-im/riot-android&repo=vector-im/riotX-android&repo=matrix-org/matrix-doc&repo=matrix-org/sydent). I think this might be a bit complex for new users and really unless they understand what those issues were about it serves little purpose in adding it. Likewise the confusion between RiotX and regular Riot, I decided not to mention this as users should use what is generally available unless they know otherwise. I also removed the Experimental E2EE badge as I do not believe that the previous description at all reflects the stability of E2EE in Riot currently which is pretty good, just need to remember to enable it. ### XMPP The original description is too complex so I decided to simplify that also. We won't talk about the bad XMPP clients just the ones we've handpicked. * * * * * Netlify preview: https://deploy-preview-1500--privacytools-io.netlify.com/software/real-time-communication/
netlify[bot] commented 2019-11-17 14:14:51 +00:00 (Migrated from github.com)
Copy Link

Deploy preview for privacytools-io ready!

Built with commit b0e178f4d1

https://deploy-preview-1500--privacytools-io.netlify.com

Deploy preview for *privacytools-io* ready! Built with commit b0e178f4d1ab956fbf18576101128a6876e133c0 https://deploy-preview-1500--privacytools-io.netlify.com
dngray commented 2019-11-17 17:25:28 +00:00 (Migrated from github.com)
Copy Link

https://github.com/dngray/ptio-edited-logos I put up the logos here, they got edited with a border.

https://github.com/dngray/ptio-edited-logos I put up the logos here, they got edited with a border.
nitrohorse (Migrated from github.com) reviewed 2019-11-17 17:34:29 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
nitrohorse (Migrated from github.com) commented 2019-11-17 17:34:28 +00:00 
  description="Encrypted instant messaging and video calling software. Uses its <a href="https://toktok.ltd/spec.html">own encryption protocol</a> that has not yet been officially audited by cryptographers."
```suggestion description="Encrypted instant messaging and video calling software. Uses its <a href="https://toktok.ltd/spec.html">own encryption protocol</a> that has not yet been officially audited by cryptographers." ```
Mikaela (Migrated from github.com) reviewed 2019-11-17 20:13:47 +00:00
Mikaela (Migrated from github.com) left a comment

I have to pause reviewing to have a dinner, but I will continue from P2P as soon as I can.

I have to pause reviewing to have a dinner, but I will continue from P2P as soon as I can.
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
Mikaela (Migrated from github.com) commented 2019-11-17 20:03:35 +00:00

I think the actual Matrix logo should be used here instead of the Riot one. The [m] one, I mean.

I think the actual Matrix logo should be used here instead of the Riot one. The `[m]` one, I mean.
Mikaela (Migrated from github.com) commented 2019-11-17 20:05:31 +00:00

Why is Matrix section advertising bridging capabilities to other platforms, while XMPP had transporting to other platforms since always? :)

Why is Matrix section advertising bridging capabilities to other platforms, while XMPP had transporting to other platforms since always? :)
Mikaela (Migrated from github.com) commented 2019-11-17 20:07:30 +00:00 
  <a href=\"https://conversations.im/omemo/\">OMEMO</a> is the most popular XEP (XMPP extension) for E2EE (end-to-end encryption). Unlike Matrix, clients are only developed by the community and not by the foundation itself. We've linked some of the ones which we think are good choices below."

I also think that this introduction is looking a lot more complicated.

```suggestion <a href=\"https://conversations.im/omemo/\">OMEMO</a> is the most popular XEP (XMPP extension) for E2EE (end-to-end encryption). Unlike Matrix, clients are only developed by the community and not by the foundation itself. We've linked some of the ones which we think are good choices below." ``` I also think that this introduction is looking a lot more complicated.
Mikaela (Migrated from github.com) commented 2019-11-17 20:08:16 +00:00 
  labels="warning:Warning inconsistent E2EE:VoIP and File transfers/names may not be end-to-end encrypted"
```suggestion labels="warning:Warning inconsistent E2EE:VoIP and File transfers/names may not be end-to-end encrypted" ```
Mikaela (Migrated from github.com) commented 2019-11-17 20:10:32 +00:00 
  linux="https://dino.im/"

This may be controversial though as it's still in early development, while being the most modern. It's also horribly outdated in some repos.

```suggestion linux="https://dino.im/" ``` This may be controversial though as it's still in early development, while being the most modern. It's also horribly outdated in some repos.
Mikaela (Migrated from github.com) commented 2019-11-17 20:11:36 +00:00 
  ios="https://siskin.im/"

More praised client on iOS, but I am missing personal experience.

```suggestion ios="https://siskin.im/" ``` More praised client on iOS, but I am missing personal experience.
Mikaela (Migrated from github.com) commented 2019-11-17 20:12:04 +00:00

Oh, Gajim doesn't have OMEMO by default and needs a plugin for that.

Oh, Gajim doesn't have OMEMO by default and needs a plugin for that.
Mikaela (Migrated from github.com) commented 2019-11-17 20:12:30 +00:00

Should this mention that it's based on XMPP?

Should this mention that it's based on XMPP?
Mikaela (Migrated from github.com) commented 2019-11-17 20:13:00 +00:00 
        <li>Other <a href="https://matrix.org/clients">Matrix</a> clients, that may however be less feature complete than Riot.im.</li>
```suggestion <li>Other <a href="https://matrix.org/clients">Matrix</a> clients, that may however be less feature complete than Riot.im.</li> ```
Mikaela (Migrated from github.com) reviewed 2019-11-17 20:49:30 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
Mikaela (Migrated from github.com) commented 2019-11-17 20:38:25 +00:00

Would it make sense to link to self-contained networks here?

Would it make sense to link to self-contained networks here?
Mikaela (Migrated from github.com) commented 2019-11-17 20:40:14 +00:00 
            <li>No offline messaging (Tox, Jami), however messages may be stored locally to wait for the contact to be online simultaneously with your client</li>

I think something like this may make this seem like a bit less bad option.

```suggestion <li>No offline messaging (Tox, Jami), however messages may be stored locally to wait for the contact to be online simultaneously with your client</li> ``` I think something like this may make this seem like a bit less bad option.
Mikaela (Migrated from github.com) commented 2019-11-17 20:41:55 +00:00

I am not entirely sure, but I think there is also something else than TLS.

I am not entirely sure, but I think there is also something else than TLS.
Mikaela (Migrated from github.com) commented 2019-11-17 20:43:44 +00:00 
  gitlab="https://git.jami.net/savoirfairelinux"

I think they are moving domains and used to have a warning about updating links.

```suggestion gitlab="https://git.jami.net/savoirfairelinux" ``` I think they are moving domains and used to have a warning about updating links.
Mikaela (Migrated from github.com) commented 2019-11-17 20:45:13 +00:00

Should it be noted that Wi-Fi/Bluetooth only works when the contact is in close proximity and that messages won't start jumping from one user to another? I don't know if this has changed recently though.

Should it be noted that Wi-Fi/Bluetooth only works when the contact is in close proximity and that messages won't start jumping from one user to another? I don't know if this has changed recently though.
Mikaela (Migrated from github.com) commented 2019-11-17 20:47:52 +00:00

Should https://theintercept.com/2019/08/04/whistleblowers-surveillance-fbi-trump/ come here via #1134 ?

Should https://theintercept.com/2019/08/04/whistleblowers-surveillance-fbi-trump/ come here via #1134 ?
Mikaela (Migrated from github.com) commented 2019-11-17 20:48:56 +00:00

Should Wire's APK being available at https://wire.com/en/download/ be noted?

Should Wire's APK being available at https://wire.com/en/download/ be noted?
djoate (Migrated from github.com) requested changes 2019-11-17 21:15:26 +00:00
djoate (Migrated from github.com) left a comment

Some nitpicks and general comments.

Another nit: There's also lot of text that says what E2EE stands for ("E2EE (end-to-end encryption)"), so it might feel better and less redundant if we just wrote out "end-to-end encryption". The Signal and Wire cards don't use "E2EE", for example

Some nitpicks and general comments. Another nit: There's also lot of text that says what E2EE stands for ("E2EE (end-to-end encryption)"), so it might feel better and less redundant if we just wrote out "end-to-end encryption". The Signal and Wire cards don't use "E2EE", for example
_includes/sections/instant-messenger.html
djoate (Migrated from github.com) commented 2019-11-17 19:55:42 +00:00 
    <p>We only recommend instant messenger programs or apps that support <a href="https://en.wikipedia.org/wiki/End-to-end_encryption">end-to-end encryption (E2EE)</a>. When E2EE is used, all transmissions (messages, voice, video, etc.) are encrypted <strong>before</strong> they are sent from your device. E2EE protects both the authenticity and confidentiality of the transmission as they pass through any part of the network (servers, etc.).</p>
```suggestion <p>We only recommend instant messenger programs or apps that support <a href="https://en.wikipedia.org/wiki/End-to-end_encryption">end-to-end encryption (E2EE)</a>. When E2EE is used, all transmissions (messages, voice, video, etc.) are encrypted <strong>before</strong> they are sent from your device. E2EE protects both the authenticity and confidentiality of the transmission as they pass through any part of the network (servers, etc.).</p> ```
djoate (Migrated from github.com) commented 2019-11-17 19:57:29 +00:00 
    <p>We have described the three main types of messaging programs that exist: Centralized, Federated and Peer-to-Peer, with the advantages and disadvantages of each.</p>
```suggestion <p>We have described the three main types of messaging programs that exist: Centralized, Federated and Peer-to-Peer, with the advantages and disadvantages of each.</p> ```
djoate (Migrated from github.com) commented 2019-11-17 20:02:38 +00:00 
        <li><a href="https://github.com/privacytoolsIO/privacytools.io/issues/1488">Ownership</a>, privacy policy, and running of the service can change easily when a single entity controls it, potentially compromising the service.</li>
```suggestion <li><a href="https://github.com/privacytoolsIO/privacytools.io/issues/1488">Ownership</a>, privacy policy, and running of the service can change easily when a single entity controls it, potentially compromising the service.</li> ```
djoate (Migrated from github.com) commented 2019-11-17 20:03:02 +00:00 
  <strong>If you are currently using an Instant Messenger like Telegram, LINE, Viber, <a href="https://www.eff.org/deeplinks/2016/10/where-whatsapp-went-wrong-effs-four-biggest-security-concerns">WhatsApp</a>, or plain SMS, you should pick an alternative here.</strong></div>
```suggestion <strong>If you are currently using an Instant Messenger like Telegram, LINE, Viber, <a href="https://www.eff.org/deeplinks/2016/10/where-whatsapp-went-wrong-effs-four-biggest-security-concerns">WhatsApp</a>, or plain SMS, you should pick an alternative here.</strong></div> ```
djoate (Migrated from github.com) commented 2019-11-17 20:05:09 +00:00

All communications are end-to-end encrypted with no option to send unencrypted messages.

This is not true. On Android, there is an option to send unencrypted SMS when you use Signal as the SMS app.

> All communications are end-to-end encrypted with no option to send unencrypted messages. This is not true. On Android, there is an option to send unencrypted SMS when you use Signal as the SMS app.
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
djoate (Migrated from github.com) commented 2019-11-17 20:15:35 +00:00

We should probably get a dark theme version of this logo (using image-dark= variable to include it), since black text on dark background isn't optimal.

