Who exactly uses Signal? Why do you think it's secure?
Disappearing messages for Signal
141–150 of 187 posts
Re: Disappearing messages for Signal
#142Earlier quoted context omitted.
It'd also be nice if the iOS or Chrome client had a chat history backup feature like they have on android. This is one of my biggest complaint with messaging apps in general. I'd like to be able to preserve and archive my chat history with people close to me.
What if the person you're chatting with does not want it archived? (I'm not questioning, but wondering what a protocol would be)
Suppose that you are chatting to me. You don't want your messages archived in any way.
I really want to keep records, so I have a second device, and take a picture of the screen every time I get a message of you.
There is no software or protocol that can entirely eliminate this human problem. The two parties have to have some level of agreement and trust.
Re: Disappearing messages for Signal
#143Cool feature, though it'd be nice if Signal fixed the message delay and message dropping problem. But Signal uses the proprietary GCM service (because "it's impossible to do message sending correctly, so let's force people to use proprietary software") so they probably can't fix it...
No one is forcing you to use proprietary software. See this comment from moxie https://news.ycombinator.com/item?id=10665520 Using GCM is only a problem for people running a custom Android ROM without Google Play Services. Using GCM doesn't make Signal less private. Google doesn't see any data via gcm, it's just a tickle. If you want push messages, you gotta use a push network. https://twitter.com/whispersystems/stat…
> Using GCM is only a problem for people running a custom Android ROM without Google Play Services. Using GCM doesn't make Signal less private.
The issue is not privacy, it's the use of a proprietary service. Now, GsmCore from microG does solve the problem somewhat. But then you have to ask "where will you get the app from?". The answer is "not F-Droid because moxie doesn't like it". So you have three options for actually installing the app and keeping it up to date:
1. Use the Google Play Store (proprietary). 2. Build the app yourself and keep it up to date yourself (not fun and doesn't help anyone other than me). 3. Use an unofficial FDroid repo (or do step 2 and host the repo myself). This option means that you have some random administrator controlling updates. I actually agree with moxie that FDroid really should add developer signatures to packages (though IMO the desktop GNU/Linux model of package updates is actually fairly solid -- though you don't have the Open Build Service for android packages :P).
Overall, the choices are a shit-show. Now, I get that it isn't of concern to moxie what people like me have to do to get this to work with their phones. That's fine, I understand. But that doesn't mean that I'm not going to mention it if I get the chance -- because it does legitimately make things harder for me. I get that free software on phones isn't a big concern to many people, but it is to me.
> Considering how a small minority complain about this everytime Signal is mentioned you'd think they'd do something about it, but take a look at that Bountysource link and you'll see 8 backers. Guess complaining is easier.
I contribute (both code and money, and also as part of my day job) to many free software projects, but I refuse to contribute to a project which actively encourages the use of proprietary software in order to use it properly. I get that it makes things easier for users, but that doesn't make it right. So maybe you shouldn't be so condescending?
Re: Disappearing messages for Signal
#144Earlier quoted context omitted.
Wire ( http://wire.com ) does not need a phone number (register with email on a desktop browser at http://app.wire.com , then login to mobile) and does not need a copy of your contacts. Supports text, image, files, audio, video. E2E encryption is based on Signal protocol. Funded by Skype founder.
Wire uploads your contacts to their service by default (on Android before M, because you nodded at the installation or something). No post installation popup asking you if you want to share them. (August 2016) Wire has not even a way to remove contacts. I'm not kidding. After the faux pas above I had random 'Wire contacts' that it discovered for me, based on a combination of 'in my address book' and 'in their address…
I use Apple iOS, where the operating system allows users to default deny contact access to all apps, with explicit whitelisting from Settings. Wire worked perfectly without access to my contacts on iOS. Signal refused to work without contact access, when iOS prevented Signal from accessing contacts.
I am sorry to hear about your Android experience, but I abandoned that platform long ago because of confusing management of per-app permissions, along with Google's penchant for data collection. Wire users on Android should try to get Wire developers to improve the control options on that platform, they usually respond within a few days to support requests.
I almost bought a separate iOS phone just to run Signal without access to contacts. Since Wire came along, that is no longer necessary and I can use Wire without a phone number.
Re: Disappearing messages for Signal
#145Earlier quoted context omitted.
They have explained what the permission is needed for http://support.whispersystems.org/hc/en-us/articles/21253585... They have a privacy policy https://whispersystems.org/signal/privacy/ They have explained their reasoning https://whispersystems.org/blog/contact-discovery/ You have access to the source https://github.com/WhisperSystems You have proof that they don't store your contacts and can't provide them even af…
I'm not the poster who you replied to, but - Just because someone explains their reasoning, doesn't mean you have to agree with them :) I don't particularly want to send Signal a list of contacts - I'd rather not leak that information about my social graph. I understand how they want to use that information for discovery, so they can know who already uses the app.. But for my needs, this isn't necessary. I'd prefer t…
For those who do not understand the economic incentives associated with social graphs, have a chat with Facebook, LinkedIn and Palantir. Or read about the reasons why mobile platforms were forced to implement access control policy for contacts, after apps began bulk-uploading valuable social graph data.
