Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disappearing messages for Signal

whispersystems.org

Post reply on HN
Print view View original

71–80 of 187 posts

Re: Disappearing messages for Signal

#71

Post by Jarwain »

kuschku wrote: post #52
uph wrote: post #47

Earlier quoted context omitted.

No one is forcing you to use proprietary software. See this comment from moxie https://news.ycombinator.com/item?id=10665520 Using GCM is only a problem for people running a custom Android ROM without Google Play Services. Using GCM doesn't make Signal less private. Google doesn't see any data via gcm, it's just a tickle. If you want push messages, you gotta use a push network. https://twitter.com/whispersystems/stat…

Actually, Moxie has threatened to shut LibreSignal down if they allow LibreSignal users to message normal Signal users, and refused to even discuss alternative solutions. He also uses the GCM library from Google, which pulls in several analytics libraries into the APK, so "Using GCM doesn't make Signal less private." is objectively false. (And in addition to that, Moxie even refuses to allow any distribution that doe…

Could it be because some of your information is spun/misleading?

LibreSignal was abandoned according to their github, first of all. Secondly, the issue is that OWS doesn't want "others" using the servers that they own and maintain for Signal.[1] As far as I understand, they disapprove of people using the name Signal or TextSecure or Redphone for their forks, due to confusion by users who believe that the fork is actually the app released by OWS. He doesn't explicitly say whether "LibreSignal" is okay, but would prefer for a namechange to reduce confusion.

Afaik, he also encourages people who don't like the GCM build in Signal to swap it out with the rewritten open source one and build with that.

[1]https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

Re: Disappearing messages for Signal

#72

Post by cgag »

laretluval wrote: post #60
AckSyn wrote: post #50

Now if they would drop the ridiculous requirement of having a phone number and go with usernames and not require access to my contact list like most other services, you could actually be safer and not rely on _their word_ alone.

Indeed. It's not just crypto nerds would want to use the service without having to have a smartphone with a phone number. The phone requirement is beyond ridiculous. How did Signal get the reputation it enjoys in the tech community anyway?

What's a trustworthy alternative?

Re: Disappearing messages for Signal

#73

Post by rorosaurus »

oconnore wrote: post #9
libeclipse wrote: post #2

I'm not sure that this is a benefit. It gives users a false sense of security. Screenshots or pictures can always be taken on the other end. Didn't signal used to be explicitly against this feature.

If their sense is that -- after configuring 1 week self destruct, the people they're talking to likely won't be keeping months and months of chat logs on their phone anymore -- it's a very true sense of security.

At least until the Jailbreak tweak is released with patches out this feature, allowing people to retain everything they want.

I don't disagree that it works for the average user, but I do agree with the sentiment that it is a false sense of security.

Unless maybe you cryptographically verify the deletion (is that possible?) and notify the other party of the successful deletion. But even then a copy could be made beforehand, on-device or with an external camera...

I think it's much better to maintain zero expectation of message destruction with all end users.

Re: Disappearing messages for Signal

#74

Post by moxie »

kuschku wrote: post #52
uph wrote: post #47

Earlier quoted context omitted.

No one is forcing you to use proprietary software. See this comment from moxie https://news.ycombinator.com/item?id=10665520 Using GCM is only a problem for people running a custom Android ROM without Google Play Services. Using GCM doesn't make Signal less private. Google doesn't see any data via gcm, it's just a tickle. If you want push messages, you gotta use a push network. https://twitter.com/whispersystems/stat…

Actually, Moxie has threatened to shut LibreSignal down if they allow LibreSignal users to message normal Signal users, and refused to even discuss alternative solutions. He also uses the GCM library from Google, which pulls in several analytics libraries into the APK, so "Using GCM doesn't make Signal less private." is objectively false. (And in addition to that, Moxie even refuses to allow any distribution that doe…

> Moxie has threatened to shut LibreSignal down if they allow LibreSignal users to message normal Signal users, and refused to even discuss alternative solutions.

Please cite this. To my knowledge I never threatened anything, and your comment is a response to a quote from the discussion about LibreSignal, where I suggest that they submit a PR with the functionality they desire to Signal. Is that not an alternative?

