Oddbean

Creating a group on Session requires a server with a clearweb IP. It’s essentially just a website. Go to this link and you can literally read the conversation from our group chat: https://session.simplifiedprivacy.is/r/simplified/ All Session is doing is for group chats is piping that website into your client. On the other hand, the one-on-one chats go to a nodes. And so system we’re presenting here is completely separated from a physical location and the ability to take it down.

😳 I guess session groups chats are... completely unencrypted?! Yikes! Today is the first I've heard of Session. I read the technical explanation of their protocol and walked away thinking everything was e2ee. I saw references to onion routing, swarms, nodes, staking and some blockchain token thing. https://simplifiedprivacy.com/uncensored/ also mentions something that sounds like decentralized DNS, which was helpful, but I don't understand how all of it fits together. A network diagram and sequence diagrams for various use cases seems like the would be just perfect to explain the sysyem to people new to Session.

Open Groups are named open for a reason. Why would you encrypt it, to post after a link to it in the web, so ANYONE can decrypt it?! If you want to use encryption and you really have a reason for it (eg. closed activist group), use closed chats, which are E2EE.

I imagined an open group being like a public pub. When the cop walks in, the topic of conversation changes and the officer doesn't know what was said before she arrived. It's open to all, but there's no NSA-style collection so they can go back through time when they fimd a person of interest and find out all of the people they talked to. That's why I would want to encrypt it. To enforce the "you had to be there" aspect of conversations that people are accustomed to with in-person conversations.

Well, it's really easy to build a government bot, which just joins all new chats that are created, to passively collect all the info. And if the group is closed/«open not for everyone», then it's not an open, it's a closed group. So that's not really making the spying harder for a cop. But if you wish, you still can setup self-deleting messages (eg. deleting the sent in a day), you don't need an encryption for that