1381
Perfectly cloning the Microsoft Teams experience (thelemmy.club)
submitted 1 day ago by to c/programmer_humor@programming.dev
126 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 7 points 17 hours ago* (14 children)

Most accurate description of Element I've ever heard to be honest. It's literally just Discord, with all of it's bloat, but with a protocol that wants to have "security" bolted on. And all of the security related dialogs have race conditions in them. Actually, not just in Element, all clients, even nheko and fluffychat, have race conditions in the fucking security dialogs. All of my devices are just unverified now, I just gave up.

XMPP at least functions reliably, if you ignore all of the protocol extensions and use it like IRC with images of course.
An artistic impression of a conversation on XMPP

Tox supermacy! Though the main and only good Android client got archived. But like, whatever. Fuck phones anyway.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 14 child comments
    •
  • [–] 5 points 11 hours ago (3 children)

    what security dialogs? and what race conditions? do you know what that means, or are you just throwing around words?

    if you mean the "verify your new device" dialog, yeah, it has a problem. it won't appear most of the time on clients that were not open when you sent the verification request from the new device. I don't know why, and this is not comfortable, but then I can start verification from a device I already have, and it will work. or I can also just fill in the password from my password manager, which you surely have too.

    but I haven't seen other problems with it recently.

    XMPP at least functions reliably, if you ignore all of the protocol extensions and use it like IRC with images of course.

    which does not even have a bolted on security that way.

    Though the main and only good Android client got archived.

    calling element classic good is a bit of a stretch. it was very slow.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 0 points 11 hours ago* (last edited 11 hours ago) (2 children)

    if you mean the "verify your new device" dialog

    That series of dialogs and pretty much everything else, including "verified devices" menu. Also, apart from race conditions it's often just desync. Like, right now for me, nheko and Element say everything is unverified but fluffychat says everything including itself is verified.

    Not Element Classic, I meant aTox (Tox for Android). It still functions, though.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 5 hours ago (1 child)

    Like, right now for me, nheko and Element say everything is unverified but fluffychat says everything including itself is verified.

    its not desynced, it is just not presented well. I think when it shows whether another device was verified, it actually does not show if you have completed verification of that device on your account, but instead whether that device is trusted by the current one (for purposes of sharing keys and whatever). in short, it's not "the user account trusts the device", but "this device trusts that device".

    when you verify device A with device B, they will mutually trust each other. if device B already trusted devices C and D, device A will immediately start trusting them too.
    if you then log in on device E and you don't verify it with any of the others, it will basically form a distinct "trust group".

    in your case it seems there are also cases when device A says it trusts B, but B says it does not trust A. how long ago did you verify your nheko, element and fluffychat devices? it looks like their verification could not complete, maybe one of them had a bug at the time or crashed before properly saving its database.

    both issues won't solve themselves automatically, you will have to verify the unverified device again. or if it does not work, report the problem with logs with the function in the app, on both sides.

    Not Element Classic, I meant aTox (Tox for Android). It still functicryptosystem

    I see. tox seems to be faring worse in security. in matrix, encryption is optional in the protocol, but it's built on well studied cryptosystem. so far when it fails, it's people not being able to read messages they should, not unexpected people being able to read messages. and that's because of flaws in key distribution.

    in tox, it seems encryption is mandatory, but they roll their own cryptosystem. and their cryptosystem has flaws that nonexperts commonly run into

    Jason Donenfeld, wireguard creator to expert:

    I think when your homebrewed crypto protocol falls to basic crypto 101 vulnerabilities that modern AKEs are explicitly designed to prevent, it's time to pin up the red banners telling people not to use your stuff.

    https://github.com/TokTok/c-toxcore/issues/426

    downvote was not me.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 3 hours ago

    {verification}

    Ah, verification and trust are separate. Cool.

    Well, it was like 2 years ago? I had a different Element session than now (new one now for testing), nheko and fluffychat, and I pressed every possible button and nothing happened. When I open nheko, a dialog box says "Activate encryption"; "to make this device trusted {blah blah blah}" with a big "Verify" button. Pressing it does the same as closing the dialog, so a whole lot of nothing. Same right now. I did try logging out and back in on different devices, back then only though.

    in tox, it seems encryption is mandatory

    Because that's how it's routed, yes. Peer to peer with fewer points of centralization (still there for node discovery and TCP<>UDP tunnels and shit). The message encryption and the transport encryption are the same.

    https://github.com/TokTok/c-toxcore/issues/426
    Let's say that Mallory, M, has stolen A's private key

    I stopped reading there. I mean, good thing to know that it's possible (especially for potential punks using it and whatnot), but I feel like opsec is fucked regardless in this case.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 14 hours ago* (1 child)

    Tox did their own insecure crypto and got roasted by the Wireguard dev, now they are apparently rewriting it.