We should probably get a dark theme version of this logo (using `image-dark=` variable to include it), since black text on dark background isn't optimal.
djoate (Migrated from github.com) commented 2019-11-17 20:17:43 +00:00 
  description="<p><a href=\"https://xmpp.org/about\">XMPP</a> (Extensible Messaging and Presence Protocol) is an open source communications protocol that began development in 1999. Since then, XMPP has been extended by the publishing of XEPs (XMPP Extension Protocols).</p>
```suggestion description="<p><a href=\"https://xmpp.org/about\">XMPP</a> (Extensible Messaging and Presence Protocol) is an open source communications protocol that began development in 1999. Since then, XMPP has been extended by the publishing of XEPs (XMPP Extension Protocols).</p> ```
djoate (Migrated from github.com) commented 2019-11-17 20:20:10 +00:00 
  labels="warning:Inconsistent E2EE:VOIP and file transfers may not be end-to-end encrypted."

I think stating "Warning" here is redundant (and the other warnings such as "Experimental E2EE" don't have it either)

```suggestion labels="warning:Inconsistent E2EE:VOIP and file transfers may not be end-to-end encrypted." ``` I think stating "Warning" here is redundant (and the other warnings such as "Experimental E2EE" don't have it either)
djoate (Migrated from github.com) commented 2019-11-17 20:22:38 +00:00 
        <li><a href="https://www.kontalk.org">Kontalk</a> - A community-driven instant messaging network. Supports E2EE (end-to-end encryption). Both client-to-server and server-to-server channels are fully encrypted.</li>
```suggestion <li><a href="https://www.kontalk.org">Kontalk</a> - A community-driven instant messaging network. Supports E2EE (end-to-end encryption). Both client-to-server and server-to-server channels are fully encrypted.</li> ```
djoate (Migrated from github.com) commented 2019-11-17 20:26:56 +00:00 
        <li><a href="https://keybase.io/">Keybase</a> - End-to-end encrypted messaging with social verification. Keybase can help you prove you own social media accounts though the use of cryptographic signing of "identity proofs" using <a href="https://en.wikipedia.org/wiki/Pretty_Good_Privacy">OpenPGP</a>. <span class="badge badge-warning" data-toggle="tooltip" title="This software relies on a closed-source central server.">Warning <i class="far fa-question-circle"></i></span></li>

While we're at it, we should add the (?) icon using <i class="far fa-question-circle"></i> for all warning badges with tooltips and move warning badges to the end.

```suggestion <li><a href="https://keybase.io/">Keybase</a> - End-to-end encrypted messaging with social verification. Keybase can help you prove you own social media accounts though the use of cryptographic signing of "identity proofs" using <a href="https://en.wikipedia.org/wiki/Pretty_Good_Privacy">OpenPGP</a>. <span class="badge badge-warning" data-toggle="tooltip" title="This software relies on a closed-source central server.">Warning <i class="far fa-question-circle"></i></span></li> ``` While we're at it, we should add the (?) icon using `<i class="far fa-question-circle"></i>` for all warning badges with tooltips and move warning badges to the end.
djoate (Migrated from github.com) commented 2019-11-17 20:32:26 +00:00 
    <p>These instant messengers connect directly to each other without an authoritative server in between. Peers (clients) usually negotiate connections through the use of some kind of <a href="https://en.wikipedia.org/wiki/Distributed_computing">distributed computing</a> network. Examples of this can include the <a href="https://en.wikipedia.org/wiki/Distributed_hash_table">DHT (distributed hash table)</a>, or <a href="https://en.wikipedia.org/wiki/Ethereum">Ethereum</a>'s <a href="https://github.com/ethereum/wiki/wiki/Whisper">Whisper</a> protocol.</p>
```suggestion <p>These instant messengers connect directly to each other without an authoritative server in between. Peers (clients) usually negotiate connections through the use of some kind of <a href="https://en.wikipedia.org/wiki/Distributed_computing">distributed computing</a> network. Examples of this can include the <a href="https://en.wikipedia.org/wiki/Distributed_hash_table">DHT (distributed hash table)</a>, or <a href="https://en.wikipedia.org/wiki/Ethereum">Ethereum</a>'s <a href="https://github.com/ethereum/wiki/wiki/Whisper">Whisper</a> protocol.</p> ```
djoate (Migrated from github.com) commented 2019-11-17 20:33:16 +00:00 
    <p>Once a peer has found the correct route to its partner, a direct connection to that contact is made. Another approach is proximity based networks, where a connection is established over WiFi or Bluetooth (e.g., Briar or the <a href="https://www.scuttlebutt.nz">Scuttlebutt</a> social networking protocol).</p>
```suggestion <p>Once a peer has found the correct route to its partner, a direct connection to that contact is made. Another approach is proximity based networks, where a connection is established over WiFi or Bluetooth (e.g., Briar or the <a href="https://www.scuttlebutt.nz">Scuttlebutt</a> social networking protocol).</p> ```
djoate (Migrated from github.com) commented 2019-11-17 20:36:11 +00:00

This might be misinterpreted as always-on E2EE as a general advantage of peer-to-peer communications, rather than an advantage of the recommendations we make for peer-to-peer chat apps.

I don't think being peer-to-peer alone implies that E2EE is always on or even present; it depends entirely on who is implementing E2EE.

This might be misinterpreted as always-on E2EE as a general advantage of peer-to-peer communications, rather than an advantage of the recommendations we make for peer-to-peer chat apps. I don't think being peer-to-peer alone implies that E2EE is always on or even present; it depends entirely on who is implementing E2EE.
djoate (Migrated from github.com) commented 2019-11-17 20:36:32 +00:00 
        <li>Minimal metadata exposed to third parties. Your <a href="https://en.wikipedia.org/wiki/IP_address">IP address</a> and that of the contacts you're communicating with may be visible if you do not use the software in conjunction with an anonymity network like <a href="https://www.torproject.org">Tor</a> or <a href="https://geti2p.net/">I2P</a>. Many countries have some form of mass surveillance and/or metadata retention.</li>
```suggestion <li>Minimal metadata exposed to third parties. Your <a href="https://en.wikipedia.org/wiki/IP_address">IP address</a> and that of the contacts you're communicating with may be visible if you do not use the software in conjunction with an anonymity network like <a href="https://www.torproject.org">Tor</a> or <a href="https://geti2p.net/">I2P</a>. Many countries have some form of mass surveillance and/or metadata retention.</li> ```
djoate (Migrated from github.com) commented 2019-11-17 20:40:08 +00:00 
        <li><a href="https://status.im">Status.im</a> - Encrypted instant messenger with an integrated <a href="https://en.wikipedia.org/wiki/Ethereum">Ethereum</a> wallet (cryptocurrency) that also includes support for <a href="https://our.status.im/tag/dapps">DApps (decentralized apps)</a> (web apps in a curated store). Uses the <a href="https://blog.enuma.io/update/2018/08/08/decentralized-application-messaging-with-whisper.html">Whisper protocol</a> for peer-to-peer communication. <span class="badge badge-warning">Experimental</span></li>

We should move badges to the end like the main recommendations.

```suggestion <li><a href="https://status.im">Status.im</a> - Encrypted instant messenger with an integrated <a href="https://en.wikipedia.org/wiki/Ethereum">Ethereum</a> wallet (cryptocurrency) that also includes support for <a href="https://our.status.im/tag/dapps">DApps (decentralized apps)</a> (web apps in a curated store). Uses the <a href="https://blog.enuma.io/update/2018/08/08/decentralized-application-messaging-with-whisper.html">Whisper protocol</a> for peer-to-peer communication. <span class="badge badge-warning">Experimental</span></li> ``` We should move badges to the end like the main recommendations.
djoate (Migrated from github.com) commented 2019-11-17 20:44:47 +00:00

Jami also uses RSA (https://jami.net/help/#answer1) for encrypting messages.

Jami also uses RSA (https://jami.net/help/#answer1) for encrypting messages.
djoate (Migrated from github.com) commented 2019-11-17 21:00:07 +00:00

I think mentioning Signal's apk here is redundant since the main card already has the apk download link.
The apk for Wire can be added under the Wire card in the same manner.

I think mentioning Signal's apk here is redundant since the main card already has the apk download link. The apk for Wire can be added under the Wire card in the same manner.
djoate (Migrated from github.com) commented 2019-11-17 21:02:12 +00:00

Some other audits to include:

Some other audits to include: - Briar also had an independent security audit in 2017 (https://briarproject.org/news/2017-beta-released-security-audit/) - Matrix had a security audit in 2016 of its Olm/Megolm encryption libraries (https://www.nccgroup.trust/us/our-research/matrix-olm-cryptographic-review/)
djoate (Migrated from github.com) commented 2019-11-17 21:07:05 +00:00

For perspective, maybe in Related Information we should include Signal's (centralized) article on their view on federation: https://signal.org/blog/the-ecosystem-is-moving/

For perspective, maybe in Related Information we should include Signal's (centralized) article on their view on federation: https://signal.org/blog/the-ecosystem-is-moving/
dngray (Migrated from github.com) reviewed 2019-11-18 01:01:03 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 01:01:03 +00:00

I saw this done on the previous version of the article for the cards. Do we not need to escape the " anymore?

I saw this done on the previous version of the article for the cards. Do we not need to escape the " anymore?
dngray (Migrated from github.com) reviewed 2019-11-18 01:04:34 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 01:04:33 +00:00

I guess this is a good point. I borrowed that from the team description, maybe we should get rid of that part as some of the feature set is unavailable ie E2EE, VOIP etc when using bridges.

I guess this is a good point. I borrowed that [from the team description](https://github.com/privacytoolsIO/privacytools.io/blob/master/_includes/sections/teamchat.html#L11), maybe we should get rid of that part as some of the feature set is unavailable ie E2EE, VOIP etc when using bridges.
dngray (Migrated from github.com) reviewed 2019-11-18 01:30:07 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 01:30:07 +00:00

I do like the look of Dino, so I would be keen to approve that however there doesn't appear to be any recently tagged releases: https://github.com/dino/dino/releases this maybe why it's horribly outdated in some repositories.

Also nobody brought this up in https://github.com/privacytoolsIO/privacytools.io/issues/1377

I do like the look of Dino, so I would be keen to approve that however there doesn't appear to be any recently tagged releases: https://github.com/dino/dino/releases this maybe why it's horribly outdated in some repositories. Also nobody brought this up in https://github.com/privacytoolsIO/privacytools.io/issues/1377
dngray (Migrated from github.com) reviewed 2019-11-18 01:35:34 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 01:35:34 +00:00

Hmm siskin is by Tigase Inc. which if i recall correctly is an official XSF sponsor which might mean they have more time to dedicate to it.

Commit wise, they're newer however I guess we would need someone with an iOS device to test (I don't have any).

Hmm siskin is by Tigase Inc. which if i recall correctly is an official [XSF sponsor](https://xmpp.org/sponsors/tigase) which might mean they have more time to dedicate to it. - https://github.com/anurodhp/Monal/graphs/contributors - https://github.com/tigase/siskin-im/graphs/contributors Commit wise, they're newer however I guess we would need someone with an iOS device to test (I don't have any).
dngray (Migrated from github.com) reviewed 2019-11-18 01:57:33 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 01:57:33 +00:00

Done

Done
dngray (Migrated from github.com) reviewed 2019-11-18 02:11:59 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 02:11:59 +00:00

Done.

Done.
dngray (Migrated from github.com) reviewed 2019-11-18 02:21:42 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 02:21:42 +00:00

I don't believe so:

What protocol does Jami use for the end-to-end encryption?

We use TLS 1.3 with a perfect forward secrecy requirement for the negotiated ciphers for calls and file transfers. Messages are encrypted with an RSA key.