Re: Disappearing messages for Signal
#146Earlier quoted context omitted.
At least until the Jailbreak tweak is released with patches out this feature, allowing people to retain everything they want. I don't disagree that it works for the average user, but I do agree with the sentiment that it is a false sense of security. Unless maybe you cryptographically verify the deletion (is that possible?) and notify the other party of the successful deletion. But even then a copy could be made befo…
Yeah: I kind of want to release such a hack just to make the point (even though I do not use this program nor do I know anyone else who does). This is simply lying to users :/.
[deleted]
Re: Disappearing messages for Signal
#147Earlier quoted context omitted.
Actually, Moxie has threatened to shut LibreSignal down if they allow LibreSignal users to message normal Signal users, and refused to even discuss alternative solutions. He also uses the GCM library from Google, which pulls in several analytics libraries into the APK, so "Using GCM doesn't make Signal less private." is objectively false. (And in addition to that, Moxie even refuses to allow any distribution that doe…
> Moxie has threatened to shut LibreSignal down if they allow LibreSignal users to message normal Signal users, and refused to even discuss alternative solutions. Please cite this. To my knowledge I never threatened anything, and your comment is a response to a quote from the discussion about LibreSignal, where I suggest that they submit a PR with the functionality they desire to Signal. Is that not an alternative? >…
> Please cite this.
I’m sorry, what was this entire discussion then supposed to mean? https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
If they can’t fork it while still using your servers, and you refuse to allow federation, how the FUCK is it open in any way?
How are users supposed to be able to verify the software running on their own systems when you only allow binaries compiled by yourself to communicate with your users, abusing the lock-in effect?
> Could you cite this as well?
Have you actually read the code that gets compiled in when you depend on play-services-base and play-services-gcm?
As I happen to have reversed all of it to write an open source library for GCM, I have. And let me tell you, most of the code in there is "measurement"-code.
> What do you mean by "full analytics?"
Distributing through any means where the user can get the app without being required to be fully tracked by the Google Play Services?
You only distribute through the Play Store, which doesn’t fully work with microG at the moment, requiring users to install spyware on their devices.
Re: Disappearing messages for Signal
#148Earlier quoted context omitted.
Actually, Moxie has threatened to shut LibreSignal down if they allow LibreSignal users to message normal Signal users, and refused to even discuss alternative solutions. He also uses the GCM library from Google, which pulls in several analytics libraries into the APK, so "Using GCM doesn't make Signal less private." is objectively false. (And in addition to that, Moxie even refuses to allow any distribution that doe…
Could it be because some of your information is spun/misleading? LibreSignal was abandoned according to their github, first of all. Secondly, the issue is that OWS doesn't want "others" using the servers that they own and maintain for Signal.[1] As far as I understand, they disapprove of people using the name Signal or TextSecure or Redphone for their forks, due to confusion by users who believe that the fork is actu…
> LibreSignal was abandoned according to their github, first of all.
Yes, because Moxie threatened in the discussion you linked?
> Secondly, the issue is that OWS doesn't want "others" using the servers that they own and maintain for Signal
The issue is that Moxie refuses to federate, or allow others the right to develop third party apps interfacing with his server (Which, btw, he can’t prohibit in the EU anyway).
> Afaik, he also encourages people who don't like the GCM build in Signal to swap it out with the rewritten open source one and build with that.
Yet he threatens anyone trying to distribute an alternative build with it stripped out.
How the fuck is that open source development, if you threaten anyone forking it, and don’t allow any PRs that could make it more open, AND refuse to allow federation? That’s not any better than just using Facebook Messenger.
Re: Disappearing messages for Signal
#149Earlier quoted context omitted.
Downvoting this comment without offering a counterpoint is very bad etiquette. Can someone provide a counterargument? Otherwise it's just pretty much censorship.
I do not think "censorship" means what you think it means. Censorship would be moderators deleting something. Making claims without citations is fully in play to downvote.
I guess you're right about the censorship part, but still, just downvoting comments without replying is not useful to anyone. The comments above that reply clarifying the situation are much more informative.
Re: Disappearing messages for Signal
#150Earlier quoted context omitted.
Looking at WhatsApps security whitepaper: "WhatsApp calls are also end-to-end encrypted When a WhatsApp user initiates a call: 1 The initiator builds an encrypted session with the recipient (as outlined in Section Initiating Session Setup), if one does not already exist 2 The initiator generates a random 32-byte SRTp master secret 3 The initiator transmits an encrypted message to the recipient that signals an incomin…
SRTP and ZRTP is only for negotiating what to use. You can still use different codecs. I'd guess Wire, WA and SC use opus (since it is by far the best), while signal is still using speex. ZRTP makes negotiation possible, so a roll-out of opus should be possible without breaking older clients.
Unless this is some non-standard variant, ZRTP only negotiates a key exchange for use when encrypting the audio packets (the 'S' in 'SRTP'). Neither of those protocols has anything to do with codec selection, which is done via a SDP sent over SIP, or some other signaling protocol.