This is what I think about whenever infosec wonks on here start telling people they should use matrix or xmpp+omemo or whatnot instead of signal
To be fair, I understand the arguments and to a large extent I agree with the critiques. However, I think anyone making these recommendations is vastly underestimating the capacity or appetite for most people to deal with the user experiences presented by these alternatives.
User experience is the ultimate force multiplier. For anything that requires network effects to function (ie most anything involving communication), if it doesn't *just work* then you've lost 90% of your audience.
#matrix #xmpp #infosec #cybersecurity #signal #ux #design #ui #encryption #privacy #crypto
![When Donald Trump launched a memecoin days before his inauguration, newspapers were quick to try to grab headlines with huge numbers.
“The $TRUMP memecoin — a financial asset that didn’t exist on Friday afternoon — now accounts for about 89% of Donald Trump’s net worth,” wrote Axios, which dubbed him a “crypto billionaire”.1 “[T]he so-called fully diluted value of all the tokens as of Saturday at noon was $30 billion, a number achieved less than a day after the token went on the market,” wrote the New York Times.2 Newspapers’ estimates of fully diluted value fluctuated wildly from somewhere around $20 billion to around $70 billion, depending on which paper you read and when they published.](https://fedi.ml/photo/preview/640/629023 "When Donald Trump launched a memecoin days before his inauguration, newspapers were quick to try to grab headlines with huge numbers.
“The $TRUMP memecoin — a financial asset that didn’t exist on Friday afternoon — now accounts for about 89% of Donald Trump’s net worth,” wrote Axios, which dubbed him a “crypto billionaire”.1 “[T]he so-called fully diluted value of all the tokens as of Saturday at noon was $30 billion, a number achieved less than a day after the token went on the market,” wrote the New York Times.2 Newspapers’ estimates of fully diluted value fluctuated wildly from somewhere around $20 billion to around $70 billion, depending on which paper you read and when they published.")
![Message posted on the GitHub issue titled "Manual key verification":
"This issue has been opened for more than 6 years now, with no clear roadmap or even real consideration from the Tuta team. I have to say, I am disappointed.
You keep saying that "[...] Tuta [is] the most secure email service on the market.", but without key verification, a malicious Tuta server can read the end-to-end encrypted emails and shared calendars exchanged on the platform as there is no way to verify the recipients' public key. As explained by @llebout, "all users of Tutanota must trust Tutanota to not provide forged keys and perform an MITM attack". This is a significant flaw in the technical design of the platform, and it does not seem to bother you.
In #198, it can be read that:
> We are aware of the issues with verification, new protocol will support verification, the work is underway
However, your post-quantum implementation has now landed but still no word on the key verification issue.
Could you please stand by what you have said from day 1, that you prioritise security and privacy, and establish a clear roadmap of the work already undertaken or to be done to fix the situation?
Thank you"](https://fedi.ml/photo/preview/640/595249 "Message posted on the GitHub issue titled \"Manual key verification\":
\"This issue has been opened for more than 6 years now, with no clear roadmap or even real consideration from the Tuta team. I have to say, I am disappointed.
You keep saying that \"[...] Tuta [is] the most secure email service on the market.\", but without key verification, a malicious Tuta server can read the end-to-end encrypted emails and shared calendars exchanged on the platform as there is no way to verify the recipients' public key. As explained by @llebout, \"all users of Tutanota must trust Tutanota to not provide forged keys and perform an MITM attack\". This is a significant flaw in the technical design of the platform, and it does not seem to bother you.
In #198, it can be read that:
> We are aware of the issues with verification, new protocol will support verification, the work is underway
However, your post-quantum implementation has now landed but still no word on the key verification issue.
Could you please stand by what you have said from day 1, that you prioritise security and privacy, and establish a clear roadmap of the work already undertaken or to be done to fix the situation?
Thank you\"")
