Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal Desktop

whispersystems.org

Post reply on HN
Print view View original

251–260 of 288 posts

Re: Signal Desktop

#251

Post by xorcist »

newjersey wrote: post #208
xorcist wrote: post #175

Earlier quoted context omitted.

Surely battery saving modes should not drop messages? It could delay them but should never (well, almost never) drop them.

With no knowledge of how signal's servers actually implement this, I would like to ask you... how long should the central server hold on to the (encrypted) message that Alice sends to Bob if Bob never becomes available again?

I haven't thought about what's reasonable (an hour? a week?) but it still shouldn't be dropped but bounced back to the sender with an undelivered message. At last that's how email solved it some thirty years ago.

(But perhaps a new protocol could take the opportunity to improve things further and offer on-line delivery status notifications throughout the process.)

No matter what, messages should never be silently dropped.

Re: Signal Desktop

#252

Post by f444fz »

akerro wrote: post #247
darklajid wrote: post #59

I'm feeling dirty, because I don't like to be that negative, especially if we're talking open-source software. And I feel that I kinda hold this project to higher standards: If I compare this to WhatsApp/Telegram/Threema/Whatever, I inheritently, somewhat subconciously expect more from Signal. And I'm disappointed. I tend to repeat the 'central server' and 'a phone number is not an address and not public information,…

I feel the same but in a bit other way. They tied up everything very closely to google services and they tell me "we really care about your privacy so use our app that requires google play frameworks on your android device". Those are two completely different things, use gapps or opensystem apps? It's 100% no-go for me and the whole idea seems to be a bit sarcastic for me. It hurt me when they removed content encrypt…

Content encryption has not been removed. It never will.

Re: Signal Desktop

#253

Post by Sir_Substance »

moxie wrote: post #84
darklajid wrote: post #59

I'm feeling dirty, because I don't like to be that negative, especially if we're talking open-source software. And I feel that I kinda hold this project to higher standards: If I compare this to WhatsApp/Telegram/Threema/Whatever, I inheritently, somewhat subconciously expect more from Signal. And I'm disappointed. I tend to repeat the 'central server' and 'a phone number is not an address and not public information,…

If we were going to rank our priorities, they would be in this order: 1) Make mass surveillance impossible. 2) Stop targeted attacks against crypto nerds. It's not that we don't find #2 laudable, but optimizing for #1 takes precedence when we're making decisions. If you don't want to use your phone number, don't use it. You can register with any GV, Twilio, Voicepulse, or other throwaway VoIP number. If you don't wan…

Could you tell me more about gcm core? I've removed play services from my phone and for the moment accept that this means some apps dont work. I'd love a substitute, but a quick search for 'gcm core' didn't give useful results.

Re: Signal Desktop

#254

Post by herbst »

nextos wrote: post #140
moxie wrote: post #127

Earlier quoted context omitted.

That's a pretty big holiday wishlist. =) This is the world we live in: people do most of their communication on mobile devices running iOS or Android, use Chrome on the desktop, and expect contact discovery to be automatic in their social apps. The browser has won the desktop, iOS and Android have won mobile, and the velocity of the ecosystem is unlikely to make "distributed" communication mechanisms possible for som…

I like the fact that Signal makes good cryptography available to the masses. But I also share the OP concern about Chromium (and about a central server, but this is technically much harder to fix). Perhaps it would be possible to have a simple CLI app that is free from these dependencies (which should also be quite simple to develop).

Yes because the GUI is the hardest part of p2p networking.

Re: Signal Desktop

#255

Post by Quiark »

dates wrote: post #51
knocknock wrote: post #40

I'm assuming this works similarly to WhatsApp Web ( https://web.whatsapp.com/ )

And actually, earlier this year, WhatsApp started using the encrpytion protocol developed by the signal folks (Axolotl) to encrypt message data, Which is super cool. (I think group chats and images are still not encrypted, or something) I wonder if in the future Signal will focus on integrating their encryption into other existing chat systems like Facebook messenger, and put the Signal apps on the backburner.

I heard somewhere on the internet (actually /r/crypto) that after being bought by Facebook, they are cancelling or backdooring it. Sounds like conspiracy to me but then again it's Facebook...

