Wire Blog

the audio on wire is great, too. I agree adoption has been slow. > But I'm not a cryptographer and am unable to verify the company's security claims. wire has been independently audited (protocol and application): https://medium.com/@wireapp/wire-application-level-security-audits-983…

For all practical purposes, "Signal" being open source hasn't made that happen. As for Wire, yes, I know about its origins and I use it too, but even Wire had disagreements with Signal on using the protocol and finally managed to settle it (this is from 2016, so take it for what it's worth). [1] Wire is also focusing more on paying users and businesses and building features exclusively for that market. So the free tier is no longer a great place to be in. [1]: https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7#.1m3nvx1l…

Looks great, I was not aware they had open source client. Given that they were forced to release their Axolotl (aka Signal protocol) under GPLv3+, they try to add some strange restrictions [2]: "Additionally, if you choose to build an Open Source App, certain restrictions apply, as follows: a. You agree not to change the way the Open Source App connects and interacts with our servers ..." As I understand I am free to ignore any additions to GPL. [1] https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7#.dmdxclai… [2] https://github.com/wireapp/wire

A link to a GitHub organization isn't great.. I'd say this is better: https://medium.com/@wireapp/you-can-now-build-your-own-wire-client-ea9… but even that doesn't clearly explain what Wire is. Visit https://wire.com to find out it's an encrypted video and group chat app.

Has anyone given this https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7 more thought and whether one should avoid Signal and work with a more friendly project that doesn't seemingly fail at its desire to have widespread use of the protocol and actually tried to sue WireApp? WireApp's now approved as a non-infringing implementation in Rust, so that's great for reliability. Edit: The suing part was initiated by Wire as a response to Moxie demanding GPL compliance over their claim Wire is infringing. I got that backwards.

From this[1] answer on the IT Security StackExchange site: > N+1Sec is a similar protocol [to multi-party OTR, which requires participants to be online at all times to renegotiate keying material] with some improvements. Note that these protocols have a lot of algorithmic complexity and tend to scale badly, especially when you add latency into the mix. It's unclear to me, though I can hardly imagine it being the case, whether this protocol requires all participants to be online at all times. The quoted answer surely sounds like it has that drawback, which is why I never really considered it as an option (leaving the Signal Protocol with "server-side fan-out" as the only good option). If it does not have that drawback, having another protocol is a great thing, assuming what Wire says is true regarding OpenWhisperSystems trying to get millions from them for implementing a supposedly open source protocol.[2] [1] https://security.stackexchange.com/a/127331/10863 [2] https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7

You are looking for links to what moxie said and people's experiences of interacting with him. The links to LibreSignal (already mentioned here) and Wire stories summarize most of what I was pointing at: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-2172… https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7

How is this explanation not adequate though? https://medium.com/@wireapp/we-do-use-variable-bit-rate-vbr-vs-14bdade… There's also the possible chance that AES is cracked without us knowing.

Wire[0][1] does it according to their blog post[2]. This has an impact on FPS and CPU usage+power consumption, but it is secure. [0]: https://wire.com/en/ [1]: https://github.com/wireapp [2]: https://medium.com/@wireapp/video-conferencing-end-to-end-encrypted-12…

Wire is already open sourced https://news.ycombinator.com/item?id=12148596 and server https://news.ycombinator.com/item?id=15302592 And article links https://medium.com/@wireapp/wire-server-code-now-100-open-source-the-j… Here is the repo https://github.com/wireapp

Unfortunately, it looks like the signal people are possibly not friendly to third-party devs and have levied seemingly spurious IP threats against third-party implementations: https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7 Obviously this is just one side of the story, but it sounds rather alarming.

Ok. Lets see https://medium.com/@wireapp/making-your-conversations-secure-dab207ab7… does not state any information on key management solution: how encryption key is transferred to another device. But it has links to https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm which has nothing about cross device key sharing and https://wire.com/resource/Wire%20Security%20Whitepaper/download/. I've read it through and found nothing on cross-device key sharing as well. Can you point me to the right part?

Please note that of the technologies tptacek listed, the only one which can operate in distributed fashion is Matrix.[0] Wire is attempting to pursue decentralization, but federation is not (yet) in their roadmap.[1] [0] https://github.com/matrix-org/synapse [1] https://medium.com/@wireapp/wire-server-code-now-100-open-source-the-j…

Wire has open sourced it's server code (gplv3 even) and is working on federation support : https://medium.com/@wireapp/wire-server-code-now-100-open-source-the-j… So you can run your own copy of it, and be in complete control of any information it collects.

