The session developers are interesting. But I don’t recommend anybody use session.
They took the signal protocol, and removed perfect forward secrecy because they found it hard to implement.
That’s crazy.
Also all of the file transfers on session go through servers in Canada. Centralized.
I give them kudos for trying to make the network self-sustainable through their crypto thing, but they never found a way to actually monetize it, there’s no paper use, it feels like the idea is kind of dead in the water at this point. I would not recommend session for any serious non-experimental usage
Nope. Whenever anybody ask them, they refer to this and close the ticket
I find their technical rationale, while welcome, a lot of hand waving to say they couldn’t figure out how to implement it, but it was not important because it’s not a big threat, because if somebody has the device they can get all the messages on the device anyway…
Losing perfect forward secrecy for “simpler code” is a strong design choice they made. I respect them for documenting this, I wish them the best of success, but that’s not a trade-off I’m willing to make for no benefit
Fair enough. They did not explicitly say they removed it for complexity.
The facts are: they started with a protocol that had perfect forward secrecy, and they removed it, but not for philosophical reasons.
They were not opposed to perfect forward secrecy
In today’s ecosystem there are products that use onion networks and provide perfect for secrecy like simple x, and briar over tor…
You’re welcome to make any decision you like, if you want to use session go right ahead. I’m not going to stop you, and I’m happy you’re doing so. We’re all better for choice
The session developers are interesting. But I don’t recommend anybody use session.
They took the signal protocol, and removed perfect forward secrecy because they found it hard to implement.
That’s crazy.
Also all of the file transfers on session go through servers in Canada. Centralized.
I give them kudos for trying to make the network self-sustainable through their crypto thing, but they never found a way to actually monetize it, there’s no paper use, it feels like the idea is kind of dead in the water at this point. I would not recommend session for any serious non-experimental usage
Is there a feature request to add PFS again?
https://getsession.org/session-protocol-technical-information
Nope. Whenever anybody ask them, they refer to this and close the ticket
I find their technical rationale, while welcome, a lot of hand waving to say they couldn’t figure out how to implement it, but it was not important because it’s not a big threat, because if somebody has the device they can get all the messages on the device anyway…
Losing perfect forward secrecy for “simpler code” is a strong design choice they made. I respect them for documenting this, I wish them the best of success, but that’s not a trade-off I’m willing to make for no benefit
deleted by creator
It’s not a lie. I have read their post. And my interpretation reading between the lines is they dropped it because of complexity
deleted by creator
Fair enough. They did not explicitly say they removed it for complexity.
The facts are: they started with a protocol that had perfect forward secrecy, and they removed it, but not for philosophical reasons.
They were not opposed to perfect forward secrecy
In today’s ecosystem there are products that use onion networks and provide perfect for secrecy like simple x, and briar over tor…
You’re welcome to make any decision you like, if you want to use session go right ahead. I’m not going to stop you, and I’m happy you’re doing so. We’re all better for choice