I don't [believe so](https://jami.net/help/#answer1): > What protocol does Jami use for the end-to-end encryption? > > We use TLS 1.3 with a perfect forward secrecy requirement for the negotiated ciphers for calls and file transfers. Messages are encrypted with an RSA key. - [Improving performance and security with TLS 1.3](https://jami.net/improving-performance-and-security-with-tls-1-3)
dngray (Migrated from github.com) reviewed 2019-11-18 06:24:04 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 06:24:03 +00:00

Resolved, https://github.com/privacytoolsIO/privacytools.io/pull/1500#discussion_r347158073

See 71cced9631

Resolved, https://github.com/privacytoolsIO/privacytools.io/pull/1500#discussion_r347158073 See https://github.com/privacytoolsIO/privacytools.io/pull/1500/commits/71cced96312e077da542540f53b913e1d2437bf9
dngray (Migrated from github.com) reviewed 2019-11-18 06:39:22 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 06:39:22 +00:00

Fixed 43da09e142

Fixed https://github.com/privacytoolsIO/privacytools.io/pull/1500/commits/43da09e142c1ab36272290fe25a7d2a534e82484
dngray (Migrated from github.com) reviewed 2019-11-18 06:44:15 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 06:44:15 +00:00

Not sure about this one. I think a comma is more appropriate, however avoided with a2d3eb7df0

Not sure about this one. I think a comma is more appropriate, however avoided with https://github.com/privacytoolsIO/privacytools.io/pull/1500/commits/a2d3eb7df0ef801d3531286060fc9ad51e9c74ca
dngray (Migrated from github.com) reviewed 2019-11-18 07:16:36 +00:00
_includes/sections/instant-messenger.html
dngray (Migrated from github.com) commented 2019-11-18 07:16:35 +00:00

Resolved in a4803c5783

Resolved in https://github.com/privacytoolsIO/privacytools.io/pull/1500/commits/a4803c578310544ce504bb32a4684192ea34952c
dngray (Migrated from github.com) reviewed 2019-11-18 07:47:11 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 07:47:10 +00:00

Fixed: eaed3a9013

As it happens it's already in the wire card.

Fixed: https://github.com/privacytoolsIO/privacytools.io/pull/1500/commits/eaed3a9013ef50c42c4f1c0955eac985a061304a As it happens it's already in the wire card.
dngray (Migrated from github.com) reviewed 2019-11-18 08:14:35 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 08:14:35 +00:00

It's mentioned in the second paragraph for peer to peer https://github.com/privacytoolsIO/privacytools.io/pull/1500/files#diff-48937a8bcda8d20aaa9a12766c6a29ddR145

Once a peer has found the correct route to its partner, a direct connection to that contact is made. Another approach is proximity based networks, where a connection is established over WiFi or Bluetooth (e.g., Briar or the Scuttlebutt social networking protocol).

Do we really need to mention it again?

It's mentioned in the second paragraph for peer to peer https://github.com/privacytoolsIO/privacytools.io/pull/1500/files#diff-48937a8bcda8d20aaa9a12766c6a29ddR145 > Once a peer has found the correct route to its partner, a direct connection to that contact is made. Another approach is proximity based networks, where a connection is established over WiFi or Bluetooth (e.g., Briar or the [Scuttlebutt](https://www.scuttlebutt.nz) social networking protocol). Do we really need to mention it again?
dngray (Migrated from github.com) reviewed 2019-11-18 08:18:31 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 08:18:31 +00:00

I think that article is a bit out of date to be honest and does seem like an excuse for doing things properly.

I also think Drew Devault sums it up pretty well: https://drewdevault.com/2018/08/08/Signal.html in particular under the "Trust, federation, and peer-to-peer chat" section. In particular this comment: Truly secure systems don’t require trust.

I think that article is a bit out of date to be honest and does seem like an excuse for doing things properly. I also think Drew Devault sums it up pretty well: https://drewdevault.com/2018/08/08/Signal.html in particular under the "Trust, federation, and peer-to-peer chat" section. In particular this comment: **Truly secure systems don’t require trust.**
dngray (Migrated from github.com) reviewed 2019-11-18 08:37:52 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 08:37:52 +00:00

Yes good point. fd7c1a5dee

Yes good point. https://github.com/privacytoolsIO/privacytools.io/pull/1500/commits/fd7c1a5deea9ddbd9daa66c637274df1825b04cd
dngray (Migrated from github.com) reviewed 2019-11-18 08:47:09 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 08:47:09 +00:00

I am wondering about this, where would it go? I am also keen to remove:

https://firstlook.org/theintercept/2015/07/14/communicating-secret-watched which was linked at the bottom. While it does hold true, I think we have distilled what information we need from it in our own blog article maybe.

The stuff about Adium/Pidgin really is very outdated and hence I am keen to remove that link.

I am wondering about this, where would it go? I am also keen to remove: https://firstlook.org/theintercept/2015/07/14/communicating-secret-watched which was linked at the bottom. While it does hold true, I think we have distilled what information we need from it in our own blog article maybe. The stuff about Adium/Pidgin really is very outdated and hence I am keen to remove that link.
dngray (Migrated from github.com) reviewed 2019-11-18 08:51:39 +00:00
_includes/sections/instant-messenger.html
dngray (Migrated from github.com) commented 2019-11-18 08:51:39 +00:00

Thanks for that I wrote it when I was rather 💤

Thanks for that I wrote it when I was rather :zzz:
dngray (Migrated from github.com) reviewed 2019-11-18 10:34:38 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 10:34:38 +00:00

Done 704683e818

We should probably do one for qtox too

Done https://github.com/privacytoolsIO/privacytools.io/pull/1500/commits/704683e818645fe6cd04b36d8328796e67b1f3e0 We should probably do one for qtox too
dngray (Migrated from github.com) reviewed 2019-11-18 13:05:04 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 13:05:04 +00:00

What was the suggestion here?

What was the suggestion here?
Mikaela (Migrated from github.com) reviewed 2019-11-18 13:06:28 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
Mikaela (Migrated from github.com) commented 2019-11-18 13:06:27 +00:00

@nitrohorse @JonahAragon I guess you can take up this part? :)

@nitrohorse @JonahAragon I guess you can take up this part? :)
dngray (Migrated from github.com) reviewed 2019-11-18 13:07:36 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 13:07:36 +00:00

Fixed in c8ed76f8c3

Fixed in https://github.com/privacytoolsIO/privacytools.io/pull/1500/commits/c8ed76f8c3d7b1f20edabd58dca1b8c2d3933359
Mikaela (Migrated from github.com) reviewed 2019-11-18 13:07:42 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
Mikaela (Migrated from github.com) commented 2019-11-18 13:07:41 +00:00

No, sorry, I think it's just my English and not understanding the word "direct", except that isn't so correct in case of P2P over the internet as there are routers on the way.

No, sorry, I think it's just my English and not understanding the word "direct", except that isn't so correct in case of P2P over the internet as there are routers on the way.
Mikaela (Migrated from github.com) reviewed 2019-11-18 13:15:15 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
Mikaela (Migrated from github.com) commented 2019-11-18 13:15:14 +00:00

Wrong, Keybase has given up on OpenPGP in 2015 switching to NaCL based device keys and it doesn't even require having a PGP key anymore.

https://keybase.io/blog/keybase-new-key-model

Wrong, Keybase has given up on OpenPGP in 2015 switching to NaCL based device keys and it doesn't even require having a PGP key anymore. https://keybase.io/blog/keybase-new-key-model
dngray commented 2019-11-18 13:38:41 +00:00 (Migrated from github.com)
Copy Link

Some nitpicks and general comments.

Another nit: There's also lot of text that says what E2EE stands for ("E2EE (end-to-end encryption)"), so it might feel better and less redundant if we just wrote out "end-to-end encryption". The Signal and Wire cards don't use "E2EE", for example

We explain what E2EE is so I've opted to use that throughout after explaining what the acronym means in the first paragraph 4a368f93dd I figured there's no point in having an acronym if we don't use it to make thing shorter.

> Some nitpicks and general comments. > > Another nit: There's also lot of text that says what E2EE stands for ("E2EE (end-to-end encryption)"), so it might feel better and less redundant if we just wrote out "end-to-end encryption". The Signal and Wire cards don't use "E2EE", for example We explain what E2EE is so I've opted to use that throughout after explaining what the acronym means in the first paragraph https://github.com/privacytoolsIO/privacytools.io/pull/1500/commits/4a368f93ddb8cafc9cc0dd89ac5e1a285b212e35 I figured there's no point in having an acronym if we don't use it to make thing shorter.
dngray (Migrated from github.com) reviewed 2019-11-18 13:49:04 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 13:49:03 +00:00

I did put it in it's own bullet point fce382f042 what do you think about that?

I did put it in it's own bullet point https://github.com/privacytoolsIO/privacytools.io/pull/1500/commits/fce382f042c658873fa10ee535022125bda20532 what do you think about that?
dngray (Migrated from github.com) reviewed 2019-11-18 14:08:56 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-18 14:08:56 +00:00

I don't actually know of any P2P instant messengers that don't have encryption.

By definition if an instant messenger that is peer to peer has encryption it is going to be E2EE as there's no server is it not?

I suppose there was winpopup at one point in time... maybe we can reword this.

I don't actually know of any P2P instant messengers that don't have encryption. By definition if an instant messenger that is peer to peer has encryption it is going to be E2EE as there's no server is it not? I suppose there was [winpopup](https://en.wikipedia.org/wiki/Windows_Messenger_service) at one point in time... maybe we can reword this.
dngray (Migrated from github.com) reviewed 2019-11-19 01:07:18 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-19 01:07:18 +00:00

Ah thanks for that, fixed 699d9cb815

Ah thanks for that, fixed https://github.com/privacytoolsIO/privacytools.io/pull/1500/commits/699d9cb815d52b843b7d66fb757ab318d82156d3
dngray (Migrated from github.com) reviewed 2019-11-19 01:20:46 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-19 01:20:45 +00:00

Fixed in b7cdadafa8

Fixed in https://github.com/privacytoolsIO/privacytools.io/pull/1500/commits/b7cdadafa808016cbf13f4282c1b0cd1b00d08f8
dngray (Migrated from github.com) reviewed 2019-11-19 01:28:10 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-19 01:28:09 +00:00

Okay then I'll mark this one as resolved. Issues like this should get resolved when we have i18n support https://github.com/privacytoolsIO/privacytools.io/issues/1106

Okay then I'll mark this one as resolved. Issues like this should get resolved when we have i18n support https://github.com/privacytoolsIO/privacytools.io/issues/1106
dngray (Migrated from github.com) reviewed 2019-11-19 01:41:39 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-19 01:41:39 +00:00

I think this sounds okay 48cdab7a39

I think this sounds okay https://github.com/privacytoolsIO/privacytools.io/pull/1500/commits/48cdab7a393c4d94446dbc87ab927a0df504674c
djoate (Migrated from github.com) reviewed 2019-11-19 03:50:35 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
djoate (Migrated from github.com) commented 2019-11-19 03:50:35 +00:00

GitHub didn't highlight the diff, but "Distributed hash table" in the parentheses should be lowercase

Examples of this can include the DHT (distributed hash table)
It's not a proper noun and it's not starting a new sentence

