Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do we know Signal or Telegram don't store our data on their servers?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 241 posts

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#41

Post by shabda »

tptacek wrote: post #38

We don't know that Signal doesn't store data about users on its servers. Even the source code can't tell us that, because we don't run the servers. What we do know is that programs like Telegram have to store data about users on their servers, by design. A big difference between the two projects is that Signal is carefully designed to minimize the amount of data the service needs to operate; it's why identifiers are…

Signal has reproducible builds for Android. https://signal.org/blog/reproducible-android/

Does that help in any way to verify that they do not store data on their servers?

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#42

Post by argggg »

faitswulff wrote: post #22

Signal’s claim to fame here is that they were subpoenaed in 2016 and could only supply account creation and last connection times: > The American Civil Liberties Union announced Tuesday that Open Whisper Systems (OWS), the company behind popular encrypted messaging app Signal, was subpoenaed earlier this year by a federal grand jury in the Eastern District of Virginia to hand over a slew of information—"subscriber na…

This, more than anything, is why I trust them and recommend them to others.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#43

Post by fuzzylightbulb »

jolmg wrote: post #25
kitkat_new wrote: post #20

Earlier quoted context omitted.

not true with respect to meta data

which I don't think is as concerning, but is there a particular piece of metadata that concerns you?

https://www.sciencemag.org/news/2016/05/your-call-and-text-r...

Metadata can be as damning as the actual message data, and in a lot of places you don't want the authorities to know that you are even communicating at all.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#44

Post by [deleted] »

faitswulff wrote: post #22

Signal’s claim to fame here is that they were subpoenaed in 2016 and could only supply account creation and last connection times: > The American Civil Liberties Union announced Tuesday that Open Whisper Systems (OWS), the company behind popular encrypted messaging app Signal, was subpoenaed earlier this year by a federal grand jury in the Eastern District of Virginia to hand over a slew of information—"subscriber na…

[deleted]

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#45

Post by rozab »

sjaak wrote: post #40

In the case of Signal, I imagine people assume all of the following: 1. the protocol between client and server is setup in such a way, even if Signal wanted to store interesting information, they could not access anything interesting even if they wanted to (for example, messages), thus they don't store anything since it's useless 2. the app implements the protocol faithfully and this has been checked by people perusi…

This might seem like a naive question, but how is it possible to verify that 3 is true?

I get how it might be done in theory but real life is complicated. Has anyone attempted to do this?

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#46

Post by cassianoleal »

jolmg wrote: post #32
cassianoleal wrote: post #24

Earlier quoted context omitted.

Assuming you have: - read the source code and are satisfied that it's secure - compiled that version of the code - installed it on your mobile or desktop You're still only as secure as the client on the other side of the conversation. If that one is compromised (has not gone throught the steps above) it could very well be sending all messages in clear text to a malicious party. Edit: formatting

Ok, sure. But what do you propose? It's still a much better situation than what we have with Whatsapp. Is there something that the Signal Foundation could do to alleviate that concern you have? There's no technical solution in any technology for preventing the other side being compromised, as far as I can see.

At present I'm choosing to trust Signal.

That doesn't mean I blindly trust them, only that despite seeing potential for abuse I judge that they have more incentive to be telling the truth than not.

Also check the comment by user faitswulff where they mention how they have been subpoenaed "and could only supply account creation time and last connection time".

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#47

Post by [deleted] »

shabda wrote: post #41
tptacek wrote: post #38

We don't know that Signal doesn't store data about users on its servers. Even the source code can't tell us that, because we don't run the servers. What we do know is that programs like Telegram have to store data about users on their servers, by design. A big difference between the two projects is that Signal is carefully designed to minimize the amount of data the service needs to operate; it's why identifiers are…

Signal has reproducible builds for Android. https://signal.org/blog/reproducible-android/ Does that help in any way to verify that they do not store data on their servers?

[deleted]

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#48

Post by Enginerrrd »

cassianoleal wrote: post #24
jolmg wrote: post #15

Earlier quoted context omitted.

Because of public-key crypto, it doesn't matter if the servers are malicious.

Assuming you have: - read the source code and are satisfied that it's secure - compiled that version of the code - installed it on your mobile or desktop You're still only as secure as the client on the other side of the conversation. If that one is compromised (has not gone throught the steps above) it could very well be sending all messages in clear text to a malicious party. Edit: formatting

Yeah and since you have the possibility of dealing with state actors with deep pockets, you have to wonder if Android or iOS doesn't have the ability to copy your private keys and send those off somewhere for storage. Because of signal's popularity, it feels pretty possible to me.

If the NSA did have it backdoored somehow through the OS, it's a good bet they'd force LE agencies to use parallel construction to keep that information top secret.

That is why we really need open source hardware and OS's. A good (or even functional) open linux phone can't come fast enough.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#50

Post by helsinkiandrew »

dylkil wrote: post #6

Signal is open source, you and anyone else can inspect the code. You can then build it from source and install on your android directly avoiding the play store.

> You can then build it from source

To be secure you would HAVE to build and install it from source.

But then again your OS could possibly inject code to get the keys. Or a keystroke logger may have been installed.

Post reply on HN