Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal Desktop

whispersystems.org

Post reply on HN
Print view View original

211–220 of 288 posts

Re: Signal Desktop

#211

Post by devit »

kingkilr wrote: post #63
hackuser wrote: post #52

Earlier quoted context omitted.

> 1. Simple encryption for everyone to prevent mass data collection Google might be the second biggest mass data collector, after the U.S. government. Using Chrome, one of Google's tools of collection (if I understand correctly), wouldn't seem to further that goal.

Can you articulate a _specific_ threat model under which this extension fails to protect against mass data collection by Google? Or is this idle speculation.

The threat is that Google (perhaps forced by the NSA, perhaps only for some users) modifies Chrome to include code that logs all keystrokes or specifically detects the Signal extension (or standalone app if Chrome is also installed) and uploads the plaintext of all messages to Google or to the NSA.

In other words, you have to trust Google to not insert such a trojan by itself and to not bow down to the U.S. government should it try to secretly force Google to do so.

You also have to trust that their security is good enough to prevent third parties from covertly performing such a feat.

That's not say that Google should not be trusted or should be trusted less than other parties, but that's the threat.

Re: Signal Desktop

#212

Post by Symen »

JetSetWilly wrote: post #103
darklajid wrote: post #59

I'm feeling dirty, because I don't like to be that negative, especially if we're talking open-source software. And I feel that I kinda hold this project to higher standards: If I compare this to WhatsApp/Telegram/Threema/Whatever, I inheritently, somewhat subconciously expect more from Signal. And I'm disappointed. I tend to repeat the 'central server' and 'a phone number is not an address and not public information,…

I just found it unreliably slow. Principles are all good, but if I message my gf saying "see you at the bus stop in 20 minutes" and she doesn't receive the message for 2 hours, that's majorly annoying and it happened so often I had to leave it. The basic functionality isn't fit for purpose, for me.

Do you have IPv6 in your home network ? Many devices (such as all the Samsung one) stop responding to ICMPv6 packets when in sleep mode (which completely breaks long-running TCP connections over v6), supposedly to save power. This breaks push notifications of every apps using GCM, but there is no way to disable IPv6 without root, and no way to only use GCM over IPv4. I find it mind-blowing that this issue has been known for 3 years and nothing has been done to fix it...

Issue from 2012: https://code.google.com/p/android/issues/detail?id=32662

Thread starting in 2013 on Samsung dev board: http://developer.samsung.com/forum/board/thread/view.do?boar...

Re: Signal Desktop

#213

Post by nextos »

HappyTypist wrote: post #156
darklajid wrote: post #133

Earlier quoted context omitted.

If we ever meet I'll buy you a beer for the year of the Linux desktop line. But honestly: I understand mobile support for iOS/Android only. I don't understand Chrome as a platform (FF isn't dead. And the biggest reason for that is that I fail to understand why that client needs to be 'web based' and then again not. A web app in a silo) Mobile numbers.. Why? I mean, if 90% of the population WANT mum to see that they u…

Perhaps Signal just isn't for you. No one who I've introduced signal to has ever had a problem with it. Now if you add a randomly generated 128 bit account identifier, then people WILL have problems with it. Not with you, but with your mum/grandma. I really think Signal might not be for you. Signal is not about building the most secure or private system, it's about building the first mass-market encrypted that that's…

It's a bit of a slippery slope argument. Things are hard. Let's compromise to make them usable.

That said there's a lot of potential as the crypto libraries are known to be top notch and reviewed. I hope they progressively address these issues.

Re: Signal Desktop

#214

Post by oldmanjay »

interrupt13 wrote: post #198
rmchugh wrote: post #21

Loving moxie's namedropping of oldschool revolutionaries: Maria (Masha) Alexandrovna Kolenkina was a Russian socialist revolutionary from a merchant family in Temzhuk, a small town on the Sea of Azov. (1850-1926) Vera Ivanovna Zasulich was a Russian Menshevik writer and revolutionary. (1849-1919) Nestor Ivanovych Makhno or Bat'ko Makhno was a Ukrainian anarcho-communist revolutionary and the commander of an independe…

Oldschool Communist revolutionaries, to be exact. Yeah, it's no mystery where Moxie's politics lie given those allusions and the not-a-company company, eat together, do push ups together, open salary policies.

Fortunately for most of the human population, the politics of the author of the software we use isn't really a consideration.

Re: Signal Desktop

#215

Post by aplaice »

phantom_oracle wrote: post #49

I have a question about this... Say a team of volunteers were willing to spend time to make something like a QT- or GTK-based native desktop application instead. How much more difficult would this be compared to what they did/used now? (the chrome-app) ? Also, will it take significantly longer to build such a native app? Anybody with experience building native apps, please share.

