An encrypted and anti-forensic public web chat server (lemmy.world)

submitted 6 days ago by Super_gamer46861@lemmy.world to c/privacy@lemmy.ml

23 comments fedilink hide all child comments

https://github.com/umutcamliyurt/Amnesichat

top 23 comments

sorted by: hot top controversial new old

[-] Imprint9816@lemmy.dbzer0.com 16 points 6 days ago

Yeah Im gonna pass on the non audited chat with only 5 stars and stick to using signal.

[+] Super_gamer46861@lemmy.world -7 points 5 days ago

See you later when Chat Control passes :)

[-] 01189998819991197253@infosec.pub 6 points 5 days ago

Chat Control, if passed, will affect this chat as well. The only way to bypass it, would be chat revolution.

[-] Super_gamer46861@lemmy.world 0 points 5 days ago

Chat Control will not affect this chat if it's source code and public instance are hosted in darknet ;)

[-] 01189998819991197253@infosec.pub 5 points 5 days ago

While I do love your optimism and appreciate the addition of this software to our (collective) arsenal, it absolutely can. Chat Control can force the developers to add back doors, for example, or to start log collection to include IPs and PSPs, etc. Please don't misunderstand, I'm not negating the benefits of Amnesichat at all. It's awesome. But, being a chat, it would still fall under the same regulatory nonsense as Briar, for example, which can also be run through Tor. Now, whether the developers adhere to Chat Control regulations, is another thing altogether.

[-] EngineerGaming@feddit.nl 1 points 4 days ago

If a backdoor is forced to be added into any project, wouldn't someone be able to fork it and go on without the backdoor? Maybe even the original dev incognito...

[-] 01189998819991197253@infosec.pub 3 points 4 days ago

Theoretically, yes. But if it's a legal entity that added it, they can easily circumvent any attempt to eradicate it. Or, in a more extreme way, criminalize FOSS chat apps altogether, then the code will have to be analyzed in a RE environment. Maybe the non FOSS server code is where the backdoor is added. There are so many relatively hidden ways to compromise a chat app's supply chain.

[-] EngineerGaming@feddit.nl 3 points 4 days ago

I doubt any FOSS restriction is doable at all. As for the supply chain - xz showed this is indeed possible... But no one can guarantee that every encrypted client would be able to get such a well-hidden backdoor, and that it will stay undiscovered, and that it wouldn't be invalidated with an update... But yeah, the only way this can be combatted is having more eyes on such software.

[-] 01189998819991197253@infosec.pub 1 points 4 days ago* (last edited 4 days ago)

I agree with you. I just think "they" will take that fact and just sit with it. I think "they" will do everything they can to get multiple backdoors in there (and I use the term 'backdoor' loosely to mean anything that can programmatically circumvent the encryption). There are more of them, in terms of power and funding, than there are of us. They will eventually succeed, if only for short times each interval. That's why I wrote that the solution is a chat revolution. I don't know what that will look like, but we need something they can't successfully attack.

[-] Super_gamer46861@lemmy.world 0 points 5 days ago

I would never comply with Chat Control

[-] 01189998819991197253@infosec.pub 3 points 5 days ago

Honestly, neither will I. No one should.

[-] Imprint9816@lemmy.dbzer0.com 3 points 4 days ago* (last edited 4 days ago)

You will be surprised to learn not everyone lives in the EU ;)

There will be a ton of great privacy services that will be unaffected or will just leave the EU market (including signal). No need to switch to a completely unproven chat.

[-] foremanguy92_@lemmy.ml 6 points 5 days ago

Use SimpleX

[-] 01189998819991197253@infosec.pub 6 points 5 days ago

Or Briar. Or Signal. Or so many others that have been audited throughput the years. While I appreciate the addition of Amnesichat to this arsenal, it has yet to be properly audited and is, therefore, not yet trusted.

[-] foremanguy92_@lemmy.ml 3 points 4 days ago

Signal maybe not

[-] 01189998819991197253@infosec.pub 1 points 3 days ago

Care to elaborate? I haven't heard anything concrete against it.

[-] foremanguy92_@lemmy.ml 1 points 3 days ago

It's really an absolute no. But it requires your phone and is centralized, basically that's the two mains concerns that I have.

[-] 01189998819991197253@infosec.pub 2 points 3 days ago

We each have our own levels of acceptable privacy posture. Signal make it easier for the masses to get off, say, Whatsapp and feel little to no real hurdles. I agree with you, though, that the phone number and physical phone requirements are a hard sell for people with a more strict posture requirement, which was the reason it took me long to get on it. But, alas, I had to settle, because SimpleX wasn't available on iOS at the time (my family and friends are on iphones) and it is much more private that Hangouts or Whatsapp (which I still can't believe we were on). We did try Matrix for a time, but it wasn't "production ready" then, which was a deterrent to them as well. Signal being centralized wouldn't be a huge deterrent for me, if it wasn't for their continuous push to keep it that way and them actively preventing decentralization, both of which have been scratching me the wrong way for a while. I had a conversation with my groups to switch to something else, but they're not all on board. Signal, they say, is "as easy as Whatsapp and more private". I mean... they're right, but we could have better.

[-] foremanguy92_@lemmy.ml 2 points 3 days ago

Absolutely right

[-] Super_gamer46861@lemmy.world 2 points 4 days ago

I had to shutdown public chat server because of some people posting illegal content :(

[-] tty84@lemmy.dbzer0.com 2 points 3 days ago

How do you know that the content was illegal if it's E2E encrypted?

[-] Super_gamer46861@lemmy.world 1 points 3 days ago

It was a public chatroom

[-] tty84@lemmy.dbzer0.com 1 points 3 days ago

ok, I see... I've never really understood the point of cryptography in public discussions as anyone can read the messages anyway.

this post was submitted on 02 Nov 2024

32 points (86.4% liked)

Privacy

31607 readers

126 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

Chat rooms

[Matrix/Element]Dead
Discord

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS