• 10 Posts
  • 13 Comments
Joined 3 years ago
cake
Cake day: February 19th, 2024

help-circle

  • It’s just forward secrecy, not “perfect forward secrecy”, unless you are writing Signal press material.

    https://en.wikipedia.org/wiki/Forward_secrecy

    I feel that such marketing can impart a false sense of security that has bitten Session users many a time. Ask Pete Hegseth, as much as I like to see him faceplant.

    Not relying on the central server largely removes the need for forward security, since you can get a similar result by creating a new account (with a new private key) on your device as often as you like. It is Signal’s reliance on a fixed identity that complicates the matter of rotating keys.

    In other words, Signal is not better because it has “perfect forward secrecy”. It is worse because it needs it.

    Even so, it is such a talking point that Session does intend to implement “perfect forward secrecy”.

    https://getsession.org/blog/session-protocol-v2

    As for “store all messages in a blockchain”, I believe that is the alternative to storing them on a central server, as Signal does. They have to be stored somewhere until you are online to receive them. If they weren’t, someone would be replying in your stead and complaining that Session does not allow users to receive messages sent while they were offline. Of course the messages are stored encrypted in both cases but only Signal associates them with your metadata.