February 4, 2025 • 57 mins
You might think that nobody can read your private messages, but chances are, the apps you are using are not as private as you think. In this episode of the Sovereign Computing Show, Jordan Bravo and Stephen DeLorme discuss how to enhance digital privacy by replacing everyday messaging apps with more secure and sovereign options. They review various messaging applications like Signal, Matrix, and SimpleX, and delve into their benefits and drawbacks.
00:00 Introduction to the Sovereign Computing Show
00:16 Sponsorship and Community at ATL BitLab
01:28 Deep Dive into Instant Messengers
02:23 The Importance of End-to-End Encryption
04:02 Privacy vs. Security: A Complex Relationship
06:47 Shifting Perceptions of Encrypted Messaging
10:50 Exploring Popular Messaging Apps
21:33 Signal: The Gold Standard for Privacy
29:07 Managing Sensitive Credentials with Disappearing Messages
30:45 The Fun and Practicality of Ephemeral Messaging
31:18 Signal in Pop Culture and Username Features
32:25 Introduction to Matrix and Element
33:47 Self-Hosting and Federation in Matrix
35:25 Matrix vs. Other Messaging Protocols
37:57 Exploring SimpleX: A Unique Messaging App
39:19 Understanding SimpleX's Server Model
45:33 Boostergrams and Listener Feedback
56:01 Wrapping Up and Final Thoughts
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Jordan Bravo (00:00):
Welcome to the Sovereign Computing Show, presented by ATL BitLab.
I'm Jordan Bravo, and this is apodcast where we teach you how to
take back control of your devices.
Sovereign Computing means you own yourtechnology, not the other way around.
Stephen DeLorme (00:18):
This episode is sponsored by ATL BitLab.
ATL BitLab is Atlanta'sfreedom tech hacker space.
We have co working desks,conference rooms, event space,
maker tools, and tons of coffee.
There is a very activecommunity here in the lab.
Every Wednesday night isBitcoin night here in Atlanta.
We also have meetups for cyber security,artificial intelligence, decentralized
(00:38):
identity, product design, and more.
We offer day passes and nomad passesfor people who need to use the lab only
occasionally, as well as membershipsfor people who plan to use the lab
more regularly, such as myself.
One of the best things abouthaving a BitLab membership isn't
the amenities, it's the people.
Surrounding yourself with acommunity helps you learn faster
and helps you build better.
(00:59):
Your creativity becomes amplifiedwhen you work in this space,
that's what I think at least.
If you're interested in becominga member or supporting this space,
please visit us at atlbitlab.
com.
That's A T L B I T L A B dot com.
Alright, on to our show.
Jordan Bravo (01:20):
I'm Jordan Bravo.
Welcome to the Sovereign Computing Show.
I'm here today with Stephen DeLorme.
Stephen DeLorme (01:26):
Hey, how's it going, everybody?
Jordan Bravo (01:28):
Today we're going to be taking a deep look at
messengers, instant messengers.
This is a great topic because it issomething that's really powerful.
We all use messengers in ourlives all the time, constantly.
And so if we can shift towards usingtechnology that is more sovereign in this
particular instance, we're really going toget a lot of mileage out of that decision.
(01:52):
In other words, We're going to make a hugedifference in how sovereign our computing
is, how sovereign our data is, just by, byreplacing our everyday messaging apps with
some more secure and sovereign options.
We're going to start today bytalking about a news article.
This was this was in the newsin the past several weeks.
(02:13):
The, and we have here, for those of youwatching, this is an NBC news article.
But for those of you that arejust listening, you can check
the show notes for the link.
Basically The U. S. infrastructure,telecom infrastructure was hacked
by Chinese hackers and the FBI andother U. S. government officials,
(02:35):
they went on record as saying thatthey now are urging Americans to
use end to end encrypted messaging.
And what's really interesting aboutthis article, or about this whole
event, is that for years, if you arein the Sovereign computing space.
Maybe you are a privacy advocate or.
(02:55):
In that general realm, you might havenoticed something, and that is that these
U. S. officials, these same ones thatwe're now reading about urging Americans
to use end to end encryption, they've beenvery anti end to end encryption because it
inhibits surveillance, and they want to beable to surveil people's communications.
(03:16):
But now they're upset because the Chineseare doing this an adversarial U. S.
Or rather, an adversarial government.
And suddenly, it's the cool thingto do, to use end to end encryption.
Which, if you are a person who caresabout your digital sovereignty,
then you've been using end toend encryption for quite a while.
(03:37):
What we'll do is we'll talk aboutsome of the apps that we can use.
Which ones are better than others,what makes apps better than others.
And we'll we'll getinto all those details.
Stephen DeLorme (03:50):
Wild times we're living in.
Jordan Bravo (03:51):
Yeah.
Do you have anything tocomment on this article?
Stephen DeLorme (03:55):
Yeah, it's it's good advice, I think.
It's good advice.
They're right.
You should be using endto end encrypted apps.
It's also one of those kind of trickythings that overlap between privacy
and security, I think, becausethey're, depending on your point of
view, they might be the same topicor they might be different topics.
Like you can imaginethat a system could be.
(04:17):
In theory, you could imaginea system could be secure
without being private, right?
Take like a corporate computer network.
And it's a company managed emailand, company managed everything.
And there's not really anexpectation of privacy.
It's like the company owns the network.
The employees are there to do their work.
And so there's not really this,grounds for privacy there.
(04:38):
And then whereas privacy I think of asokay you have this expectation that your
you know, communications, your messages,your data are protected in a way to where,
you have, only you have access to it oryou get to control who has access to it.
And there, there's a lotof times I feel like this.
They kind of people tend to talk aboutthem like they're two different things.
(04:58):
Like when you're talking aboutsecurity or cyber security, a lot of
times you're just talking about thatidea of just being able to keep the
bad guys out, the bad guys out, butthere's not an expectation of privacy.
And then when you talk about privacyit's this whole separate other thing.
But really the thing about it is likewith these kinds of articles, these
kinds of situations tell us is thatthey're not always separate things.
(05:19):
If you have a system that's not private,it, that could be a security hole, right?
Like it could be that the, whenthere's not expectations of privacy
is in a system they tend to leadto these security vulnerabilities.
Jordan Bravo (05:34):
Yeah.
And like you said, some, a lot of timesprivacy and security are looked at as
separate properties of a given system.
And you we know from there's that,there's the famous line by Nick Szabo
in the Bitcoin community, trustedthird parties are security holes.
And so when you have a system that mightbe considered secure, but not private,
(05:56):
like you said, a corporate email.
That might be it's not private inthat you are not, you're expected
that the admin, the sysadmin isable to read all of the messages.
So you have a trusted person who isable to have sort of God mode, right?
Almost like a backdoor into it.
But the idea is that trusted person isthe only one who's allowed to see it.
(06:18):
Now, when it comes to messaging foreveryday folks like us, outside of
some kind of enterprise environment.
We don't want any kind of backdoor.
We don't want anybody to haveGod mode into our messages.
The only people that should be ableto see the messages are the end users.
The people that are sending themessage from one end to the other end.
And that's why the term end to endencryption indicates that those are the
(06:42):
only places where it can be decrypted.
Stephen DeLorme (06:47):
I think one other thing that might be a good segue
from the news article into the actualsoftware we're going to talk about
would just be, the the rant that manyof my friends have heard me go on about
people's shifting perceptions aboutencrypted messaging apps over the years.
The story I like to tell peopleis just how, the idea of encrypted
(07:07):
communication or just privacy ingeneral tends to shift with who holds
the presidency in the United States.
That's what I've observedover the course of my life.
And it's 9 11 happened Patriot Act getspassed, and, suddenly, everyone has,
people have individual opinions, right?
But if I can just paint in broad strokesthe kind of mainstream narrative.
It was that like, okay, Republicans arefor breaking privacy because it's in
(07:32):
the interest of national security andDemocrats are opposed to that and, all the
privacy narratives that I heard and likehigh school were coming from the left.
Then Bush goes out of office, Obamacomes into office, we have the
Snowden revelations and all of that.
Then suddenly it was like, oh, this,this happened under Obama's watch.
(07:53):
It's a, left wing conspiracyto, break everybody's privacy.
And then it's okay then it startsto shift and all the, the privacy
stuff I started hearing in the2010s was all coming from the right
or the kind of libertarian sphere.
And, I heard more almost moreapologizing for, not apologize,
but I almost heard more, justtrying to justify it on the left.
(08:14):
And then it flipped again in2016 or 2017, Trump enters the
White House for the first time.
And then, suddenly it's like the leftis like, Oh my God, we got to, get a
journalist using encrypted messaging appslike Signal so that they can, exfiltrate
information from the White House.
Whistleblowers could getinformation out of the White
House with, without being caught.
(08:35):
And then it was like four yearslater and it was like January 2021
and suddenly, practically every GenX Republican that I know was like
suddenly asking me about Signal.
I was like, because Oh my God,we're getting censored and
pulled off of social media.
We need encrypted stuff so thatpeople, can't take us offline.
And it wasn't surprised meif now the narrative is going
(08:57):
to shift back the other way.
And the thing is that being censoredor having your privacy broken or.
Having people tap into your messages,this is always a concern on a
technical level can happen at any time.
It's just and the privacyalways is the better option.
It always makes, helps you be more secure,be more safe, keep your data more private
your personal information more private.
(09:18):
It's always a good thing in my opinion.
It's just that the way that we feel aboutprivacy, the emotions that we have about
privacy really radically shift dependingon how we feel about who's in office.
Jordan Bravo (09:30):
And so a common sort of what I would argue is a short sighted
view might be something like this.
You think, Oh, I don't care about privacy.
I don't have anything to hide becausethe people I like are currently in power.
And therefore, I don't, it doesn't matterto me whether they know or can stop
what I'm doing because they're good.
(09:51):
They're, intentioned and I don'thave to worry about being censored
or having my privacy violated.
But I would argue that the.
Longer term view would be people aregoing to go in and out of power, different
parties, different powers, and you maysuddenly find yourself in opposition
to the current party that's in power.
You might decide that the currentregardless of whether it's party
(10:14):
politics or partisan you might justthink, hey, I don't want, I don't want
any of these people to have access tomy data or to be able to censor me.
So maybe thinking long term.
Whether it's our government or whetherit's another government that's hacking
our government or our infrastructure.
(10:35):
It might be prudent to think, you knowwhat, let's just remove any back doors.
Let's make it so that the only peoplewho can see the messages are those
who send it and who are the intendedrecipients and just leave it at that.
Stephen DeLorme (10:48):
Yeah.
Jordan Bravo (10:50):
So let's talk now about the specific apps that we can use.
And first, before we talk aboutthe ones that are encrypted, let's
talk about what is not encrypted.
So this article and this story talksabout using encrypted messaging.
So what is not encrypted messaging?
That would be SMS.
That would be your regulareveryday text messages that.
(11:12):
We've been sending for decades now.
. Now a lot of people are gonna be using bydefault, iMessage because there's a lot
of iPhone users, especially in the UnitedStates, and iMessage does use end-to-end
encryption when you are messaging otheriPhone users who are using iMessage.
The problem is twofold.
(11:33):
One is it's only end to encrypted ifyou're messaging other iPhone users and.
About the last time I checked,roughly 50 percent of U. S.
mobile users are not using iPhone.
You don't want to only be encrypted whenyou're messaging other iPhone users.
You want to be encrypted all thetime with all of your messages.
(11:54):
The second problem with iMessage is thatwhile it is encrypted, we we have to take
Apple's word for how it actually worksand whether it's A sound implementation
or not, because it's completely closedsource and proprietary and we haven't
had any security researchers gettingeyes on the code and, confirming that
(12:17):
they weren't able to backdoor it orbrute force it or anything like that.
And then actually I'm gonna throw in athird problem with iMessage here, and
that is that the, your decryption keysactually get backed up to your iCloud.
And there is a way to lock down youriCloud backups to actually use end
to end encryption and be more secure,but by default, it's not enabled.
(12:39):
And I would wager that 99 percentof people don't even know that's an
option, let alone have that enabled.
Stephen DeLorme (12:46):
Yeah.
I didn't know that was an option either.
Yeah.
