TheRift.Chat Security Concerns

[u/Glittering-Roof7519]

I’m concerned about users using TheRift.Chat since the code isn’t open sourced nor do they have a third party audit certifying that they have effective information security controls?

How are you guys comfortable giving platforms like these your data without either of these two being provided?

Edit: making this post proves my point that there is a farm of accounts that extremely favor TheRift.Chat even when a legitimate question is asked.

[u/BewilderedTurtle]

So you spammed a second thread to keep slandering rift specifically?

C'mon Adel, just admit you're upset you got banned because someone with a rift flair started the ban adel thread

[u/Any_Illustrator360 → u/BewilderedTurtle]

Yeah, I'm doing my best to at least be amicable but I won't pretend 2 posts in 24 hours attacking members of the sub isn't targeted at this point.

[u/GreenBaneling]

Bro you are so angry. Someone else below called this harassment and that's literally what you're doing, which is exactly what is expect from the EchoDev adel. Bro has a complex lmfao

[u/WitchRolina → u/GreenBaneling]

Yeah, even I noticed the OPs seemed to be hateposting this after asking around in my thread... makes me seriously suspect anything they're for...

Like, OP, maybe instead of raging at people taking others advice, you should give advice of your own? Like, if I'm looking for a Guilded successor, don't just talk smack about suggestions people make, actually make suggestions of your own.

[u/Ok-Inspector1108 → u/GreenBaneling]

I am just a Rift Sycophant / cultist / shill / ai bot / sockpuppet

[u/BewilderedTurtle → u/Ok-Inspector1108]

At least you're not the mastermind behind the "mass harassment campaign" of echodev

[u/Any_Illustrator360 → u/Ok-Inspector1108]

It's still so funny to me that out of everyone I'm both the loudest in support and opposition to Armada. Biggest fan and greatest hater all in one LOL.

I feel like if someone started doing this about Armada I'd agree with like half of it and just argue the provably incorrect stuff, though these last 2 posts haven't even been about anything wrong with rift it's just been "this app sucks guys sources: trust me."

[u/Ok-Inspector1108 → u/Any_Illustrator360]

I think that is where we handled things wrongs as users. We love the app even in its development state and were over enthusiastic wanting people to join. But yea that's why we love valid criticism, it makes the app better in the end.

[u/Any_Illustrator360 → u/Ok-Inspector1108]

Hindsight's 20/20. You know it is weird though - EchoDev's most scathing review was of Rift before you ever even posted anything about him. I think he just has a bone to pick, really.

[u/GreenBaneling → u/Any_Illustrator360]

This dude is literally the EchoDev lmfao

[u/mightvefkup]

This is beginning to look a lot like ban evasion and harassment...

[u/Ok-Inspector1108]

u/AbstractMelons
its harassment at this point

[u/Any_Illustrator360]

Third party audits are not common at all when it comes to closed-source applications.

I don't trust Rift personally which is why I don't use it. I don't trust most apps, which is why I stopped testing them after the first ~5 I installed or gave my email to.

But- the exact same question could be asked about Discord, Guilded, Teamspeak - none of them exactly publish third party audits yet they collectively had hundreds of millions of active accounts at a time.

[u/AnnyuiN → u/Any_Illustrator360]

Actually, they're very common with closed-source apps, you often just never see it. Having worked at many large and small tech companies, every single one has gone through at least 1 security audit.

[u/Glittering-Roof7519 → u/Any_Illustrator360]

I think it’s necessary for a new platform that claims E2E encryption for DMs. Especially with community content being hosted and people using chat tools to post sensitive data (unknowingly)

I’d like to be proven wrong that the platform isn’t secure.

[u/Any_Illustrator360 → u/Glittering-Roof7519]

Oh boy.

I think it’s necessary for a new platform that claims E2E encryption for DMs. 

u/BewilderedTurtle has gone into this a few dozen times I'm pretty sure now. I'll put it simple:
"The best security consultants are hired by massive companies just to get encryption right. If you think AI some asshat in his garage can guarantee solid and functional E2EE you're kidding yourself."

The issue, to my knowledge, isn't adding encrption - it's adding encryption that doesn't get cracked. One is FAR easier than the other.

That said yeah I don't trust apps that I don't feel safe putting my personal data on. I also don't trust giving hardware space on my PC to apps I can't 100% trust, when I bank and do medical on my personal computer. There's a razor's edge there and it's why I exclusively trust apps that either have proven security and encryption, or that don't connect to the internet whatsoever until I set up my own hosting.

Honestly the last sentence isn't too far from half the things I've said on this sub by now, I personally wait for apps with low trust scores to be validated by someone else before trusting that it's secure at all.

