social.gl-como.it

Cerca

Elementi taggati con: ChatSecure

Note to myself: How to disable OTR in ChatSecure



Some weeks ago, a colleague, who unfortunately uses an iPhone (he is not a completely bad person, though) installed ChatSecure. Immediately, I and others were annoyed by unreadable OTR garbage he sent. It took us a while, but at the end of the day (the whole day!) we found out how to disable OTR. Yesterday, a friend who unfortunately also uses an iPhone (he is not a completely bad person neither), had the same issue and it took me the help of strangers on the internet (here; the Conversations MUC), to remember what to do. For the next time and the benefit of the public:
  • One cannot disable OTR globally in ChatSecure, but only contact by contact.
  • You need to open the chat of the contact.
  • Go to the "contact details".
  • Go to "advanced encryption settings" and select "OMEMO", nothing else.
  • Close chat with the contact.
  • Repeat the last four steps for all your 511 contacts.
#xmpp #ios #iphone #otr #omemo #chatsecure #conversations
 

The rocky road to OMEMO by default



Daniel Gultsch, developer of Android XMPP client Conversations, writes,

Why it took us more than two years to enable End-to-End encryption by default: The first in a series of essays leading up to the release of Conversations 2.0



...
The other big hurdle we had to overcome was the adoption rate in clients. If you send OMEMO encrypted messages by default you should have a reasonable expectation that your contact will be able to decrypt the message. Reasonable expectation doesn’t mean that every single client out there has to support it—In an ecosystem with hundreds of small, badly maintained clients that’s just not feasible—but the major clients should at least have a plugin available.
In March 2018 we finally reached the point where every plattform has one or more clients with OMEMO support. Conversations and Zom on Android, ChatSecure on iOS, Psi and Gajim on the desktop. The up and coming desktop client Dino—despite not having had an initial release—already has support for OMEMO as well. And even the webclient JSXC has a plugin available.
Considering the complexity of OMEMO and the fact that most of these clients are developed by people in their spare time, this is actually quite an impressive adoption rate.
...
Moxie Marlinspike, in his 2016 propaganda piece ignorantly bashing XMPP, had one valid point: Enabling end-to-end encryption in a homogenous environment is easier than introducing it in a heterogenous one like Jabber. Nobody is denying that. However, if something is hard to achieve there are two possible approaches: Either try your best and don’t give up, or put your head in the sand and create yet another walled garden that is no different from other proprietary solutions.
Admittedly it has taken us a while to get to a point where we can enable end-to-end encryption by default, but it was worth the effort in that we ended up with something that is different from WhatsApp in more than just marketing.
#xmpp #omemo #conversations #psi #gajim #zom #chatsecure #dino #jsxc #federation #encryption
 

"How to Live Without Google" - and getting it all wrong



In a failed attempt to improve users personal privacy, DuckDuckGo jumps from the frying pan straight into the fire. With the motto
Remove Google from your life? Yes, it can be done!
they give ten advices, most of them very bad. Also, they are using inexact wording by calling things free, when they are "free as in beer", but not necessarily "free as in freedom". I comment on their three worst recommendations:
Google Search -> DuckDuckGo (free)
Let's start off with the easiest one! Switching to DuckDuckGo not only keeps your searches private but also gives you extra advantages such as our bang shortcuts, handy Instant Answers, and knowing you're not trapped in a filter bubble.
I understand, that they advertise their own service here. And while I do believe, that DuckDuckGo does not cheat and keeps your searches private, as a user, one cannot prove it. In any case, one just replaces one centralised search machine with another one. Better use a decentralised service, such as meta search engine Searx.
Android -> iOS (paid)
The most popular alternative to Android is of course iOS, which offers easy device encryption and encrypted messaging via iMessage by default. We also have tips to increase privacy protection on your iPhone or iPad.
This is certainly the worst recommendation in their list. I had to check the date of the article, when I read this. Aprils Fool's Day? I'm certainly not a fan of Android and I'm not an Android user anymore, but going for a much more restrictive jail is just stupid. Android has at least relatively free versions, e.g. Replicant. iOS, in contrast, is a carcel with beautifully painted walls. Very high walls with perfectly styled barbed wire on top. Even the most proprietary variants of Android let you at least install free software from F-Droid.org.

If you don't want to use Android anymore, like myself, better go for a free alternative, e.g. support the Librem 5 crowdfunding, or the Pyra handheld or the ZeroPhone, all three running the free Debian operating system.
Google Allo -> Signal (free)
There are several services offering private messaging but, as we've mentioned before, Signal gets our recommendation. It offers free, end-to-end encryption for both messages and private calls. It's also recommended by Edward Snowden and renowned security expert Bruce Schneier, among others.
Again, they recommend to leave one centralised service for another one. And one, that even wants your phone number, otherwise you can't use it. And one, that does not yet have a decent client for Linux. There are messengers around that are federated or completely decentralised, that do not force you give them your phone number, and that have native clients for all major operating systems. My recommendation is XMPP. If you are on Linux, use e.g. Gajim, on Android the best app is probably Conversations, for iOS there is ChatSecure and so on. Alternatives to XMPP are Ring, Matrix and more recently Wire.