I think my personal thoughts on Appleare that, I'm an Apple user, I like their
products, but, there's certainly theclosed source nature of it as a risk.
I think between if you're just gonnago with an off the shelf Android
phone that's just, I don't know somerandom, pick a random Android phone
and you're gonna use it stock off theshelf as is, versus an Apple device.
(13:10):
I would personally go with the Appledevice because I think that they're,
the phone manufacturer that, Theyactually have an incentive, they have
a business incentive outside of sellingour data, which I like, but it doesn't
mean that, it doesn't mean that'sverifiable proof of the safety of the
device, it doesn't mean that at all,it's just more of a personal hunch,
Jordan Bravo (13:32):
yes, and we're going to get into a lot more detail on
iPhone, iOS, Android, and how youcan be secure on mobile and on
a whole operating system level.
But today we're going to gloss overthat and we're going to focus more
specifically on cross platform messagingapps that are secure and private.
(13:53):
So with that, let's go down to WhatsApp.
Let's talk about that.
WhatsApp is.
It is closed source, it isowned by Meta, aka Facebook.
And they do use the Signal Protocol,which is an open source encryption
protocol, but we don't know howit's implemented in WhatsApp.
(14:15):
We know that we don't know what they'redoing besides the Signal Protocol.
So in other words, there mightbe some really good encryption
at the protocol level.
At the signal protocol level, but thenthe way that they implemented, it's
decrypted in such a way that theirservers can gain all kinds of metadata.
(14:36):
We know that WhatsApp is a hugemoneymaker for meta, so if they weren't
able to glean any data from that, thenthey would be losing a ton of money
on it, and that's just not the case.
WhatsApp is I believe it is the mostwidely used messaging app in the world.
Stephen DeLorme (14:53):
Yep.
Jordan Bravo (14:53):
And.
Outside of the US where iPhoneusage is not as high it is just
the default messaging app of theworld, basically, internationally.
Now one last thing that I would say aboutWhatsApp's inherent problems, just right
off the bat, is that similar to the waythat iMessage gets backed up to iCloud,
WhatsApp by default, it gets backedup to Google Drive, and that is not.
(15:20):
Great for privacy.
Stephen DeLorme (15:22):
Yeah.
And I think when I've used WhatsAppbefore, and I want to say there's
I think I've got an option.
I think I have it pulled upon the screen right here.
I just have a little screenshot foranybody just listening, but they
have a, it's like you have to optin to that end to end encryption.
From what I remember so yeah, it's alittle bit misleading like a lot of
your data is getting backed up It's notgetting backed up Encrypted by default.
(15:46):
So yeah, not great.
But yeah for pretty much, Not usingwhatsapp is a very American thing at this
point, it's like it's so widely used.
It's wild
Jordan Bravo (15:58):
Do you have
Actually, let me ask you this.
What messaging apps do you usein your life and with whom?
You don't have to get into specificdoxing details, but just does your
family use a certain app and do you just,does your coworkers use another app?
Do your friends use a different app?
What's, what does that look like?
Stephen DeLorme (16:18):
In the business world, it's just slack all the way.
Cause it is good for like companiesand organizations and stuff.
It's pretty solid piece ofsoftware . In the open source world.
It's discord because you get manyof the perks of of slack in terms
of just having these big multi userchat rooms, but it's much better for
more like open public communities.
(16:40):
So a lot of open sourceprojects have moved to discord.
So I'm on there for that.
And then I try to useSignal wherever I can.
Whoever is a willing Signaluser, I'll usually opt for that.
And then, for, everyone outsideof Freedom Tech, it's usually
defaulting to iMessage or SMS.
So for me, that's iMessage.
(17:01):
But it's yeah, Slack forbusiness, Discord for open source.
IMessage for for Normies and,signal for, really cool people.
Jordan Bravo (17:10):
I have a similar setup as to you.
I would say Slack, of course, is forbusiness, that's what my company uses.
I'm on Android, not iOS, so I don'thave iMessage and I. I try to minimize
SMS, I would say maybe nobody, actuallynobody that I message with regularly is
(17:34):
insistent on using SMS and I've managedto convince my family to use Signal.
I would say most people that I messagewith on a regular basis are okay with
using Signal and then those that aren't,some of my family, like especially
group messages, we use WhatsApp.
We, let's talk about signal a littlebit more, but before that I want
(17:56):
to make an honorable mention ora dishonorable mention rather of
telegram telegram had its heyday.
I feel like telegram usage is peaked.
And a couple of things about Telegram.
One is that it is notencrypted by default.
So just when you join a chat ordirect message with somebody.
(18:18):
It is not end to end encrypted at all.
So that you have zero protectionfrom the server right there and
anybody that can access the server.
You can create, you canspecifically create a direct
message that's end to end encrypted.
It's called a secret chat, but youhave to go out of your way to do that.
It doesn't happen by default.
Stephen DeLorme (18:39):
Super misleading on their website here.
Telegram messages are heavilyencrypted and can self destruct.
It's like bullshit.
Jordan Bravo (18:45):
Yeah.
Stephen DeLorme (18:45):
Bullshit.
Jordan Bravo (18:47):
Yeah.
Telegram has always, I feel like itsomehow got the air of privacy about it,
but I don't think it ever deserved that.
It got really big in the crypto community,especially but I just, I feel like they
were more marketing and less substance.
Stephen DeLorme (19:06):
There's a Kendrick Lamar song, I think, where he
mentions Telegram in one of the songs.
Kendrick Lamar (19:11):
Thirty millions later, know the feds watchin Auntie
on my telegram, like, be cautious.
I be hangin' out atTam's, I be on Stockton.
I don't do it for the'Gram, I do it for Compton.
Stephen DeLorme (19:20):
Frustrating to me because especially in the Bitcoin
world, people just love Telegram.
And it's like, I don't get it.
Like, why?
And I could say it does havea, it has a delightful UX.
It's fun.
It's easy to make big roomsand add lots of people.
It feels fast.
It feels responsive.
The stickers and all that kind ofstuff are super fun to work with.
(19:42):
But just because it's dark mode bydefault, when you download it, doesn't
mean that it's encrypted, people.
Jordan Bravo (19:49):
Good point.
They do have a nice UX.
One, one thing that happened in thepast correct me if I'm wrong, maybe in
the past 12 months, but Pavel Durov,who was the creator of Telegram, he was
arrested and this was pretty big news.
Because up until then, Telegram had madesome statements on its website about
(20:14):
how it was private and how Telegramwould never cave to the authorities
or, and turn over data of users.
And then when Pavel Durov gotarrested, they, he, as part of
his plea deal or whatever dealhe made with the authorities.
They had to change that policyand now they no longer say
(20:35):
that on the Telegram website.
The wording has changed andthey do comply with requests
from authorities for user data.
So if there was any semblancebefore of privacy from Telegram, I
think that's completely gone now.
And as a result we've seen a largeNumber of Telegram users move away
(20:56):
from telegram, especially those who areactually concerned about privacy and
move to more private and secure options.
Stephen DeLorme (21:03):
Yeah, and to and to be fair to them, it's obviously
when you have a, huge like le likelegal action against you, then
you have to do that kind of stuff.
That's just the, that's the way thegrown up world works, but the better
scenario is, I think when you're using aservice that will comply with authorities
and give them all the information theyhave on you, but they can't give that,
(21:24):
the information they have is so littlethat even when they do comply and hand
over all the information, it's sparse.
It's not much at all.
Jordan Bravo (21:33):
Exactly.
That's a great segue to the next app we'regoing to talk about, which is Signal.
Signal is based in the United States, andso they do have to comply with U. S. laws.
But something that's great about Signalis it's end to end encrypted by default.
In fact, you can't turn that off,so it's always end to end encrypted.
(21:55):
And they have such littlemetadata on their users.
That they actually post on theirwebsite when they get requests from
authorities of turning over user data.
They show the letter and theirresponse and the data that they
are able to give the authorities.
And it's sparse that it'sactually worth reading, Stephen.
(22:15):
I don't know if you can
Stephen DeLorme (22:16):
Yeah, maybe is it on a blog maybe?
Jordan Bravo (22:19):
Could be.
But essentially they show, They, allthey know when they have a signal user
request is that they can look up whenthe account was created, the last time
that the account was used, and that's it.
They don't have the ability to have anykind of metadata in terms of IP addresses.
(22:41):
I suppose they have that technically.
They don't have the ability to associateit with an identity, in other words,
like your first name, last name,address, any of that kind of stuff.
And they don't have it correlatedwith any of your social media data.
Stephen DeLorme (23:01):
And I know I'm having difficulty finding the exact thing, but
I know I've seen it with my own eyes too.
I remember seeing that report and I'mnot sure if it was like Something that
they tweeted out or something like that.
But I do know it exists.
Like I've seen it before.
Jordan Bravo (23:21):
They might have a section that's dedicated to it.
But what we can do is, I'll pullit up after and put it in the
show notes so that people canclick that if they want to see it.
Stephen DeLorme (23:31):
God, their latest website design looks sick.
I want to go just download alltheir brand assets right now.
Anyway, sorry, it's the designerand me getting out of control.
Anyways.
Jordan Bravo (23:41):
Yeah on that note, Signal does have a pretty good UX, it's, I
would say it's On par with somethinglike WhatsApp or even iMessage where
at this point they have feature parity.
I would say, you, there's notreally much you can do in Signal,
or rather in WhatsApp or iMessagethat you can't do in Signal.
And the UX is so smooth that myfamily has zero issues using it.
(24:04):
You can audio call, you can video call.
. You can send stickers, emojis.
. You can send other files, you cansend pictures, videos, et cetera.
So at this point, Ithink it's pretty easy.
I would say, I don't know,let me ask you as a UX guy.
Is there anything about Signal that youthink is a UX hurdle for people to use?
Stephen DeLorme (24:25):
Not really.
There's, I think there's one caveatto it, which I'll get to that I,
but it's actually a good thing.
I think overall like signals UX is deeperthan just the fact that it's a clean,
nice looking app, but it's also just theperformance and responsiveness of it.
It just it feels like fast when you'reusing it, sometimes when an open source
(24:49):
project is new and it, might be worked onby a small team, it'll feel a little janky
when you're using it, but signal just.
It feels like it's functioning.
You don't get the impression thatit's like broken or whatever.
When you're using it,it just, it feels nice.
One thing I like is that they havethis kind of no power users philosophy.
The idea is like you shouldn't needto know how it works under the hood in
(25:13):
order to be able to use it effectively.
So one thing that's interesting aboutit is a lot of times when we think
about cryptographic applications, we'rethinking about like backing up keys
and seed phrases and stuff like that.
Signal actually doesn't giveyou the option to export your
private key to my knowledge.
It's not even buried under the settings oran advanced menu or something like that.
(25:37):
They just, they don't do it.
And this might, if you're a real technicaldeveloper type of person, it might feel
prohibitive but the upside to this isthat there's no way for the user to foot
gun themselves like they can't it'sheld on the device, presumably it's,
wherever, the most secure area to storesecrets on the devices, maybe that's
(25:58):
the enclave or whatever, but it's heldon the device securely only the signal,
app is supposed to be able to access it.
And The user can't just,accidentally leak their key material.
Another thing that is weirdabout it is that if you want
to transfer between devices.
There is some situations I've hadwhere I've lost chat history because
(26:18):
you have to get your new device andyou have to scan a QR code from your
old device to transfer everything andthere's been times when that's worked
perfectly and I've gotten all my history.
There's also been times, I think itwas in the old days when transferring
between Android and iPhone and I've lostchat history or sometimes if you like
pair your desktop computer with yourmobile signal phone, you'll you'll, you
(26:41):
won't get the chat history on the newdevice, but I think that's interesting.
It's it's a veryopinionated design decision.
They're saying like.
If we can't do this in a way whereit's done securely and encrypted,
then we're just not going to do it.
We're not going to come up witha window to the user saying, Oh,
are you sure you want to do this?
There's a, X percent chancethat your data might get leaked.
(27:03):
They just make a very strong opinionatedchoice for the user that if there
is a risk of something going wrongin this operation, we're just not
going to put your data at risk.
I think that's a really cool part of theUX is they don't even bother talking to
you about keys or surfacing any of that.
