@nprofile1q... @nprofile1q... @nprofile1q... @Martin @nprofile1q...
I haven't looked at either in detail. The first thing I'd want to see is an independent review of the crypto and the result of an independent red teaming exercise. A quick skim of cwtch a while ago didn't throw up anything obviously silly (and I like the name), I haven't looked at simplex at all.
I think this kind of thing is a natural monopoly: the value increases for any messenger system the more people are using it. Currently, Signal has over 70M users. There are two alternatives:
Make those people switch to something different.
Improve Signal.
To me, option 2 looks much easier. It's much easier to completely replace the protocol that people are using without changing the app than it is to make them use a different app.
Building a distributed system that leaks as little metadata as Signal is much harder than building a centralised one. Centralisation means that you don't have to handle the question of what data is leaked when you exchange messages between a server, especially for traffic analysis.
Large numbers of users also paper over a lot of things. If someone sends a message to Signal, thousands of other people will receive a message from Signal at about the same time, so doing any kind of correlation is hard. And it becomes harder the more people are there. And it's made even harder by the fact that Signal sends some fake messages periodically that the clients discard to further mitigate this. If you have a distributed or federated model, that becomes easier. If I'm self hosting a server (as I did with XMPP for over a decade), anyone who can see traffic in and out can tell exactly who I'm talking to, without breaking any encryption.
I haven't looked at either in detail. The first thing I'd want to see is an independent review of the crypto and the result of an independent red teaming exercise. A quick skim of cwtch a while ago didn't throw up anything obviously silly (and I like the name), I haven't looked at simplex at all.
I think this kind of thing is a natural monopoly: the value increases for any messenger system the more people are using it. Currently, Signal has over 70M users. There are two alternatives:
Make those people switch to something different.
Improve Signal.
To me, option 2 looks much easier. It's much easier to completely replace the protocol that people are using without changing the app than it is to make them use a different app.
Building a distributed system that leaks as little metadata as Signal is much harder than building a centralised one. Centralisation means that you don't have to handle the question of what data is leaked when you exchange messages between a server, especially for traffic analysis.
Large numbers of users also paper over a lot of things. If someone sends a message to Signal, thousands of other people will receive a message from Signal at about the same time, so doing any kind of correlation is hard. And it becomes harder the more people are there. And it's made even harder by the fact that Signal sends some fake messages periodically that the clients discard to further mitigate this. If you have a distributed or federated model, that becomes easier. If I'm self hosting a server (as I did with XMPP for over a decade), anyone who can see traffic in and out can tell exactly who I'm talking to, without breaking any encryption.
1
