Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do we know Signal or Telegram don't store our data on their servers?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 241 posts

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#51

Post by tdons »

rozab wrote: post #45
sjaak wrote: post #40

In the case of Signal, I imagine people assume all of the following: 1. the protocol between client and server is setup in such a way, even if Signal wanted to store interesting information, they could not access anything interesting even if they wanted to (for example, messages), thus they don't store anything since it's useless 2. the app implements the protocol faithfully and this has been checked by people perusi…

This might seem like a naive question, but how is it possible to verify that 3 is true? I get how it might be done in theory but real life is complicated. Has anyone attempted to do this?

I imagine it's non-trivial. I think it would involve (in case of iOS):

1. downloading the binary

2. jailbreaking the phone to extract the binary (pretty sure this is necessary on iOS)

3. check the version of the binary, then compile the original sources of the version

4. ??? compare the two binaries, this is likely the most difficult part, they won't be identical because of things like codesigning (and build flags, timestamps, ...)

I know noone that does this.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#52

Post by juniperplant »

7v3x3n3sem9vv wrote: post #33

It's important to note that Telegram does store all your data by default as they do not enable E2EE for everything like Signal does. So if you're under the assumption that they don't, this is incorrect. Telegram, for all intents and purposes, is about as secure as using Facebook. The best you can do with Telegram is hope they don't sell out or get compromised at some point in the future, because all your private comm…

> Everything is end-to-end encrypted by default, so you know nobody is collecting your data.

I think it's wise to remember that what happens on the other "end" is outside of your control.

If the other person in the conversation stores chat backups unencrypted you're still at risk, and there's not much you can do about it.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#53

Post by Kuraj »

faitswulff wrote: post #22

Signal’s claim to fame here is that they were subpoenaed in 2016 and could only supply account creation and last connection times: > The American Civil Liberties Union announced Tuesday that Open Whisper Systems (OWS), the company behind popular encrypted messaging app Signal, was subpoenaed earlier this year by a federal grand jury in the Eastern District of Virginia to hand over a slew of information—"subscriber na…

Is it possible that they could in fact produce this data but were prevented from publicly saying so due to a gag order?

I'm asking specifically because I remember Private Internet Access, a VPN provider, also being tested in court in the past [1], and because of this I've chosen to trust them despite them falling under Five Eyes jurisdiction.

[1] https://torrentfreak.com/private-internet-access-no-logging-...

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#55

Post by Yoric »

If you wish to be more certain, use something open-source. For instance, Matrix has many clients made by different teams, in the open, and several of these are part of e.g. Debian, so you should be able to find at least one you can trust.

What about Mozilla? What could they store?

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#57

Post by adsharma »

adsharma wrote: post #56

If this is a concern for you, consider using the signal protocol without a server. CLI prototype. Can be generalized into a nice phone app. https://github.com/adsharma/zre_raft https://twitter.com/arundsharma/status/1348718596415918080

Better quality video:

https://drive.google.com/file/d/1lmMgj76IpsX_YN4lNgqwKLexZDS...

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#58

Post by evanreichard »

shabda wrote: post #41
tptacek wrote: post #38

We don't know that Signal doesn't store data about users on its servers. Even the source code can't tell us that, because we don't run the servers. What we do know is that programs like Telegram have to store data about users on their servers, by design. A big difference between the two projects is that Signal is carefully designed to minimize the amount of data the service needs to operate; it's why identifiers are…

Signal has reproducible builds for Android. https://signal.org/blog/reproducible-android/ Does that help in any way to verify that they do not store data on their servers?

My understanding: If you verify the safety numbers in person, then I believe you can be confident that it's E2E encrypted for that conversation. If the safety numbers are different, then there could be a nefarious actor listening in.

Someone please correct me if I'm wrong.

Edit: That being said, I believe they could still record IPs, as well as the destination and timestamps of each message.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#59

Post by joshka »

idlewords wrote: post #35

One reason you can believe the claim is that there's no real market for personal data, despite the folk belief that everyone's data is somehow worth a fortune.

No real market is an easily disprovable claim. While not worth a fortune in the small, in bulk it's worth a imperial butt load. Attention is what you're able to sell. That's advertising and sales. E.g. do you think that those associated with others in right wing militia would be more or less sensitive to advertisements for gear for prepping? How big is that market?

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#60

Post by akvadrako »

tptacek wrote: post #38

We don't know that Signal doesn't store data about users on its servers. Even the source code can't tell us that, because we don't run the servers. What we do know is that programs like Telegram have to store data about users on their servers, by design. A big difference between the two projects is that Signal is carefully designed to minimize the amount of data the service needs to operate; it's why identifiers are…

We don't really know it, but there is some assurance the server is running the code they say it is because of Intel SGX.

https://signal.org/blog/private-contact-discovery/

Post reply on HN