When I said that your discord clone doesn’t need e2ee, I got a lot of comments along the lines of “ then how would I use it to organize the revolution!” The answer is: you don’t. If you have more users than can comfortably share a Signal chat and hence want to use discord or something like it, you cannot POSSIBLY be vetting all of them to a high standard of trust. Your logs ARE leaking. End-to-end encryption between more people than can fit around a dinner table is pointless.
This article confirms what I already assumed, that “open source [information sense, not code sense] intelligence gathering on social media” includes, for the US government, asking for links to join groups that may *feel* private. My own discord has literally like a thousand idlers. It would be very *lucky* if none of them were logging for potentially nefarious purposes! And I remind the active users of this occasionally.
https://www.kenklippenstein.com/p/exclusive-ice-masks-up-in-more-ways
@0xabad1dea to be honest, i disagree, not because it's safe to fedpost in a chat of hundreds of users, but because it makes e2ee itself less suspicious, and more noisy to infiltrate
yes, a fed can lurk in a large member count e2ee chat, but that still involves the effort to join, and possibly even talk sometimes when spoken to. and they'll absolutely not be in every chat.
as opposed to "hey discord let us run grep across your message database"
like, we're at the point for the web where every website[maintained] is encrypted, even if it would be fine for most to be plaintext. (and we got to that point by making TLS pretty much free)
e2ee is only really considered optional/a misfeature in some cases because it's not free, but it should be.
@5225225 sorry, I can't hear you. maybe we should both just delete all our keys and generate new ones? just click through whatever warning it shows you, this happens all the time
@0xabad1dea :sigh:
my point is it should be reliable enough to be mandatory and seamless.
are we there yet? no
should it be a goal, as opposed to saying "well, in 15 years we should still leak all our messages to whatever server hosts them"? yes
you don't click through invalid cert warnings when logging into your bank because TLS works, and e2ee should get to that point
is it okay for a discord "competitor" now to not bother with mandatory e2ee because they wouldn't be able to make it seamless?
honestly, sure. i don't care. the problems people have with discord aren't the lack of e2ee, so something else also lacking e2ee isn't making that problem worse.
but "e2ee is a misfeature" is because of bugs which can be fixed, and design decisions that can be weakened to favor usability over security in some cases, not e2ee being inherently bad.
I just want to point out that so many of our issues with social media could be at least partially addressed using web of trust techniques.
That includes avoiding trolls on social media, but also giving a hand to help scale e2ee security.
No, it's not a panacea, but it could help, and it enters the discussion far too little, IMO.
@0xabad1dea
@volkris ... social media already is the world's largest and most-used web of trust though?? we just call it the follow graph
I personally don't see how getting more cryptography involved would help anything except making it sound more like a 90s cyberpunk novel. In all seriousness, what exactly are you envisioning here?