Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disappearing messages for Signal

whispersystems.org

Post reply on HN
Print view View original

101–110 of 187 posts

Re: Disappearing messages for Signal

#101

Post by AckSyn »

geomark wrote: post #76
MereKatMoves wrote: post #62

Earlier quoted context omitted.

That is increasingly hard to do these days. Verified addresses etc are now minimum requirements to get the handset. Of course you can pay cash and make up an address

Where I live they make a copy of your ID when you buy a SIM. So you'll also need a fake ID. And then there will be a copy of your fake ID with a photo of you on file somewhere, which could lead to some issues if the authorities discover you used a fake ID.

Where I live (USA), it's as simple as walking into a Walmart, pulling a plastic encased kit off the shelf and paying for cash.

No muss, no fuss. Just activate it at the on-prem McDonalds and you're golden*.

Re: Disappearing messages for Signal

#102

Post by uph »

walterbell wrote: post #99
uph wrote: post #94

Earlier quoted context omitted.

Seems reasonable that an app that's used for messaging my contacts has access to my contacts. What exactly are you nervous about?

Only a small subset of people will be messaged with the app, it does not need access to the entire address book.

They have explained what the permission is needed for http://support.whispersystems.org/hc/en-us/articles/21253585...

They have a privacy policy https://whispersystems.org/signal/privacy/

They have explained their reasoning https://whispersystems.org/blog/contact-discovery/

You have access to the source https://github.com/WhisperSystems

You have proof that they don't store your contacts and can't provide them even after a subpoena https://whispersystems.org/bigbrother/

Again, what exactly are you nervous about? What is gained by removing contact discovery?

Re: Disappearing messages for Signal

#103

Post by secfirstmd »

StavrosK wrote: post #82
walterbell wrote: post #80

Earlier quoted context omitted.

Wire's audio quality is quite good, even on cellular and/or VPN. Haven't compared with Silent Circle.

Oh, I'll give that a go, thanks! I should try Signal again too, hopefully audio quality has improved from the Redphone days.

Yeh it definitely has come on a lot since then

Re: Disappearing messages for Signal

#104

Post by moxie »

walterbell wrote: post #75
laretluval wrote: post #60

Earlier quoted context omitted.

Indeed. It's not just crypto nerds would want to use the service without having to have a smartphone with a phone number. The phone requirement is beyond ridiculous. How did Signal get the reputation it enjoys in the tech community anyway?

Wire ( http://wire.com ) does not need a phone number (register with email on a desktop browser at http://app.wire.com , then login to mobile) and does not need a copy of your contacts. Supports text, image, files, audio, video. E2E encryption is based on Signal protocol. Funded by Skype founder.

Wire does not use Signal Protocol, they used some of our code to create a protocol of their own devising that we do not recommend.

Re: Disappearing messages for Signal

#105

Post by subliminalpanda »

moxie wrote: post #104
walterbell wrote: post #75

Earlier quoted context omitted.

Wire ( http://wire.com ) does not need a phone number (register with email on a desktop browser at http://app.wire.com , then login to mobile) and does not need a copy of your contacts. Supports text, image, files, audio, video. E2E encryption is based on Signal protocol. Funded by Skype founder.

Wire does not use Signal Protocol, they used some of our code to create a protocol of their own devising that we do not recommend.

What are their protocol's shortcomings?

Re: Disappearing messages for Signal

#106

Post by cvwright »

walterbell wrote: post #75
laretluval wrote: post #60

Earlier quoted context omitted.

Indeed. It's not just crypto nerds would want to use the service without having to have a smartphone with a phone number. The phone requirement is beyond ridiculous. How did Signal get the reputation it enjoys in the tech community anyway?

Wire ( http://wire.com ) does not need a phone number (register with email on a desktop browser at http://app.wire.com , then login to mobile) and does not need a copy of your contacts. Supports text, image, files, audio, video. E2E encryption is based on Signal protocol. Funded by Skype founder.

I almost installed Wire this afternoon. Unfortunately this part

> does not need a copy of your contacts

is not quite correct if you read the fine print.

From https://wire.com/legal/

> 5.1 Account ... You agree that if you give the App permission to access your address book, anonymized phone numbers and emails from the address book will be uploaded to the Service for the purpose of connecting users.

Re: Disappearing messages for Signal

#107

Post by cvwright »

moxie wrote: post #104
walterbell wrote: post #75

Earlier quoted context omitted.

Wire ( http://wire.com ) does not need a phone number (register with email on a desktop browser at http://app.wire.com , then login to mobile) and does not need a copy of your contacts. Supports text, image, files, audio, video. E2E encryption is based on Signal protocol. Funded by Skype founder.

Wire does not use Signal Protocol, they used some of our code to create a protocol of their own devising that we do not recommend.

Interesting. Which code of yours are they using now?

After the last flare up on Twitter, I thought they wrote their own implementation, using the Signal code as a reference.

Re: Disappearing messages for Signal

#108

Post by saurik »

rorosaurus wrote: post #73
oconnore wrote: post #9

Earlier quoted context omitted.

If their sense is that -- after configuring 1 week self destruct, the people they're talking to likely won't be keeping months and months of chat logs on their phone anymore -- it's a very true sense of security.

At least until the Jailbreak tweak is released with patches out this feature, allowing people to retain everything they want. I don't disagree that it works for the average user, but I do agree with the sentiment that it is a false sense of security. Unless maybe you cryptographically verify the deletion (is that possible?) and notify the other party of the successful deletion. But even then a copy could be made befo…

Yeah: I kind of want to release such a hack just to make the point (even though I do not use this program nor do I know anyone else who does). This is simply lying to users :/.

Re: Disappearing messages for Signal

#109

Post by saurik »

uph wrote: post #40
kuschku wrote: post #30

Earlier quoted context omitted.

[deleted]

What good is a seatbelt if the person sitting next to you can stab you? The blog post makes a point of this not being secure if the person you're messaging is malicious and that's not what it's for. I think these two comments make good points: I just had an interesting conversation with a friend who was recommending that I use Telegram/Wickr, and I told him that Signal was where it's at. Then he asked me if it had se…

> The usual scenario is a recipient who is not that security-aware and doesn't think about those things that much if at all. Personally, I'd say most of my contact are that way.

Relying on this user to not have disabled your self-destructing messages seems like a really dumb move.

Re: Disappearing messages for Signal

#110

Post by cvwright »

1024core wrote: post #100
drew-y wrote: post #67

Earlier quoted context omitted.

It'd also be nice if the iOS or Chrome client had a chat history backup feature like they have on android. This is one of my biggest complaint with messaging apps in general. I'd like to be able to preserve and archive my chat history with people close to me.

What if the person you're chatting with does not want it archived? (I'm not questioning, but wondering what a protocol would be)

This issue is one of those that make it very difficult to build a single "secure chat" app that does everything for everyone.

Personally, I want an automatic, encrypted network backup of all my messages so I don't lose them if my device is lost or destroyed. But I know lots of folks around here are excited about the automatic delete thing too. It's going to be very hard to make something that all of us can be happy with.

Post reply on HN