• 2 Posts
  • 108 Comments
Joined 2 years ago
cake
Cake day: November 8th, 2023

help-circle
  • A few observations from others about why Delta Chat is neat but not remotely close to a replacement for Signal (or probably much else):

    It hasn’t achieved the bare minimum for serious encrypted messaging

    “No, Delta Chat doesn’t support Perfect Forward Secrecy (PFS). This means that if your Delta Chat private decryption key is leaked, and someone has collected your prior in-transit messages, they will be able to decrypt and read them using the leaked decryption key.”

    https://delta.chat/en/help#pfs

    It’s great they’re being open about the implications. But given that there’s better protocols out there (Signal protocol for example), it makes no sense to use inferior apps.

    Forward secrecy and metadata privacy are table stakes in any modern secure messaging design, and Delta Chat has neither.

    If Keybase hasn’t managed to “fix” the same base encryption Delta Chat is using, there’s no reason to assume this small project will have better luck.

    PGP isn’t architecturally well-equipped to provide forward secrecy. In the mean time, I think it’s borderline negligent to put this in the category of secure messaging; the world’s expectations for security baselines have moved on beyond the mid-2000s.

    (My reference point here is Keybase, which built a very user-friendly and misuse-resistant encrypted chat on top of PGP in the mid-2010s. They couldn’t get to forward secrecy either with PGP as their substrate.)

    Delta Chat treats encryption as optional and requires extra steps to avoid accidentally exposing more data

    No forward secrecy and will automatically switch to unencrypted messages if you receive an unencrypted message from a contact.

    The way to have guaranteed encryped is creating two user encrypted group chat.










  • Based on your descriptions of the integration between Windows 96 and Office, I did get the feeling you might run into even more issues if more software wasn’t installed alongside Windows as well.

    I’m all Mac and Virtual Box doesn’t run on M-series hardware.

    I had no idea!

    And hopefully my comment didn’t come across as a dig against your article - it just promises to be a potentially fascinating follow-up. Especially when, even today, Windows Explorer feels like it added previews of files as little more than an afterthought (and occasionally as a PowerToy).

    BTW I enjoyed 100% of your article, I think it’s a good sign when it leaves the reader wanting more!


  • This is a very good article, but this part peeved me on a petty level (as well as explaining why there’s precious little in the way of screenshots):

    While I can’t find any uploads that are set to run on their website in a virtual computing session, the files are available to download if you felt like spinning up a piece of computing history.

    The opportunity to do a little investigative journalism is right there, and the blog author didn’t take it







  • What is this article? Besides terrible, I mean. This article is terrible.

    First of all, this isn’t a new leak. It’s not even a combination of old leaks. It’s just somebody noticing that a bunch of leaks existed and did an Excel Sum operation on the passwords on them.

    According to Vilius Petkauskas at Cybernews, whose researchers have been investigating the leakage since the start of the year, “30 exposed datasets containing from tens of millions to over 3.5 billion records each,” have been discovered. In total, Petkauskas has confirmed, the number of compromised records has now hit 16 billion. Let that sink in for a bit.

    And to add insult to injury, the article has this gem:

    Is This The GOAT When It Comes To Passwords Leaking?

    Password compromise is no joke.

    Certainly not with writing like this.