There's no power users in Signal.
Jordan Bravo (27:23):
Yeah, I agree.
I think it, like you said,it removes those foot guns.
As far as privacy, they do require aphone number, which is something a lot
of people who are really into theirown privacy are going to balk at.
But one thing you can do is, it onlyrequires a signature, or excuse me, a
(27:47):
phone number to register the account.
And then going forward, you canactually you can actually give any of
your contacts a username then they canget that by scanning the QR code or
just manually typing in a username.
And so you actually never have toshare your phone number with anybody.
It's really only used to registerwith the server upon account creation.
(28:09):
So that's pretty cool.
The other really great privacy featureis disappearing chats and you can
both turn that on manually per chat.
You can also have a default.
chat time.
So you can either have no disappearingchat for new chats or you can set
it to something like a minute,an hour, a day, a week, a month.
(28:33):
And that's actually a great featurebecause a lot of reducing our digital
footprint, it goes a huge it goes along way towards making us more private.
And so let me ask you.
Again, thinking about your typicalmessaging, when you have like in
your signal setup, what is your goto disappearing message strategy?
(28:58):
Do you have it enabled by default?
Do you manually enableit for certain chats?
How does that work?
Stephen DeLorme (29:04):
Yeah.
I usually just enable itwhen I feel like I need it.
Usually that's if something like, Ineed to like send myself a password or.
Send somebody else a credentialfor something like that.
It's I don't want that likesensitive credential just
sitting around for forever.
And so I tend to turn it on, sendit, and then turn it off for me.
Jordan Bravo (29:26):
I do the same thing, especially with passwords or any
kind of credentials like that I wouldsay I also use it on a longer term
disappearing timer for certain chats.
Especially with my wife, we message eachother constantly, many times per day.
And we have an understanding that afterfour weeks, the chat is going to be gone.
(29:53):
Any message that's sent,and this is fine for us.
We treat signal as a. Quick messagingapp for ephemeral conversations, but
if it's something like, Hey, here'ssome, here's a link or something
that's important and I want it tobe there more than four weeks in the
future, I'm going to save it elsewhere.
And this has the advantage of alsonot bloating our chat history.
(30:17):
You've got to think if you'remessaging dozens of times per day with
somebody and it's not disappearing,it's just piling up forever.
And as long as you signals on your phone.
That database size is goingto be growing and growing.
And to me I think it's just unnecessary.
I don't want to worry about the space.
I don't want to worry aboutpossible privacy leaks.
(30:39):
So for me, for everyday conversations, Ifeel like disappearing messages are great.
Stephen DeLorme (30:45):
Yeah.
And I think there's also, I don't know,something fun about the ephemeralness
of that too, because you got tothink about I don't know, being
married 30 years ago or something.
And it was just just, the messagingbetween husband and wife would have
been just as ephemeral back thenjust because of the limitations
of the technology at the time.
Unless you want to, really get out and,pen and paper some messages to each other.
(31:07):
But, the phone calls, which probablywould have been the norm, that,
that would be just as ephemeral.
I don't know our little monkeybrains aren't necessarily equipped
for this world where our datajust goes on and on forever.
Jordan Bravo (31:16):
Yup.
Stephen DeLorme (31:18):
Two little tidbits I'll inject real quick.
Last season of Mr. Robot, very funny,there's a plot arc where they're
using Signal, two of the charactersin the show are using Signal, and
they have disappearing messagesturned on for I don't know, like
one minute or something like that?
Like some ridiculously low time, andyou'll see them in the show like pulling
out Signal, checking their phone realquick, and then you'll see the messages
(31:39):
like disappearing in like the same scene.
I wanted to point out about the usernamestoo before I move on to another one.
One feature that I like about theirusernames is they automatically append
a number to the end of their username.
So it'll be like whatever name you choosedot, whatever number, and I know discord
does this too, even though they're notprivate, it's a thing with like scamming
and impersonation that happens online.
(32:00):
That's an interesting just getting inthe norm of there being a randomized
number on the end of your name as apotential, like impersonation prevention
strategy, which is interesting, I think.
Jordan Bravo (32:12):
Yeah.
Notably, Telegram does not do that.
And the scammers are abundant on Telegram.
Stephen DeLorme (32:17):
Yeah.
Jordan Bravo (32:20):
Okay, I think we've covered Signal pretty thoroughly.
The next app we're goingto talk about is Matrix.
And Matrix is actually the name of theprotocol and there, there are various
apps, clients as they're called, that youcan use that implement the Matrix protocol
and are compatible with each other.
(32:42):
The reference implementation, inother words, the company that is
behind the Matrix Protocol is alsothe one creating the most popular
app for it, is called Element.
And let's take a look at that.
So if you're looking at thevideo here, we have element.
io is the domain name.
(33:03):
And you can log in via the web,or you can download the client.
Both on mobile and desktop and what'sreally cool about matrix is by default
it uses the third party matrix.
org server.
So if you just want to try itout, you don't have to worry
about hosting your own server.
(33:24):
It's just like signal out of thebox where you can either sign up
for an account using only email andpassword or something like that.
And if you start messaging, DMing somebodyelse who's using Matrix, you're getting
end to end encryption right away out ofthe box, basically for free, you don't
have to do any extra configuration.
But what's cool about Matrix isthat you can take it a step further.
(33:47):
You can self host Matrix.
This is all completely opensource and self hostable.
Such that if you're running aserver, you are the only person who
is able to control the server data.
And therefore, your client, whichis pointed at your server, is
only going to be storing yourchat history on that server.
(34:10):
Which means, if you and another person,if you are talking to somebody with
your self hosted matrix, And they are,they have their own self hosted matrix.
These two servers are able to communicatewith each other because of federation.
This is a federated protocol whereany server that speaks the matrix
(34:31):
protocol can speak to any other server.
I could have Jordan at Bravo.
com as my username for Matrix.
And then I might be able totalk to Stephen at DeLorme.
com where he's hostinghis own Matrix server.
And our apps are going to beable to speak to each other
(34:52):
interoperably with zero issue.
And it's end to end encrypted.
If you think about it, the only place thatdata is existing, it goes from my client.
Let's say I'm talking, I'm usingmy phone and he's using his phone.
It goes from my phone to myserver, and that's encrypted.
And then from my server toStephen's server, and then
(35:13):
Stephen's server to his phone.
There are no third parties in thatchain of communication right there,
which I think is really cool.
That's about as decentralizedand off grid as you can get.
Stephen DeLorme (35:25):
And I guess since we say federated, that's like a similar
concept to what Mastodon uses, right?
Jordan Bravo (35:32):
Yes.
Yeah, federation.
Another really common protocolthat's federated is email.
If you are on Gmail and I'm on YahooMail, for whatever reason those can
speak to each other, even though they'retwo different companies, two different
servers, two different domain names.
But they both speak SMTP and IMAP orPOP, so that they're able to communicate.
Stephen DeLorme (35:57):
Yeah.
I've used Element before, and I'venever self hosted a matrix server,
though we're certainly in the processof setting one up here for ATL BitLab.
But I so I've never run a server, but Ihave used Element before on the desktop
and the phone, and it's pretty slick.
I mean It sometimes feels a little slowto me when it feels oh, it's, pulling
down a whole chat room full of messagesand decrypting it in the background.
(36:20):
But, aside from those kind of, veryminor performance nets, it feels
pretty snappy and it feels, like acompetitor to something like Slack.
Jordan Bravo (36:32):
Yep, and I know what you mean about the loading factor
where especially that when the firsttime you open the app Let's say it's
been a while since you logged in orlet's say you add a new Chat room.
It does seem like it takes a little whileto process and decrypt it now I've been
following the matrix blog and they'vebeen It seems like they've been really
(36:53):
hard at work focusing on that UX problembecause they want to have a, that snappy
feel where you dive into a room andyour chats are immediately available.
And I think they're using a lot ofengineering tricks where to maybe decrypt
like the ones that are immediatelyavailable and then in the background
decrypt the rest of them because the oddsare you aren't going to be scrolling back.
(37:15):
Really quickly right away.
I'm excited to see that UX gap be closed.
And as you mentioned, we are going to beswitching over to Matrix for ATL BitLab.
Currently, BitLab and its associatedcommunities are on Telegram.
And as we talked about earlier, Telegramhas its issues, especially now with Pavel
(37:39):
Durov arrest and changing their policies.
So it just feels like it's notthe most sovereign option when
really we could be using somethinglike a self hosted Matrix chat.
Stephen DeLorme (37:51):
Yeah, I'm definitely excited to dive
more into the Matrix universe.
Jordan Bravo (37:57):
The last application that we're gonna talk about
is called Simple X or Simplex.
I don't know which way to pronounce it,so I'm just gonna call it simple X. Now,
SimpleX is, it's a chat app for mobileand does it have a desktop as well?
I actually don't know.
(38:17):
Oh yeah, hey look at that.
GetSimpleX desktop app.
You have it for desktop, you have itfor iOS, you have it for Android, and
what's interesting about SimpleX isthey use a different server model.
They have a D, even when you'reusing the, Default server, which
(38:38):
is, you don't have to self host it.
Whereas Matrix has a single centralizedserver and Signal has a single centralized
server, SimpleX actually has multipleservers and it, so it's decentralizing it.
And they also have this concept ofinstead of having a username, that's
(38:59):
the way we always think of theseapps is I have my Signal username,
I have my Matrix username, whatever.
And then other people findme with that username.
SimpleX, it actually sets up an ephemeraluser, I guess you would call it, account.
I'm not really surethe proper terminology.
But it sets up a unique one for each chat.
If anybody was listening orperforming surveillance on the
(39:23):
servers, they wouldn't be able tocorrelate one chat with another.
If I'm talking to Stephen in one chatand I'm talking to My wife in another
chat and brother in another chat.
None of those arecorrelated with each other.
None of them have the same user data.
I believe there's a diagram of howit works on the Simplex website.
Stephen DeLorme (39:44):
Yeah, let's see if we can find that.
I think the out of band key exchangeis probably a part of the puzzle.
Okay, here we go.
Simplex explained.
Their logo drives me crazy becausefor anyone who can't see on the the
audio version it looks like a hash,like a pound hash symbol at the end
of the logo that's rotated to me.
So I don't know.
Anyways, this is a computingshow, not a design show.
(40:07):
What users experience.
You can create contacts and groupsand have two way conversations
as in any other messenger.
How can it work with unidirectionalcues and without user profile identity?
So we have a little networkdiagram with people icons.
So how does it work?
For each connection, you use twoseparate messaging queues to send and
receive messages via different servers.
Servers only pass messages one waywithout having the full picture
(40:29):
of each user's connections.
So they took the same network diagram theyhad before with all these kind of user
icons being connected with dotted lines.
But then we can see that one of the userslet's call it, user one, they're passing
their messages through another user.
And then that user is like passingthem back through another user,
(40:52):
it looks like, so it's yeah, it'seach user only passes the messages
one way and then what servers see.
And so then it straightens out thewhole diagram for the next picture.
And it just shows like message streamone, message stream two, message stream
three, has more arrows going through it,but it's still going in one direction.
(41:14):
It says the servers have separateanonymous credentials for each queue, and
do not know which users they belong to.
Users can further improve metadataprivacy by using Tor to access servers,
Preventing correlation by IP address.
So what it's sounding like to meis you think of typically with a
messaging, if you had some serverthat handles the message queue
or whatever, they can see that.
Okay.
Alice messaged Bob, Bob messagedAlice, Alice messaged Bob.
(41:37):
Whereas this simple X thing seemslike it abstracts it into there's
unidirectional messaging queues.
So all the server sees is that it's like.
X is messaging Y. X ismessaging Y over and over again.
And then there might be another messagequeue it has where A is messaging B, and
C is messaging D, and E is messaging F.
(41:59):
But it doesn't really know because,maybe maybe A and B. That's, that
could be messages going from Aliceto Bob, but where are the messages
coming from Bob back to Alice?
You don't know like which, if any of thosemessaging streams are going the other way.
Jordan Bravo (42:17):
So in this most, in the simplest case you would have, so going
back to something like, let's say, Signal.
If Signal were somehow the server wascompromised and there was surveillance
on it, and they could somehowbreak the decryption or encryption.