GitHub didn't highlight the diff, but "Distributed hash table" in the parentheses should be lowercase > Examples of this can include the DHT (**d**istributed hash table) It's not a proper noun and it's not starting a new sentence
dngray (Migrated from github.com) reviewed 2019-11-19 04:43:43 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +63,4 @@
mac="https://keybase.io/docs/the_app/install_macos"
linux="https://keybase.io/docs/the_app/install_linux"
freebsd="https://www.freshports.org/security/keybase/"
googleplay="https://play.google.com/store/apps/details?id=io.keybase.ossifrage"
dngray (Migrated from github.com) commented 2019-11-19 04:43:42 +00:00

thanks for spotting that.

thanks for spotting that.
nitrohorse (Migrated from github.com) reviewed 2019-11-20 06:47:04 +00:00
_includes/sections/instant-messenger.html
nitrohorse (Migrated from github.com) commented 2019-11-20 06:47:03 +00:00 
        <li>Centralized services could be more susceptible to <a href="#exploiting-centralized-networks">legislation requiring backdoor access</a>.</li>
```suggestion <li>Centralized services could be more susceptible to <a href="#exploiting-centralized-networks">legislation requiring backdoor access</a>.</li> ```
nitrohorse (Migrated from github.com) reviewed 2019-11-20 06:49:37 +00:00
_includes/sections/instant-messenger.html
nitrohorse (Migrated from github.com) commented 2019-11-20 06:49:37 +00:00

I wonder if it's worth linking to the protocol audit? Taken from https://threatpost.com/signal-audit-reveals-protocol-cryptographically-sound/121892/

I wonder if it's worth linking to the [protocol audit](https://eprint.iacr.org/2016/1013.pdf)? Taken from https://threatpost.com/signal-audit-reveals-protocol-cryptographically-sound/121892/
nitrohorse (Migrated from github.com) reviewed 2019-11-20 06:50:24 +00:00
_includes/sections/instant-messenger.html
nitrohorse (Migrated from github.com) commented 2019-11-20 06:50:23 +00:00

We link to Keybase's protocol audit btw.

We link to Keybase's [protocol audit](https://keybase.io/docs-assets/blog/NCC_Group_Keybase_KB2018_Public_Report_2019-02-27_v1.3.pdf) btw.
nitrohorse (Migrated from github.com) reviewed 2019-11-20 07:01:48 +00:00
_includes/sections/instant-messenger.html
nitrohorse (Migrated from github.com) commented 2019-11-20 07:01:48 +00:00 
   description="Signal is a mobile app developed by Signal Messenger LLC. The app provides instant messaging, as well as voice and video calling. All communications are E2EE unless you choose to send as SMS. Its protocol has also been <a href="https://eprint.iacr.org/2016/1013.pdf">indepedently audited (PDF)</a>"
```suggestion description="Signal is a mobile app developed by Signal Messenger LLC. The app provides instant messaging, as well as voice and video calling. All communications are E2EE unless you choose to send as SMS. Its protocol has also been <a href="https://eprint.iacr.org/2016/1013.pdf">indepedently audited (PDF)</a>" ```
nitrohorse (Migrated from github.com) reviewed 2019-11-20 07:02:40 +00:00
_includes/sections/instant-messenger.html
nitrohorse (Migrated from github.com) commented 2019-11-20 07:02:39 +00:00 
  description='<p>Keybase provides a hosted team chat with E2EE. Its protocol has also been <a href="https://keybase.io/docs-assets/blog/NCC_Group_Keybase_KB2018_Public_Report_2019-02-27_v1.3.pdf">indepedently audited (PDF)</a>.</p>Keybase can help you prove you own social media accounts though the use of cryptographic signing of "identity proofs".'
```suggestion description='<p>Keybase provides a hosted team chat with E2EE. Its protocol has also been <a href="https://keybase.io/docs-assets/blog/NCC_Group_Keybase_KB2018_Public_Report_2019-02-27_v1.3.pdf">indepedently audited (PDF)</a>.</p>Keybase can help you prove you own social media accounts though the use of cryptographic signing of "identity proofs".' ```
nitrohorse (Migrated from github.com) reviewed 2019-11-20 07:07:38 +00:00
_includes/sections/instant-messenger.html
nitrohorse (Migrated from github.com) commented 2019-11-20 07:07:38 +00:00

I wonder if we could also hyperlink "identity proofs" for further reading/reference.

I wonder if we could also hyperlink "identity proofs" for further reading/reference.
nitrohorse (Migrated from github.com) reviewed 2019-11-20 07:10:39 +00:00
_includes/sections/instant-messenger.html
nitrohorse (Migrated from github.com) commented 2019-11-20 07:10:39 +00:00

Maybe https://keybase.io/docs/server_security ?

Maybe https://keybase.io/docs/server_security ?
nitrohorse (Migrated from github.com) reviewed 2019-11-20 07:14:06 +00:00
_includes/sections/instant-messenger.html
nitrohorse (Migrated from github.com) commented 2019-11-20 07:14:06 +00:00 
        <li>Often includes "bridging" features to join different kinds of instant messenger networks together, e.g, <a href="https://matrix.org/bridges/">Matrix Bridges</a> and <a href="https://en.wikipedia.org/wiki/XMPP#Connecting_to_other_protocols">XMPP Transports</a></li>.
```suggestion <li>Often includes "bridging" features to join different kinds of instant messenger networks together, e.g, <a href="https://matrix.org/bridges/">Matrix Bridges</a> and <a href="https://en.wikipedia.org/wiki/XMPP#Connecting_to_other_protocols">XMPP Transports</a></li>. ```
nitrohorse (Migrated from github.com) reviewed 2019-11-20 07:14:47 +00:00
_includes/sections/instant-messenger.html
nitrohorse (Migrated from github.com) commented 2019-11-20 07:14:46 +00:00 
        <li>A less juicy target for governments wanting <a href="#exploiting-centralized-networks">backdoor access to everything</a> as the trust is decentralized. The server may be hosted independently to the organization who makes the software.</li>
```suggestion <li>A less juicy target for governments wanting <a href="#exploiting-centralized-networks">backdoor access to everything</a> as the trust is decentralized. The server may be hosted independently to the organization who makes the software.</li> ```
nitrohorse (Migrated from github.com) reviewed 2019-11-20 07:15:50 +00:00
_includes/sections/instant-messenger.html
nitrohorse (Migrated from github.com) commented 2019-11-20 07:15:50 +00:00 
        <li>More complex to develop new features because standards documents need to be written to ensure a thought-out implementation.</li>
```suggestion <li>More complex to develop new features because standards documents need to be written to ensure a thought-out implementation.</li> ```
nitrohorse (Migrated from github.com) reviewed 2019-11-20 07:16:28 +00:00
_includes/sections/instant-messenger.html
nitrohorse (Migrated from github.com) commented 2019-11-20 07:16:27 +00:00 
  description='<p><a href="https://matrix.org/docs/guides/introduction">Matrix</a> is an open-source project that publishes the <a href="https://matrix.org/docs/spec">Matrix open standard</a> for secure, decentralized, real-time communication. <p><a href="https://en.wikipedia.org/wiki/Riot.im">Riot.im</a> is the popular reference client produced by the Matrix.org team. It offers optional E2EE for 1:1 and group conversations that <strong>must</strong> be turned on by the user. (This can be done by clicking on the toggle switch which is accessed by clicking the room name or user name of the chat → Security & Privacy → Encrypted). In the future it will be <a href="https://github.com/vector-im/riot-web/issues/6779">on by default.</a></p>'
```suggestion description='<p><a href="https://matrix.org/docs/guides/introduction">Matrix</a> is an open-source project that publishes the <a href="https://matrix.org/docs/spec">Matrix open standard</a> for secure, decentralized, real-time communication. <p><a href="https://en.wikipedia.org/wiki/Riot.im">Riot.im</a> is the popular reference client produced by the Matrix.org team. It offers optional E2EE for 1:1 and group conversations that <strong>must</strong> be turned on by the user. (This can be done by clicking on the toggle switch which is accessed by clicking the room name or user name of the chat → Security & Privacy → Encrypted). In the future it will be <a href="https://github.com/vector-im/riot-web/issues/6779">on by default.</a></p>' ```
nitrohorse (Migrated from github.com) reviewed 2019-11-20 07:16:41 +00:00
_includes/sections/instant-messenger.html
nitrohorse (Migrated from github.com) commented 2019-11-20 07:16:41 +00:00 
  description='<p><a href="https://xmpp.org/about">XMPP</a> (Extensible Messaging and Presence Protocol) is an open-source communications protocol that began development in 1999. Since then, XMPP has been extended by the publishing of XEPs (XMPP Extension Protocols).</p>
```suggestion description='<p><a href="https://xmpp.org/about">XMPP</a> (Extensible Messaging and Presence Protocol) is an open-source communications protocol that began development in 1999. Since then, XMPP has been extended by the publishing of XEPs (XMPP Extension Protocols).</p> ```
nitrohorse (Migrated from github.com) reviewed 2019-11-20 07:16:58 +00:00
_includes/sections/teamchat.html
nitrohorse (Migrated from github.com) commented 2019-11-20 07:16:58 +00:00 
  description='<p><a href="https://matrix.org/docs/guides/introduction">Matrix</a> is an open-source project that publishes the <a href="https://matrix.org/docs/spec">Matrix open standard</a> for secure, decentralized, real-time communication. <p><a href="https://en.wikipedia.org/wiki/Riot.im">Riot.im</a> is the popular reference client produced by the Matrix.org team. It offers optional E2EE for 1:1 and group conversations that <strong>must</strong> be turned on by the user. (This can be done by clicking on the toggle switch which is accessed by clicking the room name or user name of the chat → Security & Privacy → Encrypted). In the future it will be <a href="https://github.com/vector-im/riot-web/issues/6779">on by default.</a></p><p>It also may make sense in a business environment to have a server which doesn\'t federate with the rest of the Matrix network. This can be achieved by not setting up the <a href="https://matrix.org/faq/#how-do-i-join-the-global-matrix-federation%3F">federation component</a> of Synapse.'
```suggestion description='<p><a href="https://matrix.org/docs/guides/introduction">Matrix</a> is an open-source project that publishes the <a href="https://matrix.org/docs/spec">Matrix open standard</a> for secure, decentralized, real-time communication. <p><a href="https://en.wikipedia.org/wiki/Riot.im">Riot.im</a> is the popular reference client produced by the Matrix.org team. It offers optional E2EE for 1:1 and group conversations that <strong>must</strong> be turned on by the user. (This can be done by clicking on the toggle switch which is accessed by clicking the room name or user name of the chat → Security & Privacy → Encrypted). In the future it will be <a href="https://github.com/vector-im/riot-web/issues/6779">on by default.</a></p><p>It also may make sense in a business environment to have a server which doesn\'t federate with the rest of the Matrix network. This can be achieved by not setting up the <a href="https://matrix.org/faq/#how-do-i-join-the-global-matrix-federation%3F">federation component</a> of Synapse.' ```
nitrohorse commented 2019-11-20 07:19:03 +00:00 (Migrated from github.com)
Copy Link

Also worth noting we'll need to create Discourse forum links for any new suggestions.

Also worth noting we'll need to create Discourse forum links for any new suggestions.
👍 1
nitrohorse (Migrated from github.com) reviewed 2019-11-20 07:21:46 +00:00
_includes/sections/instant-messenger.html
nitrohorse (Migrated from github.com) commented 2019-11-20 07:21:45 +00:00

I think we can do

        <li>Minimal metadata exposed to third parties. Your <a href="https://en.wikipedia.org/wiki/IP_address">IP address</a> and that of the contacts you're communicating with may be visible if you do not use the software in conjunction with a <a href="/software/networks">self contained network</a>, such as <a href="https://www.torproject.org">Tor</a> or <a href="https://geti2p.net/">I2P</a>. Many countries have some form of mass surveillance and/or metadata retention.</li>
I think we can do ```suggestion <li>Minimal metadata exposed to third parties. Your <a href="https://en.wikipedia.org/wiki/IP_address">IP address</a> and that of the contacts you're communicating with may be visible if you do not use the software in conjunction with a <a href="/software/networks">self contained network</a>, such as <a href="https://www.torproject.org">Tor</a> or <a href="https://geti2p.net/">I2P</a>. Many countries have some form of mass surveillance and/or metadata retention.</li> ```
nitrohorse (Migrated from github.com) reviewed 2019-11-20 07:22:25 +00:00
_includes/sections/instant-messenger.html
nitrohorse (Migrated from github.com) commented 2019-11-20 07:22:25 +00:00 
        <li>Modern P2P programs/apps have encryption which in turn is E2EE. As there are no servers in between the peers, encryption and decryption must occur before a transmission is sent and once it is received by the remote recipient.</li>
```suggestion <li>Modern P2P programs/apps have encryption which in turn is E2EE. As there are no servers in between the peers, encryption and decryption must occur before a transmission is sent and once it is received by the remote recipient.</li> ```
nitrohorse (Migrated from github.com) reviewed 2019-11-20 07:26:17 +00:00
_includes/sections/instant-messenger.html
nitrohorse (Migrated from github.com) commented 2019-11-20 07:26:17 +00:00

I think I remember @danarel mention to remove this for now since it's undergoing construction.

