Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do we know Signal or Telegram don't store our data on their servers?

news.ycombinator.com

Post reply on HN
Print view View original

161–170 of 241 posts

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#161

Post by andrepd »

juniperplant wrote: post #52
7v3x3n3sem9vv wrote: post #33

It's important to note that Telegram does store all your data by default as they do not enable E2EE for everything like Signal does. So if you're under the assumption that they don't, this is incorrect. Telegram, for all intents and purposes, is about as secure as using Facebook. The best you can do with Telegram is hope they don't sell out or get compromised at some point in the future, because all your private comm…

> Everything is end-to-end encrypted by default, so you know nobody is collecting your data. I think it's wise to remember that what happens on the other "end" is outside of your control. If the other person in the conversation stores chat backups unencrypted you're still at risk, and there's not much you can do about it.

The threat model assumes the other party is trusted. If not, in the limit they can film their screen and broadcast it to the internet, so there's nothing you can do about that.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#162

Post by tialaramex »

evolve2k wrote: post #156
TrueDuality wrote: post #134

Earlier quoted context omitted.

I prefer to look at the history of who founded and continues to run the Signal Foundation... Moxie Marlinspike. Moxie has a long history of improving security in all kinds of tech and fighting for privacy. The Signal app itself is opensource as well various pieces of the tech stack. You can audit yourself what is being sent and how their protocols work. The protocol itself has won awards due to its security and elega…

Curious. Is there an easy way to validate the code running on my phone is exactly the same code available on Github (here: https://github.com/signalapp ) ?

"Easy" is a moveable feast.

Your phone is running an APK, which is a bunch of signed code. You don't have the keys to sign such an APK yourself, but you can get tools that will tell you exactly what's inside the one you have.

I believe the Java source in GitHub is designed to be capable of a reproducible build, where you get the exact same Java binaries out as Signal's own builders did and thus you can compare that to confirm the Java code in your APK matches a specific Git checkout.

The media files (e.g. images, labels) are just straight binary copies so that's easy enough.

However there is native code to make stuff like video calls work, and when I last paid attention there was no reproducible build for that component. So you could imagine that somehow the native video call code is actually a secret backdoor or something.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#163

Post by restingrobot »

Mediterraneo10 wrote: post #154
faitswulff wrote: post #22

Signal’s claim to fame here is that they were subpoenaed in 2016 and could only supply account creation and last connection times: > The American Civil Liberties Union announced Tuesday that Open Whisper Systems (OWS), the company behind popular encrypted messaging app Signal, was subpoenaed earlier this year by a federal grand jury in the Eastern District of Virginia to hand over a slew of information—"subscriber na…

Signal may have only supplied that metadata at the time. But what I am concerned about is that if Signal is US-based, couldn’t the state demand Signal’s app signing key via a NSL, and couldn’t that signing key then be used for targeted attacks by which someone of interest gets a Signal app upgrade that is malicious (while everyone else gets the non-malicious app)? I admit to being somewhat unfamiliar with Android dis…

Technically they could get the signature key, but they can't force Signal to publish it via the store. Users would have to download an .apk file and install it directly. At that point there is no reason to have the signing key at all as the phone will recognize a sideload as a third party install. As far as I know, the government cannot compel a company to do something like update an app.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#164

Post by Mediterraneo10 »

restingrobot wrote: post #163
Mediterraneo10 wrote: post #154

Earlier quoted context omitted.

Signal may have only supplied that metadata at the time. But what I am concerned about is that if Signal is US-based, couldn’t the state demand Signal’s app signing key via a NSL, and couldn’t that signing key then be used for targeted attacks by which someone of interest gets a Signal app upgrade that is malicious (while everyone else gets the non-malicious app)? I admit to being somewhat unfamiliar with Android dis…

Technically they could get the signature key, but they can't force Signal to publish it via the store. Users would have to download an .apk file and install it directly. At that point there is no reason to have the signing key at all as the phone will recognize a sideload as a third party install. As far as I know, the government cannot compel a company to do something like update an app.

> but they can't force Signal to publish it via the store

Is there not a suspicion that Google, another US-based corporation, may have some agreement with American national security to supply malicious APKs to individual targets via the Play Store? Having Signal’s signing key would allow the state to present that custom-targeted APK as an ordinary Signal version update.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#165

Post by restingrobot »

aarchi wrote: post #125
danielrhodes wrote: post #100

Earlier quoted context omitted.

While this is a great way to build trust, there is obviously no way to confirm the App Store version is the same as one built from their public source. In fact, due to the way Apple optimizes apps for each device, this becomes even harder. Furthermore, just because you compile it from source and put it on your phone does not mean that you can reasonably stay aware of or understand all the internal workings that happe…

I know that developers can post LLVM bitcode to the App Store instead of a binary, which allows Apple to recompile it for architectural changes. I'd be surprised if Apple optimized per device. Creating separate builds with optimizations for different iPhone models would make more sense. Do you have more details on that?

I think he meant "iPhone models" when he said "devices". I'm not the op, but they definitely do optimize per model, not individual device.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#166

Post by paxys »

cschmidt wrote: post #146

While not directly about data storage, I loved this tweet [1] from Edward Snowdon this week: > do we really trust signal? cause i see zero reason to. Here's a reason: I use it every day and I'm not dead yet. [1] https://twitter.com/Snowden/status/1347217810368442368?s=20

That's a stupid reason. He's not dead (or at least imprisoned) yet because USA doesn't have an extradition treaty with Russia. What does a chat app have to do with it?

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#167

Post by mjg59 »

johnchristopher wrote: post #54

What prevents Google from replacing Signal on the Android Application store with their custom and backdoored version ? Can we check a hash or something ? Does the signal foundation do that on a regular basis ?

Signal is signed with a key that's held by Signal, not Google. Android won't install app updates unless they're signed with the same key as the currently installed version.

(I work at Google, but not on Android)

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#168

Post by restingrobot »

cassianoleal wrote: post #13
dylkil wrote: post #6

Signal is open source, you and anyone else can inspect the code. You can then build it from source and install on your android directly avoiding the play store.

As much as it is open source, there's no way to know for sure that the software running on their servers is the same that's published on Github.

The software on the server doesn't matter, as long as the encryption is solid on the device. That's the whole point, the devices handles all encryption/decryption so the server can't understand any of the data coming and going. The reason they don't store the data is because it would be pointless. The Github repos contain the device source code which, for most platforms, can be verified.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#169

Post by lavezzi »

paxys wrote: post #166
cschmidt wrote: post #146

While not directly about data storage, I loved this tweet [1] from Edward Snowdon this week: > do we really trust signal? cause i see zero reason to. Here's a reason: I use it every day and I'm not dead yet. [1] https://twitter.com/Snowden/status/1347217810368442368?s=20

That's a stupid reason. He's not dead (or at least imprisoned) yet because USA doesn't have an extradition treaty with Russia. What does a chat app have to do with it?

Why would he need to be extradited to the USA in order to be killed?

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#170

Post by restingrobot »

johnchristopher wrote: post #54

What prevents Google from replacing Signal on the Android Application store with their custom and backdoored version ? Can we check a hash or something ? Does the signal foundation do that on a regular basis ?

You can verify the installed version on Android with the Github repo version. Yes you can essentially check a hash.
Post reply on HN