Then they would see if I'm messagingyou, Stephen, with Signal, there's that
centralized server, and they would beable to say, Okay, Jordan's sending
(42:40):
messages to Stephen, Stephen's sendingmessages back to Jordan, and we can
see that going in both directions.
Now, if it were Simplex, and I'm sendingyou messages via Simplex, there's going
to be server A. Jordan sends A messageto Stephen, the server, the message
goes from Jordan to server A to Stephen.
(43:00):
Now when Stephen sends a messageback to Jordan, it's going from
Stephen to server B to Jordan.
So if let's say server A wascompromised and there's somebody
surveilling that, they would see onlymessages going from Jordan to Stephen.
They wouldn't see any of Stephen'smessages going back to Jordan.
And so you could see howdecentralizing it like that
(43:21):
reduces single point of failures.
Stephen DeLorme (43:23):
And do you know what the expectation is with simplex in terms of
these servers and I'm assuming there'spublic ones, I'm assuming I could probably
also run my own, but is this the kindof thing where it's is the architecture
imagined to be that everybody runs theirown or that there's just tons of public
(43:44):
ones or any insight into that at all?.
Jordan Bravo (43:48):
Yeah.
No, that's a great question.
I would like to know more abouthow many servers are running.
I do know that it is self hostable andthat I think plenty of people do it.
For example, it's availableas a service on start OS.
So if you have a start nineserver, you can easily self
host it with a couple of clicks.
(44:09):
And actually more broadly speaking, youcan also do that with matrix as well.
Both of these things are really easyto self host if you're using a one
of these kind of easy mode serverslike StartOS and and then obviously
if you are a more advanced user andyou actually want to run your Linux
server by hand or manually, then theyhave instructions for that as well.
(44:32):
But as far as how many are self hostingversus how many are using the default
public servers, I don't know, but that's,that would be interesting to find out.
Stephen DeLorme (44:43):
I love their placeholder, their delightful placeholder
copy and their sample app up here.
I think this one chat coming in is aDune reference, who controls the past,
controls the future, who controls thepresent, it's from some science fiction.
Okay.
There's a Fight Club reference,there's also a Ghost in the Shell stand
alone complex reference, that's thelaughing man from Ghost in the shell.
(45:07):
Just think about it, ourwhole world is sitting there.
Anyways, I'll stop picking apart the
Jordan Bravo (45:11):
And one last thing on that.
The Graphene OS chat is listed as well,which is cool because if you are a person
who's into Simplex then you're goingto be a privacy conscious individual
and you might also be interested inGraphene OS, which is a more private
version of Android, which we'll betalking about in a future episode.
Stephen DeLorme (45:32):
Sweet.
Jordan Bravo (45:33):
Let's let's move on into Boostergrams.
We're going to read out theboosts from a previous show.
We're going to hear what you,the audience, have boosted in.
And before we read those, we'dencourage you to boost in on this show.
Let us know what kindof messaging you use.
(45:54):
Do you self host?
Do you use private messaging?
Have you had success getting people inyour life to use more private messaging
and you can do that by going to atlbitlab.
com slash podcast or by going to fountain.
fm and searching for atlbitlab.
(46:14):
com And boosting in on one ofthe Sovereign Computing episodes.
Stephen DeLorme (46:18):
Yeah, and we don't have the ability, you can certainly
leave us a tip directly on atobitlab.
com slash podcast.
It goes to BTC Pay Server.
We don't have the ability to acceptthe text messages and boost directly
on the website, but it's a featureI'd like to get added at one point.
I think for the Boostergram segment,I almost feel like we need to come up
with some like cool sound effects, like
(46:40):
booster grams or something like that.
Jordan Bravo (46:43):
Yeah.
Maybe some bumper music or something.
Stephen DeLorme (46:45):
Some fire and explosions.
Okay.
So anyways, we're herelooking at the boost.
This was from episode one ofthe Sovereign Computing Show.
Jordan Bravo (46:53):
Cool.
We have a boost for 1000Sats from Justin Goldberg.
And Justin says.
In addition to a password manager,I strongly recommend that if your
browser or password manager or Nostrclient generates passwords, it's a
good idea to add some random text tothe end of the generated password.
(47:16):
Alright, thank you Justin for that boost.
He is referring to how in episodeone, I recommended using a password
manager as a first step for anybodythat isn't already doing that to take
on their sovereign computing journey.
And what he says about adding random textat the end of a generated password, this
is known in the security field as salt.
(47:40):
So passwords, they are added withthis little random text at the end.
It's called salt.
And by salting passwords, it makesit harder to brute force them.
So a lot of password managers willactually do this Automatically for you.
But if you are manually typingyour password for whatever, or
manually generating your passwordfor whatever reason, then this is
(48:01):
certainly a good, some good adviceto add some random text at the end.
Stephen DeLorme (48:04):
Yeah, and I'm wondering I actually, I'm curious
what he meant by the random text.
So yeah, I'm familiar with salting.
And it gets like salting, like definitely,especially when you're dealing with
like server applications that has likea kind of special application, but I'm
wondering here, if I can read a littleinto his comment, if he means that it's
like a fail safe almost that so anytimeyou have something that generates a
(48:28):
random thing for you, a random key,a random password, you're relying on
wherever that thing gets its entropy from.
And there have been caseswhere for example, there was
the milk, sad vulnerability.
There was a a Bitcoin library, one madefrom the early days that was getting its
entropy and some not, and this wasn'tfor Bitcoin core for any is wondering it
(48:51):
was for some other Just coding librarythat people use and it wasn't getting
its entropy in the best of ways, soit wasn't really like good entropy.
It wasn't random enough.
And with the milk side vulnerability,people were able to get this library to
produce, the same key twice effectively.
And so it might be that what he'sproposing Is that if you added some if
(49:14):
you let it generate a random password foryou, if you also take that and add your
own extra characters, like a couple ofcharacters, perhaps that might act as a
safeguard just in case one day down theline, it's, discovered that this thing,
wasn't as random as previously thought.
I'm not sure if that's what he means.
That's just my my, my guess there.
(49:35):
But you can, there's certainly,it's always a, that's a very deep
rabbit hole, like wondering howrandom, random generators are.
Jordan Bravo (49:43):
Yeah I tend to trust, so to speak, or I, I tend
to rely on the implementation ofthe random password generation.
For example, I always, I set itto a certain amount of characters
and I set it to use symbolsand capitalization, all that.
(50:05):
And then I just let thepassword manager handle it.
I don't even try to customizeit myself because I figure.
However clever I think I am, I'm notgoing to be beating random entropy that's
generated by a sophisticated algorithm.
So for me, I just let the random generatordo its work and I save it and I don't
ever think about the password after that.
Stephen DeLorme (50:27):
But yeah, and same here, but always, everyone is going
to have their own threat model.
So sweet.
Thanks for the boost, Justin.
Jordan Bravo (50:35):
All right.
The next boost we haveis from Gavin Green.
Gavin sent 500 sats and he says greatdebut guys on the subject of password
keepers What do you think aboutusing browsers to save passwords?
Is the data stored locally or in the cloudand I Think that it actually depends.
(50:57):
So you have Firefox.
Let's say you have Brave or Chromeif you are not signed in to the sync
service, then it's saving it locallyAnd you have the benefit of it's, you
don't have to worry about it beingin some third party service, but you
have the downside of it's not synced.
So if you have different machines,different desktop laptops or mobile you're
(51:20):
not going to have it across those devices.
So for me, I prefer a tool that's notreliant on a single browser because
I like to use different browsersand in different environments.
So for me, that's why somethinglike Bitwarden, which is
the password manager I use.
That it works really well because you,it's in, it's a Firefox extension,
it's a Chrome extension, whichalso works for Brave, it works on
(51:44):
mobile there's even like a desktopapp if you want a standalone app.
So for me, I like not being reliant on thespecific browser implementation, but still
having the ability to sync my passwords.
Stephen DeLorme (51:55):
Yeah, I feel the same way.
I remember like once I, I think I don'tknow 15 years ago or something like that,
my girlfriend at the time was using theFirefox password manager and I ended up
like we, we needed to recover a passwordand we like dug into it and found that it
was all just unencrypted on the system.
But I guess, it does, it makes senseif they don't prompt you to make a
master password, then it's just storedunencrypted on the system, which again, if
(52:18):
it's on your local computer that's fine.
I think we're in much more sophisticatedterritory nowadays where a lot of
windows computers and Mac computerslike do end to end encrypt things.
Or at least I think the windows computers,they enabled it in windows 10, I
think, but I'm not going to say everycomputer has the hardware for that, but.
The point is, could do that.
(52:39):
I know there are some servicesthat let you sync to the cloud.
I'm pretty sure Chrome will syncyour passwords to the cloud.
I haven't vetted this, code of that oranything, but my assumption is that it's
probably just going up into the cloud.
Like unless there, likeyour Google account is not.
Like when you log into Chrome,you're just logging in with your
(53:02):
like Gmail account, usually, ifyou use the browser profile thing.
And so that's not an endto end encrypted account.
Like you can just resetthe Google password.
So I don't imagine if you dosome kind of cloud sync that it's
like fully end to end encrypted.
That would be my assumption there.
But yeah, I agree with you.
I like not having it coupled ontothe browser, because you may want
to use that in a different context.
(53:22):
You might want to use yourpasswords in a browser.
You might need to use itfor desktop applications or.
You may want to use it ondifferent devices or whatever.
And so like just having it as likea standalone service is good too.
And I think there's also just somethinglike we were saying about the psychology
of taking over your own passwords.
There's something about the psychologyof being like, this is like my
(53:43):
super secret, encrypted fault.
And it's like separate fromthe other services I use.
It just makes you take it a littlebit more seriously and a little
bit more empowering, I think.
Jordan Bravo (53:53):
All right.
Our next boost is from M U T U M 8, I'mgoing to call him Mutum, or Mutum 8.
Stephen DeLorme (54:04):
Mutum 8.
Jordan Bravo (54:05):
Mutum 8, boosted in with 210 sats, and Mutum says, Topic suggestion,
how do I decentralize my domain name?
That is a great question I,Million dollar question yeah.
Based on previous discussionson this topic, that is, it
(54:26):
is a very difficult thing.
It's actually, it's tricky becauseDNS is inherently centralized,
the domain name system.
And so while there are some experimentalideas for how we could decentralize it.
There's it's really tough and it's goingto be a whole episode if we get into it.
(54:48):
I was, I say,
Stephen DeLorme (54:49):
that'd be a fun one to get into one episode.
Yeah.
Jordan Bravo (54:51):
Yeah.
So thank you for that topic suggestion.
That's a great topic.
We are going to coverthat in a future episode.
Stephen DeLorme (54:57):
Yeah.
And I think that would probably bea more experimental forward looking
future, future philosophy kind of stuff.
Cause as you pointed out, there's notlike an actionable way you can just like.
Completely decentralizeyour DNS right now.
It's all, it's a very experimentalspace, at least to my understanding.
But it's worth kind of thinking, it's
worth thinking about these things.
Jordan Bravo (55:18):
Yeah.
Yeah that's a great topic.
That's it for our boost.
Stephen DeLorme (55:23):
Oh, I will highlight one other person.
There's no boosts on here, but Isaw recently in the backend, the our
top supporter is now weird robot.
So congratulations, weird robot.
You're our top supporter.
Jordan Bravo (55:34):
Oh, yes.
So we, you can also supportthe show by streaming sats.
You don't have to boost in a message.
You can just.
Set your Fountain app or Podverseor any of the other podcasting 2.
0 apps.
You can just set it to streamsats while you're listening.
And so we want to thank ourstreamer Weird, and we appreciate
(55:55):
you streaming in those sats.
Stephen DeLorme (55:58):
Yep.
All right.
Jordan Bravo (56:01):
All right.
That's it for our show today.
Thanks again.
You can visit us at atlbitlab.
com slash podcast for videos, show notes.
Boosts and all of the other good stuff
Stephen DeLorme (56:13):
Catch you later
Jordan Bravo (56:14):
Thanks, and we'll see you next time
Stephen DeLorme (56:17):
Hey, thanks for listening.
I hope you enjoyed this episode.