    I agree that Matrix is complex but personally never had issues with key verification. Just try to restart it, maybe on the other device?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] -1 points 11 hours ago*

    Tox did their own insecure crypto and got roasted by the Wireguard dev

    Everyone does crypto in their own way and roasts each other. On a quantum physical mathematical psychological level unidentified flying object Yugoslavia UFO something something. I only really believe stuff in relation to exploits when there's a demo.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 12 hours ago

    Yeah I gave up on Element/Matrix too, for other reasons.

    First of all the clients don't work for shit and every update breaks something IME, got tired of that. Also for all of my normie friends and family it was "too hard" to use, I disagree, but regardless what good is a chat app if I have nobody to use it with? Further, the one friend I did convince to join also joined the public Ras Pi room, and some dickhead posted CP in it, he saw, and then I had to explain "no, this isn't a 'pedo app,' that is spam and they get banned," and I'm gonna be real I don't want to have to do that again and I can't in good faith recommend my mother use a goddamn app that very possibly could spam her with CP.

    So, I moved to Delta Chat. Fixes all those problems, no complaints. Easy to use, easy onboarding, no discoverability, just chats.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 16 hours ago (4 children)

    Yeah but XMPP sounds so techy you know... /s

    I bet that if someone scraped together the bare minimum and found a catchy name it'd be the winner easily.

    Et-tu-Brutus would slay IMO.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 11 hours ago

    Yeah but XMPP sounds so techy you know... /s

    the trick is to not mention XMPP to the end users. if they dig deep in the app settings they can find it out, but otherwise all that end users need to know is just, download the app named conversations, and use this domain and username. the domain could likely be hidden from them by deep linking, and sending the link in a company email. then they just need to log in as anywhere else.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 15 hours ago* (1 child)

    https://astrachat.com/ paid XMPP. It claims the US army, apart from a few other government entities around the world, use it. I find this funny because this implies someone integrated Grok into XMPP.

    Also, the old name for XMPP is Jabber. That sounds less techy, you know.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 0 points 12 hours ago* (1 child)

    element is much lighter weight, my god wgat fuck are you even dreaming up about, discord is fucking unresponsive and horrible to use, I do agree that the device verificstion still barely works sometimes, and you can also just use a different a client, as far as web clients go cinny is really good honestly, cinny is fast and responsive it even feels almost native, which compared to garbagecord is a night and day difference in usability beyond DOING ALL OF THIS WHILE USING LESS RESOURCES, for android Schildichat Next is my choice

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 12 hours ago* (last edited 11 hours ago)

    element is much lighter weight

    Here, the webapps are measured via the very scientific method of Firefox about:processes, doesn't even account Firefox itself which is like 760 megs (decimal MB or MiB? I am not sure) if I were to believe it.

    On amd64, loonix with glibc and all that crap, zero memory pressure (assuming I am reading "shared" correctly in htop which I assume to be libraries like glibc and glib):

    • Discord: starts at 800 megs, garbage collects down to 704 to 710-ish (overburned CD size?); turning on/off equicord doesn't affect it much
    • Element: 367 mystery units after clicking around for a while, 341 unfocused
    • Nheko: 362 MiB, 201MiB shared (probably with Firefox, can't close cuz I am typing here rn)
    • Dino: 334MiB, 116 shared (probably with Firefox)
    • Mumble (random server with a long text greeting and nobody in voice): 169MiB, 130MiB shared.
    • random forum with a bunch of emotes and table decorations (for comparison sake): 69 meters (NICE)
    • qwebirc (1 server): 61 megs
    • Weechat (6 servers): 65392 bytes, out of which 33396 shared (with system daemons I am guessing).
    • Toxic: 44648 bytes, out of which 0 are shared. Plus ~90000 for Alacritty (65160 shared when multiple).

    lmao

  • permalink
  • fedilink
  • source
  • parent