I think I remember @danarel mention to remove this for now since it's undergoing construction. ```suggestion ```
nitrohorse (Migrated from github.com) reviewed 2019-11-20 07:27:42 +00:00
_includes/sections/instant-messenger.html
nitrohorse (Migrated from github.com) commented 2019-11-20 07:27:41 +00:00

I'm thinking for Signal and Keybase, we could just link to this subsection instead (since it already contains links to the audits and more)?

    <h3 id="#rtc-independent-security-audits">Independent security audits</h3>
I'm thinking for Signal and Keybase, we could just link to this subsection instead (since it already contains links to the audits and more)? ```suggestion <h3 id="#rtc-independent-security-audits">Independent security audits</h3> ```
dngray (Migrated from github.com) reviewed 2019-11-20 07:33:37 +00:00
_includes/sections/instant-messenger.html
dngray (Migrated from github.com) commented 2019-11-20 07:33:37 +00:00

Maybe https://keybase.io/docs/server_security ?

Maybe https://en.wikipedia.org/wiki/Keybase#Identity_proofs might be easier to digest?

> Maybe https://keybase.io/docs/server_security ? Maybe https://en.wikipedia.org/wiki/Keybase#Identity_proofs might be easier to digest?
nitrohorse (Migrated from github.com) reviewed 2019-11-20 08:05:00 +00:00
nitrohorse (Migrated from github.com) left a comment

Some suggestions, nice work so far!

Some suggestions, nice work so far!
Mikaela commented 2019-11-20 10:54:34 +00:00 (Migrated from github.com)
Copy Link

I think this is a bit too big for me at the moment, but I will get back to this at a better time. I should be able to especially next week.

I think this is a bit too big for me at the moment, but I will get back to this at a better time. I should be able to especially next week.
dngray (Migrated from github.com) reviewed 2019-11-21 11:21:46 +00:00
_includes/sections/instant-messenger.html
dngray (Migrated from github.com) commented 2019-11-21 11:21:46 +00:00

I agree looks good for consistency.

I agree looks good for consistency.
dngray commented 2019-11-21 11:28:29 +00:00 (Migrated from github.com)
Copy Link

Also worth noting we'll need to create Discourse forum links for any new suggestions.

Yes i had a note on my list to do this, i don't think i have permission to do that.

> Also worth noting we'll need to create Discourse forum links for any new suggestions. Yes i had a note on my list to do this, i don't think i have permission to do that.
Mikaela commented 2019-11-21 12:53:51 +00:00 (Migrated from github.com)
Copy Link

XMPP: https://forum.privacytools.io/t/discussion-xmpp/2112
Briar: https://forum.privacytools.io/t/discussion-briar/2114
Jami: https://forum.privacytools.io/t/discussion-jami/2116
(q)Tox (is there point in making it client specific?): https://forum.privacytools.io/t/discussion-tox/2115

XMPP: https://forum.privacytools.io/t/discussion-xmpp/2112 Briar: https://forum.privacytools.io/t/discussion-briar/2114 Jami: https://forum.privacytools.io/t/discussion-jami/2116 (q)Tox (is there point in making it client specific?): https://forum.privacytools.io/t/discussion-tox/2115
ghost commented 2019-11-22 19:55:07 +00:00 (Migrated from github.com)
Copy Link

Regarding disadvantages of federated servers:
We oftentimes observe that small servers run by private people don't serve privacy policies, or there are some indications that the server admins aren't security "professionals" but set up their server by implementing some guides on the internet.

Due to this, it can be 1) hard to reclaim any privacy rights, 2) hard to identify the party actually running the server, and 3) hard to check the actual level of security of the federated server (also including that federated network don't come with a homogenous level of security).

Furthermore (not directly connected to points mentioned above), a federated server can still block federation to other servers. So depending on your server, it can be impossible to talk to some other server in the federated network.

Regarding disadvantages of federated servers: We oftentimes observe that small servers run by private people don't serve privacy policies, or there are some indications that the server admins aren't security "professionals" but set up their server by implementing some guides on the internet. Due to this, it can be 1) hard to reclaim any privacy rights, 2) hard to identify the party actually running the server, and 3) hard to check the actual level of security of the federated server (also including that federated network don't come with a homogenous level of security). Furthermore (not directly connected to points mentioned above), a federated server can still block federation to other servers. So depending on your server, it can be impossible to talk to some other server in the federated network.
👍 2 👎 1
jonah reviewed 2019-11-23 03:57:43 +00:00
_includes/sections/instant-messenger.html
jonah commented 2019-11-23 03:57:43 +00:00 
        <li>Some metadata may be available. Information like "who is talking to whom," but not actual message content if E2EE is used.</li>
        <li>Federated servers generally require trusting your server's administrator. They may be a hobbyist or otherwise not a "security professional," and may not serve standard documents like a privacy policy or terms of service detailing how your data is utilized.</li>
        <li>The server you use may choose to block other servers, meaning communication across servers is not always guaranteed.</li>
```suggestion <li>Some metadata may be available. Information like "who is talking to whom," but not actual message content if E2EE is used.</li> <li>Federated servers generally require trusting your server's administrator. They may be a hobbyist or otherwise not a "security professional," and may not serve standard documents like a privacy policy or terms of service detailing how your data is utilized.</li> <li>The server you use may choose to block other servers, meaning communication across servers is not always guaranteed.</li> ```
jonah reviewed 2019-11-23 04:38:31 +00:00
jonah left a comment

these are merely suggestions, do as you wish.

these are merely suggestions, do as you wish.
_includes/sections/instant-messenger.html
jonah commented 2019-11-23 04:06:28 +00:00

What I wonder is, is this an advantage for the user? We can restate it in a way that is more clearly is.

        <li>New features and changes can be implemented more quickly.</li>
What I wonder is, is this an advantage for the user? We can restate it in a way that is more clearly is. ```suggestion <li>New features and changes can be implemented more quickly.</li> ```
jonah commented 2019-11-23 04:11:09 +00:00 
        <li>Easier to get started with and to find contacts.</li>
```suggestion <li>Easier to get started with and to find contacts.</li> ```
jonah commented 2019-11-23 04:11:56 +00:00 
        <li>The <a href="https://blog.privacytools.io/delisting-wire">ownership</a>, privacy policy, and operations of the service can change easily when a single entity controls it, potentially compromising the service later on.</li>
```suggestion <li>The <a href="https://blog.privacytools.io/delisting-wire">ownership</a>, privacy policy, and operations of the service can change easily when a single entity controls it, potentially compromising the service later on.</li> ```
jonah commented 2019-11-23 04:13:32 +00:00 
    <p>Federated messengers use multiple, independent servers that are able to talk to each other (email is one example of a federated service). Federation allows system administrators to control their own server and still be a part of the larger communications network.</p>
```suggestion <p>Federated messengers use multiple, independent servers that are able to talk to each other (email is one example of a federated service). Federation allows system administrators to control their own server and still be a part of the larger communications network.</p> ```
jonah commented 2019-11-23 04:22:42 +00:00

I can't do multi-line suggestions but I would make the following changes (which I can't do in multiple suggestions because I want to reorder everything — I think the order is important in terms of what people care about the most).

    <ul>
        <li>Allows for greater control over your own data when running your own server.</li>
        <li>Allows you to choose who to trust your data with by choosing between multiple "public" servers.</li>
        <li>Often allows for third party clients which can provide a more native, customized, or accessible experience.</li>
        <li>Often includes "bridging" features to join different kinds of instant messenger networks together, e.g, <a href="https://matrix.org/bridges/">Matrix Bridges</a> and <a href="https://en.wikipedia.org/wiki/XMPP#Connecting_to_other_protocols">XMPP Transports</a>.</li>
        <li>Generally a less juicy target for governments wanting <a href="#exploiting-centralized-networks">backdoor access to everything</a> as the trust is decentralized. The server may be hosted independently from the organization developing the software.</li>
        <li>Server software can be verified that it matches public source code.</li>
        <li>Third-party developers can contribute code and add new features, instead of waiting for a private development team to do so.</li>
    </ul>
I can't do multi-line suggestions but I would make the following changes (which I can't do in multiple suggestions because I want to reorder everything — I think the order is important in terms of what people care about the most). ``` <ul> <li>Allows for greater control over your own data when running your own server.</li> <li>Allows you to choose who to trust your data with by choosing between multiple "public" servers.</li> <li>Often allows for third party clients which can provide a more native, customized, or accessible experience.</li> <li>Often includes "bridging" features to join different kinds of instant messenger networks together, e.g, <a href="https://matrix.org/bridges/">Matrix Bridges</a> and <a href="https://en.wikipedia.org/wiki/XMPP#Connecting_to_other_protocols">XMPP Transports</a>.</li> <li>Generally a less juicy target for governments wanting <a href="#exploiting-centralized-networks">backdoor access to everything</a> as the trust is decentralized. The server may be hosted independently from the organization developing the software.</li> <li>Server software can be verified that it matches public source code.</li> <li>Third-party developers can contribute code and add new features, instead of waiting for a private development team to do so.</li> </ul> ```
jonah commented 2019-11-23 04:23:38 +00:00 
        <li>Adding more features is more complex, because new features need to be standardized and tested to ensure they work with all servers on the network.</li>
```suggestion <li>Adding more features is more complex, because new features need to be standardized and tested to ensure they work with all servers on the network.</li> ```
jonah commented 2019-11-23 04:28:41 +00:00 
    <p>Peer-to-Peer instant messengers connect directly to each other without requiring third-party servers. Clients (peers) usually find each other through the use of a <a href="https://en.wikipedia.org/wiki/Distributed_computing">distributed computing</a> network. Examples of this include <a href="https://en.wikipedia.org/wiki/Distributed_hash_table">DHT (distributed hash table)</a> (used with technologies like torrents and IPFS, for example), or or <a href="https://en.wikipedia.org/wiki/Ethereum">Ethereum</a>'s <a href="https://github.com/ethereum/wiki/wiki/Whisper">Whisper</a> protocol (used with some newer DApps). Another approach is proximity based networks, where a connection is established over WiFi or Bluetooth (for example, Briar or the <a href="https://www.scuttlebutt.nz">Scuttlebutt</a> social networking protocol). Once a peer has found a route to its contact via any of these methods, a direct connection between them is made.</p>
```suggestion <p>Peer-to-Peer instant messengers connect directly to each other without requiring third-party servers. Clients (peers) usually find each other through the use of a <a href="https://en.wikipedia.org/wiki/Distributed_computing">distributed computing</a> network. Examples of this include <a href="https://en.wikipedia.org/wiki/Distributed_hash_table">DHT (distributed hash table)</a> (used with technologies like torrents and IPFS, for example), or or <a href="https://en.wikipedia.org/wiki/Ethereum">Ethereum</a>'s <a href="https://github.com/ethereum/wiki/wiki/Whisper">Whisper</a> protocol (used with some newer DApps). Another approach is proximity based networks, where a connection is established over WiFi or Bluetooth (for example, Briar or the <a href="https://www.scuttlebutt.nz">Scuttlebutt</a> social networking protocol). Once a peer has found a route to its contact via any of these methods, a direct connection between them is made.</p> ```
jonah commented 2019-11-23 04:29:37 +00:00