Re: Signal Desktop

#256

Post by devit »

moxie wrote: post #84
darklajid wrote: post #59

I'm feeling dirty, because I don't like to be that negative, especially if we're talking open-source software. And I feel that I kinda hold this project to higher standards: If I compare this to WhatsApp/Telegram/Threema/Whatever, I inheritently, somewhat subconciously expect more from Signal. And I'm disappointed. I tend to repeat the 'central server' and 'a phone number is not an address and not public information,…

If we were going to rank our priorities, they would be in this order: 1) Make mass surveillance impossible. 2) Stop targeted attacks against crypto nerds. It's not that we don't find #2 laudable, but optimizing for #1 takes precedence when we're making decisions. If you don't want to use your phone number, don't use it. You can register with any GV, Twilio, Voicepulse, or other throwaway VoIP number. If you don't wan…

Why not both?

#1 is essential, but you really need to cater to #2 as well because "crypto nerds" are likely those who will eagerly adopt the software and advertise and praise it to others.

Here is a simple non-exhaustive list of changes to better achieve #2:

1. If the phone number starts with +xx where xx is a reserved/invalid country code, the rest is the client's base10 public key. Verification happens by signing a challenge or simply successfully performing a DH handshake instead of by SMS.

2. Provide a "pull" notification socket in the Signal server, use it if GCM is not available

3. Package the mobile-sync Chrome app with node-webkit or simply as a standalone server that auto-opens your browser to localhost:port

4. Use libtextsecure-java to make a simple standalone desktop client that could either have a command line interface or a localhost web interface (please don't use the C library, since C is not suitable for secure software)

Obviously these changes could be done by third parties, not necessarily by Open Whisper Systems.

Re: Signal Desktop

#257

Post by Natanael_L »

darklajid wrote: post #169
HappyTypist wrote: post #156

Earlier quoted context omitted.

Perhaps Signal just isn't for you. No one who I've introduced signal to has ever had a problem with it. Now if you add a randomly generated 128 bit account identifier, then people WILL have problems with it. Not with you, but with your mum/grandma. I really think Signal might not be for you. Signal is not about building the most secure or private system, it's about building the first mass-market encrypted that that's…

See, that identifier might be an option. Or .. it might not be necessary. If that identifier would be the core 'me' on Signal, why wouldn't you be able to add me by phone number - if I gave Signal one to share/associate with? Mum and Grandma would see no change. People like me could run around without a phone number. It's not as if that hasn't been done. twitter.com/darklajid is me (not worth checking it out). See? A…

If that identifier was linked to my Keybase.io account, that would be really cool. Or linked to Namecoin. Using methods like that to find my contacts would be great.

Re: Signal Desktop

#258

Post by Natanael_L »

devit wrote: post #256
moxie wrote: post #84

Earlier quoted context omitted.

If we were going to rank our priorities, they would be in this order: 1) Make mass surveillance impossible. 2) Stop targeted attacks against crypto nerds. It's not that we don't find #2 laudable, but optimizing for #1 takes precedence when we're making decisions. If you don't want to use your phone number, don't use it. You can register with any GV, Twilio, Voicepulse, or other throwaway VoIP number. If you don't wan…

Why not both? #1 is essential, but you really need to cater to #2 as well because "crypto nerds" are likely those who will eagerly adopt the software and advertise and praise it to others. Here is a simple non-exhaustive list of changes to better achieve #2: 1. If the phone number starts with +xx where xx is a reserved/invalid country code, the rest is the client's base10 public key. Verification happens by signing a…

#1: Will require really long numbers.

Re: Signal Desktop

#259

Post by Spakman »

phantom_oracle wrote: post #49

I have a question about this... Say a team of volunteers were willing to spend time to make something like a QT- or GTK-based native desktop application instead. How much more difficult would this be compared to what they did/used now? (the chrome-app) ? Also, will it take significantly longer to build such a native app? Anybody with experience building native apps, please share.

These aren't specifically about Qt or GTK applications (except maybe the Ubuntu phone app), but here are some other projects that are shooting for compatibility:

https://github.com/f41c0r/textsecure-client

https://github.com/AsamK/textsecure-cli

https://github.com/TerrorM/pytextsecure

https://github.com/janimo/textsecure.git

https://github.com/janimo/textsecure-qml

https://github.com/StarfishInteractive/Norvos

Re: Signal Desktop

#260

Post by kuschku »

driverdan wrote: post #231
kuschku wrote: post #113

Earlier quoted context omitted.

Google adds Google Analytics to their browser, to automatically report what a user does in Chrome apps, and "accidentally" your whole chat history ends up on Google’s servers? This is not an unrealistic example.

> Google adds Google Analytics to their browser Source?

Someone asked for a hypothetical way Google could, in the future, get the data.

As you are doing automated updates, Google can just add Analytics to the browser, and even publish it as something "good".

Post reply on HN