Benjamin Franklin wrote in 1755:
Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety.
One should also not give up libre software, which is essential in many ways, to purchase a little perceived safety or privacy through non-free or centralised services.

#duckduckgo #google #searx #replicant #fdroid #librem5 #pyra #zerophone #debian #xmpp #gajim #conversations #chatsecure #ring #matrix #wire

How to Live Without Google

Google tracking is more pervasive than most people realize. We show you some alternatives to Google services to limit your exposure.
 
General good advice for freedom and privacy/security



Some general good advice to ensure the best possible respect of freedom and privacy/security on mobile devices includes:

Installing only free software applications, from trusted sources such as #F-Droid on #Replicant.
#Encrypting the device's storage, to prevent some unauthorized access to the device's data.
Using software that provides secure peer-to-peer-encrypted communications such as #ChatSecure for instant messaging and #AGP with K-9 Mail for emails on Replicant.
Using #Tor to achieve reliable anonymity, for instance with #Orbot on Replicant.
If the device is telephony-enabled, switching the modem to airplane mode or (when possible) turning it off when not in use, to avoid being tracked at all times.
Browsers using the webview framework (such as the browser shipped with Replicant and Lightning) are subject to various security flaws in Replicant 4.2.

In addition, the #FreeSoftwareFoundation provides a comprehensive guide to help protect freedom and privacy and the Tor project an article entitled Mission Impossible: Hardening Android for Security and Privacy.

Replicant

Replicant
 
General good advice for freedom and privacy/security



Some general good advice to ensure the best possible respect of freedom and privacy/security on mobile devices includes:

Installing only free software applications, from trusted sources such as #F-Droid on #Replicant.
#Encrypting the device's storage, to prevent some unauthorized access to the device's data.
Using software that provides secure peer-to-peer-encrypted communications such as #ChatSecure for instant messaging and #AGP with K-9 Mail for emails on Replicant.
Using #Tor to achieve reliable anonymity, for instance with #Orbot on Replicant.
If the device is telephony-enabled, switching the modem to airplane mode or (when possible) turning it off when not in use, to avoid being tracked at all times.
Browsers using the webview framework (such as the browser shipped with Replicant and Lightning) are subject to various security flaws in Replicant 4.2.

In addition, the #FreeSoftwareFoundation provides a comprehensive guide to help protect freedom and privacy and the Tor project an article entitled Mission Impossible: Hardening Android for Security and Privacy.

Replicant

Replicant
 

Welche Messenger unterstützen schon OMEMO?



#messenger #it-sicherheit #xmpp #omemo #olm #xep0384

OMEMO ist seit Dezember 2016 offiziell XEP-0384 und seit Kurzem für ChatSecure verfügbar.

Wer wissen will, wie es mit anderen Messengern aussieht, kann einen Blick auf die Übersicht „Are we OMEMO yet?“ werfen.

ChatSecure für iOS nun offiziell mit OMEMO

ChatSecure für iOS nun offiziell mit OMEMO
#chatsecure #omemo #ios #it-sicherheit #privacy #datenschutz
Ab sofort liegt ChatSecure in der vierten Hauptversion (https://chatsecure.org/blog/chatsecure-v4-released/) vor und unterstützt jetzt nativ OMEMO. Weiterhin wurden knapp 300 Änderungen seit 3.2 (https://github.com/chatsecure/chatsecure-ios/compare/v3.2.3...v4.0) vorgenommen.
Für die kommenden Versionen sind u. a. OMEMO für MUCs, XEP-0313 MAM sowie XEP-0333 Chat Markers geplant.
 

Welche Messenger unterstützen schon OMEMO?



#messenger #it-sicherheit #xmpp #omemo #olm #xep0384

OMEMO ist seit Dezember 2016 offiziell XEP-0384 und seit Kurzem für ChatSecure verfügbar.

Wer wissen will, wie es mit anderen Messengern aussieht, kann einen Blick auf die Übersicht „Are we OMEMO yet?“ werfen.

ChatSecure für iOS nun offiziell mit OMEMO

ChatSecure für iOS nun offiziell mit OMEMO
#chatsecure #omemo #ios #it-sicherheit #privacy #datenschutz
Ab sofort liegt ChatSecure in der vierten Hauptversion (https://chatsecure.org/blog/chatsecure-v4-released/) vor und unterstützt jetzt nativ OMEMO. Weiterhin wurden knapp 300 Änderungen seit 3.2 (https://github.com/chatsecure/chatsecure-ios/compare/v3.2.3...v4.0) vorgenommen.
Für die kommenden Versionen sind u. a. OMEMO für MUCs, XEP-0313 MAM sowie XEP-0333 Chat Markers geplant.
 
nuovi vecchi