[gary_0]

Didn't the early versions of Skype, which was coded by like 4 guys, do decentralized end-to-end encrypted messaging like 20 years ago? Before MS bought it and removed all the security at the behest of the government[0], I mean.

So two decades later, when we now have so many widely available open source libraries for networking and encryption, that job is somehow too hard for a well-funded organization like Bluesky? That's very sad.

[0] https://en.m.wikipedia.org/wiki/Skype_security#Eavesdropping...

[mjg59]

End to end encryption is not a hard problem from a cryptography perspective. It's a hard problem for key management (eg, how do you handle multiple devices?) and recovery (how do you handle someone losing their phone and wanting to recover their previous messages?). Twitter tried this and half-assed it, and Bluesky apparently want to do a better job.

[fragmede]

apparently they didn't.

[djur]

Not having done something yet doesn't mean you've failed to do it.

[fragmede]

releasing, missing a core feature, isn't a great example that you care about that core feature

[djur]

It's not a core feature for their current user base, apparently. I think they care about it more than their users do. They won't be able to implement it at all if they don't have any users.

[ziml77]

Doing it in a way that behaves the way people expect is what requires work. It's easy when both people are online at the same time. It becomes more difficult when you want to ensure asynchronous delivery and receipt and which supports people hopping between devices and not losing the conversation history. I can naively think of a way which would be to make them work identically to normal Bluesky posts except they're encrypted with a public-private keypair, but that would leak who is talking to who and how many DMs people are sending and receiving.

[theeandthy]

Curious if they could simply piggyback on the Signal source code. Lots of folks try to reinvent the wheel these days. Just like protocol buffers reinvented ASN.1 + PER and so-forth. Even the crypto folks at protocol labs opted for the former in place of an established standard.

[mjg59]

No. I wrote about this a couple of years ago (https://mjg59.dreamwidth.org/62598.html) and the answer is that while Signal solves the cryptography problem, the other hard problem (ie, everything to do with key management) is still up to whatever's on top of the Signal protocol.