Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do we know Signal or Telegram don't store our data on their servers?

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 241 posts

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#111

Post by godelski »

godelmachine wrote: post #103
geraltofrivia wrote: post #76

Earlier quoted context omitted.

I’ve been using Mullvad since the past few years and I’ve no complaints. The fact that the recent Mozilla VPN is based on Mullvad makes me more confident in my decision.

Did you consider NordVPN? I like the fact that I get to login from anywhere in the world. My default choice is Sweden since they have the most lax copyright laws in the world, so subpoenaing any Swedish server gonna be tough. They also offered me unavoidable discount.

> I like the fact that I get to login from anywhere in the world.

This is a fairly common practice and my understanding is that every major and most minor VPN services offer this.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#112

Post by godelmachine »

godelski wrote: post #111
godelmachine wrote: post #103

Earlier quoted context omitted.

Did you consider NordVPN? I like the fact that I get to login from anywhere in the world. My default choice is Sweden since they have the most lax copyright laws in the world, so subpoenaing any Swedish server gonna be tough. They also offered me unavoidable discount.

> I like the fact that I get to login from anywhere in the world. This is a fairly common practice and my understanding is that every major and most minor VPN services offer this.

I never knew. Is it available on PIA and Mullvad?

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#114

Post by godelmachine »

dewey wrote: post #107
godelmachine wrote: post #105

Earlier quoted context omitted.

That’s one point in favor of PIA. I chose NordVPN coz we can access from any server in the world and they have offered me good discount

Are you aware of the controversies around NordVPN? https://en.wikipedia.org/wiki/NordVPN#Security_issues_and_co...

Thanks for highlighting this.

I also read somewhere their CEO did something comprising to churn in more profits.

Maybe I will think about buying Mullvad subscription.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#115

Post by CarelessExpert »

rozab wrote: post #45
sjaak wrote: post #40

In the case of Signal, I imagine people assume all of the following: 1. the protocol between client and server is setup in such a way, even if Signal wanted to store interesting information, they could not access anything interesting even if they wanted to (for example, messages), thus they don't store anything since it's useless 2. the app implements the protocol faithfully and this has been checked by people perusi…

This might seem like a naive question, but how is it possible to verify that 3 is true? I get how it might be done in theory but real life is complicated. Has anyone attempted to do this?

> I get how it might be done in theory but real life is complicated. Has anyone attempted to do this?

This is mentioned elsewhere, but the answer is: reproducible builds.

You can take the Signal client source (which is available on Github), build an APK or whatnot yourself, then get the SHA256 hash or whatever and compare that to the artifact downloaded from the app store and validate that it's the same.

Has anyone done it? No idea!

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#117

Post by hunter2_ »

tptacek wrote: post #80
gfxgirl wrote: post #75

Earlier quoted context omitted.

I can't trust any company that has to read my contact list PERIOD! It's not something anyone should be having to share ever.

That's the point. They don't.

I don't want to speak for the parent commenter, but I think the concern is that the local app could be exfiltrating the contact list (and then by the exact same logic, message content as well) in some side channel unrelated to anything seen in the published source code, unless (a) the user builds the apk from published source code themselves, or (b) if there's some way to prove that the apk received via the Play Store is identical to one built from that source code.

Is (b) achievable by all users who have this concern?

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#118

Post by nwsm »

cs702 wrote: post #92
tptacek wrote: post #38

We don't know that Signal doesn't store data about users on its servers. Even the source code can't tell us that, because we don't run the servers. What we do know is that programs like Telegram have to store data about users on their servers, by design. A big difference between the two projects is that Signal is carefully designed to minimize the amount of data the service needs to operate; it's why identifiers are…

> We don't know that Signal doesn't store data about users on its servers. Even the source code can't tell us that, because we don't run the servers. Yes. Ultimately we have no choice but to trust trust itself.[a] That said, if the OP were a non-technical friend asking me the same question, I would respond more or less like this: "Of all the widely used messaging services, Signal is the only one known to be designed…

I've seen [a] on HN three times in the last week. Don't know if it's recency bias, Baader-Meinhof, a legitimate increase in common popularity/knowledge, or a sign of the times.

edit: after a quick algolia search, it has indeed been posted much more this year than years before.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#119

Post by saurik »

dante_dev wrote: post #39
2rsf wrote: post #11

Earlier quoted context omitted.

That is a somewhat misleading statement, you may know what's on your device but you don't know what is happening on the servers

Right! the keyword here is "Reproducible Builds". Basically once there is documentation about how to produce the release build, you can do it yourself and compare the resulting hash with the build distributed in the Store. Generally speaking it does no come for free, but once you find a way (e.g. for iOS compiling with a specific Xcode version in a specific OS with some adjusted config) is kind of doable (except that…

This has nothing to do with the comment you replied to, as you have no idea what software is running on their server, so what would it even mean to reproduce it in the first place? The correct answer is merely "the server never received much in the first place so it doesn't matter as much if they stored all of it".

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#120

Post by floreen »

rozab wrote: post #45
sjaak wrote: post #40

In the case of Signal, I imagine people assume all of the following: 1. the protocol between client and server is setup in such a way, even if Signal wanted to store interesting information, they could not access anything interesting even if they wanted to (for example, messages), thus they don't store anything since it's useless 2. the app implements the protocol faithfully and this has been checked by people perusi…

This might seem like a naive question, but how is it possible to verify that 3 is true? I get how it might be done in theory but real life is complicated. Has anyone attempted to do this?

Signal has reproducible builds for at least Android: https://github.com/signalapp/Signal-Android/tree/master/repr...

You compare the result you get compiling the app yourself with what you downloaded from the Play Store. For iOS this might be harder

Post reply on HN