Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal for Android: RedPhone and TextSecure in one app

whispersystems.org

Post reply on HN
Print view View original

71–80 of 158 posts

Re: Signal for Android: RedPhone and TextSecure in one app

#71

Post by darklajid »

IshKebab wrote: post #64
Tepix wrote: post #55

Signal is pretty awesome, it's by far the best that we have right now: • state of the art crypto • open source • free as in beer • Available for Android and iOS There are a few minor features that are missing but I can live with that. However, there are also a couple of important shortcomings: • no decentralization • use of the phone number I hope they can be fixed sooner or later.

But the centralisation and use of the phone number is necessary to make it not shit. Anyway you forgot the important features: * Nice modern UI * Integrates with SMS * Supports group chats * Uses MMS for group chat if not all members have Signal * Not really buggy or hard to use

I disagree that a phone number is required. You don't have one here, nor on Facebook should you use that. Identity doesn't need to be tied to a phone number and arguably .. shouldn't be.

How is centrali[zs]ation important? Mail works transparently and you don't know a thing about the stack behind a random address, right?

I'd side with the GP: The 'one server, ours' and 'your phone number is your identity' limitations are what I'd like to see go away. Prioritizing the 'no phone number' over 'hosting my own server', as far as I'm concerned.

Re: Signal for Android: RedPhone and TextSecure in one app

#72

Post by xenophonf »

iheartmemcache wrote: post #20
deckiedan wrote: post #14

One of the reasons I didn't install WhatsApp is the sheer quantity of permissions it wants (on Android). Yes, I realise that this is part of Android's broken security model. But the Signal app also wants access to practically everything. Device & App History, Identity, Calendar, Contact, Location, SMS, Phone, Photos/Media/Files, Camera, Microphone, WiFi Connection info and Device ID and call info. Call me paranoid, b…

I'm not associated with Signal or Moxie (though I've been a silent fanboy for ~15 years-- [[hey Moxie if you're reading this and still are hiring, ping me - contact info is in my profile]]), but I'd inherently trust the application more than an average application or company because: a) Moxie has a track history of having a lot of personal integrity with regards to security. Some might say this is blasphemous but I'd…

  compile the APK and see if it matches
Are deterministic builds possible with the Android toolchain?

Re: Signal for Android: RedPhone and TextSecure in one app

#73

Post by rogeryu »

deckiedan wrote: post #14

One of the reasons I didn't install WhatsApp is the sheer quantity of permissions it wants (on Android). Yes, I realise that this is part of Android's broken security model. But the Signal app also wants access to practically everything. Device & App History, Identity, Calendar, Contact, Location, SMS, Phone, Photos/Media/Files, Camera, Microphone, WiFi Connection info and Device ID and call info. Call me paranoid, b…

I just installed Signal, and the list of permissions is endless!

Re: Signal for Android: RedPhone and TextSecure in one app

#74

Post by ikurei »

iheartmemcache wrote: post #20
deckiedan wrote: post #14

One of the reasons I didn't install WhatsApp is the sheer quantity of permissions it wants (on Android). Yes, I realise that this is part of Android's broken security model. But the Signal app also wants access to practically everything. Device & App History, Identity, Calendar, Contact, Location, SMS, Phone, Photos/Media/Files, Camera, Microphone, WiFi Connection info and Device ID and call info. Call me paranoid, b…

I'm not associated with Signal or Moxie (though I've been a silent fanboy for ~15 years-- [[hey Moxie if you're reading this and still are hiring, ping me - contact info is in my profile]]), but I'd inherently trust the application more than an average application or company because: a) Moxie has a track history of having a lot of personal integrity with regards to security. Some might say this is blasphemous but I'd…

> I'd be willing to bet that Google is collecting way more information than Signal is.

I don't understand this sentences. It's quite obvious that Google is collecting way more information than Signal and almost anyone else. I'm curious, what did you mean?

Re: Signal for Android: RedPhone and TextSecure in one app

#75

Post by venomsnake »

biokoda wrote: post #68
venomsnake wrote: post #57

Earlier quoted context omitted.

PrivateWave claim they have.

No they don't. It's not mentioned anywhere on their website.

Who am I to argue. You could use a standard modem software to create a data channel over voice.

https://web.archive.org/web/20150303132755/http://www.privat...

ZRTP/S

ZRTP/S is an extension to ZRTP protocol. It is designed to make ZRTP-secured calls work across Circuit Switched communication channels such as the traditional telephony networks (GSM, CDMA, PSTN, ISDN, etc) where internet protocol is not available.

On these telecommunication technologies peers can have a sort of “serial connection” through which they send and receive raw digital data.

The communication channel is so narrowband (9.6kbit/s) that it is not possible to run IP (internet protocol over IP) over it.

So, PrivateWave and Philip Zimmermann jointly designed and implemented ZRTP/S. It is a transport and security protocol for Voice over Circuit Switched channel, carefully adapted to be extremely narrowband and minimalistic.