see above

see above ```suggestion ```
jonah commented 2019-11-23 04:31:35 +00:00 
        <li>Minimal information is exposed to third parties.</li>

moving this to disadvantages.

```suggestion <li>Minimal information is exposed to third parties.</li> ``` moving this to disadvantages.
jonah commented 2019-11-23 04:33:12 +00:00 
        <li>Modern P2P platforms implement end-to-end encryption by default. There are no servers that could potentially intercept and decrypt your transmissions, unlike centralized and federated models.</li>
```suggestion <li>Modern P2P platforms implement end-to-end encryption by default. There are no servers that could potentially intercept and decrypt your transmissions, unlike centralized and federated models.</li> ```
jonah commented 2019-11-23 04:34:32 +00:00 
            <li>Messages can only be sent when both peers are online, however, your client may store messages locally to wait for the contact to return online.</li>
```suggestion <li>Messages can only be sent when both peers are online, however, your client may store messages locally to wait for the contact to return online.</li> ```
jonah commented 2019-11-23 04:35:51 +00:00 
            <li>Generally increases battery usage on mobile devices, because the client must stay connected to the distributed network and their peers to be discoverable and send/receive messages.</li>
```suggestion <li>Generally increases battery usage on mobile devices, because the client must stay connected to the distributed network and their peers to be discoverable and send/receive messages.</li> ```
_includes/sections/instant-messenger.html
@ -53,1 +161,4 @@
fdroid="https://f-droid.org/packages/org.briarproject.briar.android/"
googleplay="https://play.google.com/store/apps/details?id=org.briarproject.briar.android"
%}
jonah commented 2019-11-23 04:32:03 +00:00 
        </ul>
        <li>Your <a href="https://en.wikipedia.org/wiki/IP_address">IP address</a> and that of the contacts you're communicating with may be visible if you do not use the software in conjunction with a <a href="/software/networks">self contained network</a>, such as <a href="https://www.torproject.org">Tor</a> or <a href="https://geti2p.net/">I2P</a>. Many countries have some form of mass surveillance and/or metadata retention.</li>
```suggestion </ul> <li>Your <a href="https://en.wikipedia.org/wiki/IP_address">IP address</a> and that of the contacts you're communicating with may be visible if you do not use the software in conjunction with a <a href="/software/networks">self contained network</a>, such as <a href="https://www.torproject.org">Tor</a> or <a href="https://geti2p.net/">I2P</a>. Many countries have some form of mass surveillance and/or metadata retention.</li> ```
dngray (Migrated from github.com) reviewed 2019-11-23 07:10:48 +00:00
_includes/sections/instant-messenger.html
dngray (Migrated from github.com) commented 2019-11-23 07:10:48 +00:00

I am inclined to agree with you.

I am inclined to agree with you.
dngray (Migrated from github.com) reviewed 2019-11-23 07:11:59 +00:00
_includes/sections/instant-messenger.html
dngray (Migrated from github.com) commented 2019-11-23 07:11:59 +00:00

We need to reword that part if we go with this

more features is more complex

We need to reword that part if we go with this > more features is more complex
Mikaela (Migrated from github.com) reviewed 2019-11-24 17:47:51 +00:00
Mikaela (Migrated from github.com) left a comment

I am approving this, but request the typo "or or " to be fixed before merging. I have some other questions, but that is the biggest one I can spot at the moment.

I am approving this, but request the typo "or or " to be fixed before merging. I have some other questions, but that is the biggest one I can spot at the moment.
_includes/sections/instant-messenger.html
Mikaela (Migrated from github.com) commented 2019-11-24 17:28:58 +00:00

I wish for a better link for XMPP, but I am fine with this one.

I wish for a better link for XMPP, but I am fine with this one.
Mikaela (Migrated from github.com) commented 2019-11-24 17:29:50 +00:00

Any idea how?

Any idea how?
Mikaela (Migrated from github.com) commented 2019-11-24 17:36:46 +00:00

I am not sure Matrix.org team is correct, isn't it New Vector?

I am not sure Matrix.org team is correct, isn't it New Vector?
Mikaela (Migrated from github.com) commented 2019-11-24 17:42:40 +00:00 
    <p>Peer-to-Peer instant messengers connect directly to each other without requiring third-party servers. Clients (peers) usually find each other through the use of a <a href="https://en.wikipedia.org/wiki/Distributed_computing">distributed computing</a> network. Examples of this include <a href="https://en.wikipedia.org/wiki/Distributed_hash_table">DHT (distributed hash table)</a> (used with technologies like torrents and IPFS, for example), or <a href="https://en.wikipedia.org/wiki/Ethereum">Ethereum</a>'s <a href="https://github.com/ethereum/wiki/wiki/Whisper">Whisper</a> protocol (used with some newer DApps). Another approach is proximity based networks, where a connection is established over WiFi or Bluetooth (for example, Briar or the <a href="https://www.scuttlebutt.nz">Scuttlebutt</a> social networking protocol). Once a peer has found a route to its contact via any of these methods, a direct connection between them is made.</p>

Double or looks wrong to me.

```suggestion <p>Peer-to-Peer instant messengers connect directly to each other without requiring third-party servers. Clients (peers) usually find each other through the use of a <a href="https://en.wikipedia.org/wiki/Distributed_computing">distributed computing</a> network. Examples of this include <a href="https://en.wikipedia.org/wiki/Distributed_hash_table">DHT (distributed hash table)</a> (used with technologies like torrents and IPFS, for example), or <a href="https://en.wikipedia.org/wiki/Ethereum">Ethereum</a>'s <a href="https://github.com/ethereum/wiki/wiki/Whisper">Whisper</a> protocol (used with some newer DApps). Another approach is proximity based networks, where a connection is established over WiFi or Bluetooth (for example, Briar or the <a href="https://www.scuttlebutt.nz">Scuttlebutt</a> social networking protocol). Once a peer has found a route to its contact via any of these methods, a direct connection between them is made.</p> ``` Double or looks wrong to me.
Mikaela (Migrated from github.com) commented 2019-11-24 17:44:25 +00:00

Their peers? Would contacts be more clear or could this be reworded?

Their peers? Would contacts be more clear or could this be reworded?
_includes/sections/instant-messenger.html
@ -31,0 +87,4 @@
<h3>Disadvantages</h3>
<ul>
<li>Adding new features is more complex, because these features need to be standardized and tested to ensure they work with all servers on the network.</li>
<li>Some metadata may be available. Information like "who is talking to whom," but not actual message content if E2EE is used.</li>
Mikaela (Migrated from github.com) commented 2019-11-24 17:34:42 +00:00

I am not entirely certain on the reasoning.

I am not entirely certain on the reasoning.
_includes/sections/instant-messenger.html
@ -31,0 +88,4 @@
<ul>
<li>Adding new features is more complex, because these features need to be standardized and tested to ensure they work with all servers on the network.</li>
<li>Some metadata may be available. Information like "who is talking to whom," but not actual message content if E2EE is used.</li>
<li>Federated servers generally require trusting your server's administrator. They may be a hobbyist or otherwise not a "security professional," and may not serve standard documents like a privacy policy or terms of service detailing how your data is utilized.</li>
Mikaela (Migrated from github.com) commented 2019-11-24 17:35:16 +00:00

Was there a comment on file names?

Was there a comment on file names?
Mikaela (Migrated from github.com) commented 2019-11-24 17:38:00 +00:00

Nevermind it's in the XMPP warning.

Nevermind it's in the XMPP warning.
_includes/sections/instant-messenger.html
@ -31,2 +132,4 @@
<p>Peer-to-Peer instant messengers connect directly to each other without requiring third-party servers. Clients (peers) usually find each other through the use of a <a href="https://en.wikipedia.org/wiki/Distributed_computing">distributed computing</a> network. Examples of this include <a href="https://en.wikipedia.org/wiki/Distributed_hash_table">DHT (distributed hash table)</a> (used with technologies like <a href="https://en.wikipedia.org/wiki/BitTorrent_(protocol)">torrents</a> and <a href="https://en.wikipedia.org/wiki/InterPlanetary_File_System">IPFS</a>, for example), or <a href="https://en.wikipedia.org/wiki/Ethereum">Ethereum</a>'s <a href="https://github.com/ethereum/wiki/wiki/Whisper">Whisper</a> protocol (used with some newer DApps). Another approach is proximity based networks, where a connection is established over WiFi or Bluetooth (for example, Briar or the <a href="https://www.scuttlebutt.nz">Scuttlebutt</a> social networking protocol). Once a peer has found a route to its contact via any of these methods, a direct connection between them is made.</p>
Mikaela (Migrated from github.com) commented 2019-11-24 17:43:18 +00:00

Should IPFS and torrents also be links by the way?

Should IPFS and torrents also be links by the way?
dngray (Migrated from github.com) reviewed 2019-11-24 23:25:14 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +87,4 @@
<h3>Disadvantages</h3>
<ul>
<li>Adding new features is more complex, because these features need to be standardized and tested to ensure they work with all servers on the network.</li>
<li>Some metadata may be available. Information like "who is talking to whom," but not actual message content if E2EE is used.</li>
dngray (Migrated from github.com) commented 2019-11-24 23:25:13 +00:00

The reasoning is that documentation needs to be available so a consistent integration can occur.

Kind of like with Matrix, when a new room upgrade is available, they have to write about it first rather than just merge a change.

The reasoning is that documentation needs to be available so a consistent integration can occur. Kind of like with Matrix, when a new room upgrade is available, they have to write about it first rather than just merge a change.
ara4n (Migrated from github.com) reviewed 2019-11-25 01:03:38 +00:00
_includes/sections/instant-messenger.html
ara4n (Migrated from github.com) commented 2019-11-25 01:03:38 +00:00

Riot itself is released by New Vector, although it's a thin skin on top of the reference client SDKs (matrix-{react,ios,android}-sdk) released by the Matrix.org Foundation.

