• 0 Posts
  • 423 Comments
Joined 2 年前
cake
Cake day: 2023年7月14日

help-circle




  • OnlyOffice is available on Android already.

    “any linux app” - I don’t think any nontechnical users want GParted on their Android phones, and it wouldn’t work anyway.

    Android has its own games, same as iOS. Nontechnical users are way more likely to want Windows games than Linux games anyway.

    Wine used to be developed natively for Android but they stopped a few years back. You can still download it at winehq though. I think Box64 with wine is a decent option?

    Overall the thing I’m confused about is why you think Google or any major Android phone manufacturer have a motivation to make native Linux apps more accessible. Google certainly doesn’t want to make it easier for you to use the better versions of their competitors’ apps. Google is moving further away from Linux, not closer. Providing a usable, good enough desktop experience that’s still Android underneath makes far more sense for them.

    Fortunately, like I said earlier, there are workarounds to get access to those Linux apps.

    The thing that is more likely to change is for the creators of Android apps to build apps that function better when used in a phone-as-desktop format. And even if they don’t, there are enough competent web apps out there that just being able to use your browser full screen on a monitor solves 90% of people’s actual use cases - and probably over 95% when you include the other apps that have decent desktop experiences that can be run alongside them.

    The Steam Deck approach is much closer to what you seem to want. The Steam Deck is an actually competent Linux machine that has a Valve-supported compatibility layer in Proton for running non-Linux games. It plugs into a USB-C hub connected to a monitor, mouse, and keyboard just fine, can install any Linux app, etc… It’s completely usable handheld as well. But it isn’t a phone, and even though it’s quite portable, it’s not “stick into your pocket” portable.

    I don’t expect a major manufacturer to make a Linux phone any time soon, and I don’t think the Linux phones that are out already have - or will have in the next 5 years - a smooth enough experience to convince any nontechnical user to switch.



  • What are the gaps in functionality for nontechnical people? And “apps that exist on Linux but not Android” doesn’t count, because such people are unlikely to have ever even used a Linux desktop in the first place. The improvement that matters won’t be Linux apps; it’ll be Android apps that are more usable in desktop mode.

    That said, what are the issues with the apps that are currently available?

    If a user installed Chrome, an office suite (whether that be Google Docs, Sheets, and Slides, the Microsoft equivalent, or something else), an email client, and other commonly available apps, what tasks would they be unable to complete, if any?

    Are these, or other commonly used apps, substantially less usable than on desktop? If so, how so?











  • you’re the only one with your SSL keys. As part of authentication, you are identified. All the information about your device is transmitted. Then you stop identifying yourself in future messages, but your SSL keys tie your messages together. They are discarded once the message is decrypted by the server, so your messages should in theory be anonymised in the case of a leak to a third party. That seems to be what sealed sender is designed for, but it isn’t what I’m concerned about.

    Why do you think that Signal uses SSL client keys or that it transmits unique information about your device? Do you have a source for that or is it just an assumption?



  • And it’s I who should take a course in encryption and cybersecurity.

    Yes. I was trying to be nice, but you’re clearly completely ignorant and misinformed when it comes to information security. Given that you self described as a “cryptography nerd,” it’s honestly embarrassing.

    But since you’ve doubled down on being rude, just because I pointed out that you don’t know what you’re talking about, it’s unlikely you’ll ever learn enough about the topic to have a productive conversation, anyway.

    Have fun protecting your ignorance.


  • Nice try FBI.

    Wouldn’t “NSA” or “CIA” be more appropriate here?

    Well, if my pin is four numbers, that’ll make it so hard to crack. /s

    If you’re using a 4 number PIN then that’s on you. The blog post I shared covers that explicitly: “However, there’s a limit to how slow things can get without affecting legitimate client performance, and some user-chosen passwords may be so weak that no feasible amount of “key-stretching” will prevent brute force attacks” and later, “However, it would allow an attacker with access to the service to run an “offline” brute force attack. Users with a BIP39 passphrase (as above) would be safe against such a brute force, but even with an expensive KDF like Argon2, users who prefer a more memorable passphrase might not be, depending on the amount of money the attacker wants to spend on the attack.”

    If you can’t show hard evidence that everything is offline locally, no keys stored in the cloud, then it’s just not secure.

    If you can’t share a reputable source backing up that claim, along with a definition of what “secure” means, then your claim that “it’s just not secure” isn’t worth the bits taken to store the text in your comment.

    You haven’t even specified your threat model.

    BTW, “keys” when talking about encryption is the keys used to encrypt and decrypt,

    Are you being earnest here? First, even if we were just talking about encryption, the question of what’s being encrypted is relevant. Secondly, we weren’t just talking about encryption. Here’s your complete comment, for reference:

    I have read that it is self hostable (but I haven’t digged into it) but as it’s not a federating service so not better than other alternative out there.

    Also read that the keys are stored locally but also somehow stored in the cloud (??), which makes it all completely worthless if it is true.

    That said, the three letter agencies can probably get in any android/apple phones if they want to, like I’m not forgetting the oh so convenient “bug” heartbleed…

    Just so you know, “keys” are used for a number of purposes in Signal (and for software applications in general) and not all of those purposes involve encryption. Many keys are used for verification/authentication.

    Assuming you were being earnest: I recommend that you take some courses on encryption and cybersecurity, because you have some clear misconceptions. Specifically, I recommend that you start with Cryptography I (by Stanford, hosted on Coursera. See also Stanford’s page for the course, which contains a link to the free textbook). Its follow-up, Crypto II, isn’t available on Coursera, but I believe that this 8 hour long Youtube video contains several of the lectures from it. Alternatively, Berkeley’s Zero Knowledge Proofs course would be a good follow-up, and basically everything (excepting the quizzes) appears to be freely available online.

    it wouldn’t be very interesting to encrypt them, because now you have another set of keys you have to deal with.

    The link I shared with you has 6 keys (stretched_key, auth_key, c1, c2, master_key, and application_key) in a single code block. By encrypting the master key (used to derive application keys such as the one that encrypts social graph information) with a user-derived, stretched key, Signal can offer an optional feature: the ability to recover that encrypted information if their device is lost, stolen, wiped, etc., though of course message history is out of scope.

    Full disk encryption also uses multiple keys in a similar way. Take LUKS, for example. Your drive is encrypted with a master key. You derive the master key by decrypting one of the access keys using its corresponding pass phrase. (Source: section 4.3 in the LUKS1 On-Disk Format Specification (I don’t believe this basic behavior was changed in LUKS2).)