> But until any of these new age apps/platforms support federation and decentralized communication, there's not much use for the masses to look for servers run by specific people. Federation of self-hosted servers and the "official cloud" seems to be on Wire's road-map, cf: * Third paragraph of OP * https://www.reddit.com/r/selfhosted/comments/5vylls/wire_endtoend_encr… * Last sentence on https://medium.com/@wireapp/open-sourcing-wire-server-code-ef7866a731d…

The Mobile OS war can still be continued. Mozilla should join forces with Lineage OS instead of wasting time with their own. Do the embrace, extend, extinguish strategy with Android. Secure messaging is also still a hot topic. Join forces with Signal or Wire or Matrix or XMPP. For example, Wire intends to open source their server code and enable federation [0]. Voice control requires some weight for an Open Source solution. Specifically, we could use something which does not rely on the internet. PocketSphinx is an ok foundation, but needs more work. [0] https://medium.com/@wireapp/open-sourcing-wire-server-code-ef7866a731d…

My understanding is that the client code and some of the server code is on github, and the rest of the server side code is being released gradually: https://github.com/wireapp https://medium.com/@wireapp/open-sourcing-wire-server-code-ef7866a731d… https://medium.com/@wireapp

The guy has a point. They write on Medium[1]: Q: How is open source going to impact Wire’s users and what are the opportunities for them? Wire’s users can now build their own client from our source code and run it on our platform. Which is clearly not the case... [1] https://medium.com/@wireapp/you-can-now-build-your-own-wire-client-ea9…

Did you see that they implemented CBR for audio calls and submitted patches to both Signal and WebRTC? https://medium.com/@wireapp/call-security-constant-bit-rate-encoding-a…

Correct, built with Electron like our Windows and macOS apps. Glad you're enjoying it. Possible reason: https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7#.89118rx5…

You're apologizing for a project that has repeatedly damaged user trust with excuses. These are "valid" reasons for keeping the source code private for a year? By whose book? Yours? Certainly not by mine. I wouldn't let any other business abscond from its promise to keep open source open source in spirit and practice, why would I let Signal? This is some underhanded, sneaky maneuvering I'm more used to seeing from the Amazons and the Facebooks of the world. These are not the actions of an ethically Good organization. And as has already been demonstrated by Moxie in his lust to power, he's more than capable of deviance. On Wire vs Signal: "He claimed that we had copied his work and demanded that we either recreate it without looking at his code, or take a license from him and add his copyright header to our code. We explained that we have not copied his work. His behavior was concerning and went beyond a reasonable business exchange — he claimed to have recorded a phone call with me without my knowledge or consent, and he threatened to go public with information about alleged vulnerabilities in Wire’s implementation that he refused to identify." [1] These are not the machinations of the crypto-idealist, scrappy underdog for justice we are painted by such publications as the New Yorker. This is some straight up cartoon villain twirling their moustache plotting. So now I'm being sold on a business vision that was just so hot the public's eyes couldn't bear it? We're talking…

I agree that the open-source ability to audit is one of the strong points of foss and that's an allure to keep everyone honest. Look at Signal, ProtonMail, Telegram, and to a lesser extent WhatsApp, AWS and Zoom. Once things get increasingly proprietary, they tend to pull the curtain wider across the stage. Network traffic - or rather lack thereof - could conceivably be a good place to start. Wireshark not showing you any tangible information when you're sniffing the data? You stand a good change of being positively encrypted, but that's only one end of the end-to-end. There's an interesting research paper from the 1984 IEEE Symposium on Security and Privacy written by Dianne E. Britton entitled, "Formal Verification of a Secure Network with End-to-End Encryption" - the abstract being: A formal specification and verification of a simple secure communications network using end-to-end encryption is presented. It is shown that all data sent over the network is encrypted and all heats on the network exchange messages only if they are authorized to do so. The network and its hosts are modelled by a set of concurrent processes that communicate via unidirectional buffers. Each process is viewed as a state machine. The specification has been formally verified using the commercially-available VERUS verification system. I feel like this would at least illustrate the groundwork current systems have expanded on over the last twenty-odd years, but the paper is behind a research wall.…

I'm not a lawyer but my understanding is that copying semantics could still be argued as creating a derivative work. This is what e.g. Whisper Systems claimed before publishing an axolotl spec, that anyone implementing the spec was doing so by deducing the semantic meaning of a copyleft piece of software and thus was a derivative work of said copyleft piece of software. This meant that the resulting binary was covered under the copyleft license (GPLv3 in that case, but my understanding of EPL is similar) https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7 I don't know if Rich or the other Clojure copyright holders care enough to ever make trouble, but I'm pretty sure most companies with a decent legal team would think thrice before offering a piece of code built using Ferret GCC has already solved the problem the other commenter you mention brings up with the runtime library exception https://www.gnu.org/licenses/gcc-exception-faq.html but I don't know if you can tack this on to the clojure-derived parts of ferret. I sure wish SFLC or someone was able to do legal counselling for new/small projects like this, I feel like a big reason people shy away from copyleft isn't the hippie dippie bullshit but because these interactions are impossible to reason about by laypersons

Wouldn't secure Wire[1] be a better replacement? It's crypto-audited[2], open-sourced[3], has native mobile clients[4], Swiss based[5], and pretty well known[6]. [1] https://wire.com [2] https://techcrunch.com/2017/02/10/messaging-app-wire-now-has-an-extern… [3] https://medium.com/@wireapp/wire-server-code-now-100-open-source-the-j… [4] https://github.com/wireapp [5] https://en.wikipedia.org/wiki/Wire_Swiss [6] https://news.ycombinator.com/item?id=12148596