Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do we know Signal or Telegram don't store our data on their servers?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 241 posts

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#91

Post by llimos »

majormajor wrote: post #78
llimos wrote: post #72

Earlier quoted context omitted.

In a way, yes, Telegram is even less secure than WhatsApp for this. The way I've been presenting it to people is that Telegram can look at more data than WhatsApp can. But WhatsApp will use the data they have more than Telegram will. That's the tradeoff. And yes, obviously Signal is more secure than both of them but I've been steering non-techies to Telegram because of usability, backups, cross-device history etc. As…

> The way I've been presenting it to people is that Telegram can look at more data than WhatsApp can. But WhatsApp will use the data they have more than Telegram will. That's the tradeoff. I think you should look at the odds of that "can" turning into a "will" over time. After an acquisition, or a change in business fortunes, or a change in leadership...

It's true, and it's part of the consideration. But the current mass emigration from WhatsApp seems to show that it's not as hard to jump platform as everyone thought it would be.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#92

Post by cs702 »

tptacek wrote: post #38

We don't know that Signal doesn't store data about users on its servers. Even the source code can't tell us that, because we don't run the servers. What we do know is that programs like Telegram have to store data about users on their servers, by design. A big difference between the two projects is that Signal is carefully designed to minimize the amount of data the service needs to operate; it's why identifiers are…

> We don't know that Signal doesn't store data about users on its servers. Even the source code can't tell us that, because we don't run the servers.

Yes. Ultimately we have no choice but to trust trust itself.[a] That said, if the OP were a non-technical friend asking me the same question, I would respond more or less like this:

"Of all the widely used messaging services, Signal is the only one known to be designed to minimize the amount of user data needed to operate, and all indications are that they are operating as designed[b], so Signal is likely your best choice today if privacy is your main concern."

[a] http://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thom...

[b] https://news.ycombinator.com/item?id=25764526

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#93

Post by dorchadas »

geraltofrivia wrote: post #76
dave_sullivan wrote: post #63

Earlier quoted context omitted.

What did you switch to?

I’ve been using Mullvad since the past few years and I’ve no complaints. The fact that the recent Mozilla VPN is based on Mullvad makes me more confident in my decision.

I switched from PIA to Mullvad too for that reason and have absolutely no complaints. Wish I had done them first!

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#94

Post by oneplane »

johnchristopher wrote: post #54

What prevents Google from replacing Signal on the Android Application store with their custom and backdoored version ? Can we check a hash or something ? Does the signal foundation do that on a regular basis ?

Nothing, because they can also just read it off of your phone and don't need to 'break' Signal.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#95

Post by chimeracoder »

Kuraj wrote: post #53
faitswulff wrote: post #22

Signal’s claim to fame here is that they were subpoenaed in 2016 and could only supply account creation and last connection times: > The American Civil Liberties Union announced Tuesday that Open Whisper Systems (OWS), the company behind popular encrypted messaging app Signal, was subpoenaed earlier this year by a federal grand jury in the Eastern District of Virginia to hand over a slew of information—"subscriber na…

Is it possible that they could in fact produce this data but were prevented from publicly saying so due to a gag order? I'm asking specifically because I remember Private Internet Access, a VPN provider, also being tested in court in the past [1], and because of this I've chosen to trust them despite them falling under Five Eyes jurisdiction. [1] https://torrentfreak.com/private-internet-access-no-logging-...

> Is it possible that they could in fact produce this data but were prevented from publicly saying so due to a gag order?

Unlikely. Signal and the ACLU were the ones who filed suit to allow them to disclose the terms of the warrant the first place.

It would be an incredibly expensive and risky move for them to do so if they knew that the judge could force them to reveal that they've been turning over more detailed user data in secret.

Not to mention that it would have amounted to perjury.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#96

Post by s_gourichon »

gfxgirl wrote: post #75
tptacek wrote: post #38

We don't know that Signal doesn't store data about users on its servers. Even the source code can't tell us that, because we don't run the servers. What we do know is that programs like Telegram have to store data about users on their servers, by design. A big difference between the two projects is that Signal is carefully designed to minimize the amount of data the service needs to operate; it's why identifiers are…

I can't trust any company that has to read my contact list PERIOD! It's not something anyone should be having to share ever.

Signal does not has to access to contacts. It does asks for contact access permission, to show in the app the names that you have set for your contacts. But you can just answer no and everything works.

On the contrary, if you answer the same to WhatsApp, it plain refuses to work. But it actually created an account on their servers, and from that on you appear on your contacts who do use WhatsApp as another user of WhatsApp, which invites them to write to you there although you cannot receive their messages. To fix this, you have to find the option in WhatsApp to delete your account.

Tally:

Signal 1 WhatsApp 0

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#97

Post by merlinscholz »

dave_sullivan wrote: post #63
sithadmin wrote: post #62

Earlier quoted context omitted.

PIA used to be my go-to, but I immediately ceased using PIA after the 2019 acquisition by Kape Technologies, which has a rather foul track record.

What did you switch to?

I can recommend protonVPN

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#98

Post by jwr »

faitswulff wrote: post #22

Signal’s claim to fame here is that they were subpoenaed in 2016 and could only supply account creation and last connection times: > The American Civil Liberties Union announced Tuesday that Open Whisper Systems (OWS), the company behind popular encrypted messaging app Signal, was subpoenaed earlier this year by a federal grand jury in the Eastern District of Virginia to hand over a slew of information—"subscriber na…

I think this discussion should also mention that Signal is a non-profit organization, dedicated to enabling secure and private communications.

Yes, it's not strong proof, but it should be taken into account when comparing the goals and motivations of organizations developing various other communicators.

The organization behind your communicator app could be in the business of gathering data about you and selling it in various forms (Facebook, Google), in the business of selling hardware and add-on software services (Apple), or in the non-business of trying to provide you with private communications.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#99

Post by chipsa »

henearkr wrote: post #65
sneak wrote: post #61

Earlier quoted context omitted.

The server can MITM the public keys, providing you with a key from the server instead of the key from your conversation partner. It very much does matter if the server is malicious.

Not if the keys are generated by the client. Signal also offers to label contacts for which you could verify the authenticity by another way. Doing a video call with the contact can be a simple way to clear doubts, even if it is not a proper different channel.

Video calls alone won't stop a MITM attack. They would just send both video streams along, and record both sides.

Signal does have the capability to have a verification phrase displayed, which is generated from the session key. Reading that off can make the video more difficult to MITM, because then they'd have to morph the audio to match the phrase, and if it's done after the video is setup, morph the video as well. Not impossible, but difficult.

Re: Ask HN: How do we know Signal or Telegram don't store our data on their servers?

#100

Post by danielrhodes »

dylkil wrote: post #6

Signal is open source, you and anyone else can inspect the code. You can then build it from source and install on your android directly avoiding the play store.

While this is a great way to build trust, there is obviously no way to confirm the App Store version is the same as one built from their public source. In fact, due to the way Apple optimizes apps for each device, this becomes even harder. Furthermore, just because you compile it from source and put it on your phone does not mean that you can reasonably stay aware of or understand all the internal workings that happen inside the app.
Post reply on HN