HN Explorer

Ask HN: Am I Being Paranoid?

24 points by supermatou ↗ HN
I've been using Signal for years; I like it, but some things made me frown (having to provide a phone number, server software becoming closed-source, thus non-auditable; integrated crypto and so on). I then discovered Session - and I liked the fact that they avoided having a single point-of-failure, by having many servers, in various geographical locations. Still... something bothers me with Session: the devs say that maintaing a server incurrs a non-trivial financial burden ($15,000/year), while claiming that all those servers are maintained by volunteers around the world; most of the servers are in First World countries (US, Germany), but, a couple of days ago, once I connected, one of the servers appeared to be in Ukraine. Seriously? Fifteen grand a year is not peanuts even for someone in the First World, let alone for someone residing in a country with a collapsing economy and battered by an active war.

What are your thoughts on this?

15 comments

[ 5.3 ms ] story [ 44.1 ms ] thread
[deleted]
(comment deleted)
lilsoso
That depends on whether or not your paranoia is warranted. If your communication is compromised, what's the cost?

Are you naive enough to think you're secure from the most sophisticated actors? Those with nearly unlimited funds? They run a lot of other 'nodes'. They're also involved in the development of many projects. They're involved in the infrastructure.

supermatou
> Are you naive enough to think you're secure from the most sophisticated actors?

Certainly not. Plus, I'm not in the habit of doing anything illegal. It's just something that bothers me in principle (c'mon, don't plunge head first into something that, uh, glows).

jeroenhd
I don't know where the $15k number comes from, but I imagine that number is more about the parent company (Oxen) which runs a blockchain system. Adding a new server to this system requires an amount of cryptocurrency (set to 15,000 $OXEN according to their docs, or about $2,706).

I don't know exactly how their infrastructure is designed, but the direct integration with any cryptocurrency tech is reason enough for me to be sceptical about it. If their integration was just for sending back and forth cryptocurrency then that's somewhat acceptable (i.e. Signal's approach, though I still don't like it myself) but with Session the blockchain is deeper ingrained.

As for server cost, I imagine hosting a server in a country where the power infrastructure is under attack from a foreign invader isn't exactly making life cheaper. I'd expect the price for electricity to skyrocket, especially for unimportant services like messaging servers.

Source: https://docs.oxen.io/products-built-on-oxen/session

pestatije
You already trusting "volunteer" servers, what difference does their location make? You should be paranoid with all of them or none.
supermatou
>what difference does their location make?

Well...

The first thing that made me go "hmm..." was the fact that the random servers I see whenever I connect are always in handful of countries (US, Germany, France). I would have expected something more geographically distributed, not just in Five Eyes+ countries (although one could retort that hoenypots are easier to install and maintain in low-cost countries, like the Philippines or Moldova)

The second thing, as stated, was the perceived discrepancy between the high cost (physical and emotional) of running a server in a country involved in a very distructive war.

So, as you can see, I'm - well, let's avoid "paranoid" - suspicious all over board.

Terretta
> suspicious all over board

If lucky, you'll figure it out before the $OXEN come home.

kavin1337
I'd say Oxen Service nodes are quite similar to Tor and its relays operate, it doesn't matter where the server is due to their onion routing.

I don't think you should be worried due to the onion routing.

Even Tor has a disproportionate amount of servers in a few countries in comparision to others: https://metrics.torproject.org/bubbles.html#country

cbluth
My real thoughts are, I want to suggest a different heading, not sure where you're headed, but something less vague like: - "Is Session Chat at risk?" - "Are we at risk for using Session Chat?" - "Session Chat servers are up in Ukraine?"

I dunno, I'm terrible at this

profstasiak
smoke some weed to fuel your paranoia and go back sending emails with encrypted messages
jacooper
Personally, I see matrix as the best private and mainstream-able chat protocol.
greggarious
Your main goal is avoiding ss7 stuff if identify rather than encryption is your concern maybe just change sims often?

(But unless your contacts do too you’ll still be spotted, so just turn on disappearing and blend in w the sexts and weed dealers imho.)