A fantastic video by #mentaloutlaw explaining SimpleX network design better than we do:
Thank you so much for producing it š
We have some important comments: š§µ
1. Nerds love to present information security as a way to avoid law enforcement ā it's a cypherpunk cliche ā but 1) it cannot be further from our goals, and 2) cypherpunk stories are used by surveillance lobbyists against the right of people to privacy and security from data criminals.
2. SimpleX design protects its users from crime and protects children from sexual abuse that happens a lot on non-private platforms. Criminals can't discover users, and it makes users safe, reducing crime ā many families use SimpleX for that reason.
3. Contrary to what video says, by default messaging servers can observe users' IP addresses. Onion hosts in server addresses are only used when users use Tor, but they have to install and enable SOCKS proxy for that (e.g., with Orbot app).
4. While group size has no limit, they don't scale well yet - groups are fully decentralized, and to send the message to a group you have to send it to each member - for a large group it will be A LOT of traffic (~20mb/message for 1000 people group). We are working on it!
5. iOS notifications are really unreliable at the moment, they are hard in decentralized networks - the cost of privacy! We are very focused on improving their reliability, and it should get a lot better very soon - some big improvements and fixes are being released right now.
6. iOS notifications in SimpleX network are an inevitable point of centralization ā users have to use one of the push notification servers provided by us (or any other app developer, once there are other apps in the network).
7. Huge thanks for promoting our small collection of groups ā at the moment, most of them focussed on technology, open-source, cryptocurrencies and, of course, privacy. We agree that once group can scale, they will help growth.
Thank you so much - we cannot appreciate enough the work you do - we know how hard it is to produce good videos, and yours are fantastic!
@threadreaderapp unroll
⢠⢠ā¢
Missing some Tweet in this thread? You can try to
force a refresh
But there is no existing solution for using the same profile on multiple devices without compromising security more than we're comfortable with. In time, we will find a better balance for UX/security than now and then what is offered elsewhere. š§µ
Why don't we just do what Signal / WhatsApp do? They, effectively, convert each direct conversation into a group. This approach has some solvable and some unsolvable problems:
1. Adding device does not show notification to the user, and can be used as an attack vector (). This problem is solvable, and we hope to see Signal and WhatsApp solving it.eprint.iacr.org/2021/626.pdf
by @securemess is the great comparison of messaging apps, but there are several incorrect statements about @SimpleXChat there. Commenting in thread š§µbelow.securemessagingapps.com
1. Main reasons why the app isn't recommended: Provide a transparency report
It is available online and updated at least quarterly, or if anything changes: simplex.chat/transparency/
2. Company jurisdiction: UK
We disagree that there are any jurisdictions that are particularly good for privacy.
Also, this might important for centralised services, like Threema, where the users can't host servers, and much less important for decentralized network, such as SimpleX, where there are hundreds (if not thousands) of servers that we don't control.