Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal for Android: RedPhone and TextSecure in one app

whispersystems.org

Post reply on HN
Print view View original

101–110 of 158 posts

Re: Signal for Android: RedPhone and TextSecure in one app

#101

Post by finnn »

xenophonf wrote: post #72
iheartmemcache wrote: post #20

Earlier quoted context omitted.

I'm not associated with Signal or Moxie (though I've been a silent fanboy for ~15 years-- [[hey Moxie if you're reading this and still are hiring, ping me - contact info is in my profile]]), but I'd inherently trust the application more than an average application or company because: a) Moxie has a track history of having a lot of personal integrity with regards to security. Some might say this is blasphemous but I'd…

compile the APK and see if it matches Are deterministic builds possible with the Android toolchain?

F-Droid is working on this:

https://f-droid.org/wiki/page/Deterministic,_Reproducible_Bu...

Re: Signal for Android: RedPhone and TextSecure in one app

#102

Post by veeti »

mtgx wrote: post #94
Tepix wrote: post #55

Signal is pretty awesome, it's by far the best that we have right now: • state of the art crypto • open source • free as in beer • Available for Android and iOS There are a few minor features that are missing but I can live with that. However, there are also a couple of important shortcomings: • no decentralization • use of the phone number I hope they can be fixed sooner or later.

I wonder if they opt-out of Google Now on Tap. Google has made its spying the default on Android 6.0, and developers have to know to opt-out of it, otherwise private Signal communications could be collected by Google.

This is nonsense. Now on Tap only scrapes the screen through explicit user action.

TextSecure also uses the FLAG_SECURE window flag by setting, so NoT among other things is blocked.

Re: Signal for Android: RedPhone and TextSecure in one app

#103

Post by finnn »

rogerbraun wrote: post #83
verusfossa wrote: post #58

TextSecure used to be on fDroid, then this happened https://f-droid.org/posts/security-notice-textsecure/ . Now it's a GPlay exclusive. I don't have GAPPS so now I can't get it. I'd assume many privacy conscious people don't have GAPPS. I understand the technical hurtles, but it's too big a pill to swallow.

Just use Conversations. It can now use the same protocol and is the best XMPP client there is. I'm completely baffled that the Textsecure people insist on using the gapps package, which is of course an extreme privacy risk.

> It can now use the same protocol

Conversations uses XMPP, not whatever custom stuff WhisperSystems worked up for Signal. Are you talking about OMEMO[0]? That's their implementation of Axolotl over XMPP. So same crypto, yes, but different protocol.

[0]:http://conversations.im/omemo/

Re: Signal for Android: RedPhone and TextSecure in one app

#104

Post by pasbesoin »

I just updated, after which I checked the settings. I noticed that auto-downloading in MMS text messages was enabled (moxie stated for a prior version that it was not, at that time), whereupon I changed the settings to disable. I may well be misinterpreting what I was seeing, but better safe than sorry.

(I'm stuck on Android 5.1 (not 5.1.1) on a Verizon phone. I was thinking of the ongoing Stagefright problems.)

Re: Signal for Android: RedPhone and TextSecure in one app

#105

Post by andrewpi »

ohthehugemanate wrote: post #66
Arnt wrote: post #4

Earlier quoted context omitted.

What does it send via googleplay other than "please connect to the server now"?

It sends messages through Google's messaging framework. Of course the messages are end to end encrypted, so there's no security risk. It's just really hard to set up a global push messaging framework unless you have the clout of, say, Google.

I believe it doesn't actually send the message content through GCM anymore, but just notifies the client that a new message is available and tells it to connect to Open Whisper Systems' server for the content.

Re: Signal for Android: RedPhone and TextSecure in one app

#106

Post by devit »

lorenzhs wrote: post #12
corney91 wrote: post #2

I really want to start using TextSecure (or Signal now I guess), but the only thing holding me back is it depends on Google Play Services. I love what they're doing and can understand the decision, but still thinks it sucks a bit that the best option for secure communications is so tied into Google.

It's mostly because there aren't any real alternatives. Building a world wide push messaging network is really hard (you have to deal with carriers a lot and convince them not to close your long running connections after 5 minutes). That said, the servers support websocket connections as well. I don't know the current state of client support. Also, a Chrome/Chromium extension is in the works.

Just send heartbeats and reconnect if needed?

Only real problems I see are hosting costs and preventing misuse, plus some minor coding work.

Re: Signal for Android: RedPhone and TextSecure in one app

#108

Post by amluto »

What happened to short authentication strings? The SAS protocol is nicely documented in the Silent Circle Instant Messaging Protocol paper [1], but when I go to "Verify identity" in the app I'm asked to verify an obnoxiously long pair of hexadecimal strings.

The phone call feature supports it (with a curious lack of documentation), but it would be easy to imagine a UI that allowed verification without making a phone call and without allowing users to screw it up: one phone shows the SAS string, the other phone asks you to type it in, and neither phone allows IMs to be sent while doing this.

Re: Signal for Android: RedPhone and TextSecure in one app

#109

Post by pakled_engineer »

acqq wrote: post #51
Natanael_L wrote: post #45

Earlier quoted context omitted.

You can run your own server, but there's no federation. The reason for that I imagine is that they want a privacy preserving automatic lookup method (a single server can confirm phone numbers and allow privacy preserving contact list comparisons for its own clients), and aren't convinced of using a model where the public key is the identifier instead of your phone number.

Have you actually tried it, or do you know somebody who have tried? Is the client really fully independent on Whisper servers? Can it work without the mobile connection, just with WiFi? Does the voice communication work? I'm asking all this because it seems that the server code was earlier in "you can look but it's not enough to run it" state?

I've run the server source as a private textsecure chat app. You can run your own without the proprietary gapps framework app too by mimicking what GCM does on your own back end, and it works with wifi if you change the identifiers to email/nicks instead of phone numbers, but this was for a small number of coworkers nothing of massive scale. This was for business communication from China since at that time TS wasn't working very well behind the GFC but they added another server around that time (I assume, all connections got better) so we abandoned our hacked fork for regular TS/Signal.

Re: Signal for Android: RedPhone and TextSecure in one app

#110

Post by on_and_off »

verusfossa wrote: post #58

TextSecure used to be on fDroid, then this happened https://f-droid.org/posts/security-notice-textsecure/ . Now it's a GPlay exclusive. I don't have GAPPS so now I can't get it. I'd assume many privacy conscious people don't have GAPPS. I understand the technical hurtles, but it's too big a pill to swallow.

I can understand somebody deciding to focus on the users with Google Play Services, but I find very hard to trust a 'Secure' application which writes sensitive in the logs.

If the app runs in an android version < 4.1, logs are readable by any application.

Post reply on HN