Riot itself is released by [New Vector](https://vector.im), although it's a thin skin on top of the reference client SDKs (`matrix-{react,ios,android}-sdk`) released by the Matrix.org Foundation.
Mikaela (Migrated from github.com) reviewed 2019-11-25 12:31:37 +00:00
Mikaela (Migrated from github.com) reviewed 2019-11-25 20:57:05 +00:00
Mikaela (Migrated from github.com) left a comment

Sorry @dngray, more things to address were given to me in private at Matrix

Sorry @dngray, more things to address were given to me in private at Matrix
_includes/sections/instant-messenger.html
Mikaela (Migrated from github.com) commented 2019-11-25 20:49:19 +00:00

On Matrix I am asked what does this actually mean?

File transfers may not be e2e which means files you send may be seen by people in plain text, right? and its e2e is still experimental?

And I think every time I use an XMPP client, I must have OMEMO installed otherwise, all my messages will be unencrypted?

I tried to explain transport encryption and that there are also other E2EE protocols, but that OMEMO is the best/easiest and that there is a comparsion on https://conversations.im/omemo

On Matrix I am asked what does this actually mean? > File transfers may not be e2e which means files you send may be seen by people in plain text, right? and its e2e is still experimental? > And I think every time I use an XMPP client, I must have OMEMO installed otherwise, all my messages will be unencrypted? I tried to explain transport encryption and that there are also other E2EE protocols, but that OMEMO is the best/easiest and that there is a comparsion on https://conversations.im/omemo
Mikaela (Migrated from github.com) commented 2019-11-25 20:51:48 +00:00

I was also asked what does this mean. My answer was:

It's possible for server admins to block all users on a specific server, I don't think it can be done on Matrix, but XMPP at times has a spammer problem and especially in Mastodon instances block other instances that don't fit their rules

I was also asked what does this mean. My answer was: > It's possible for server admins to block all users on a specific server, I don't think it can be done on Matrix, but XMPP at times has a spammer problem and especially in Mastodon instances block other instances that don't fit their rules
Mikaela (Migrated from github.com) reviewed 2019-11-25 20:57:28 +00:00
_includes/sections/instant-messenger.html
Mikaela (Migrated from github.com) commented 2019-11-25 20:57:28 +00:00

Is there anything about transport encryption currently?

Is there anything about transport encryption currently?
Mikaela commented 2019-11-25 21:00:07 +00:00 (Migrated from github.com)
Copy Link

Assigning myself, so I maybe will remember to use the fine suggest changes button or may be sending PRs to your branch

*Assigning myself, so I maybe will remember to use the fine suggest changes button or may be sending PRs to your branch*
Mikaela (Migrated from github.com) reviewed 2019-11-25 22:32:21 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +55,4 @@
image="/assets/img/tools/keybase.png"
description='Keybase provides a hosted team chat with E2EE. Its protocol has also been <a href="https://keybase.io/docs-assets/blog/NCC_Group_Keybase_KB2018_Public_Report_2019-02-27_v1.3.pdf">indepedently audited (PDF)</a>. Keybase can help you prove you own social media accounts though the use of cryptographic signing of "<a href="https://en.wikipedia.org/wiki/Keybase#Identity_proofs">identity proofs</a>".'
labels="warning:<a href=//github.com/keybase/client/issues/6374>Warning</a>:This software relies on a closed-source central server."
website="https://keybase.io/"
Mikaela (Migrated from github.com) commented 2019-11-25 22:32:20 +00:00

Another link: https://github.com/keybase/keybase-issues/issues/162

Another link: https://github.com/keybase/keybase-issues/issues/162
dngray (Migrated from github.com) reviewed 2019-11-27 02:26:30 +00:00
_includes/sections/instant-messenger.html
@ -31,2 +132,4 @@
<p>Peer-to-Peer instant messengers connect directly to each other without requiring third-party servers. Clients (peers) usually find each other through the use of a <a href="https://en.wikipedia.org/wiki/Distributed_computing">distributed computing</a> network. Examples of this include <a href="https://en.wikipedia.org/wiki/Distributed_hash_table">DHT (distributed hash table)</a> (used with technologies like <a href="https://en.wikipedia.org/wiki/BitTorrent_(protocol)">torrents</a> and <a href="https://en.wikipedia.org/wiki/InterPlanetary_File_System">IPFS</a>, for example), or <a href="https://en.wikipedia.org/wiki/Ethereum">Ethereum</a>'s <a href="https://github.com/ethereum/wiki/wiki/Whisper">Whisper</a> protocol (used with some newer DApps). Another approach is proximity based networks, where a connection is established over WiFi or Bluetooth (for example, Briar or the <a href="https://www.scuttlebutt.nz">Scuttlebutt</a> social networking protocol). Once a peer has found a route to its contact via any of these methods, a direct connection between them is made.</p>
dngray (Migrated from github.com) commented 2019-11-27 02:26:30 +00:00

Done.

Done.
dngray (Migrated from github.com) reviewed 2019-11-27 02:30:29 +00:00
_includes/sections/instant-messenger.html
dngray (Migrated from github.com) commented 2019-11-27 02:30:29 +00:00

I think I have resolved this in 1a20f3acbb

I think I have resolved this in https://github.com/privacytoolsIO/privacytools.io/pull/1500/commits/1a20f3acbb46021dd195633e766244c33f1b2b2f
dngray (Migrated from github.com) reviewed 2019-11-27 03:16:02 +00:00
_includes/sections/instant-messenger.html
dngray (Migrated from github.com) commented 2019-11-27 03:16:02 +00:00

That table does say that file transfer with OMEMO is encrypted however there are two XEPs for file transfer (3 if you include the retracted one).

Looking at XEP-0384: OMEMO Encryption it says:

Provide a method to exchange auxilliary keying material. This could for example be used to secure encrypted file transfers.

If the OMEMO element does not contain a , the client has received a KeyTransportElement. The key extracted from the element can then be used for other purposes (e.g. encrypted file transfer).

Note that it says could and can that does not mean that it does. Maybe Conversations does?

This is of course assuming that the client is using XEP-0234: Jingle File Transfer and not the older XEP-0096: SI File Transfer.

Looking at XEP-xxxx: OMEMO Encrypted Jingle File Transfer I don't think file transfers or voice/video do get encrypted E2EE. (This one is also written by the developer of Conversations).

Jingle File Transfer (XEP-0234)[1] describes a very flexible and powerful method for peer-to-peer file transfer with interchangable transports. Unfortunatly only some of those transports can by encrypted (e.g. Jingle In-Band Bytestreams Transport Method (XEP-0261) [2]) and none integrate into existing end-to-end encryption schemes. This specification defines an approach to encrypt the actual file before transferring it by using the OMEMO encryption. Note that the encryption can and should happen on the fly.

Looking at XEP-0234: Jingle File Transfer it says:

In order to secure the data stream, implementations SHOULD use encryption methods appropriate to the transport method being used. For example, end-to-end encryption can be negotiated over either SOCKS5 Bytestreams or In-Band Bytestreams as described in XEP-0260 and XEP-0261.

Now if we dig into XEP-0260: Jingle SOCKS5 Bytestreams Transport Method we see:

This specification, like XEP-0065 before it, does not directly support end-to-end encryption of the media sent over the transport.

XEP-0261: Jingle In-Band Bytestreams Transport Method says:

This specification, like XEP-0047 before it, does not directly support end-to-end encryption of the media sent over the transport.

Should also note that sharing files is a peer-to-peer operation will expose your IP address to the other participant. Unless the client supports XEP-0363: HTTP File Upload, yet another way to share files.

So in conclusion my observation is voip/video is not encrypted, they are peer to peer transfers that occur exposing your IP to the remote user.

File transfers can be encrypted transparently but might not be. It's not very clear on that.

That table does say that file transfer with OMEMO is encrypted however there are two XEPs for file transfer (3 if you include the retracted one). Looking at [XEP-0384: OMEMO Encryption](https://xmpp.org/extensions/xep-0384.html) it says: > Provide a method to exchange auxilliary keying material. This could for example be used to secure encrypted file transfers. > > If the OMEMO element does not contain a <payload>, the client has received a KeyTransportElement. The key extracted from the <key> element can then be used for other purposes (e.g. encrypted file transfer). Note that it says *could* and *can* that does not mean that it does. Maybe Conversations does? This is of course assuming that the client is using [XEP-0234: Jingle File Transfer](https://xmpp.org/extensions/xep-0234.html) and not the older [XEP-0096: SI File Transfer](https://xmpp.org/extensions/xep-0096.html). Looking at [XEP-xxxx: OMEMO Encrypted Jingle File Transfer](https://xmpp.org/extensions/inbox/omemo-filetransfer.html) I don't think file transfers or voice/video do get encrypted E2EE. (This one is also written by the developer of Conversations). > [Jingle File Transfer (XEP-0234)](https://xmpp.org/extensions/xep-0234.html)[1] describes a very flexible and powerful method for peer-to-peer file transfer with interchangable transports. Unfortunatly only some of those transports can by encrypted (e.g. [Jingle In-Band Bytestreams Transport Method (XEP-0261)](https://xmpp.org/extensions/xep-0261.html) [2]) and none integrate into existing end-to-end encryption schemes. This specification defines an approach to encrypt the actual file before transferring it by using the OMEMO encryption. Note that the encryption can and should happen on the fly. Looking at [XEP-0234: Jingle File Transfer](https://xmpp.org/extensions/xep-0234.html) it says: > In order to secure the data stream, implementations SHOULD use encryption methods appropriate to the transport method being used. For example, end-to-end encryption can be negotiated over either SOCKS5 Bytestreams or In-Band Bytestreams as described in [XEP-0260](https://xmpp.org/extensions/xep-0260.html) and [XEP-0261](https://xmpp.org/extensions/xep-0261.html). Now if we dig into [XEP-0260: Jingle SOCKS5 Bytestreams Transport Method](https://xmpp.org/extensions/xep-0260.html) we see: > This specification, like XEP-0065 before it, does not directly support end-to-end encryption of the media sent over the transport. [XEP-0261: Jingle In-Band Bytestreams Transport Method](https://xmpp.org/extensions/xep-0261.html#security-media) says: > This specification, like XEP-0047 before it, does not directly support end-to-end encryption of the media sent over the transport. Should also note that sharing files is a peer-to-peer operation will expose your IP address to the other participant. Unless the client supports [XEP-0363: HTTP File Upload](https://xmpp.org/extensions/xep-0363.html), yet another way to share files. So in conclusion my observation is voip/video is **not** encrypted, they are peer to peer transfers that occur exposing your IP to the remote user. File transfers *can* be encrypted transparently but might not be. It's not very clear on that.
dngray (Migrated from github.com) reviewed 2019-11-27 04:13:35 +00:00
_includes/sections/instant-messenger.html
dngray (Migrated from github.com) commented 2019-11-27 04:13:35 +00:00

I think i've made it clearer d1487f7a3c

I think i've made it clearer https://github.com/privacytoolsIO/privacytools.io/pull/1500/commits/d1487f7a3cc5ef593a5b93639969c4f2d59637b7
dngray (Migrated from github.com) reviewed 2019-11-27 08:09:46 +00:00
_includes/sections/instant-messenger.html
dngray (Migrated from github.com) commented 2019-11-27 08:09:45 +00:00

@danarel and I had a look around, and couldn't find anything.

I've decided to remove this as it's very much an advanced feature, which actually means no E2EE on Matrix so we probably shouldn't recommend it.

@danarel and I had a look around, and couldn't find anything. I've decided to remove this as it's very much an advanced feature, which actually means no E2EE on Matrix so we probably shouldn't recommend it.
dngray (Migrated from github.com) reviewed 2019-11-27 08:11:55 +00:00
_includes/sections/instant-messenger.html
dngray (Migrated from github.com) commented 2019-11-27 08:11:55 +00:00

What point specifically are you talking about?