> He also uses the GCM library from Google, which pulls in several analytics libraries into the APK

Could you cite this as well? Here's the entire POM file for the version of the GCM library we use:

http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="" rel="nofollow">http://www.w3.org/2001/XMLSchema-instance"> 4.0.0 com.google.android.gms play-services-gcm 8.1.0 aar com.google.android.gms play-services-base 8.1.0 compile aar

A single dependency. If you follow it, the only transitive dependency is the supportv4 library. Where are the "several" analytics libraries?

> (And in addition to that, Moxie even refuses to allow any distribution that doesn’t come with full analytics, which is extremely user hostile.)

What do you mean by "full analytics?" Is there something user hostile about having an aggregate count of the number of users you have on what platforms, so that you can develop and deploy software accordingly? About being able to receive crash reports when users choose to submit them so that you can fix their problems?

Re: Disappearing messages for Signal

#75

Post by walterbell »

laretluval wrote: post #60
AckSyn wrote: post #50

Now if they would drop the ridiculous requirement of having a phone number and go with usernames and not require access to my contact list like most other services, you could actually be safer and not rely on _their word_ alone.

Indeed. It's not just crypto nerds would want to use the service without having to have a smartphone with a phone number. The phone requirement is beyond ridiculous. How did Signal get the reputation it enjoys in the tech community anyway?

Wire (http://wire.com) does not need a phone number (register with email on a desktop browser at http://app.wire.com, then login to mobile) and does not need a copy of your contacts. Supports text, image, files, audio, video. E2E encryption is based on Signal protocol. Funded by Skype founder.

Re: Disappearing messages for Signal

#76

Post by geomark »

MereKatMoves wrote: post #62
woah wrote: post #58

Earlier quoted context omitted.

If you really want to be secure, get a disposable prepaid phone and use its phone number with signal.

That is increasingly hard to do these days. Verified addresses etc are now minimum requirements to get the handset. Of course you can pay cash and make up an address

Where I live they make a copy of your ID when you buy a SIM. So you'll also need a fake ID. And then there will be a copy of your fake ID with a photo of you on file somewhere, which could lead to some issues if the authorities discover you used a fake ID.

Re: Disappearing messages for Signal

#77

Post by mintplant »

CoryG89 wrote: post #63
laretluval wrote: post #60

Earlier quoted context omitted.

Indeed. It's not just crypto nerds would want to use the service without having to have a smartphone with a phone number. The phone requirement is beyond ridiculous. How did Signal get the reputation it enjoys in the tech community anyway?

> How did Signal get the reputation it enjoys in the tech community anyway? You can thank Edward Snowden for that. In fact, they have his picture and testimonial on their front page: https://whispersystems.org

moxie, the founder of OWS, was already well-known before Snowden. SSLstrip, for example: https://moxie.org/software/sslstrip/ and this DEFCON talk where he presents multiple attacks on cert validation: https://youtube.com/watch?v=ibF36Yyeehw

Re: Disappearing messages for Signal

#78

Post by lenish »

wtbob wrote: post #65

> They're relatively compact. Users compare 12 groups of 5 digits with each other, which is half the size of our previous hexadecimal format. 60 digits have 199 bits of security, so I suppose that's mostly okay, right? Does the birthday paradox apply here, reducing it to 98 bits?

>reducing it to 98 bits?

Did you mean 198?

198 bits is entirely reasonable assuming a brute force attack is the only option. Were it not we'd be in a panic over AES-128 and AES-192. :)

Re: Disappearing messages for Signal

#79

Post by geomark »

subliminalpanda wrote: post #14
mtgx wrote: post #6

Great. One of the most requested features is finally here. I think all that's left now is video calling (on the desktop, too).

I would like to be able to re-register a new number without having to de-activate the account thereby not losing all of my chats.

Is there a way to export chart history and then import it to the new account?

Re: Disappearing messages for Signal

#80

Post by walterbell »

StavrosK wrote: post #69
MereKatMoves wrote: post #37

Earlier quoted context omitted.

I love using Signal and will continue to make modest donations, but I would really appreciate an improvement in audio call quality. I still use Silent Circle for calls because it is so tiring to talk when the bitrate is low.

> I still use Silent Circle for calls because it is so tiring to talk when the bitrate is low. To be fair, that's a high bar. Our (SC) phone guys are masters at optimizing audio quality. I would be extremely surprised if any other app (encrypted or not) had significantly better audio quality than Silent Phone.

Wire's audio quality is quite good, even on cellular and/or VPN. Haven't compared with Silent Circle.
Post reply on HN