Live data from Hacker News

Signal for Android: RedPhone and TextSecure in one app

whispersystems.org

41–50 of 158 posts

Re: Signal for Android: RedPhone and TextSecure in one app

#41
post #22

https://www.reddit.com/r/netsec/comments/3rc9br/psa_signal_f... There seem to be concerns about the security of it.

Seems like the persistence for automatic VoIP authentication confirmation is currently disabled. Meaning you need to confirm our again each time. But have they confirmed this is in the release, not just in a development branch?

Re: Signal for Android: RedPhone and TextSecure in one app

#42
post #27

Earlier quoted context omitted.

A browser extension for Chrome/Chromium is being worked on! You can track it at https://github.com/WhisperSystems/TextSecure-Browser

Looking forward to it! Why is a browser extension needed in this case? Does not the browser expose a source of randomness that would be enough to write the rest of the crypto in JS and use that?

To prevent MITM against a web page.

Re: Signal for Android: RedPhone and TextSecure in one app

#43
post #39

I'm glad it's not called RedPhone for Android users, they may get it confused with YouRed I mean YouTubeRed I mean RedTube or whatever it's called now. In all seriousness though - what was (is) with the trend of apps with Red in the name? Red to me gives the idea of danger or something that's stopped / blocked.

There's a long history of calling a secure phone a red phone, like the connection between Moscow and Washington during the Cold War.

In the cheesy TV show from the 60s, Batman and the police commissioner had literal red phones that they used to talk to each other.

Re: Signal for Android: RedPhone and TextSecure in one app

#44
post #19

Earlier quoted context omitted.

A browser extension for Chrome/Chromium is being worked on! You can track it at https://github.com/WhisperSystems/TextSecure-Browser

That's excellent. Installing and using GPG (or GPGTools or GPG Keychain or whatever it's name is) on OS X is awful. Something that's still OSS and cares about UX (like Signal on iOS) would be fantastic.

OpenKeychain ported to computers, maybe?

Re: Signal for Android: RedPhone and TextSecure in one app

#45
post #28

Earlier quoted context omitted.

>Why isn't it a walled garden then? Because the client and server are both OSS? https://github.com/WhisperSystems/TextSecure https://github.com/WhisperSystems/TextSecure-Server

Can I download the the Signal client from any store and then point it to my own server instead of Whisper's? Did anybody try to run his own server? Can such setup really work?

You can run your own server, but there's no federation.

The reason for that I imagine is that they want a privacy preserving automatic lookup method (a single server can confirm phone numbers and allow privacy preserving contact list comparisons for its own clients), and aren't convinced of using a model where the public key is the identifier instead of your phone number.

Re: Signal for Android: RedPhone and TextSecure in one app

#48
post #39

I'm glad it's not called RedPhone for Android users, they may get it confused with YouRed I mean YouTubeRed I mean RedTube or whatever it's called now. In all seriousness though - what was (is) with the trend of apps with Red in the name? Red to me gives the idea of danger or something that's stopped / blocked.

There's a long history of calling a secure phone a red phone, like the connection between Moscow and Washington during the Cold War. In the cheesy TV show from the 60s, Batman and the police commissioner had literal red phones that they used to talk to each other.

Ah! That's quite interesting and now that you say it I of course remember seeing red phones in films in such situations. Thank you for taking he time to reply.
Post reply on HN