What point specifically are you talking about?
Mikaela (Migrated from github.com) reviewed 2019-11-27 08:13:24 +00:00
_includes/sections/instant-messenger.html
Mikaela (Migrated from github.com) commented 2019-11-27 08:13:24 +00:00

How can I verify that the server software running on a random server somewhere matches the public source code?

How can I verify that the server software running on a random server somewhere matches the public source code?
dngray (Migrated from github.com) reviewed 2019-11-27 08:14:29 +00:00
_includes/sections/instant-messenger.html
@ -31,0 +55,4 @@
image="/assets/img/tools/keybase.png"
description='Keybase provides a hosted team chat with E2EE. Its protocol has also been <a href="https://keybase.io/docs-assets/blog/NCC_Group_Keybase_KB2018_Public_Report_2019-02-27_v1.3.pdf">indepedently audited (PDF)</a>. Keybase can help you prove you own social media accounts though the use of cryptographic signing of "<a href="https://en.wikipedia.org/wiki/Keybase#Identity_proofs">identity proofs</a>".'
labels="warning:<a href=//github.com/keybase/client/issues/6374>Warning</a>:This software relies on a closed-source central server."
website="https://keybase.io/"
dngray (Migrated from github.com) commented 2019-11-27 08:14:29 +00:00

As far as this is concerned, no. They've not said they are going to do federation, and I like to avoid linking to github issues on the main page.

As far as this is concerned, no. They've not said they are going to do federation, and I like to avoid linking to github issues on the main page.
dngray (Migrated from github.com) reviewed 2019-11-27 08:19:10 +00:00
_includes/sections/instant-messenger.html
dngray (Migrated from github.com) commented 2019-11-27 08:19:10 +00:00

How can I verify that the server software running on a random server somewhere matches the public source code?

sure you can only do that if you're running it yourself, or you trust your system administrator, ie if it was a family member that set it up.

> How can I verify that the server software running on a random server somewhere matches the public source code? sure you can only do that if you're running it yourself, or you trust your system administrator, ie if it was a family member that set it up.
Mikaela commented 2019-11-27 15:27:23 +00:00 (Migrated from github.com)
Copy Link

I added the netlify link to the original comment and I am not sure if the bridge/transport part was removed, but could it be noted that bridges/transports/relays turn federation/P2P into a single point of failure? And is the depedency on your server explained or do we consider that as too obvious?

I added the netlify link to the original comment and I am not sure if the bridge/transport part was removed, but could it be noted that bridges/transports/relays turn federation/P2P into a single point of failure? And is the depedency on your server explained or do we consider that as too obvious?
danarel (Migrated from github.com) reviewed 2019-11-28 04:04:53 +00:00
danarel (Migrated from github.com) left a comment

Looks great!

Looks great!
jonah reviewed 2019-11-28 04:19:27 +00:00
Mikaela (Migrated from github.com) reviewed 2019-11-28 06:11:47 +00:00
Mikaela (Migrated from github.com) left a comment

Emergency approval before I leave from home as requested on the team chat, however I disagree with demoting XMPP.

(And my other change requests will probably need a new PR?)

Emergency approval before I leave from home as requested on the team chat, however ***I disagree with demoting XMPP.*** (And my other change requests will probably need a new PR?)
Mikaela commented 2019-11-28 06:14:14 +00:00 (Migrated from github.com)
Copy Link

shouldn't Matrix have warning that E2EE is not enabled by default yet and it stores media files forever and the reader needs to ask themselves whether they trust Matrix's encryption to protect them in 5, 10...50 years?

https://github.com/matrix-org/synapse/issues/1263

> shouldn't Matrix have warning that E2EE is not enabled by default yet and it stores media files forever and the reader needs to ask themselves whether they trust Matrix's encryption to protect them in 5, 10...50 years? https://github.com/matrix-org/synapse/issues/1263
Mikaela (Migrated from github.com) reviewed 2019-11-28 06:14:54 +00:00
Mikaela (Migrated from github.com) left a comment

another emergency approval while I still disagree with the direction this PR took overnight.

another emergency approval while I still disagree with the direction this PR took overnight.
jonah commented 2019-11-28 06:43:04 +00:00
Copy Link

I disagree with demoting XMPP.

Was this even something previously discussed? It was never full-recommended in the first place, this keeps it in the same position.

> I disagree with demoting XMPP. Was this even something previously discussed? It was never full-recommended in the first place, this keeps it in the same position.
jonah approved these changes 2019-11-28 06:43:47 +00:00
dawidpotocki (Migrated from github.com) approved these changes 2019-11-28 06:45:43 +00:00
dawidpotocki (Migrated from github.com) left a comment

duawdhuawhdawudh

duawdhuawhdawudh
nitrohorse (Migrated from github.com) approved these changes 2019-11-28 06:47:42 +00:00
Mikaela commented 2019-11-28 09:11:27 +00:00 (Migrated from github.com)
Copy Link

Clarification on my previous comments:

I woke up at 07.23 which is earlier than usually and left for psykofyysinen kuntoutus at 8.23 (where I arrived late). During this time I did my morning tasks and checked the PrivacyTools team chat where I learned that a blog post has been posted and this needs emergency merging immediately and that we have delisted XMPP.

After I left from home, I was unable to reach other team members than @nitrohorse on XMPP and Wire (and we also established a Signal connection) who apologised for not understanding that I didn't have time for reviewing and clarified to me that we have not delisted XMPP and XMPP is still a worth mentioning app, which I can agree with).

I also learned that as a backup to the teamchat on Matrix, we are having a backup chat on Keybase. However neither works on my main phone (and I was too di/stressed about everything to remember I have a powered off spare phone that Riot works on) as they are too heavy.

I am not sure if RiotX has an issue about not performing well on Nokia 1, but at first it was showing me that everything is an encrypted message, then I maybe got two or three lines sent and read and as it then threw me to ancient history in the scrollback I attempted the clear cache and reload trick, which RiotX never continued further. I am aware that RiotX is an experimental app, but even with its malfunctioning, it works better and seems lighter than Riot.

On Keybase, I have been complaining about it not working on my main phone for almost an year https://github.com/keybase/client/issues/15115 and it's also one of the most heavy apps I run on my desktop (that has 8 GB RAM) alongside Riot, Signal and Wire.

PS. I haven't still reviewed what has happened to this PR since my previous full review yesterday or earlier and I don't see much point doing that seeing that it has been merged already.

PPS. I have no access to either team chat until around 14 UTC as the app is too heavy for my work try-out practice device with 4 GB of RAM that is efficiently eaten by Firefox, RocketChat, Riot and Telegram.

Clarification on my previous comments: I woke up at 07.23 which is earlier than usually and left for _psykofyysinen kuntoutus_ at 8.23 (where I arrived late). During this time I did my morning tasks and checked the PrivacyTools team chat where I learned that a blog post has been posted and this needs emergency merging immediately and that we have delisted XMPP. After I left from home, I was unable to reach other team members than @nitrohorse on XMPP and Wire (and we also established a Signal connection) who apologised for not understanding that I didn't have time for reviewing and clarified to me that we have not delisted XMPP and XMPP is still a worth mentioning app, which I can agree with). I also learned that as a backup to the teamchat on Matrix, we are having a backup chat on Keybase. However neither works on my main phone (and I was too di/stressed about everything to remember I have a powered off spare phone that Riot works on) as they are too heavy. I am not sure if RiotX has an issue about not performing well on Nokia 1, but at first it was showing me that everything is an encrypted message, then I maybe got two or three lines sent and read and as it then threw me to ancient history in the scrollback I attempted the _clear cache and reload_ trick, which RiotX never continued further. I am aware that RiotX is an experimental app, but even with its malfunctioning, it works better and seems lighter than Riot. On Keybase, I have been complaining about it not working on my main phone for almost an year https://github.com/keybase/client/issues/15115 and it's also one of the most heavy apps I run on my desktop (that has 8 GB RAM) alongside Riot, Signal and Wire. PS. I haven't still reviewed what has happened to this PR since my previous full review yesterday or earlier and I don't see much point doing that seeing that it has been merged already. PPS. I have no access to either team chat until around 14 UTC as the app is too heavy for my work try-out practice device with 4 GB of RAM that is efficiently eaten by Firefox, RocketChat, Riot and Telegram.
This repo is archived. You cannot comment on pull requests.
Reviewers
No reviewers
jonah
djoate
dawidpotocki
nitrohorse
Labels
Clear labels   
🔍🤖 Search Engines

   
approved

approved, waiting for a PR

  
dependencies

Pull requests that update a dependency file

  
duplicate

   
feedback wanted

   
high priority

   
I2P

The Invisible Internet Project (I2P)

  
iOS

   
low priority

   
OS

Operating Systems

  
Self-contained networks

   
Social media

   
stale

A label for stalebot if it gets added

  
streaming

Anything related to media streaming.

  
todo

   
Tor

Anything covering the Tor network

  
WIP

active work in progress, do not merge or PR (yet)!

  
wontfix

Issues or bugs that will not be fixed and/or do not have significant impact on the project.

  
XMPP

Extensible Messaging and Presence Protocol

  
[m]

Matrix protocol

  
₿ cryptocurrency

   
ℹ️ help wanted

   
↔️ file sharing

   
⚙️ web extensions

Browser Extension related issues

  
✨ enhancement

   
❌ software removal

   
💬 discussion

   
🤖 Android

   
🐛 bug

   
💢 conflicting

   
📝 correction

Correction of content on the website

  
🆘 critical

   
📧 email

   
🔒 file encryption

   
📁 file storage

   
🦊 Firefox

Firefox & forks, about:config etc.

  
💻 hardware

   
🌐 hosting

   
🏠 housekeeping

Anything primarily related to site cleanup.

  
🔐 password managers

   
🧰 productivity tools

   
🔎 research required

   
🌐 Social News Aggregators

   
🆕 software suggestion

   
👥 team chat

   
🔒 VPN

Virtual Private Network

  
🌐 website issue

*Technical* issues with the website.

  
🚫 Windows

   
👁️ browsers

   
🖊️ digital notebooks

   
🗄️ DNS

Domain Name System

  
🗨️ instant messaging (im)

   
🇦🇶 translations

Anything covering a translated version of the site

No Label
🔍🤖 Search Engines
approved
dependencies
duplicate
feedback wanted
high priority
I2P
iOS
low priority
OS
Self-contained networks
Social media
stale
streaming
todo
Tor
WIP
wontfix
XMPP
[m]
₿ cryptocurrency
ℹ️ help wanted
↔️ file sharing
⚙️ web extensions
✨ enhancement
❌ software removal
💬 discussion
🤖 Android
🐛 bug
💢 conflicting
📝 correction
🆘 critical
📧 email
🔒 file encryption
📁 file storage
🦊 Firefox
💻 hardware
🌐 hosting
🏠 housekeeping
🔐 password managers
🧰 productivity tools
🔎 research required
🌐 Social News Aggregators
🆕 software suggestion
👥 team chat
🔒 VPN
🌐 website issue
🚫 Windows
👁️ browsers
🖊️ digital notebooks
🗄️ DNS
🗨️ instant messaging (im)
🇦🇶 translations
Milestone
Clear milestone
No items
No Milestone
Assignees
Clear assignees
No Assignees
1 Participants
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: privacyguides/privacytools.io#1500
No description provided.
Delete Branch "pr-instant_messaging_refinement"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?