TIL I’m an infosec nihilist. We go about our days pretending that we can secure our data, yet are unwilling and unable to do what actually needs to be done for that to be so.
Infosec is a bet. I’m betting that I did enough in the right places to be secure, but technology advanced beyond my ability to know whether it really is secure.
@jerry also, isn’t telling people they shouldn’t click on links because it’s too risky not dramatically different than telling people not to send highly sensitive messages via email? Aren’t both an admission of our inability to ensure security? Why is one ok to say and the other heretical?
From the article: "[Security nihilists] make any gains contingent on systems that are so cumbersome and inconvenient that they drive people away from the security mechanism in the first place."
Also from the article: an eight-point list of things to check before clicking a link in an email.
People will continue to send e-mail. There is no way this goes away antime soon. People will send sensitive stuff via e-mail.
We can spend time discussing just how exactly people should not use e-mail, or we can build a system that works.
I like the ideas behind PEP and AutoCrypt. I'd like to see them implemented in more clients.
@jerry @rysiek @Aaron
I have a feeling that right now, SMTP has the biggest adoption of all federated messagning protocols, and the second place is far far behind. Of all the new communication protocols I've seen recently, they're either popular, or federated, not both. And trying to get your new protocol adopted not just by people for their private communications, but also by companies, govts, and orgs for their internal and external communication is going to be extremely hard.
BitTorrent is not exactly a "messaging" protocol, but got immensely popular.
FireChat, a p2p messaging app, got very popular during protests in Romania. Sadly it's proprietary, so I'd stay far away from it.
Briar doesn't need any introduction in this group, methinks, but is not popular at all... yet.
But, messaging and e-mail are two different things. It's not just about sending the message. It's about the infra around it.
@rysiek @jerry @Aaron
Maybe we mean different things by messaging.
IMO email is a messaging protocol, but one with certain interesting properties:
- allows you to send very long messages, with attachments, after preparing and proof-reading the whole thing
- is a de-facto standard for official online communication, incl. official documents
- everyone has it
@Wolf480pl @jerry @Aaron exectamente! But we have to be explicit about what we're talking about (incidentally, anyone who heard me talk in private about infosec and internet messaging knows just *how* explicit I get, but I digress).
The last two of your points is what I meant by "infra around it". That's the hard part. The network effect.
But we have a head start since SMTP is an open standard.
It's freesoftware with multiple GUIs, and is quite similar to Briar. Except they do allow adding remote contacts (though sharing the pubkeyhashes to do so may not be practical for most), and they've made superficially different protocol decisions.
At the same time I don't know what I'd recommend instead. I like the freesoftware p2p, but Briar doesn't appear to fit my usecase (besides I'd prefer a smaller codebase to audit, it looks quite bloated).
Maybe I'll lean more on Matrix or XMPP? But then a loose the metadata encryption I'd love to play with.
Also RetroShare seems interesting, but also bloated.
I am not concerned about Briar's codebase. People working on it are as solid as they come, and Briar went through an audit already. More problematic is the model of establishing contact, which requires physical presence or a common friend. I like how secure it is, but I understand how annoying it might be at times.
For me personally Briar looks good.
@rysiek @alcinnz @jerry @Aaron
I'm not a fan of Matrix. From what I've heard, they have a terrible server implementation, and nobody else tries to make their own implementation because Matrix changes the s2s protocol too often.
Also, I've heard there's a thing called Secure Scuttlebutt, haven't looked into it, but it may be relevant here.
@Wolf480pl @rysiek @jerry @Aaron I do kind-of have questions about Matrix. From a distance it kind-of looks like they decided to reimplement XMPP with the latest fashion of JSON. And I still have to explore it's encryption situation.
As for SSB I'm starting to look into it, particularly with Git-SSB. And from what I've seen, the tech looks very elegant when dealing with group comms or reliability despite the clients. Though again I have to look at the encryption again.
First off I'm aware that the routing metadata is quite sensitive information, and am keen on seeing ways to encrypt it.
And second while I by no means think everything should be p2p, I do think messaging should be. This comes down to a concern that unless given a practical reason otherwise I worry everyone will use the same server.
As for the personal auditing, it's something I like to make a habit of. Not that I seriously trust myself to catch many or any issues, but nor do I trust enough auditing is done. And I be no means trust myself with auditting crypto, the most I really can do is say "yeah, that kinda looks like crypto". I'm glad you trust the devs.
@Wolf480pl @rysiek @Aaron having said that, I look at my kids (late teens) and realize that email will likely be relegated to inter and intra corporation communications. I’m not saying this is a good thing, mind you, because I don’t think replacing email with a series of Snapchat pictures is the most ideal solution, either.
@rysiek @Wolf480pl @Aaron true. Email itself is becoming rapidly less federated. It’s becoming increasingly more painful to run a mail server (I speak from much experience) and it’s all moving to just a few providers (google, MS, etc). Point is, I think we’re moving to that walled garden even with smtp.
Oh, I see. @jerry was remarking that email is increasingly centralized -- an "everyone is either using Gmail or Outlook.com" thing.
To be clear, email will continue working for mailing lists and friend groups. For a very long time, I'll bet. You don't need to worry about email going away.
To put it in perspective: Does ActivityPub feel more decentralized than email? It shouldn't, because it's currently dominated by Mastodon. Email is arguably more decentralized.
@jerry @rysiek @Wolf480pl @Aaron Interesting discussion! And I recently tooted a thread about a different angle on why so many people are so attracted to these centralised e-mail and other services. It's accessibility for people with disabilities, non-tech users etc. These big companies usually have much better resources to make things usable for a broader audience. See my thread here: https://toot.cafe/@marcozehe/100032643360174880
@Wolf480pl @jerry @rysiek @Aaron I feel like just one "killer" app would speed the adoption quite a bit. Like if Slack was federated similarly to Matrix.org - people would just use Slack and in the process prop up the new protocol. Like most people don't realize they're using federation when they email someone on a different provider, but they do. Problem is, email's primary incentive wasn't profit, in this VC-funded age it is, so Slack has no incentive to adopt an open, federated protocol.