We don’t want the state-run telcos in Saudi, Iran, Bahrain,
Belarus, China, Egypt, Cuba, USA, etc… to have direct access
to the metadata of TextSecure users in those countries or
anywhere else.
https://plus.google.com/u/0/104092656004159577193/posts/2ncB...
Tipped off to me by SoftwareMaven here at HN: https://news.ycombinator.com/item?id=9077061
(Links are described in more detail in my G+ post above)
http://www.theguardian.com/world/2013/nov/20/us-uk-secret-de...
http://www.theguardian.com/world/2013/dec/02/revealed-austra...
http://www.theguardian.com/politics/2013/jun/10/nsa-offers-i...
http://uk.reuters.com/article/2013/06/21/uk-usa-security-bri...
America needs a new constitutional amendment to address what the 4th Amendment means in the 21st century.
- https://github.com/WhisperSystems/TextSecure/issues/127 - http://support.whispersystems.org/customer/portal/articles/1...
Hopefully that option will be available soon.
This is especially true because GCM is treated specially by lots of telcos and they won't time out GCM sessions automatically. TextSecure wouldn't benefit from that.
Looking forward to dropping the GCM requirement.
It's cognitively dissonant not to read GCM not as Galois Counter Mode in a crypto discussion.
I <3 Moxie.
Assuming that any given endpoint was already a surveillance target, the advantage here is that the traffic cannot be used (or is less readily used) to determine contacts -- who's talking to whom.
For contacts that have intermittent or expensive data connections, especially while roaming, the ability to use SMS was a selling point vs other messaging systems.
Telco's in my country record and store SMS data for a period and knowing this data was encrypted and unreadable by them was another useful feature of TextSecure.
I think Moxie is a total dude but wasn't SMS encryption the Unique Selling Point of TextSecure? It was the reason I installed the app and go through the inconvenience of typing a very long string into the app every time the app restarts.
I undertsand the logic of what Moxie is saying, if that's the case then the conclusion should be, "We need to shut down the entire app", not "We got to switch off encryption"
I get that SMS leaks metadata. It's like email in that respect, isn't it?. And we still want to encrypt email. Is it so much of a burden for you people to carry the SMS encryption code? Maybe a fund-raising drive to keep it financed and included?
The reasons make sense - SMS as a transport is almost unworkable, there's a lot of crap involved with MMS bugs that it would be good to rip out, and it can never be compatible with iOS.
A replacement for GCM/push/etc for wakeup would be nice - I wonder what that would look like? - but it'll do for now.
"Occasionally" is not what I desire. Being abroad and not being able to use data due to huge roaming fees leaves me vulnerable something like 80-90days a year. Leaking metadata is still better than leaking the contents which is why I'm feeling rather skeptical about this decision
I've perceived their own proprietary data transport as progressive enhancement that enables to cut the costs, not as a primary option. I.e. SMS transport being the core option, not a fallback. Personally, haven't bothered to use data transport at all - it was unable to handle multiple identities anyway.
Sadly, I was mistaken.
I use the term "proprietary" in sense that it's their own unique protocol that nobody else uses. (Don't tell me about their interop with CM, its partnership, not federation.) Or you know some alternative compatible SMS apps that use libaxolotl or Axolotl protocol? I don't. Would love to hear there are some.
The context analysis sideband leakage is the big win here for a data-based approach.
I understand the decision is, again, for the greater good, but I can't help to think it's going to leave a hole.
Yes, this was also one of my main use of TS, and also in the subway, where Data is limited... Else, I could use Whatsapp, with ZRTP...
I have been struggling for over a year now to get this one contact and I to have a smooth & reliable secure channel. Sometimes it works great and others times it just doesn't exist. And I usually have to jump through all kinds of hoops to get it to work again. Which makes it nearly impossible for me to recommend TS to others who are a little less technical than my one TS contact and myself.
I really want this to work smoothly, Moxie, I really do! If it does, then I can recommend it to everyone.
edit: spelling
edit2: Moxie has quickly replied to my issue on github and will be pushing v2.6.1 soon.
What I'm trying to say is, very few people here care about SMS compatibility.
Wait... what?
Does anyone have recommendations for a service that will encrypt my messages?
none of the services encrypt your sms anymore, though.