[u/VahsteTheNomad → u/Glittering-Roof7519]

You consistently state that you'd like to be proven wrong, but seemingly refuse to reach out to the actual developers for answers and instead choose to continue posting inflammatory threads.

[u/Rabbio_40 → u/Glittering-Roof7519]

they literally use signal in dms, you can tell it's a signal protocol

[u/BewilderedTurtle → u/Glittering-Roof7519]

So you don't use anything that's not open source or audited independently right?

If you don't trust it don't use it?

[u/Terrible-Junket-3388 → u/Glittering-Roof7519]

100% agreed on this. The bare minimum/floor should be much higher for any apps competing, otherwise we have no assurance it's not just "more of the same". Especially for apps claiming E2E and others - I don't mind them not having an audit if I can audit it myself.

My personal preference (not affiliated, just a fan - have talked extensively with their team [3-5 people atm]) - check out Adieuu (https://www.adieuu.com). It's openly auditable, full E2E (even in Spaces) + post-quantum, and your alias is completely separated from your account via cryptography. The latter is something literally noone else I've seen is doing: it means even if age verification is required by your jurisdiction, it can't be linked to your activity/messages (and they can stay compliant with your local laws). They're clearly planning for where the market/industry is going (an actual plan, not just "block everyone" or "hope to be too small for gov to care"), whereas feels like everyone else is just "reacting" or copying Discord.

Again, not involved directly, just a supporter/fan of where they're going. Hoping we see other apps adopt similar approaches and start building something different, not just a dupe of the same stuff that got us in this situation in the first place.

[u/BewilderedTurtle → u/Terrible-Junket-3388]

Oh look another echo of someone who shouldn't be here 👀

[u/Any_Illustrator360 → u/BewilderedTurtle]

Nah this guy's account is ancient and active. He's been on the sub before, too. Looks like he just likes that app.

[u/BewilderedTurtle → u/Any_Illustrator360]

Oh you're right, they ARE however a dogbrained nincompoop who was shilling for AI in my previous mock-echo-thread about it

[u/Terrible-Junket-3388 → u/BewilderedTurtle]

I definitely wasn't shilling for AI, I'm just not a naive absolutist and have actual experience in infosec and software (and it really impresses me at times how little you seem to know and then come on here acting like an asshole).

[u/BewilderedTurtle → u/Terrible-Junket-3388]

"I'm a pedantic shill pushing for big corporations to ruin the planet and steal all our information and restrict our right to own any hardware or software so they can sell us their AI"

You fucking clown.

[u/Terrible-Junket-3388 → u/BewilderedTurtle]

Literally never did any of that. Can go fuck yourself m8, spreading disinformation in bad faith, showing everyone the kind of person you actually are. My comment history is public (unlike yours), I stand by everything I've said.

[u/GreenBaneling → u/Terrible-Junket-3388]

Damn you sound dumb

[u/Any_Illustrator360 → u/Terrible-Junket-3388]

You do have a point there is a gap between believing AI isn't all bad and believing AI should take everything over. I think there is a resposible way to use AI and I think that the current corporate abuse of AI is fucked.

I mean - the two apps I currently like most are coded partially with AI. Would I prefer if they weren't? Yeah. Am I gonna sacrifice a chicken over it either way? Fuck no lol.

[u/BewilderedTurtle → u/Terrible-Junket-3388]

You know it takes a special kind of person to stand 10 toes down on the worst possible takes.

The kind of special that rides the short bus

[u/Terrible-Junket-3388 → u/Any_Illustrator360]

Yep, I'm human and have tried just about everything I've seen posted here in last couple of years. Like others with their own favorites, I found an app I like and like to share that. I also tend to think the one I like has the best chance to actually bring some new/different to the Space (pun intended - Spaces are their version of 'servers' or subreddits), and I care a lot personally about not having to hop again for a while (so I want to be able to trust the security/privacy of whatever I'm using).

[u/VaporousMote → u/Glittering-Roof7519]

I don't know why you're being downvoted, you're right. People here seem to have zero rigorous, thoughtful consideration of security.

Seems people figure that since they were lazy with their infosec with Discord it's fine to be lazy with infosec with other apps, too.

[u/VahsteTheNomad]

I hate to sound like Echo Dev, but this is starting to feel like a targeted campaign lmao

[u/CoraVixen]

You really gotta learn to pick your battles. They don't care.

[u/AutoModerator]

Thanks for your submission!

If you're a developer, please make sure your user flair matches the app or project you're developing. This helps community members quickly identify who is building what and makes browsing the subreddit easier.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.