redsandFeb 19

It’s not a good discord alternative but simplex has been a solid secure chat option PQC working by default. It and mumble or jitsi serve my gaming needs.

simplex.chat

XMPP would need one hell of an upgrade but it might be easier to refactor than the years of lazy bullshit in matrix’s code. Time will tell. Flux could hackathon and venture captial into the lead

SimpleX Chat: private and secure messenger without any user IDs (not even random)

SimpleX Chat - a private and encrypted messenger without any user IDs (not even random ones)! Make a private connection via link / QR code to send messages and make calls.

Show threadSoatok DreamseekerFeb 19
I haven’t reviewed SimpleX, but it does some weird things (Curve448? Really??) that make me wonder about the author’s capacity for threat modeling.
Show threadredsandFeb 19

Where? It’s all TLS and NTRU prime now to my knowledge

github.com/…/20240314-simplex-chat-v5-6-quantum-r…

simplex-chat/blog/20240314-simplex-chat-v5-6-quantum-resistance-signal-double-ratchet-algorithm.md at stable · simplex-chat/simplex-chat

SimpleX - the first messaging network operating without user identifiers of any kind - 100% private by design! iOS, Android and desktop apps 📱! - simplex-chat/simplex-chat

GitHub
Show threadSoatok DreamseekerFeb 20
github.com/simplex-chat/crypton/…/Curve448.hs
crypton/Crypto/PubKey/Curve448.hs at 90e1a0f46a2adb30feb3222b417ddef41b1feee1 · simplex-chat/crypton

lowlevel set of cryptographic primitives for haskell - simplex-chat/crypton

GitHub
Show threadredsandFeb 20
3 year old subpackage blob. Maybe it’s from before the switch to PQC? They have a published threat model that helped guide the audits and seemed well reasoned. I’m not sure where that version of curve would be used in the current client or server.
Show threadSoatok DreamseekerFeb 23
Either way, it’s just… weird.
Show threadredsandFeb 23
you can message the developers directly from the client. Ask, if they dont know why it’s there it’ll get stripped out. I would guess it’s legacy compatibility but it could be zombie code that needs pruned
Show threadSoatok Dreamseeker

Why would I want to use the client? :S

I’m just here to criticize cryptographic open source software. I don’t actually want to use these programs.

Feb 24 at 12:51pmWeb