World News
A community for discussing events around the World
Rules:
-
Rule 1: posts have the following requirements:
- Post news articles only
- Video links are NOT articles and will be removed.
- Title must match the article headline
- Not United States Internal News
- Recent (Past 30 Days)
- Screenshots/links to other social media sites (Twitter/X/Facebook/Youtube/reddit, etc.) are explicitly forbidden, as are link shorteners.
-
Rule 2: Do not copy the entire article into your post. The key points in 1-2 paragraphs is allowed (even encouraged!), but large segments of articles posted in the body will result in the post being removed. If you have to stop and think "Is this fair use?", it probably isn't. Archive links, especially the ones created on link submission, are absolutely allowed but those that avoid paywalls are not.
-
Rule 3: Opinions articles, or Articles based on misinformation/propaganda may be removed. Sources that have a Low or Very Low factual reporting rating or MBFC Credibility Rating may be removed.
-
Rule 4: Posts or comments that are homophobic, transphobic, racist, sexist, anti-religious, or ableist will be removed. “Ironic” prejudice is just prejudiced.
-
Posts and comments must abide by the lemmy.world terms of service UPDATED AS OF 10/19
-
Rule 5: Keep it civil. It's OK to say the subject of an article is behaving like a (pejorative, pejorative). It's NOT OK to say another USER is (pejorative). Strong language is fine, just not directed at other members. Engage in good-faith and with respect! This includes accusing another user of being a bot or paid actor. Trolling is uncivil and is grounds for removal and/or a community ban.
Similarly, if you see posts along these lines, do not engage. Report them, block them, and live a happier life than they do. We see too many slapfights that boil down to "Mom! He's bugging me!" and "I'm not touching you!" Going forward, slapfights will result in removed comments and temp bans to cool off.
-
Rule 6: Memes, spam, other low effort posting, reposts, misinformation, advocating violence, off-topic, trolling, offensive, regarding the moderators or meta in content may be removed at any time.
-
Rule 7: We didn't USED to need a rule about how many posts one could make in a day, then someone posted NINETEEN articles in a single day. Not comments, FULL ARTICLES. If you're posting more than say, 10 or so, consider going outside and touching grass. We reserve the right to limit over-posting so a single user does not dominate the front page.
We ask that the users report any comment or post that violate the rules, to use critical thinking when reading, posting or commenting. Users that post off-topic spam, advocate violence, have multiple comments or posts removed, weaponize reports or violate the code of conduct will be banned.
All posts and comments will be reviewed on a case-by-case basis. This means that some content that violates the rules may be allowed, while other content that does not violate the rules may be removed. The moderators retain the right to remove any content and ban users.
Lemmy World Partners
News [email protected]
Politics [email protected]
World Politics [email protected]
Recommendations
For Firefox users, there is media bias / propaganda / fact check plugin.
https://addons.mozilla.org/en-US/firefox/addon/media-bias-fact-check/
- Consider including the article’s mediabiasfactcheck.com/ link
view the rest of the comments
https://github.com/olvid-io
At least it's open source, so we should know soon enough how it compares to Signal
the client is open source. but the server? not so much.
in any case, if security is the concern... they should probably switch to a government-built system that only runs on gooberment devices. Will it be shitty? absolutely. But data is owned by whoever has the hardware it sits on. if it's not your device its not your data.
From Olvid website
They are advertising the fact that the security does not depend on the server.
I don't know what is worth.
Also it's developed by a French company, I think this is the main argument for the French government, they want to have options that does not rely on US companies.
Without the server-side code there’s no way to validate that. (This is the reason open source is preferred.)
It’s definitely being selected because it’s French. (And has all the buzzwords,)
You've misunderstood. With the client code you can be sure that your messages are properly encrypted before leaving the device. If that's done correctly, you don't need to trust the server, because it can't read your messages just like some attacker couldn't. Signal is pretty similar, they didn't update the public server source for a few years, and even with the source, we can't know that that is what they're actually running. But with a verified build of the client code we can know that our messages are encrypted such that, even if they held on to them until quantum computers became mainstream, they'd still be properly protected.
the server can store metadata though. who you're texting, when, how often, etc. - and store that indefinitely. or even store the encrypted message, and when a flaw in the encryption is discovered 10 years later, they're all readable. their servers could be breached and that info could be siphoned by criminals selling it to the highest bidder.
signals blog had an interesting post about what they're doing to prevent these issues
It kind of depends on how keys are handled. If the key passes through their servers at all (and it probably does,) then they have access to the keys and sufficient information to decrypt it. it's possible the app does send keys independent of their server- I don't know- but I very much doubt it. if they were capable of sending keys without a server, chances are very good they don't actually need the server for the messages themselves. (which would then ask why they do have a server.)
Assuming they don't have the keys. This is not a valid assumption so far as I'm aware.
It should most definitely be a valid assumption.
The keys shouldn't be on or go through a server anywhere, that would be an absolute joke.
What makes you think that private keys are being sent anywhere? This app uses a slightly modified version of the Signal protocol (because of course it does), as they describe here, section 27, page 90. Only public keys should ever leave your device, otherwise no amount of showing the code would make it secure. That's the whole point.
Again, with the client code you should be able to tell that the keys are generated there and not sent anywhere.
As I said, with any app, just because they publish some server code does not mean that that's what they're running on their server - for security you have to be sure that the app is sufficiently secure on its own. Even if they were running the exact public code that "didn't save the keys" the server could harvest them from memory.
then no one- including the intended recipient- can decode them without that physical device. kinda defeats the point of a messenger service. The codes have to be sent somehow. Either it's sent along their servers, or the recipient's device directly.
I really don't care to get into it. Just know that if you're using a generic, stock device... any message you send should be considered compromised. depending on the app, and the device in question, it may (but not necessarily) require physical access to the device. but, by it's very nature, the messenger service meant to be decoded and read. it is fundamentally permissive in nature.
Is it secure enough for France's needs? Probably. does it mean it's the best? Probably not.
You seem to be a bit confused about how asymmetric encryption works. There is no need for private keys to be transmitted for a messaging service to work. I encourage you to read about the difference between public and private keys in asymmetric encryption. They are generated in pairs, such that when something is encrypted using a public key, it can only be decrypted using the corresponding private key. So it's not correct to say that the message can't be decrypted by the intended recipient - they are in fact the only party who can, but even the sender can not.
Jack-shit without evidence and demonstrations.
Only the client. Though that's probably enough to make sure messages leave your device suitably encrypted. Depending on the algos it could be quite vulnerable to hndl attacks, though, or (less likely) any undiscovered backdoors in the implementations. Of course, even for Signal one has to trust they're using the public server code anyway, but at least we know they're folding in a quantum-resistant algo.
That thing has some of the most verbose documentation I've ever seen. Stuff that should be a paragraph takes multiple pages.