Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal for Android: RedPhone and TextSecure in one app

whispersystems.org

Post reply on HN
Print view View original

111–120 of 158 posts

Re: Signal for Android: RedPhone and TextSecure in one app

#111

Post by probablypat »

iheartmemcache wrote: post #20
deckiedan wrote: post #14

One of the reasons I didn't install WhatsApp is the sheer quantity of permissions it wants (on Android). Yes, I realise that this is part of Android's broken security model. But the Signal app also wants access to practically everything. Device & App History, Identity, Calendar, Contact, Location, SMS, Phone, Photos/Media/Files, Camera, Microphone, WiFi Connection info and Device ID and call info. Call me paranoid, b…

I'm not associated with Signal or Moxie (though I've been a silent fanboy for ~15 years-- [[hey Moxie if you're reading this and still are hiring, ping me - contact info is in my profile]]), but I'd inherently trust the application more than an average application or company because: a) Moxie has a track history of having a lot of personal integrity with regards to security. Some might say this is blasphemous but I'd…

In terms of privacy tools, I work for a company that makes one aimed for the general internet user (i.e. someone who doesn't know what DNS is). Do you have any comments on our extension? https://redmorph.com

We aimed to put adblock/ublock/donottrack all in one extension and coupled it with vpn and proxy paid services.

Re: Signal for Android: RedPhone and TextSecure in one app

#112

Post by unfamiliar »

vox_mollis wrote: post #76
IshKebab wrote: post #64

Earlier quoted context omitted.

But the centralisation and use of the phone number is necessary to make it not shit. Anyway you forgot the important features: * Nice modern UI * Integrates with SMS * Supports group chats * Uses MMS for group chat if not all members have Signal * Not really buggy or hard to use

Huge respect for Moxie, but the requirement of a phone number really is a dealkiller. 1. Phone number requires a service provider 2. Service provider owns the baseband and root of your phone. 3. $government makes a "lawful request" of Verizon et. al. to install keyloggers/screenshotters on your phone. 4. Your "secure" commms are compromised. Signal needs to work on comprehensively rooted devices connected only via wi…

Plus it still leaves people open to metadata analysis. The phone number has to be verified, meaning a text message is sent from Signal HQ to your device, clearly marking you as a Signal user.

Re: Signal for Android: RedPhone and TextSecure in one app

#113

Post by scienhack »

Omnipresent wrote: post #107

Is Signal for Android open source like other things coming out of open whisper? I didn't see it on their github page [0] [0] https://github.com/WhisperSystems

Signal for Android is effectively TextSecure v3+, with a new label. So it's TextSecure repo that holds Signal's code.

Re: Signal for Android: RedPhone and TextSecure in one app

#114

Post by on_and_off »

deckiedan wrote: post #14

One of the reasons I didn't install WhatsApp is the sheer quantity of permissions it wants (on Android). Yes, I realise that this is part of Android's broken security model. But the Signal app also wants access to practically everything. Device & App History, Identity, Calendar, Contact, Location, SMS, Phone, Photos/Media/Files, Camera, Microphone, WiFi Connection info and Device ID and call info. Call me paranoid, b…

>Yes, I realise that this is part of Android's broken security model.

Well, with Marshmallow, they have no excuse. The permission model is now very similar to iOS's one and any app can start with 0 critical permissions (basically anything related to personal info) and ask the permissions at runtime.

For either Android or iOS, you still have to trust that an app won't abuse the permissions you give it though.

Re: Signal for Android: RedPhone and TextSecure in one app

#116

Post by gcb0 »

finnn wrote: post #100
blub wrote: post #87

Earlier quoted context omitted.

Any chance of not requiring access to the whole contact list? I think there are pickers that allow selecting one contact - or better yet, one could allow adding contacts inside Signal.

Probably not because they check that against the list of people who have Signal installed so they can send encrypted messages to the people who support it. They talk more about how they try to do this privately in [0]. [0]: https://whispersystems.org/blog/contact-discovery/

which is silly. that should be fine for people already advertising their contact list for facebook, wasapp, etc. but there should have been a isolated account setup for people not doing so

Re: Signal for Android: RedPhone and TextSecure in one app

#118

Post by gcb0 »

Tepix wrote: post #55

Signal is pretty awesome, it's by far the best that we have right now: • state of the art crypto • open source • free as in beer • Available for Android and iOS There are a few minor features that are missing but I can live with that. However, there are also a couple of important shortcomings: • no decentralization • use of the phone number I hope they can be fixed sooner or later.

It is not opensource.

the client WAS. the server i don't think was ever.

Re: Signal for Android: RedPhone and TextSecure in one app

#119

Post by gcb0 »

moxie wrote: post #80
corney91 wrote: post #2

I really want to start using TextSecure (or Signal now I guess), but the only thing holding me back is it depends on Google Play Services. I love what they're doing and can understand the decision, but still thinks it sucks a bit that the best option for secure communications is so tied into Google.

It seems like you don't want to install Google Play Services on your device. My sense is that this isn't because you find the communication over GCM to be inherently offensive (it's just a tickle, after all), but because you don't want to run proprietary software. There's a very small number of people who find this to be very important, and my experience has been that the strategy is to loudly complain whenever anyth…

just debunking the bogus "you are a nerd that has a pet peeve against google services". this affect lots of users overseas or in poorer markets than san francisco.

amazon phones don't ship with google service. cheap samsung models (most dual sim ones) sold overseas don't ship with it either. the cheap chinese phones don't have any google service. ...and those are only the ones i saw. i'm sure india/africa/europe have even more cases.

Re: Signal for Android: RedPhone and TextSecure in one app

#120

Post by marssaxman »

corney91 wrote: post #2

I really want to start using TextSecure (or Signal now I guess), but the only thing holding me back is it depends on Google Play Services. I love what they're doing and can understand the decision, but still thinks it sucks a bit that the best option for secure communications is so tied into Google.

Does it actually use Google Play Services during normal operation or does it just depend on the Play Store for installation?
Post reply on HN