FWIW someone is trying to create a Signal/Textsecure client for Ubuntu phone[1][2], using web-sockets, with (I think) a QML-interface and a go back-end, so once it's ready it should hopefully be relatively easily portable to desktop Linux (and if/when Ubuntu convergence becomes more than a pipe dream it should work even without porting...)

I haven't actually used it or looked at the code, so I can't comment on the usability of the interface or the security of the implementation.

[1] https://github.com/janimo/textsecure-qml/

[2] https://uappexplorer.com/app/textsecure.jani

Re: Signal Desktop

#216

Post by codethief »

Shish2k wrote: post #195
59hhllhbhvc7 wrote: post #73

Earlier quoted context omitted.

They don't like to admit it, but Signal has a metadata problem. It's fine if that's not their threat model, but I wish they would be more clear about it, especially when other chat systems get criticism more often for precisely that aspect. Edit: "As far as we can determine, practical privacy preserving contact discovery remains an unsolved problem." -03 Jan 2014 [0] https://whispersystems.org/blog/contact-discovery/…

> "As far as we can determine, practical privacy preserving contact discovery remains an unsolved problem." This reminds me of an idea I had which I would love for people to tear apart (I know that the obvious bandwidth problem makes it completely impractical, but I wonder if there are theoretical flaws): Have a central server which everybody connects to. All clients send a constant stream of data, 24/7 - if they don…

You don't even need a central server for that. Just set up a p2p network and have all peers broadcast their messages (¶) to everyone they're connected to. Those peers in turn forward everything they receive to everyone they are connected to and so on. (And, of course, they try to decrypt everything in the meantime to see if any message is meant for them.)

(¶) I think you could do without sending random data unless network consists of only two active peers and your adversary taps every single internet link. (As in, even the cable underneath the street in front of your house.) If he doesn't, broadcasting your message to your (physical) neighbors would likely be enough to obfuscate the message's origin.

Anyway, the idea of broadcasting / flooding to protect metadata is not new. See, for instance, Bitmessage and Ethereum Whisper. If you ask me, though, (and you mentioned that, too) the traffic and performance issues originating from broadcasting and brute-force decryption make this approach rather impractical to pretty much impossible – at least if you want this to work for the masses. (Even if it's just for text messages, not cat pics or anything.)

Re: Signal Desktop

#217

Post by eplanit »

oldmanjay wrote: post #214
interrupt13 wrote: post #198

Earlier quoted context omitted.

Oldschool Communist revolutionaries, to be exact. Yeah, it's no mystery where Moxie's politics lie given those allusions and the not-a-company company, eat together, do push ups together, open salary policies.

Fortunately for most of the human population, the politics of the author of the software we use isn't really a consideration.

That wasn't the case for Brendan Eich[1][2].

[1] http://www.reuters.com/article/2014/04/03/us-mozilla-ceo-res...

[2] https://en.wikipedia.org/wiki/Brendan_Eich

Re: Signal Desktop

#218

Post by tedks »

interrupt13 wrote: post #198
rmchugh wrote: post #21

Loving moxie's namedropping of oldschool revolutionaries: Maria (Masha) Alexandrovna Kolenkina was a Russian socialist revolutionary from a merchant family in Temzhuk, a small town on the Sea of Azov. (1850-1926) Vera Ivanovna Zasulich was a Russian Menshevik writer and revolutionary. (1849-1919) Nestor Ivanovych Makhno or Bat'ko Makhno was a Ukrainian anarcho-communist revolutionary and the commander of an independe…

Oldschool Communist revolutionaries, to be exact. Yeah, it's no mystery where Moxie's politics lie given those allusions and the not-a-company company, eat together, do push ups together, open salary policies.

Reading Moxie's early stories it is indeed no mystery where his politics lie, and it's certainly not "old-school communist."

Re: Signal Desktop

#219

Post by hysan »

zellyn wrote: post #4
pc86 wrote: post #3

Earlier quoted context omitted.

Which is funny considering they are using a MacBook (with Photoshopped screen) as a promotional image.

I believe you link to your phone, and that part is Android only.

But why does the app appear with the wrong window decorations? It looks like the app is using the window decorations and title font from Xubuntu.

Re: Signal Desktop

#220

Post by DanBC »

eplanit wrote: post #217
oldmanjay wrote: post #214

Earlier quoted context omitted.

Fortunately for most of the human population, the politics of the author of the software we use isn't really a consideration.

That wasn't the case for Brendan Eich[1][2]. [1] http://www.reuters.com/article/2014/04/03/us-mozilla-ceo-res... [2] https://en.wikipedia.org/wiki/Brendan_Eich

HN should declare this off topic.
Post reply on HN