Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do we know Signal or Telegram don't store our data on their servers?

news.ycombinator.com

Post reply on HN
Print view View original

181–190 of 241 posts

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#181

Post by SulfurHexaFluri »

akvadrako wrote: post #60
tptacek wrote: post #38

We don't know that Signal doesn't store data about users on its servers. Even the source code can't tell us that, because we don't run the servers. What we do know is that programs like Telegram have to store data about users on their servers, by design. A big difference between the two projects is that Signal is carefully designed to minimize the amount of data the service needs to operate; it's why identifiers are…

We don't really know it, but there is some assurance the server is running the code they say it is because of Intel SGX. https://signal.org/blog/private-contact-discovery/

I just had a skim over the post and it seems to be saying that it allows them to process user data without the OS having access to it. This does nothing at all for letting me verify what is running on their server or that they are even using this SGX feature at all.

It protects signal from hackers or a malicious datacenter provider at best.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#182

Post by bigiain »

joshxyz wrote: post #108
7v3x3n3sem9vv wrote: post #33

It's important to note that Telegram does store all your data by default as they do not enable E2EE for everything like Signal does. So if you're under the assumption that they don't, this is incorrect. Telegram, for all intents and purposes, is about as secure as using Facebook. The best you can do with Telegram is hope they don't sell out or get compromised at some point in the future, because all your private comm…

What I don't get is people are trusting unverifiable builds of Signal, Telegram, WhatsApp, etc as "secure" on each of their E2EE implementations when that part of the binaries we install on our phones isn't even verifiable by code and compilable by ourselves. But what I do like about Telegram is their good user experience and Bot API developer experience. It's soooooooooo fucking good I'm telling you. It just works,…

FWIW, I personally trust the "unverifiable" Signal build I get from the app store more than I trust the OS my phone runs.

That's not true of Telegram/WhatsApp/etc...

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#183

Post by SulfurHexaFluri »

iamben wrote: post #36
hutzlibu wrote: post #23

Well in the case of Telegram, you can trust, that they store your data on their server, because they say so. And it is convenient, because you can just switch your smartphone and still access all your chathistory, without having to manually backup/restore. But Telegram in general does not have a business model yet, so just assume, that one day, they want(or have) to cash out. Signal on the other hand is a non-profit…

IIRC the business model was going to be the GRAM coin/TON network, which was P2P transactions, dropbox style storage etc.

I thought that got shut down by the US government for being a scam.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#184

Post by hanniabu »

jakub_g wrote: post #173
benhurmarcel wrote: post #141

Earlier quoted context omitted.

It will happen. So far Telegram has developed without consideration for revenue, but it cannot last too long. According to his own numbers [1], Durov's entire net worth [2] can only sustain Telegram for about a decade. [1] https://t.me/s/durov/142 [2] https://www.forbes.com/profile/pavel-durov/

Durov recently announced they will smart monetizing through ads, but only in "channels" of people with huge subscriber count (which generates a lot of costs). Channels are 1:N public broadcasts, a bit like Twitter.

That's how it all starts. And how will they know what ads to show you? By mining your conversations.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#185

Post by urvader »

TrueDuality wrote: post #157
evolve2k wrote: post #156

Earlier quoted context omitted.

Curious. Is there an easy way to validate the code running on my phone is exactly the same code available on Github (here: https://github.com/signalapp ) ?

I don't believe so directly, but you can build it yourself and put it on your phone. You'll still be able to use your account and their service.

Someone should file a PR with a git hash (and some form of proof) of the currently running app?

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#186

Post by bigiain »

paxys wrote: post #171
lavezzi wrote: post #169

Earlier quoted context omitted.

Why would he need to be extradited to the USA in order to be killed?

If the US government wanted to send a hit squad to Russia to take him out, the fact that he uses Signal instead of WhatsApp isn't what would be holding them back.

One could read into Snowden's tweet that he has sent/received messages using Signal that would with certainly have pushed the US government into wanting to send that hit squad.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#187

Post by dastx »

gfxgirl wrote: post #75
tptacek wrote: post #38

We don't know that Signal doesn't store data about users on its servers. Even the source code can't tell us that, because we don't run the servers. What we do know is that programs like Telegram have to store data about users on their servers, by design. A big difference between the two projects is that Signal is carefully designed to minimize the amount of data the service needs to operate; it's why identifiers are…

I can't trust any company that has to read my contact list PERIOD! It's not something anyone should be having to share ever.

Signal isn't a company. They're a non-profit. In addition, as others have mentioned, Signal works without giving them permissions to read your contacts.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#188

Post by smoser0 »

joshxyz wrote: post #108
7v3x3n3sem9vv wrote: post #33

It's important to note that Telegram does store all your data by default as they do not enable E2EE for everything like Signal does. So if you're under the assumption that they don't, this is incorrect. Telegram, for all intents and purposes, is about as secure as using Facebook. The best you can do with Telegram is hope they don't sell out or get compromised at some point in the future, because all your private comm…

What I don't get is people are trusting unverifiable builds of Signal, Telegram, WhatsApp, etc as "secure" on each of their E2EE implementations when that part of the binaries we install on our phones isn't even verifiable by code and compilable by ourselves. But what I do like about Telegram is their good user experience and Bot API developer experience. It's soooooooooo fucking good I'm telling you. It just works,…

Telegram reports to have reproducible builds for android and ios. More information at https://core.telegram.org/reproducible-builds

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#189

Post by bigiain »

fsflover wrote: post #129

If you don't want to trust anyone but to verify instead, consider running Matrix with your own server. In this case you still can talk to anyone else on Matrix, because it' federated.

I'm not familiar enough with Matrix, but I'm curious about how/if it can protect against malicious federated server operators? Does that just boil down to needing to trust they are not running modified code?

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#190

Post by bigiain »

CarelessExpert wrote: post #115
rozab wrote: post #45

Earlier quoted context omitted.

This might seem like a naive question, but how is it possible to verify that 3 is true? I get how it might be done in theory but real life is complicated. Has anyone attempted to do this?

> I get how it might be done in theory but real life is complicated. Has anyone attempted to do this? This is mentioned elsewhere, but the answer is: reproducible builds. You can take the Signal client source (which is available on Github), build an APK or whatnot yourself, then get the SHA256 hash or whatever and compare that to the artifact downloaded from the app store and validate that it's the same. Has anyone d…

The signatures on app store apks mean that doesn't work.

You can though, decompile both your version and the app store version and compare them that way.

Post reply on HN