After a year of researching and development, PrivateWave created a library, libzrtps. The library allowed PrivateWave to release the 1st version of PrivateGSM product - PrivateGSM CSD. It allows users to communicate securely in a point-to-point fashion with the ZRTP end-to-end encryption protocol and with a bandwidth as small as 5400bit/s.

Full specification of ZRTP/S and Source Code will be soon published. Anyone willing to create his own project, improve and eventually establish interoperability between Circuit Switched secure telephony (ZRTP/S over GSM) and Packet Switch secure telephony (ZRTP over IP) can benefit from the publications.

Interoperability represents one of the design goals of the ZRTP/S protocol.

Re: Signal for Android: RedPhone and TextSecure in one app

#76

Post by vox_mollis »

IshKebab wrote: post #64
Tepix wrote: post #55

Signal is pretty awesome, it's by far the best that we have right now: • state of the art crypto • open source • free as in beer • Available for Android and iOS There are a few minor features that are missing but I can live with that. However, there are also a couple of important shortcomings: • no decentralization • use of the phone number I hope they can be fixed sooner or later.

But the centralisation and use of the phone number is necessary to make it not shit. Anyway you forgot the important features: * Nice modern UI * Integrates with SMS * Supports group chats * Uses MMS for group chat if not all members have Signal * Not really buggy or hard to use

Huge respect for Moxie, but the requirement of a phone number really is a dealkiller.

  1. Phone number requires a service provider
  2. Service provider owns the baseband and root of your phone.
  3. $government makes a "lawful request" of Verizon et. al.
     to install keyloggers/screenshotters on your phone.
  4. Your "secure" commms are compromised.
Signal needs to work on comprehensively rooted devices connected only via wifi for the above threat model to go away.

Re: Signal for Android: RedPhone and TextSecure in one app

#77

Post by Spakman »

Tepix wrote: post #55

Signal is pretty awesome, it's by far the best that we have right now: • state of the art crypto • open source • free as in beer • Available for Android and iOS There are a few minor features that are missing but I can live with that. However, there are also a couple of important shortcomings: • no decentralization • use of the phone number I hope they can be fixed sooner or later.

They do plan to use other identifiers than the phone number but I don't know how high a priority it is. My knowledge about this is probably a year old.

Re: Signal for Android: RedPhone and TextSecure in one app

#78

Post by ionised »

suenamy wrote: post #11
sasvari wrote: post #8

Earlier quoted context omitted.

it does require to have the google play services installed in the first place. so for those who i.e. run cyanogenmod without the google play services installed, it's unfortunately not possible to use Signal/TextSecure.

microg's GmsCore (an unprivileged open source reimplementation of Google Play Services) can do Google Cloud Messaging and should work for Signal.

This looks interesting.

Thanks!

Re: Signal for Android: RedPhone and TextSecure in one app

#79

Post by moxie »

vox_mollis wrote: post #76
IshKebab wrote: post #64

Earlier quoted context omitted.

But the centralisation and use of the phone number is necessary to make it not shit. Anyway you forgot the important features: * Nice modern UI * Integrates with SMS * Supports group chats * Uses MMS for group chat if not all members have Signal * Not really buggy or hard to use

Huge respect for Moxie, but the requirement of a phone number really is a dealkiller. 1. Phone number requires a service provider 2. Service provider owns the baseband and root of your phone. 3. $government makes a "lawful request" of Verizon et. al. to install keyloggers/screenshotters on your phone. 4. Your "secure" commms are compromised. Signal needs to work on comprehensively rooted devices connected only via wi…

If we were going to rank our priorities, they would be in this order:

1) Make mass surveillance impossible. 2) Stop targeted attacks against crypto nerds.

It's not that we don't find #2 laudable, but optimizing for #1 takes precedence when we're making decisions. It's totally possible for you to install Signal on an iPod touch with a VoIP number, for instance, but that takes more effort than the common case we're designing for.

Re: Signal for Android: RedPhone and TextSecure in one app

#80

Post by moxie »

corney91 wrote: post #2

I really want to start using TextSecure (or Signal now I guess), but the only thing holding me back is it depends on Google Play Services. I love what they're doing and can understand the decision, but still thinks it sucks a bit that the best option for secure communications is so tied into Google.

It seems like you don't want to install Google Play Services on your device. My sense is that this isn't because you find the communication over GCM to be inherently offensive (it's just a tickle, after all), but because you don't want to run proprietary software.

There's a very small number of people who find this to be very important, and my experience has been that the strategy is to loudly complain whenever anything depends on play services. Just tactically speaking, I don't think this is going to work in the end, in the same sense that simply refusing to have a mobile phone won't work anymore -- slowly, the circumstances around this technology will make it impossible to refuse.

What I don't understand is why nobody just writes an API-compatible open source implementation of play services. Even if it only supported GCM and nothing else, that'd unlock an enormous swath of apps, and would only require writing a basic implementation of the GCM network protocol.

I'd love to know more if I'm misunderstanding the challenges around doing that. Right now it's part of the reason that I don't pay much attention to that crowd -- everyone seems very willing to complain, but nobody seems willing to do what seems like pretty straightforward work to solve their own problem.

Post reply on HN