Earlier quoted context omitted.
and how does this proof that they don't save what you send them?
what use are my encrypted messages to them?
1) Meta data
2) Decrypt in case of security breach or more advanced computing
Ask HN: How do we know Signal or Telegram don't store our data on their servers?
31–40 of 241 posts
Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?
#32Earlier quoted context omitted.
Because of public-key crypto, it doesn't matter if the servers are malicious.
Assuming you have: - read the source code and are satisfied that it's secure - compiled that version of the code - installed it on your mobile or desktop You're still only as secure as the client on the other side of the conversation. If that one is compromised (has not gone throught the steps above) it could very well be sending all messages in clear text to a malicious party. Edit: formatting
Ok, sure. But what do you propose? It's still a much better situation than what we have with Whatsapp. Is there something that the Signal Foundation could do to alleviate that concern you have? There's no technical solution in any technology for preventing the other side being compromised, as far as I can see.
Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?
#33It's important to note that Telegram does store all your data by default as they do not enable E2EE for everything like Signal does. So if you're under the assumption that they don't, this is incorrect.
Telegram, for all intents and purposes, is about as secure as using Facebook. The best you can do with Telegram is hope they don't sell out or get compromised at some point in the future, because all your private communications are stored on their servers forever. Telegram does have "secret chats", which from what I can gather, don't even work for group chats, only one-to-one messages.
My general advice is to treat Telegram like a new Facebook if you have to use it, assume everything may by read by everyone, don't treat it like it's private and secure.
For "text messaging" friends and family use Signal. Everything is end-to-end encrypted by default, so you know nobody is collecting your data.
Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?
#34Earlier quoted context omitted.
not true with respect to meta data
which I don't think is as concerning, but is there a particular piece of metadata that concerns you?
I do think it is a valid concern. Over the years, various sources reported that intelligence agencies mostly use metadata (who's talking to whom, i.e. the social network) in their analysis because message content is harder to parse and understand (and, outside of email traffic, harder to obtain in the first place).
Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?
#35One reason you can believe the claim is that there's no real market for personal data, despite the folk belief that everyone's data is somehow worth a fortune.
Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?
#36Well in the case of Telegram, you can trust, that they store your data on their server, because they say so. And it is convenient, because you can just switch your smartphone and still access all your chathistory, without having to manually backup/restore. But Telegram in general does not have a business model yet, so just assume, that one day, they want(or have) to cash out. Signal on the other hand is a non-profit…
IIRC the business model was going to be the GRAM coin/TON network, which was P2P transactions, dropbox style storage etc.
Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?
#37One reason you can believe the claim is that there's no real market for personal data, despite the folk belief that everyone's data is somehow worth a fortune.
Not everyone's personal data is worth a fortune. Specific persons of interest, however, their personal data IS worth a fortune.
Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?
#38We don't know that Signal doesn't store data about users on its servers. Even the source code can't tell us that, because we don't run the servers.
What we do know is that programs like Telegram have to store data about users on their servers, by design. A big difference between the two projects is that Signal is carefully designed to minimize the amount of data the service needs to operate; it's why identifiers are phone numbers --- so it can piggyback on your already-existing contact lists, which are kept on your phone.
By contrast, other services store, in effect, a durable list of every person you communicate with, usually indexed in a plaintext database.
Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?
#39Signal is open source, you and anyone else can inspect the code. You can then build it from source and install on your android directly avoiding the play store.
That is a somewhat misleading statement, you may know what's on your device but you don't know what is happening on the servers
Right! the keyword here is "Reproducible Builds". Basically once there is documentation about how to produce the release build, you can do it yourself and compare the resulting hash with the build distributed in the Store.
Generally speaking it does no come for free, but once you find a way (e.g. for iOS compiling with a specific Xcode version in a specific OS with some adjusted config) is kind of doable (except that Apple encrypts your build server side for DRM purposes, so you'll need a jailbroken phone to do something about it)
For Signal there is an open issue here for iOS [1] and some documentation for Android [2]
Some nice work about it has already be done by telegram https://core.telegram.org/reproducible-builds
[1] https://github.com/signalapp/Signal-iOS/issues/641
[2] https://github.com/signalapp/Signal-Android/blob/fab24bcd1e5...
Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?
#40In the case of Signal, I imagine people assume all of the following:
1. the protocol between client and server is setup in such a way, even if Signal wanted to store interesting information, they could not access anything interesting even if they wanted to (for example, messages), thus they don't store anything since it's useless
2. the app implements the protocol faithfully and this has been checked by people perusing the source code
3. the binary downloaded from the app/play store phone is compiled from the sources listed on github