If you want to learn more aboutanything that we discussed, you can
look for links in the show notesthat should be in your podcast
player, or you can go to atlbitlab.
com slash podcast.
On a final note, if you foundthis information useful and you
want to help support us, you canalways send us a tip in Bitcoin.
(56:38):
Your support really helps us so that wecan keep bringing you content like this.
All right.
Catch you later.
Welcome to the Sovereign Computing Show, presented by ATL BitLab.
I'm Jordan Bravo, and this is apodcast where we teach you how to
take back control of your devices.
Sovereign Computing means you own yourtechnology, not the other way around.
Stephen DeLorme (00:18):
This episode is sponsored by ATL BitLab.
ATL BitLab is Atlanta'sfreedom tech hacker space.
We have co working desks,conference rooms, event space,
maker tools, and tons of coffee.
There is a very activecommunity here in the lab.
Every Wednesday night isBitcoin night here in Atlanta.
We also have meetups for cyber security,artificial intelligence, decentralized
(00:38):
identity, product design, and more.
We offer day passes and nomad passesfor people who need to use the lab only
occasionally, as well as membershipsfor people who plan to use the lab
more regularly, such as myself.
One of the best things abouthaving a BitLab membership isn't
the amenities, it's the people.
Surrounding yourself with acommunity helps you learn faster
and helps you build better.
(00:59):
Your creativity becomes amplifiedwhen you work in this space,
that's what I think at least.
If you're interested in becominga member or supporting this space,
please visit us at atlbitlab.
com.
That's A T L B I T L A B dot com.
Alright, on to our show.
Jordan Bravo (01:20):
I'm Jordan Bravo.
Welcome to the Sovereign Computing Show.
I'm here today with Stephen DeLorme.
Stephen DeLorme (01:26):
Hey, how's it going, everybody?
Jordan Bravo (01:28):
Today we're going to be taking a deep look at
messengers, instant messengers.
This is a great topic because it issomething that's really powerful.
We all use messengers in ourlives all the time, constantly.
And so if we can shift towards usingtechnology that is more sovereign in this
particular instance, we're really going toget a lot of mileage out of that decision.
(01:52):
In other words, We're going to make a hugedifference in how sovereign our computing
is, how sovereign our data is, just by, byreplacing our everyday messaging apps with
some more secure and sovereign options.
We're going to start today bytalking about a news article.
This was this was in the newsin the past several weeks.
(02:13):
The, and we have here, for those of youwatching, this is an NBC news article.
But for those of you that arejust listening, you can check
the show notes for the link.
Basically The U. S. infrastructure,telecom infrastructure was hacked
by Chinese hackers and the FBI andother U. S. government officials,
(02:35):
they went on record as saying thatthey now are urging Americans to
use end to end encrypted messaging.
And what's really interesting aboutthis article, or about this whole
event, is that for years, if you arein the Sovereign computing space.
Maybe you are a privacy advocate or.
(02:55):
In that general realm, you might havenoticed something, and that is that these
U. S. officials, these same ones thatwe're now reading about urging Americans
to use end to end encryption, they've beenvery anti end to end encryption because it
inhibits surveillance, and they want to beable to surveil people's communications.
(03:16):
But now they're upset because the Chineseare doing this an adversarial U. S.
Or rather, an adversarial government.
And suddenly, it's the cool thingto do, to use end to end encryption.
Which, if you are a person who caresabout your digital sovereignty,
then you've been using end toend encryption for quite a while.
(03:37):
What we'll do is we'll talk aboutsome of the apps that we can use.
Which ones are better than others,what makes apps better than others.
And we'll we'll getinto all those details.
Stephen DeLorme (03:50):
Wild times we're living in.
Jordan Bravo (03:51):
Yeah.
Do you have anything tocomment on this article?
Stephen DeLorme (03:55):
Yeah, it's it's good advice, I think.
It's good advice.
They're right.
You should be using endto end encrypted apps.
It's also one of those kind of trickythings that overlap between privacy
and security, I think, becausethey're, depending on your point of
view, they might be the same topicor they might be different topics.
Like you can imaginethat a system could be.
(04:17):
In theory, you could imaginea system could be secure
without being private, right?
Take like a corporate computer network.
And it's a company managed emailand, company managed everything.
And there's not really anexpectation of privacy.
It's like the company owns the network.
The employees are there to do their work.
And so there's not really this,grounds for privacy there.
(04:38):
And then whereas privacy I think of asokay you have this expectation that your
you know, communications, your messages,your data are protected in a way to where,
you have, only you have access to it oryou get to control who has access to it.
And there, there's a lotof times I feel like this.
They kind of people tend to talk aboutthem like they're two different things.
(04:58):
Like when you're talking aboutsecurity or cyber security, a lot of
times you're just talking about thatidea of just being able to keep the
bad guys out, the bad guys out, butthere's not an expectation of privacy.
And then when you talk about privacyit's this whole separate other thing.
But really the thing about it is likewith these kinds of articles, these
kinds of situations tell us is thatthey're not always separate things.
(05:19):
If you have a system that's not private,it, that could be a security hole, right?
Like it could be that the, whenthere's not expectations of privacy
is in a system they tend to leadto these security vulnerabilities.
Jordan Bravo (05:34):
Yeah.
And like you said, some, a lot of timesprivacy and security are looked at as
separate properties of a given system.
And you we know from there's that,there's the famous line by Nick Szabo
in the Bitcoin community, trustedthird parties are security holes.
And so when you have a system that mightbe considered secure, but not private,
(05:56):
like you said, a corporate email.
That might be it's not private inthat you are not, you're expected
that the admin, the sysadmin isable to read all of the messages.
So you have a trusted person who isable to have sort of God mode, right?
Almost like a backdoor into it.
But the idea is that trusted person isthe only one who's allowed to see it.
(06:18):
Now, when it comes to messaging foreveryday folks like us, outside of
some kind of enterprise environment.
We don't want any kind of backdoor.
We don't want anybody to haveGod mode into our messages.
The only people that should be ableto see the messages are the end users.
The people that are sending themessage from one end to the other end.
And that's why the term end to endencryption indicates that those are the
(06:42):
only places where it can be decrypted.
Stephen DeLorme (06:47):
I think one other thing that might be a good segue
from the news article into the actualsoftware we're going to talk about
would just be, the the rant that manyof my friends have heard me go on about
people's shifting perceptions aboutencrypted messaging apps over the years.
The story I like to tell peopleis just how, the idea of encrypted
(07:07):
communication or just privacy ingeneral tends to shift with who holds
the presidency in the United States.
That's what I've observedover the course of my life.
And it's 9 11 happened Patriot Act getspassed, and, suddenly, everyone has,
people have individual opinions, right?
But if I can just paint in broad strokesthe kind of mainstream narrative.
It was that like, okay, Republicans arefor breaking privacy because it's in
(07:32):
the interest of national security andDemocrats are opposed to that and, all the
privacy narratives that I heard and likehigh school were coming from the left.
Then Bush goes out of office, Obamacomes into office, we have the
Snowden revelations and all of that.
Then suddenly it was like, oh, this,this happened under Obama's watch.
(07:53):
It's a, left wing conspiracyto, break everybody's privacy.
And then it's okay then it startsto shift and all the, the privacy
stuff I started hearing in the2010s was all coming from the right
or the kind of libertarian sphere.
And, I heard more almost moreapologizing for, not apologize,
but I almost heard more, justtrying to justify it on the left.
(08:14):
And then it flipped again in2016 or 2017, Trump enters the
White House for the first time.
And then, suddenly it's like the leftis like, Oh my God, we got to, get a
journalist using encrypted messaging appslike Signal so that they can, exfiltrate
information from the White House.
Whistleblowers could getinformation out of the White
House with, without being caught.
(08:35):
And then it was like four yearslater and it was like January 2021
and suddenly, practically every GenX Republican that I know was like
suddenly asking me about Signal.
I was like, because Oh my God,we're getting censored and
pulled off of social media.
We need encrypted stuff so thatpeople, can't take us offline.
And it wasn't surprised meif now the narrative is going
(08:57):
to shift back the other way.
And the thing is that being censoredor having your privacy broken or.
Having people tap into your messages,this is always a concern on a
technical level can happen at any time.
It's just and the privacyalways is the better option.
It always makes, helps you be more secure,be more safe, keep your data more private
your personal information more private.
(09:18):
It's always a good thing in my opinion.
It's just that the way that we feel aboutprivacy, the emotions that we have about
privacy really radically shift dependingon how we feel about who's in office.
Jordan Bravo (09:30):
And so a common sort of what I would argue is a short sighted
view might be something like this.
You think, Oh, I don't care about privacy.
I don't have anything to hide becausethe people I like are currently in power.
And therefore, I don't, it doesn't matterto me whether they know or can stop
what I'm doing because they're good.
(09:51):
They're, intentioned and I don'thave to worry about being censored
or having my privacy violated.
But I would argue that the.
Longer term view would be people aregoing to go in and out of power, different
parties, different powers, and you maysuddenly find yourself in opposition
to the current party that's in power.
You might decide that the currentregardless of whether it's party
(10:14):
politics or partisan you might justthink, hey, I don't want, I don't want
any of these people to have access tomy data or to be able to censor me.
So maybe thinking long term.
Whether it's our government or whetherit's another government that's hacking
our government or our infrastructure.
(10:35):
It might be prudent to think, you knowwhat, let's just remove any back doors.
Let's make it so that the only peoplewho can see the messages are those
who send it and who are the intendedrecipients and just leave it at that.
Stephen DeLorme (10:48):
Yeah.
Jordan Bravo (10:50):
So let's talk now about the specific apps that we can use.
And first, before we talk aboutthe ones that are encrypted, let's
talk about what is not encrypted.
So this article and this story talksabout using encrypted messaging.
So what is not encrypted messaging?
That would be SMS.
That would be your regulareveryday text messages that.
(11:12):
We've been sending for decades now.
. Now a lot of people are gonna be using bydefault, iMessage because there's a lot
of iPhone users, especially in the UnitedStates, and iMessage does use end-to-end
encryption when you are messaging otheriPhone users who are using iMessage.
The problem is twofold.
(11:33):
One is it's only end to encrypted ifyou're messaging other iPhone users and.
About the last time I checked,roughly 50 percent of U. S.
mobile users are not using iPhone.
You don't want to only be encrypted whenyou're messaging other iPhone users.
You want to be encrypted all thetime with all of your messages.
(11:54):
The second problem with iMessage is thatwhile it is encrypted, we we have to take
Apple's word for how it actually worksand whether it's A sound implementation
or not, because it's completely closedsource and proprietary and we haven't
had any security researchers gettingeyes on the code and, confirming that
(12:17):
they weren't able to backdoor it orbrute force it or anything like that.
And then actually I'm gonna throw in athird problem with iMessage here, and
that is that the, your decryption keysactually get backed up to your iCloud.
And there is a way to lock down youriCloud backups to actually use end
to end encryption and be more secure,but by default, it's not enabled.
(12:39):
And I would wager that 99 percentof people don't even know that's an
option, let alone have that enabled.
Stephen DeLorme (12:46):
Yeah.
I didn't know that was an option either.
Yeah.
I think my personal thoughts on Appleare that, I'm an Apple user, I like their
products, but, there's certainly theclosed source nature of it as a risk.
I think between if you're just gonnago with an off the shelf Android
phone that's just, I don't know somerandom, pick a random Android phone
and you're gonna use it stock off theshelf as is, versus an Apple device.
(13:10):
I would personally go with the Appledevice because I think that they're,
the phone manufacturer that, Theyactually have an incentive, they have
a business incentive outside of sellingour data, which I like, but it doesn't
mean that, it doesn't mean that'sverifiable proof of the safety of the
device, it doesn't mean that at all,it's just more of a personal hunch,
Jordan Bravo (13:32):
yes, and we're going to get into a lot more detail on
iPhone, iOS, Android, and how youcan be secure on mobile and on
a whole operating system level.
But today we're going to gloss overthat and we're going to focus more
specifically on cross platform messagingapps that are secure and private.
(13:53):
So with that, let's go down to WhatsApp.
Let's talk about that.
WhatsApp is.
It is closed source, it isowned by Meta, aka Facebook.
