blog/data/2016-11-07-comm-loved-ones.txt

   1 Title: How to talk with your loved ones in private
   2 Tags: english, personvern, sikkerhet, surveillance
   3 Date: 2016-11-07 10:25
   4
   5 <p>A few days ago I ran a very biased and informal survey to get an
   6 idea about what options are being used to communicate with end to end
   7 encryption with friends and family.  I explicitly asked people not to
   8 list options only used in a work setting.  The background is the
   9 uneasy feeling I get when using Signal, a feeling shared by others as
  10 a blog post from Sander Venima about
  11 <a href="https://sandervenema.ch/2016/11/why-i-wont-recommend-signal-anymore/">why
  12 he do not recommend Signal anymore</a> (with
  13 <a href="https://news.ycombinator.com/item?id=12883410">feedback from
  14 the Signal author available from ycombinator</a>).  I wanted an
  15 overview of the options being used, and hope to include those options
  16 in a less biased survey later on.  So far I have not taken the time to
  17 look into the individual proposed systems.  They range from text
  18 sharing web pages, via file sharing and email to instant messaging,
  19 VOIP and video conferencing.  For those considering which system to
  20 use, it is also useful to have a look at
  21 <a href="https://www.eff.org/secure-messaging-scorecard">the EFF Secure
  22 messaging scorecard</a> which is slightly out of date but still
  23 provide valuable information.</p>
  24
  25 <p>So, on to the list.  There were some used by many, some used by a
  26 few, some rarely used ones and a few mentioned but without anyone
  27 claiming to use them.  Notice the grouping is in reality quite random
  28 given the biased self selected set of participants.  First the ones
  29 used by many:</p>
  30
  31 <ul>
  32
  33 <li><a href="https://whispersystems.org/">Signal</a></li>
  34 <li>Email w/<a href="http://openpgp.org/">OpenPGP</a> (Enigmail, GPGSuite,etc)</li>
  35 <li><a href="https://www.whatsapp.com/">Whatsapp</a></li>
  36 <li>IRC w/<a href="https://otr.cypherpunks.ca/">OTR</a></li>
  37 <li>XMPP w/<a href="https://otr.cypherpunks.ca/">OTR</a></li>
  38
  39 </ul>
  40
  41 <p>Then the ones used by a few.</p>
  42
  43 <ul>
  44
  45 <li><a href="https://wiki.mumble.info/wiki/Main_Page">Mumble</a></li>
  46 <li>iMessage (included in iOS from Apple)</li>
  47 <li><a href="https://telegram.org/">Telegram</a></li>
  48 <li><a href="https://jitsi.org/">Jitsi</a></li>
  49 <li><a href="https://keybase.io/download">Keybase file</a></li>
  50
  51 </ul>
  52
  53 <p>Then the ones used by even fewer people</p>
  54
  55 <ul>
  56
  57 <li><a href="https://ring.cx/">Ring</a></li>
  58 <li><a href="https://bitmessage.org/">Bitmessage</a></li>
  59 <li><a href="https://wire.com/">Wire</a></li>
  60 <li>VoIP w/<a href="https://en.wikipedia.org/wiki/ZRTP">ZRTP</a> or controlled <a href="https://en.wikipedia.org/wiki/Secure_Real-time_Transport_Protocol">SRTP</a> (e.g using <a href="https://en.wikipedia.org/wiki/CSipSimple">CSipSimple</a>, <a href="https://en.wikipedia.org/wiki/Linphone">Linphone</a>)</li>
  61 <li><a href="https://matrix.org/">Matrix</a></li>
  62 <li><a href="https://kontalk.org/">Kontalk</a></li>
  63 <li><a href="https://0bin.net/">0bin</a> (encrypted pastebin)</li>
  64 <li><a href="https://appear.in">Appear.in</a></li>
  65 <li><a href="https://riot.im/">riot</a></li>
  66 <li><a href="https://www.wickr.com/">Wickr Me</a></li>
  67
  68 </ul>
  69
  70 <p>And finally the ones mentioned by not marked as used by
  71 anyone. This might be a mistake, perhaps the person adding the entry
  72 forgot to flag it as used?</p>
  73
  74 <ul>
  75
  76 <li>Email w/Certificates <a href="https://en.wikipedia.org/wiki/S/MIME">S/MIME</a></li>
  77 <li><a href="https://www.crypho.com/">Crypho</a></li>
  78 <li><a href="https://cryptpad.fr/">CryptPad</a></li>
  79 <li><a href="https://github.com/ricochet-im/ricochet">ricochet</a></li>
  80
  81 </ul>
  82
  83 <p>Given the network effect it seem obvious to me that we as a society
  84 have been divided and conquered by those interested in keeping
  85 encrypted and secure communication away from the masses.  The
  86 finishing remarks <a href="https://vimeo.com/97505679">from Aral Balkan
  87 in his talk "Free is a lie"</a> about the usability of free software
  88 really come into effect when you want to communicate in private with
  89 your friends and family.  We can not expect them to allow the
  90 usability of communication tool to block their ability to talk to
  91 their loved ones.</p>
  92
  93 <p>Note for example the option IRC w/OTR.  Most IRC clients do not
  94 have OTR support, so in most cases OTR would not be an option, even if
  95 you wanted to.  In my personal experience, about 1 in 20 I talk to
  96 have a IRC client with OTR.  For private communication to really be
  97 available, most people to talk to must have the option in their
  98 currently used client.  I can not simply ask my family to install an
  99 IRC client.  I need to guide them through a technical multi-step
 100 process of adding extensions to the client to get them going.  This is
 101 a non-starter for most.</p>
 102
 103 <p>I would like to be able to do video phone calls, audio phone calls,
 104 exchange instant messages and share files with my loved ones, without
 105 being forced to share with people I do not know.  I do not want to
 106 share the content of the conversations, and I do not want to share who
 107 I communicate with or the fact that I communicate with someone.
 108 Without all these factors in place, my private life is being more or
 109 less invaded.</p>
 110
 111 <p><strong>Update 2019-10-08</strong>: Børge Dvergsdal, who told me he
 112   is Customer Relationship Manager @ Whereby (formerly appear.in),
 113   asked if I could mention that appear.in is now renamed and found at
 114   <a href="https://whereby.com/">https://whereby.com/</a>.  And sure,
 115   why not.  Apparently they changed the name because they were unable
 116   to trademark appear.in somewhere...  While I am at it, I can mention
 117   that Ring changed name to Jami, now available from <a
 118   href="https://jami.net/">https://jami.net/</a>.  Luckily they were
 119   able to have a direct redirect from ring.cx to jami.net, so the user
 120   experience is almost the same.</p>