Show HN: ChatSecure iOS v3.0 (OTR + Tor + XMPP)

https://chatsecure.org/blog/chatsecure-ios-v3-released/

by chrisballinger • 12 years ago

74 28 12 years ago

Mizza• 12 years ago

Great to see this finally get out there, it's been awesome to watch this project develop!

This is also a particularly good release write-up, big ups to the team for writing about all of the components that have gone into this new release.

funcSoulBrother• 12 years ago

Pretty excited about the hidden TOR xmpp functionality in this version, since NAT won't ever be an issue.

laveur• 12 years ago

Does the fact that they use Tor make it more secure? It seems like the network has been getting hacked a lot lately.

dewey2• 12 years ago

It's not "getting hacked a lot". What you are talking about is probably just the take-down of a few hidden services with poor operational security.

dewey2• 12 years ago

Very excited for this, just from the GUI point of view it's a big step forward.

tyrion• 12 years ago

If you are so concerned about privacy and security, why use an iOS device at all?

Note: I am not trolling. It is a serious question. I mean, probably no one would be using ChatSecure if it were not Free Software, rightly, because nobody could audit its source code, but then isn't it a security/privacy issue using it on top of a completely closed platform?

chrisballinger4• 12 years ago

Most people don't choose their devices like a developer would and instead focus on things like ease of use (or the best marketing campaign). Just because a platform doesn't offer completely perfect theoretical security and privacy, users should still have access to tools that can help.

LeoPanthera• 12 years ago

Even if you don't use iOS, you may wish to communicate (relatively) securely with those who do.

acdha2• 12 years ago

1. You are using the device you already have

2. You know that for non-experts the free software distinction is pointless because almost nobody actually audits the installed binaries either way

3. You value the security benefits from iOS's more restrictive app sandbox and mandatory code auditing.

(That last is not an Android slam – both policies have their merits but the net effect is that Android has more malware than iOS because there are multiple ways to get code onto the device and the vast majority of users can't meaningfully make security decisions)

gnur• 12 years ago

It is clear that there really is no iOS's mandatory code auditing. If there was, there would be no iOS apps that pose as one app but are actually an other (like emulators).

There is some auditing, but it isn't fool proof and for developers it is a huge pain in the butt.

And there are multiple ways to get code on an Android device, but by default only the play store is enabled. You need to go into settings and accept multiple warnings to sideload apps.

avree2• 12 years ago

Because there's a tradeoff between 'privacy and security' and 'convenience', and most people like to fall somewhere in the middle.

It's like locking your doors on your house. Sure, a burglar could break the door down, smash a window, follow you around and steal your keys, etc., but it adds a level of security and precaution that keeps some of the bad guys out while not being insanely inconvenient.

I care about the privacy and security of my home, but I'm not going to live in a bunker.

jakeogh2• 12 years ago

A closer analogy would address a group controlled by a few which has the resources to install people (whom believe that are doing good things) into positions that have access to your private keys. It's more like there is an automatically updated encrypted manifest of your house available. The bunker analogy is bad unless you think we should meet in the middle on infosec. At some point, this same conversation will be about hardware inside our heads, we already use these devices like second brains.

richardwhiuk• 12 years ago

That way lies the path of not having a smartphone.

All smartphones on the market involve some level of closed source - whether that's the baseband, the graphics blob, the chipset, the ROM, the firmware, or the complete operating system. Any of these could theoretically intercept the voice from the microphone / speaker, encode it and ship it on some back channel to the Five Eyes.

At that point it's simply a matter of where you draw the line between paranoia (that the NSA are reading your thoughts and have compromised everything) / idealism (e.g. RMS) and ease of use.

jakeogh2• 12 years ago

Good point. Until we control of the baseband it's somewhat moot what smartphone you use.

Anyone working on an open LTE stack? I'm looking for the donate link @ http://bb.osmocom.org/trac/ ...

mrmondo2• 12 years ago

I'd love to see Moxie review this!

girvo• 12 years ago

I'd rather see Signal have text messaging enabled first ;)

mrmondo2• 12 years ago

Yeah me too ;)

ex3ndr• 12 years ago

We in Actor.im tried to build tor-enabled messaging (on better and faster protocol), but for working tor engine need to download 1-3mb files every 4 hour period. So, this became useless in mobile environment. Tor need to do step forward to mobile before we can really use it.

chrisballinger4• 12 years ago

I was excited about the possibility of federated XMPP over mobile hidden services, mainly because of the built-in NAT traversal. It could make creating a "good enough" XMPP server as simple as buying a cheap Android phone, installing an app, and keeping it plugged in somewhere.

magikarp• 12 years ago

Fantastic work, Chris! It's really great to see that ChatSecure has such an ambitious roadmap.

higherpurpose• 12 years ago

Would it be possible for TextSecure and ChatSecure to interoperate (at least with chats)? Or would that create too much pain for both groups to support each other as they (possibly) diverge in features?

chrisballinger4• 12 years ago

I'd love to make this happen, but it won't be possible unless they support open federation, which is currently impossible when using your phone number as the identifier. I do plan to support Axolotl in conjunction with our provider-agnostic push solution, which could potentially provide a bridge between the two platforms.

foobarqux• 12 years ago

Why not use Signal?

xxdesmus2• 12 years ago

Signal doesn't do messaging on iOS right now, only phone calls.

chrisballinger4• 12 years ago

It will soon! After playing around with their latest Signal 2.0 beta that integrates TextSecure support, I honestly would recommend using Signal unless you specifically need Tor/OTR or want to host your own XMPP infrastructure.

Show HN: ChatSecure iOS v3.0 (OTR + Tor + XMPP)

Related Stories