Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disappearing messages for Signal

whispersystems.org

Post reply on HN
Print view View original

81–90 of 187 posts

Re: Disappearing messages for Signal

#81

Post by lqdc13 »

_9vpl wrote: post #57
AckSyn wrote: post #50

Now if they would drop the ridiculous requirement of having a phone number and go with usernames and not require access to my contact list like most other services, you could actually be safer and not rely on _their word_ alone.

With the approach that Signal has taken, it doesn't require you to register a username. The app just registers you with the server as a Signal user using your already unique ID - your phone number. While not the most secure and privacy-protecting method, it allows anyone to just install it and start using it as a secure alternative to plaintext SMS.

Regarding SMS - it's not always an alternative to SMS since it uses data. I know data is more popular than SMS in many countries, but when you hit your monthly limit, you want to disable all data.

Regarding the simplicity of using a phone number and how it would be very easy for all users - Wickr provides basically the same service, is more popular, but uses usernames instead of phone numbers.

The fact that something is open source isn't always a clear win. OpenSSL, for example, is open source and yet they seem to have many bugs.

For the record, I use Signal almost exclusively for communication. I just wish it was more protective of users' privacy without having to put in a ton of effort.

Re: Disappearing messages for Signal

#82

Post by StavrosK »

walterbell wrote: post #80
StavrosK wrote: post #69

Earlier quoted context omitted.

> I still use Silent Circle for calls because it is so tiring to talk when the bitrate is low. To be fair, that's a high bar. Our (SC) phone guys are masters at optimizing audio quality. I would be extremely surprised if any other app (encrypted or not) had significantly better audio quality than Silent Phone.

Wire's audio quality is quite good, even on cellular and/or VPN. Haven't compared with Silent Circle.

Oh, I'll give that a go, thanks! I should try Signal again too, hopefully audio quality has improved from the Redphone days.

Re: Disappearing messages for Signal

#83

Post by topkeks »

moxie wrote: post #74
kuschku wrote: post #52

Earlier quoted context omitted.

Actually, Moxie has threatened to shut LibreSignal down if they allow LibreSignal users to message normal Signal users, and refused to even discuss alternative solutions. He also uses the GCM library from Google, which pulls in several analytics libraries into the APK, so "Using GCM doesn't make Signal less private." is objectively false. (And in addition to that, Moxie even refuses to allow any distribution that doe…

> Moxie has threatened to shut LibreSignal down if they allow LibreSignal users to message normal Signal users, and refused to even discuss alternative solutions. Please cite this. To my knowledge I never threatened anything, and your comment is a response to a quote from the discussion about LibreSignal, where I suggest that they submit a PR with the functionality they desire to Signal. Is that not an alternative? >…

kuschku BTFO

Re: Disappearing messages for Signal

#84

Post by wtbob »

lenish wrote: post #78
wtbob wrote: post #65

> They're relatively compact. Users compare 12 groups of 5 digits with each other, which is half the size of our previous hexadecimal format. 60 digits have 199 bits of security, so I suppose that's mostly okay, right? Does the birthday paradox apply here, reducing it to 98 bits?

>reducing it to 98 bits? Did you mean 198? 198 bits is entirely reasonable assuming a brute force attack is the only option. Were it not we'd be in a panic over AES-128 and AES-192. :)

No, hashes generally require twice as many bits in order to avoid birthday attacks — that's why one uses SHA-256 for 128-bit security.

98 bits is still plenty, of course, but it's not 128 bits.

Re: Disappearing messages for Signal

#86

Post by MereKatMoves »

StavrosK wrote: post #69
MereKatMoves wrote: post #37

Earlier quoted context omitted.

I love using Signal and will continue to make modest donations, but I would really appreciate an improvement in audio call quality. I still use Silent Circle for calls because it is so tiring to talk when the bitrate is low.

> I still use Silent Circle for calls because it is so tiring to talk when the bitrate is low. To be fair, that's a high bar. Our (SC) phone guys are masters at optimizing audio quality. I would be extremely surprised if any other app (encrypted or not) had significantly better audio quality than Silent Phone.

Having used all the encrypted call possibilities there are , you are, in my opinion, absolutely spot on. SC has exceptional clarity. WA isn't bad.

Can you talk more about "our guys" in respect to the fact that the CIA and NSA use the Blackphone? Should I, as a casual business person, be wondering that the handsets you supply to them are in some way compromised? I know that both the NSA and the CIA are interested in my phone conversations, which is why I ironically bought a Blackphone (for when I assume they are listening) and others which make their life harder (but I do accept that I do this more for the kicks of making them work for their intel)

tl:dr - is SC actually secure given that the company has been short on cash for a while and that the CIA and NSA equip their agents with the same phones. I don't mind talking because I have nothing to hide, but backdoor code is usually the case if you are selling 10k phone units to US LE.

Re: Disappearing messages for Signal

#87

Post by lenish »

StavrosK wrote: post #68
wtbob wrote: post #65

> They're relatively compact. Users compare 12 groups of 5 digits with each other, which is half the size of our previous hexadecimal format. 60 digits have 199 bits of security, so I suppose that's mostly okay, right? Does the birthday paradox apply here, reducing it to 98 bits?

No, since you presumably want to match a specific user's key, not just find two users with the same key.

It is a similar problem, however: https://en.wikipedia.org/wiki/Birthday_problem#Same_birthday...

Re: Disappearing messages for Signal

#88

Post by mbenjaminsmith »

AckSyn wrote: post #50

Now if they would drop the ridiculous requirement of having a phone number and go with usernames and not require access to my contact list like most other services, you could actually be safer and not rely on _their word_ alone.

What's more bothersome: If you withdraw access (after they've already scanned your contacts) they'll disable the app. That's why I deleted the app and won't use it again.

If a privacy-focused app makes you nervous about privacy they've already lost the war, haven't they?

Re: Disappearing messages for Signal

#89

Post by subliminalpanda »

geomark wrote: post #79
subliminalpanda wrote: post #14

Earlier quoted context omitted.

I would like to be able to re-register a new number without having to de-activate the account thereby not losing all of my chats.

Is there a way to export chart history and then import it to the new account?

> Is there a way to export chart history and then import it to the new account?

Another feature that I would like to see (Chat backup and restore). If it's there, I can't find it.

Re: Disappearing messages for Signal

#90

Post by lenish »

wtbob wrote: post #84
lenish wrote: post #78

Earlier quoted context omitted.

>reducing it to 98 bits? Did you mean 198? 198 bits is entirely reasonable assuming a brute force attack is the only option. Were it not we'd be in a panic over AES-128 and AES-192. :)

No, hashes generally require twice as many bits in order to avoid birthday attacks — that's why one uses SHA-256 for 128-bit security. 98 bits is still plenty, of course, but it's not 128 bits.

If we're talking about the actual hash signal uses for this value, then sure, but talking about the number of digits displayed isn't even the right thing to care about, since they're using SHA1 for the hash AFAICT: https://github.com/WhisperSystems/Signal-Android/blob/3.0.0/...
Post reply on HN