this post was submitted on 31 Dec 2021
25 points (85.7% liked)
Open Source
31173 readers
442 users here now
All about open source! Feel free to ask questions, and share news, and interesting stuff!
Useful Links
- Open Source Initiative
- Free Software Foundation
- Electronic Frontier Foundation
- Software Freedom Conservancy
- It's FOSS
- Android FOSS Apps Megathread
Rules
- Posts must be relevant to the open source ideology
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
- !libre_culture@lemmy.ml
- !libre_software@lemmy.ml
- !libre_hardware@lemmy.ml
- !linux@lemmy.ml
- !technology@lemmy.ml
Community icon from opensource.org, but we are not affiliated with them.
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Some red flags about this messenger:
They are dishonest about the merits of existing secure messengers.
From the homepage:
There is no "most secure messenger in the world"; that judgement is much too nuanced and situation-dependent for such a claim.
This is false of at least several alternatives, including Signal and Matrix.
From the "technology" link on top bar:
Objectively false. Even if you consider end-to-end encrypted and federated platforms like Matrix to "rely on a trusted third party", there are P2P messengers which truly have no servers and which solve the problem of mapping username to public key, such as Tox.
Actually, all existing secure messengers have cryptographic authentication, and I'm pretty sure some of them also encrypt as much metadata as possible, such as Signal.
It seems like they're dishonest about the merits of their own messenger.
This is huge. I'm developing a federated messenger and had given up on hiding the recipient ID when sending a message because I couldn't find a way to do it. If there's a practical way to do it, I want to hear about it. So I opened their protocol specification.
In the section "Upload message and get UID", I see that the request actually contains a list of both the device UIDs and the identity of all recipients. They call it "encoded", but it sounds like that just means JSON.
In summary, I would stay away from this messenger in favor of another option like Matrix or SIgnal.
Marketing speak bends the truth? Say it ain't so!