And they do use the Signal Protocol,which is an open source encryption
protocol, but we don't know howit's implemented in WhatsApp.
(14:15):
We know that we don't know what they'redoing besides the Signal Protocol.
So in other words, there mightbe some really good encryption
at the protocol level.
At the signal protocol level, but thenthe way that they implemented, it's
decrypted in such a way that theirservers can gain all kinds of metadata.
(14:36):
We know that WhatsApp is a hugemoneymaker for meta, so if they weren't
able to glean any data from that, thenthey would be losing a ton of money
on it, and that's just not the case.
WhatsApp is I believe it is the mostwidely used messaging app in the world.
Stephen DeLorme (14:53):
Yep.
Jordan Bravo (14:53):
And.
Outside of the US where iPhoneusage is not as high it is just
the default messaging app of theworld, basically, internationally.
Now one last thing that I would say aboutWhatsApp's inherent problems, just right
off the bat, is that similar to the waythat iMessage gets backed up to iCloud,
WhatsApp by default, it gets backedup to Google Drive, and that is not.
(15:20):
Great for privacy.
Stephen DeLorme (15:22):
Yeah.
And I think when I've used WhatsAppbefore, and I want to say there's
I think I've got an option.
I think I have it pulled upon the screen right here.
I just have a little screenshot foranybody just listening, but they
have a, it's like you have to optin to that end to end encryption.
From what I remember so yeah, it's alittle bit misleading like a lot of
your data is getting backed up It's notgetting backed up Encrypted by default.
(15:46):
So yeah, not great.
But yeah for pretty much, Not usingwhatsapp is a very American thing at this
point, it's like it's so widely used.
It's wild
Jordan Bravo (15:58):
Do you have
Actually, let me ask you this.
What messaging apps do you usein your life and with whom?
You don't have to get into specificdoxing details, but just does your
family use a certain app and do you just,does your coworkers use another app?
Do your friends use a different app?
What's, what does that look like?
Stephen DeLorme (16:18):
In the business world, it's just slack all the way.
Cause it is good for like companiesand organizations and stuff.
It's pretty solid piece ofsoftware . In the open source world.
It's discord because you get manyof the perks of of slack in terms
of just having these big multi userchat rooms, but it's much better for
more like open public communities.
(16:40):
So a lot of open sourceprojects have moved to discord.
So I'm on there for that.
And then I try to useSignal wherever I can.
Whoever is a willing Signaluser, I'll usually opt for that.
And then, for, everyone outsideof Freedom Tech, it's usually
defaulting to iMessage or SMS.
So for me, that's iMessage.
(17:01):
But it's yeah, Slack forbusiness, Discord for open source.
IMessage for for Normies and,signal for, really cool people.
Jordan Bravo (17:10):
I have a similar setup as to you.
I would say Slack, of course, is forbusiness, that's what my company uses.
I'm on Android, not iOS, so I don'thave iMessage and I. I try to minimize
SMS, I would say maybe nobody, actuallynobody that I message with regularly is
(17:34):
insistent on using SMS and I've managedto convince my family to use Signal.
I would say most people that I messagewith on a regular basis are okay with
using Signal and then those that aren't,some of my family, like especially
group messages, we use WhatsApp.
We, let's talk about signal a littlebit more, but before that I want
(17:56):
to make an honorable mention ora dishonorable mention rather of
telegram telegram had its heyday.
I feel like telegram usage is peaked.
And a couple of things about Telegram.
One is that it is notencrypted by default.
So just when you join a chat ordirect message with somebody.
(18:18):
It is not end to end encrypted at all.
So that you have zero protectionfrom the server right there and
anybody that can access the server.
You can create, you canspecifically create a direct
message that's end to end encrypted.
It's called a secret chat, but youhave to go out of your way to do that.
It doesn't happen by default.
Stephen DeLorme (18:39):
Super misleading on their website here.
Telegram messages are heavilyencrypted and can self destruct.
It's like bullshit.
Jordan Bravo (18:45):
Yeah.
Stephen DeLorme (18:45):
Bullshit.
Jordan Bravo (18:47):
Yeah.
Telegram has always, I feel like itsomehow got the air of privacy about it,
but I don't think it ever deserved that.
It got really big in the crypto community,especially but I just, I feel like they
were more marketing and less substance.
Stephen DeLorme (19:06):
There's a Kendrick Lamar song, I think, where he
mentions Telegram in one of the songs.
Kendrick Lamar (19:11):
Thirty millions later, know the feds watchin Auntie
on my telegram, like, be cautious.
I be hangin' out atTam's, I be on Stockton.
I don't do it for the'Gram, I do it for Compton.
Stephen DeLorme (19:20):
Frustrating to me because especially in the Bitcoin
world, people just love Telegram.
And it's like, I don't get it.
Like, why?
And I could say it does havea, it has a delightful UX.
It's fun.
It's easy to make big roomsand add lots of people.
It feels fast.
It feels responsive.
The stickers and all that kind ofstuff are super fun to work with.
(19:42):
But just because it's dark mode bydefault, when you download it, doesn't
mean that it's encrypted, people.
Jordan Bravo (19:49):
Good point.
They do have a nice UX.
One, one thing that happened in thepast correct me if I'm wrong, maybe in
the past 12 months, but Pavel Durov,who was the creator of Telegram, he was
arrested and this was pretty big news.
Because up until then, Telegram had madesome statements on its website about
(20:14):
how it was private and how Telegramwould never cave to the authorities
or, and turn over data of users.
And then when Pavel Durov gotarrested, they, he, as part of
his plea deal or whatever dealhe made with the authorities.
They had to change that policyand now they no longer say
(20:35):
that on the Telegram website.
The wording has changed andthey do comply with requests
from authorities for user data.
So if there was any semblancebefore of privacy from Telegram, I
think that's completely gone now.
And as a result we've seen a largeNumber of Telegram users move away
(20:56):
from telegram, especially those who areactually concerned about privacy and
move to more private and secure options.
Stephen DeLorme (21:03):
Yeah, and to and to be fair to them, it's obviously
when you have a, huge like le likelegal action against you, then
you have to do that kind of stuff.
That's just the, that's the way thegrown up world works, but the better
scenario is, I think when you're using aservice that will comply with authorities
and give them all the information theyhave on you, but they can't give that,
(21:24):
the information they have is so littlethat even when they do comply and hand
over all the information, it's sparse.
It's not much at all.
Jordan Bravo (21:33):
Exactly.
That's a great segue to the next app we'regoing to talk about, which is Signal.
Signal is based in the United States, andso they do have to comply with U. S. laws.
But something that's great about Signalis it's end to end encrypted by default.
In fact, you can't turn that off,so it's always end to end encrypted.
(21:55):
And they have such littlemetadata on their users.
That they actually post on theirwebsite when they get requests from
authorities of turning over user data.
They show the letter and theirresponse and the data that they
are able to give the authorities.
And it's sparse that it'sactually worth reading, Stephen.
(22:15):
I don't know if you can
Stephen DeLorme (22:16):
Yeah, maybe is it on a blog maybe?
Jordan Bravo (22:19):
Could be.
But essentially they show, They, allthey know when they have a signal user
request is that they can look up whenthe account was created, the last time
that the account was used, and that's it.
They don't have the ability to have anykind of metadata in terms of IP addresses.
(22:41):
I suppose they have that technically.
They don't have the ability to associateit with an identity, in other words,
like your first name, last name,address, any of that kind of stuff.
And they don't have it correlatedwith any of your social media data.
Stephen DeLorme (23:01):
And I know I'm having difficulty finding the exact thing, but
I know I've seen it with my own eyes too.
I remember seeing that report and I'mnot sure if it was like Something that
they tweeted out or something like that.
But I do know it exists.
Like I've seen it before.
Jordan Bravo (23:21):
They might have a section that's dedicated to it.
But what we can do is, I'll pullit up after and put it in the
show notes so that people canclick that if they want to see it.
Stephen DeLorme (23:31):
God, their latest website design looks sick.
I want to go just download alltheir brand assets right now.
Anyway, sorry, it's the designerand me getting out of control.
Anyways.
Jordan Bravo (23:41):
Yeah on that note, Signal does have a pretty good UX, it's, I
would say it's On par with somethinglike WhatsApp or even iMessage where
at this point they have feature parity.
I would say, you, there's notreally much you can do in Signal,
or rather in WhatsApp or iMessagethat you can't do in Signal.
And the UX is so smooth that myfamily has zero issues using it.
(24:04):
You can audio call, you can video call.
. You can send stickers, emojis.
. You can send other files, you cansend pictures, videos, et cetera.
So at this point, Ithink it's pretty easy.
I would say, I don't know,let me ask you as a UX guy.
Is there anything about Signal that youthink is a UX hurdle for people to use?
Stephen DeLorme (24:25):
Not really.
There's, I think there's one caveatto it, which I'll get to that I,
but it's actually a good thing.
I think overall like signals UX is deeperthan just the fact that it's a clean,
nice looking app, but it's also just theperformance and responsiveness of it.
It just it feels like fast when you'reusing it, sometimes when an open source
(24:49):
project is new and it, might be worked onby a small team, it'll feel a little janky
when you're using it, but signal just.
It feels like it's functioning.
You don't get the impression thatit's like broken or whatever.
When you're using it,it just, it feels nice.
One thing I like is that they havethis kind of no power users philosophy.
The idea is like you shouldn't needto know how it works under the hood in
(25:13):
order to be able to use it effectively.
So one thing that's interesting aboutit is a lot of times when we think
about cryptographic applications, we'rethinking about like backing up keys
and seed phrases and stuff like that.
Signal actually doesn't giveyou the option to export your
private key to my knowledge.
It's not even buried under the settings oran advanced menu or something like that.
(25:37):
They just, they don't do it.
And this might, if you're a real technicaldeveloper type of person, it might feel
prohibitive but the upside to this isthat there's no way for the user to foot
gun themselves like they can't it'sheld on the device, presumably it's,
wherever, the most secure area to storesecrets on the devices, maybe that's
(25:58):
the enclave or whatever, but it's heldon the device securely only the signal,
app is supposed to be able to access it.
And The user can't just,accidentally leak their key material.
Another thing that is weirdabout it is that if you want
to transfer between devices.
There is some situations I've hadwhere I've lost chat history because
(26:18):
you have to get your new device andyou have to scan a QR code from your
old device to transfer everything andthere's been times when that's worked
perfectly and I've gotten all my history.
There's also been times, I think itwas in the old days when transferring
between Android and iPhone and I've lostchat history or sometimes if you like
pair your desktop computer with yourmobile signal phone, you'll you'll, you
(26:41):
won't get the chat history on the newdevice, but I think that's interesting.
It's it's a veryopinionated design decision.
They're saying like.
If we can't do this in a way whereit's done securely and encrypted,
then we're just not going to do it.
We're not going to come up witha window to the user saying, Oh,
are you sure you want to do this?
There's a, X percent chancethat your data might get leaked.
(27:03):
They just make a very strong opinionatedchoice for the user that if there
is a risk of something going wrongin this operation, we're just not
going to put your data at risk.
I think that's a really cool part of theUX is they don't even bother talking to
you about keys or surfacing any of that.
There's no power users in Signal.
Jordan Bravo (27:23):
Yeah, I agree.
I think it, like you said,it removes those foot guns.
As far as privacy, they do require aphone number, which is something a lot
of people who are really into theirown privacy are going to balk at.
But one thing you can do is, it onlyrequires a signature, or excuse me, a
(27:47):
phone number to register the account.
And then going forward, you canactually you can actually give any of
your contacts a username then they canget that by scanning the QR code or
just manually typing in a username.
And so you actually never have toshare your phone number with anybody.
It's really only used to registerwith the server upon account creation.
(28:09):
So that's pretty cool.
The other really great privacy featureis disappearing chats and you can
both turn that on manually per chat.
You can also have a default.
chat time.
So you can either have no disappearingchat for new chats or you can set
it to something like a minute,an hour, a day, a week, a month.
(28:33):
And that's actually a great featurebecause a lot of reducing our digital
footprint, it goes a huge it goes along way towards making us more private.
And so let me ask you.
Again, thinking about your typicalmessaging, when you have like in
your signal setup, what is your goto disappearing message strategy?
