Ask HN: How do we know Signal or Telegram don't store our data on their servers? • Hacker News Board

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#11

Post by 2rsf » Wed, Jan 13, 2021, 4:39 PM UTC

dylkil wrote: post #6

Signal is open source, you and anyone else can inspect the code. You can then build it from source and install on your android directly avoiding the play store.

That is a somewhat misleading statement, you may know what's on your device but you don't know what is happening on the servers

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#12

Post by theshrike79 » Wed, Jan 13, 2021, 4:39 PM UTC

chimeracoder wrote: post #2

> I'm just curious how we trust companies such as Signal, Telegram, Mozilla, that claim they don't store and sell our data? These are three very different companies with very different security processes and trust profiles. In the case of Signal: if you trust that the source code they distribute is the same as the app available in the Play Store, then it's pretty easy to verify that the messaging data is end-to-end e…

Telegram has reproducible client builds.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#13

Post by cassianoleal » Wed, Jan 13, 2021, 4:39 PM UTC

dylkil wrote: post #6

Signal is open source, you and anyone else can inspect the code. You can then build it from source and install on your android directly avoiding the play store.

As much as it is open source, there's no way to know for sure that the software running on their servers is the same that's published on Github.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#14

Post by dylkil » Wed, Jan 13, 2021, 4:40 PM UTC

2rsf wrote: post #11

dylkil wrote: post #6

Signal is open source, you and anyone else can inspect the code. You can then build it from source and install on your android directly avoiding the play store.

That is a somewhat misleading statement, you may know what's on your device but you don't know what is happening on the servers

Its end to end encrypted chat. They could store the encrypted messages sure. I think the biggest fear people should have with signal is the client side encryption.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#15

Post by jolmg » Wed, Jan 13, 2021, 4:41 PM UTC

2rsf wrote: post #11

dylkil wrote: post #6

Signal is open source, you and anyone else can inspect the code. You can then build it from source and install on your android directly avoiding the play store.

That is a somewhat misleading statement, you may know what's on your device but you don't know what is happening on the servers

Because of public-key crypto, it doesn't matter if the servers are malicious.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#16

Post by bzb6 » Wed, Jan 13, 2021, 4:41 PM UTC

Telegram stores your data by default in their servers. You have the option of removing single messages or conversations but there’s no way of knowing if they really do so. Also if you remove your account without removing your conversations first they stay there forever (others can see the messages)

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#17

Post by Akcium » Wed, Jan 13, 2021, 4:42 PM UTC

At first I wanted to write about client-side app verification, that we can prove that the apps we have and the open-source complied app would be the same.

Which does not prove that if the app sends your phone number or location (for example), they don't save it in database.

Indeed, interesting question

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#18

Post by pdevr » Wed, Jan 13, 2021, 4:42 PM UTC

As long as it is stored on the server and the transmission is encrypted, we will never know for sure. Especially in cases where the company "controls" the encryption and decryption.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#19

Post by dylkil » Wed, Jan 13, 2021, 4:43 PM UTC

kitkat_new wrote: post #8

dylkil wrote: post #6

Signal is open source, you and anyone else can inspect the code. You can then build it from source and install on your android directly avoiding the play store.

and how does this proof that they don't save what you send them?

what use are my encrypted messages to them?

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#20

Post by kitkat_new » Wed, Jan 13, 2021, 4:44 PM UTC

jolmg wrote: post #15

2rsf wrote: post #11

Earlier quoted context omitted.

That is a somewhat misleading statement, you may know what's on your device but you don't know what is happening on the servers

Because of public-key crypto, it doesn't matter if the servers are malicious.

not true with respect to meta data