this post was submitted on 01 Jun 2024
47 points (96.1% liked)
Privacy
32026 readers
631 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The session developers are interesting. But I don't recommend anybody use session.
They took the signal protocol, and removed perfect forward secrecy because they found it hard to implement.
That's crazy.
Also all of the file transfers on session go through servers in Canada. Centralized.
I give them kudos for trying to make the network self-sustainable through their crypto thing, but they never found a way to actually monetize it, there's no paper use, it feels like the idea is kind of dead in the water at this point. I would not recommend session for any serious non-experimental usage
Is there a feature request to add PFS again?
https://getsession.org/session-protocol-technical-information
Nope. Whenever anybody ask them, they refer to this and close the ticket
I find their technical rationale, while welcome, a lot of hand waving to say they couldn't figure out how to implement it, but it was not important because it's not a big threat, because if somebody has the device they can get all the messages on the device anyway....
Losing perfect forward secrecy for "simpler code" is a strong design choice they made. I respect them for documenting this, I wish them the best of success, but that's not a trade-off I'm willing to make for no benefit
It's not a lie. I have read their post. And my interpretation reading between the lines is they dropped it because of complexity
Fair enough. They did not explicitly say they removed it for complexity.
The facts are: they started with a protocol that had perfect forward secrecy, and they removed it, but not for philosophical reasons.
They were not opposed to perfect forward secrecy
In today's ecosystem there are products that use onion networks and provide perfect for secrecy like simple x, and briar over tor...
You're welcome to make any decision you like, if you want to use session go right ahead. I'm not going to stop you, and I'm happy you're doing so. We're all better for choice