(28:58):
Do you have it enabled by default?
Do you manually enableit for certain chats?
How does that work?
Stephen DeLorme (29:04):
Yeah.
I usually just enable itwhen I feel like I need it.
Usually that's if something like, Ineed to like send myself a password or.
Send somebody else a credentialfor something like that.
It's I don't want that likesensitive credential just
sitting around for forever.
And so I tend to turn it on, sendit, and then turn it off for me.
Jordan Bravo (29:26):
I do the same thing, especially with passwords or any
kind of credentials like that I wouldsay I also use it on a longer term
disappearing timer for certain chats.
Especially with my wife, we message eachother constantly, many times per day.
And we have an understanding that afterfour weeks, the chat is going to be gone.
(29:53):
Any message that's sent,and this is fine for us.
We treat signal as a. Quick messagingapp for ephemeral conversations, but
if it's something like, Hey, here'ssome, here's a link or something
that's important and I want it tobe there more than four weeks in the
future, I'm going to save it elsewhere.
And this has the advantage of alsonot bloating our chat history.
(30:17):
You've got to think if you'remessaging dozens of times per day with
somebody and it's not disappearing,it's just piling up forever.
And as long as you signals on your phone.
That database size is goingto be growing and growing.
And to me I think it's just unnecessary.
I don't want to worry about the space.
I don't want to worry aboutpossible privacy leaks.
(30:39):
So for me, for everyday conversations, Ifeel like disappearing messages are great.
Stephen DeLorme (30:45):
Yeah.
And I think there's also, I don't know,something fun about the ephemeralness
of that too, because you got tothink about I don't know, being
married 30 years ago or something.
And it was just just, the messagingbetween husband and wife would have
been just as ephemeral back thenjust because of the limitations
of the technology at the time.
Unless you want to, really get out and,pen and paper some messages to each other.
(31:07):
But, the phone calls, which probablywould have been the norm, that,
that would be just as ephemeral.
I don't know our little monkeybrains aren't necessarily equipped
for this world where our datajust goes on and on forever.
Jordan Bravo (31:16):
Yup.
Stephen DeLorme (31:18):
Two little tidbits I'll inject real quick.
Last season of Mr. Robot, very funny,there's a plot arc where they're
using Signal, two of the charactersin the show are using Signal, and
they have disappearing messagesturned on for I don't know, like
one minute or something like that?
Like some ridiculously low time, andyou'll see them in the show like pulling
out Signal, checking their phone realquick, and then you'll see the messages
(31:39):
like disappearing in like the same scene.
I wanted to point out about the usernamestoo before I move on to another one.
One feature that I like about theirusernames is they automatically append
a number to the end of their username.
So it'll be like whatever name you choosedot, whatever number, and I know discord
does this too, even though they're notprivate, it's a thing with like scamming
and impersonation that happens online.
(32:00):
That's an interesting just getting inthe norm of there being a randomized
number on the end of your name as apotential, like impersonation prevention
strategy, which is interesting, I think.
Jordan Bravo (32:12):
Yeah.
Notably, Telegram does not do that.
And the scammers are abundant on Telegram.
Stephen DeLorme (32:17):
Yeah.
Jordan Bravo (32:20):
Okay, I think we've covered Signal pretty thoroughly.
The next app we're goingto talk about is Matrix.
And Matrix is actually the name of theprotocol and there, there are various
apps, clients as they're called, that youcan use that implement the Matrix protocol
and are compatible with each other.
(32:42):
The reference implementation, inother words, the company that is
behind the Matrix Protocol is alsothe one creating the most popular
app for it, is called Element.
And let's take a look at that.
So if you're looking at thevideo here, we have element.
io is the domain name.
(33:03):
And you can log in via the web,or you can download the client.
Both on mobile and desktop and what'sreally cool about matrix is by default
it uses the third party matrix.
org server.
So if you just want to try itout, you don't have to worry
about hosting your own server.
(33:24):
It's just like signal out of thebox where you can either sign up
for an account using only email andpassword or something like that.
And if you start messaging, DMing somebodyelse who's using Matrix, you're getting
end to end encryption right away out ofthe box, basically for free, you don't
have to do any extra configuration.
But what's cool about Matrix isthat you can take it a step further.
(33:47):
You can self host Matrix.
This is all completely opensource and self hostable.
Such that if you're running aserver, you are the only person who
is able to control the server data.
And therefore, your client, whichis pointed at your server, is
only going to be storing yourchat history on that server.
(34:10):
Which means, if you and another person,if you are talking to somebody with
your self hosted matrix, And they are,they have their own self hosted matrix.
These two servers are able to communicatewith each other because of federation.
This is a federated protocol whereany server that speaks the matrix
(34:31):
protocol can speak to any other server.
I could have Jordan at Bravo.
com as my username for Matrix.
And then I might be able totalk to Stephen at DeLorme.
com where he's hostinghis own Matrix server.
And our apps are going to beable to speak to each other
(34:52):
interoperably with zero issue.
And it's end to end encrypted.
If you think about it, the only place thatdata is existing, it goes from my client.
Let's say I'm talking, I'm usingmy phone and he's using his phone.
It goes from my phone to myserver, and that's encrypted.
And then from my server toStephen's server, and then
(35:13):
Stephen's server to his phone.
There are no third parties in thatchain of communication right there,
which I think is really cool.
That's about as decentralizedand off grid as you can get.
Stephen DeLorme (35:25):
And I guess since we say federated, that's like a similar
concept to what Mastodon uses, right?
Jordan Bravo (35:32):
Yes.
Yeah, federation.
Another really common protocolthat's federated is email.
If you are on Gmail and I'm on YahooMail, for whatever reason those can
speak to each other, even though they'retwo different companies, two different
servers, two different domain names.
But they both speak SMTP and IMAP orPOP, so that they're able to communicate.
Stephen DeLorme (35:57):
Yeah.
I've used Element before, and I'venever self hosted a matrix server,
though we're certainly in the processof setting one up here for ATL BitLab.
But I so I've never run a server, but Ihave used Element before on the desktop
and the phone, and it's pretty slick.
I mean It sometimes feels a little slowto me when it feels oh, it's, pulling
down a whole chat room full of messagesand decrypting it in the background.
(36:20):
But, aside from those kind of, veryminor performance nets, it feels
pretty snappy and it feels, like acompetitor to something like Slack.
Jordan Bravo (36:32):
Yep, and I know what you mean about the loading factor
where especially that when the firsttime you open the app Let's say it's
been a while since you logged in orlet's say you add a new Chat room.
It does seem like it takes a little whileto process and decrypt it now I've been
following the matrix blog and they'vebeen It seems like they've been really
(36:53):
hard at work focusing on that UX problembecause they want to have a, that snappy
feel where you dive into a room andyour chats are immediately available.
And I think they're using a lot ofengineering tricks where to maybe decrypt
like the ones that are immediatelyavailable and then in the background
decrypt the rest of them because the oddsare you aren't going to be scrolling back.
(37:15):
Really quickly right away.
I'm excited to see that UX gap be closed.
And as you mentioned, we are going to beswitching over to Matrix for ATL BitLab.
Currently, BitLab and its associatedcommunities are on Telegram.
And as we talked about earlier, Telegramhas its issues, especially now with Pavel
(37:39):
Durov arrest and changing their policies.
So it just feels like it's notthe most sovereign option when
really we could be using somethinglike a self hosted Matrix chat.
Stephen DeLorme (37:51):
Yeah, I'm definitely excited to dive
more into the Matrix universe.
Jordan Bravo (37:57):
The last application that we're gonna talk about
is called Simple X or Simplex.
I don't know which way to pronounce it,so I'm just gonna call it simple X. Now,
SimpleX is, it's a chat app for mobileand does it have a desktop as well?
I actually don't know.
(38:17):
Oh yeah, hey look at that.
GetSimpleX desktop app.
You have it for desktop, you have itfor iOS, you have it for Android, and
what's interesting about SimpleX isthey use a different server model.
They have a D, even when you'reusing the, Default server, which
(38:38):
is, you don't have to self host it.
Whereas Matrix has a single centralizedserver and Signal has a single centralized
server, SimpleX actually has multipleservers and it, so it's decentralizing it.
And they also have this concept ofinstead of having a username, that's
(38:59):
the way we always think of theseapps is I have my Signal username,
I have my Matrix username, whatever.
And then other people findme with that username.
SimpleX, it actually sets up an ephemeraluser, I guess you would call it, account.
I'm not really surethe proper terminology.
But it sets up a unique one for each chat.
If anybody was listening orperforming surveillance on the
(39:23):
servers, they wouldn't be able tocorrelate one chat with another.
If I'm talking to Stephen in one chatand I'm talking to My wife in another
chat and brother in another chat.
None of those arecorrelated with each other.
None of them have the same user data.
I believe there's a diagram of howit works on the Simplex website.
Stephen DeLorme (39:44):
Yeah, let's see if we can find that.
I think the out of band key exchangeis probably a part of the puzzle.
Okay, here we go.
Simplex explained.
Their logo drives me crazy becausefor anyone who can't see on the the
audio version it looks like a hash,like a pound hash symbol at the end
of the logo that's rotated to me.
So I don't know.
Anyways, this is a computingshow, not a design show.
(40:07):
What users experience.
You can create contacts and groupsand have two way conversations
as in any other messenger.
How can it work with unidirectionalcues and without user profile identity?
So we have a little networkdiagram with people icons.
So how does it work?
For each connection, you use twoseparate messaging queues to send and
receive messages via different servers.
Servers only pass messages one waywithout having the full picture
(40:29):
of each user's connections.
So they took the same network diagram theyhad before with all these kind of user
icons being connected with dotted lines.
But then we can see that one of the userslet's call it, user one, they're passing
their messages through another user.
And then that user is like passingthem back through another user,
(40:52):
it looks like, so it's yeah, it'seach user only passes the messages
one way and then what servers see.
And so then it straightens out thewhole diagram for the next picture.
And it just shows like message streamone, message stream two, message stream
three, has more arrows going through it,but it's still going in one direction.
(41:14):
It says the servers have separateanonymous credentials for each queue, and
do not know which users they belong to.
Users can further improve metadataprivacy by using Tor to access servers,
Preventing correlation by IP address.
So what it's sounding like to meis you think of typically with a
messaging, if you had some serverthat handles the message queue
or whatever, they can see that.
Okay.
Alice messaged Bob, Bob messagedAlice, Alice messaged Bob.
(41:37):
Whereas this simple X thing seemslike it abstracts it into there's
unidirectional messaging queues.
So all the server sees is that it's like.
X is messaging Y. X ismessaging Y over and over again.
And then there might be another messagequeue it has where A is messaging B, and
C is messaging D, and E is messaging F.
(41:59):
But it doesn't really know because,maybe maybe A and B. That's, that
could be messages going from Aliceto Bob, but where are the messages
coming from Bob back to Alice?
You don't know like which, if any of thosemessaging streams are going the other way.
Jordan Bravo (42:17):
So in this most, in the simplest case you would have, so going
back to something like, let's say, Signal.
If Signal were somehow the server wascompromised and there was surveillance
on it, and they could somehowbreak the decryption or encryption.
Then they would see if I'm messagingyou, Stephen, with Signal, there's that
centralized server, and they would beable to say, Okay, Jordan's sending
(42:40):
messages to Stephen, Stephen's sendingmessages back to Jordan, and we can
see that going in both directions.
Now, if it were Simplex, and I'm sendingyou messages via Simplex, there's going
to be server A. Jordan sends A messageto Stephen, the server, the message
goes from Jordan to server A to Stephen.
(43:00):
Now when Stephen sends a messageback to Jordan, it's going from
Stephen to server B to Jordan.
So if let's say server A wascompromised and there's somebody
surveilling that, they would see onlymessages going from Jordan to Stephen.
They wouldn't see any of Stephen'smessages going back to Jordan.
And so you could see howdecentralizing it like that
(43:21):
reduces single point of failures.
Stephen DeLorme (43:23):
And do you know what the expectation is with simplex in terms of
these servers and I'm assuming there'spublic ones, I'm assuming I could probably
also run my own, but is this the kindof thing where it's is the architecture
imagined to be that everybody runs theirown or that there's just tons of public
(43:44):
ones or any insight into that at all?.
