I find it bold stating that #DeltaChat doesn’t need a hyperscaler like #Signal does when it is based on… email servers. Where there is no audio/video calling. Where every sender and recipient server knows who is communicating with whom. Where you need to trust every decentralized server to not keep that information. Maybe be less smug if you can’t provide metadata protection. 🙄 @delta chaos.social/@delta/1154540411…


Signal's president claimed it takes billions to replicate the availability and reliability of "hyperscalers" (AWS/Google/Microsoft/Cloudfare) that Signal uses.

#chatmail and #deltachat are about disproving this claim by

1) making relays super cheap (DONE)

2) enabling chat profiles to use multiple relays redundantly (WIP)

3) distributing relay knowledge among chatters (TBD).

Fat servers, corporate overlords and billionaires: not needed and better to not exist for a convivial e2ee future :)


This entry was edited (16 hours ago)
in reply to Delta Chat

So how are you going to disprove the claim that you need hyperscalers when providing a service like #Signal does? Because that is what your post said. But I don’t see you providing a service like Signal does. And I’m sure DeltaChat does good stuff, but I was using PGP for mails 20 years ago. So maybe don’t try do dunk on another service while providing the same metadata protection we had 20 years ago?
This entry was edited (16 hours ago)
in reply to Sebastian

with all due respect and recognition that pgp has a troubled history, pgp twenty years ago and #openpgp now are different things. See for example chaos.social/@delta/1145902670… or
for a more thorough security talk including discussing metadata passthesalt.ubicast.tv/videos/…


our friends over at @rpgp just published a monster milestone, humbly tagged 0.16 😍 with

- streaming decryption and encryption

- post-quantum-cryptography

- API streamlining.

#rPGP is a full Rust implementation of #openpgp which counts among the fastest and most compliant implementations today, and includes security audits. Note: #deltachat uses a restricted subset of OpenPGP, and follows best practices (eg using the same ed25519 keys implementation as #signal) github.com/rpgp/rpgp/


in reply to feld

It knows who the recipient is. Recipients create a token and give it to future senders; senders only include that. They don't need to authenticate because the only way they could know this token is if the receiver already "trusts" them. All the details are in signal.org/blog/sealed-sender/
in reply to Delta Chat

But you don’t address any of the privacy issues that exist in a post-Snowden threat model. Designing something that works in this context at all is hard, doing it in a decentralised setting is even harder (doing it in a federated model is probably impossible). But you continue to criticise Signal while not even attempting to solve the problems.

You are working with the same threat model that we used when I worked on XMPP 20+ years ago, which is no longer relevant to the modern Internet.

in reply to David Chisnall (*Now with 50% more sarcasm!*)

and yet Signal hasn't even fixed the "phone number tied to your government identity required to have an account", "your ISP is tied to your government identity and knows the IP addresses you've used", and the "group members can be identified because they're exposing their IP addresses to the CDN" problems.

Aren't these significant post-Snowden threat model problems too?

edit: especially in a world where every one of these corporations has folded like a wet napkin and happily complies with anything the current US government demands of them

This entry was edited (7 hours ago)
in reply to David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall you are rightfully coming from a very skeptical position if you look at 20 years of XMPP and traditional PGP happenings. Likely you would find things to complain about but at least skimming our "encryption and security" FAQ might clear some common misconceptions stemming exactly from those 20 years of bad experiences delta.chat/en/help#e2ee
in reply to Christian Kugler

@syphdias
1) end-to-end latency on a 33EUR chatmail relay with ~200K monthly active users is sub-second. see attachment.

2) metadata details are here: delta.chat/en/help#message-met…
including a note on sealed sender (which btw Signal only does opportunistically by default, and easily falls back to non-sealed)