Jordan Bravo (43:48):
Yeah.
No, that's a great question.
I would like to know more abouthow many servers are running.
I do know that it is self hostable andthat I think plenty of people do it.
For example, it's availableas a service on start OS.
So if you have a start nineserver, you can easily self
host it with a couple of clicks.
(44:09):
And actually more broadly speaking, youcan also do that with matrix as well.
Both of these things are really easyto self host if you're using a one
of these kind of easy mode serverslike StartOS and and then obviously
if you are a more advanced user andyou actually want to run your Linux
server by hand or manually, then theyhave instructions for that as well.
(44:32):
But as far as how many are self hostingversus how many are using the default
public servers, I don't know, but that's,that would be interesting to find out.
Stephen DeLorme (44:43):
I love their placeholder, their delightful placeholder
copy and their sample app up here.
I think this one chat coming in is aDune reference, who controls the past,
controls the future, who controls thepresent, it's from some science fiction.
Okay.
There's a Fight Club reference,there's also a Ghost in the Shell stand
alone complex reference, that's thelaughing man from Ghost in the shell.
(45:07):
Just think about it, ourwhole world is sitting there.
Anyways, I'll stop picking apart the
Jordan Bravo (45:11):
And one last thing on that.
The Graphene OS chat is listed as well,which is cool because if you are a person
who's into Simplex then you're goingto be a privacy conscious individual
and you might also be interested inGraphene OS, which is a more private
version of Android, which we'll betalking about in a future episode.
Stephen DeLorme (45:32):
Sweet.
Jordan Bravo (45:33):
Let's let's move on into Boostergrams.
We're going to read out theboosts from a previous show.
We're going to hear what you,the audience, have boosted in.
And before we read those, we'dencourage you to boost in on this show.
Let us know what kindof messaging you use.
(45:54):
Do you self host?
Do you use private messaging?
Have you had success getting people inyour life to use more private messaging
and you can do that by going to atlbitlab.
com slash podcast or by going to fountain.
fm and searching for atlbitlab.
(46:14):
com And boosting in on one ofthe Sovereign Computing episodes.
Stephen DeLorme (46:18):
Yeah, and we don't have the ability, you can certainly
leave us a tip directly on atobitlab.
com slash podcast.
It goes to BTC Pay Server.
We don't have the ability to acceptthe text messages and boost directly
on the website, but it's a featureI'd like to get added at one point.
I think for the Boostergram segment,I almost feel like we need to come up
with some like cool sound effects, like
(46:40):
booster grams or something like that.
Jordan Bravo (46:43):
Yeah.
Maybe some bumper music or something.
Stephen DeLorme (46:45):
Some fire and explosions.
Okay.
So anyways, we're herelooking at the boost.
This was from episode one ofthe Sovereign Computing Show.
Jordan Bravo (46:53):
Cool.
We have a boost for 1000Sats from Justin Goldberg.
And Justin says.
In addition to a password manager,I strongly recommend that if your
browser or password manager or Nostrclient generates passwords, it's a
good idea to add some random text tothe end of the generated password.
(47:16):
Alright, thank you Justin for that boost.
He is referring to how in episodeone, I recommended using a password
manager as a first step for anybodythat isn't already doing that to take
on their sovereign computing journey.
And what he says about adding random textat the end of a generated password, this
is known in the security field as salt.
(47:40):
So passwords, they are added withthis little random text at the end.
It's called salt.
And by salting passwords, it makesit harder to brute force them.
So a lot of password managers willactually do this Automatically for you.
But if you are manually typingyour password for whatever, or
manually generating your passwordfor whatever reason, then this is
(48:01):
certainly a good, some good adviceto add some random text at the end.
Stephen DeLorme (48:04):
Yeah, and I'm wondering I actually, I'm curious
what he meant by the random text.
So yeah, I'm familiar with salting.
And it gets like salting, like definitely,especially when you're dealing with
like server applications that has likea kind of special application, but I'm
wondering here, if I can read a littleinto his comment, if he means that it's
like a fail safe almost that so anytimeyou have something that generates a
(48:28):
random thing for you, a random key,a random password, you're relying on
wherever that thing gets its entropy from.
And there have been caseswhere for example, there was
the milk, sad vulnerability.
There was a a Bitcoin library, one madefrom the early days that was getting its
entropy and some not, and this wasn'tfor Bitcoin core for any is wondering it
(48:51):
was for some other Just coding librarythat people use and it wasn't getting
its entropy in the best of ways, soit wasn't really like good entropy.
It wasn't random enough.
And with the milk side vulnerability,people were able to get this library to
produce, the same key twice effectively.
And so it might be that what he'sproposing Is that if you added some if
(49:14):
you let it generate a random password foryou, if you also take that and add your
own extra characters, like a couple ofcharacters, perhaps that might act as a
safeguard just in case one day down theline, it's, discovered that this thing,
wasn't as random as previously thought.
I'm not sure if that's what he means.
That's just my my, my guess there.
(49:35):
But you can, there's certainly,it's always a, that's a very deep
rabbit hole, like wondering howrandom, random generators are.
Jordan Bravo (49:43):
Yeah I tend to trust, so to speak, or I, I tend
to rely on the implementation ofthe random password generation.
For example, I always, I set itto a certain amount of characters
and I set it to use symbolsand capitalization, all that.
(50:05):
And then I just let thepassword manager handle it.
I don't even try to customizeit myself because I figure.
However clever I think I am, I'm notgoing to be beating random entropy that's
generated by a sophisticated algorithm.
So for me, I just let the random generatordo its work and I save it and I don't
ever think about the password after that.
Stephen DeLorme (50:27):
But yeah, and same here, but always, everyone is going
to have their own threat model.
So sweet.
Thanks for the boost, Justin.
Jordan Bravo (50:35):
All right.
The next boost we haveis from Gavin Green.
Gavin sent 500 sats and he says greatdebut guys on the subject of password
keepers What do you think aboutusing browsers to save passwords?
Is the data stored locally or in the cloudand I Think that it actually depends.
(50:57):
So you have Firefox.
Let's say you have Brave or Chromeif you are not signed in to the sync
service, then it's saving it locallyAnd you have the benefit of it's, you
don't have to worry about it beingin some third party service, but you
have the downside of it's not synced.
So if you have different machines,different desktop laptops or mobile you're
(51:20):
not going to have it across those devices.
So for me, I prefer a tool that's notreliant on a single browser because
I like to use different browsersand in different environments.
So for me, that's why somethinglike Bitwarden, which is
the password manager I use.
That it works really well because you,it's in, it's a Firefox extension,
it's a Chrome extension, whichalso works for Brave, it works on
(51:44):
mobile there's even like a desktopapp if you want a standalone app.
So for me, I like not being reliant on thespecific browser implementation, but still
having the ability to sync my passwords.
Stephen DeLorme (51:55):
Yeah, I feel the same way.
I remember like once I, I think I don'tknow 15 years ago or something like that,
my girlfriend at the time was using theFirefox password manager and I ended up
like we, we needed to recover a passwordand we like dug into it and found that it
was all just unencrypted on the system.
But I guess, it does, it makes senseif they don't prompt you to make a
master password, then it's just storedunencrypted on the system, which again, if
(52:18):
it's on your local computer that's fine.
I think we're in much more sophisticatedterritory nowadays where a lot of
windows computers and Mac computerslike do end to end encrypt things.
Or at least I think the windows computers,they enabled it in windows 10, I
think, but I'm not going to say everycomputer has the hardware for that, but.
The point is, could do that.
(52:39):
I know there are some servicesthat let you sync to the cloud.
I'm pretty sure Chrome will syncyour passwords to the cloud.
I haven't vetted this, code of that oranything, but my assumption is that it's
probably just going up into the cloud.
Like unless there, likeyour Google account is not.
Like when you log into Chrome,you're just logging in with your
(53:02):
like Gmail account, usually, ifyou use the browser profile thing.
And so that's not an endto end encrypted account.
Like you can just resetthe Google password.
So I don't imagine if you dosome kind of cloud sync that it's
like fully end to end encrypted.
That would be my assumption there.
But yeah, I agree with you.
I like not having it coupled ontothe browser, because you may want
to use that in a different context.
(53:22):
You might want to use yourpasswords in a browser.
You might need to use itfor desktop applications or.
You may want to use it ondifferent devices or whatever.
And so like just having it as likea standalone service is good too.
And I think there's also just somethinglike we were saying about the psychology
of taking over your own passwords.
There's something about the psychologyof being like, this is like my
(53:43):
super secret, encrypted fault.
And it's like separate fromthe other services I use.
It just makes you take it a littlebit more seriously and a little
bit more empowering, I think.
Jordan Bravo (53:53):
All right.
Our next boost is from M U T U M 8, I'mgoing to call him Mutum, or Mutum 8.
Stephen DeLorme (54:04):
Mutum 8.
Jordan Bravo (54:05):
Mutum 8, boosted in with 210 sats, and Mutum says, Topic suggestion,
how do I decentralize my domain name?
That is a great question I,Million dollar question yeah.
Based on previous discussionson this topic, that is, it
(54:26):
is a very difficult thing.
It's actually, it's tricky becauseDNS is inherently centralized,
the domain name system.
And so while there are some experimentalideas for how we could decentralize it.
There's it's really tough and it's goingto be a whole episode if we get into it.
(54:48):
I was, I say,
Stephen DeLorme (54:49):
that'd be a fun one to get into one episode.
Yeah.
Jordan Bravo (54:51):
Yeah.
So thank you for that topic suggestion.
That's a great topic.
We are going to coverthat in a future episode.
Stephen DeLorme (54:57):
Yeah.
And I think that would probably bea more experimental forward looking
future, future philosophy kind of stuff.
Cause as you pointed out, there's notlike an actionable way you can just like.
Completely decentralizeyour DNS right now.
It's all, it's a very experimentalspace, at least to my understanding.
But it's worth kind of thinking, it's
worth thinking about these things.
Jordan Bravo (55:18):
Yeah.
Yeah that's a great topic.
That's it for our boost.
Stephen DeLorme (55:23):
Oh, I will highlight one other person.
There's no boosts on here, but Isaw recently in the backend, the our
top supporter is now weird robot.
So congratulations, weird robot.
You're our top supporter.
Jordan Bravo (55:34):
Oh, yes.
So we, you can also supportthe show by streaming sats.
You don't have to boost in a message.
You can just.
Set your Fountain app or Podverseor any of the other podcasting 2.
0 apps.
You can just set it to streamsats while you're listening.
And so we want to thank ourstreamer Weird, and we appreciate
(55:55):
you streaming in those sats.
Stephen DeLorme (55:58):
Yep.
All right.
Jordan Bravo (56:01):
All right.
That's it for our show today.
Thanks again.
You can visit us at atlbitlab.
com slash podcast for videos, show notes.
Boosts and all of the other good stuff
Stephen DeLorme (56:13):
Catch you later
Jordan Bravo (56:14):
Thanks, and we'll see you next time
Stephen DeLorme (56:17):
Hey, thanks for listening.
I hope you enjoyed this episode.
If you want to learn more aboutanything that we discussed, you can
look for links in the show notesthat should be in your podcast
player, or you can go to atlbitlab.
com slash podcast.
On a final note, if you foundthis information useful and you
want to help support us, you canalways send us a tip in Bitcoin.
(56:38):
Your support really helps us so that wecan keep bringing you content like this.
All right.
Catch you later.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
On Purpose with Jay Shetty
I’m Jay Shetty host of On Purpose the worlds #1 Mental Health podcast and I’m so grateful you found us. I started this podcast 5 years ago to invite you into conversations and workshops that are designed to help make you happier, healthier and more healed. I believe that when you (yes you) feel seen, heard and understood you’re able to deal with relationship struggles, work challenges and life’s ups and downs with more ease and grace. I interview experts, celebrities, thought leaders and athletes so that we can grow our mindset, build better habits and uncover a side of them we’ve never seen before. New episodes every Monday and Friday. Your support means the world to me and I don’t take it for granted — click the follow button and leave a review to help us spread the love with On Purpose. I can’t wait for you to listen to your first or 500th episode!