Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disappearing messages for Signal

whispersystems.org

Post reply on HN
Print view View original

171–180 of 187 posts

Re: Disappearing messages for Signal

#171

Post by StavrosK »

MereKatMoves wrote: post #86
StavrosK wrote: post #69

Earlier quoted context omitted.

> I still use Silent Circle for calls because it is so tiring to talk when the bitrate is low. To be fair, that's a high bar. Our (SC) phone guys are masters at optimizing audio quality. I would be extremely surprised if any other app (encrypted or not) had significantly better audio quality than Silent Phone.

Having used all the encrypted call possibilities there are , you are, in my opinion, absolutely spot on. SC has exceptional clarity. WA isn't bad. Can you talk more about "our guys" in respect to the fact that the CIA and NSA use the Blackphone? Should I, as a casual business person, be wondering that the handsets you supply to them are in some way compromised? I know that both the NSA and the CIA are interested in m…

As far as I know (and I'm not really very high up in the hierarchy, nor do I know much about the Blackphone hardware), the NSA and CIA are buying them because they are secure. I heard they had a list of phones/apps they are allowed to use internally, and SC was pretty much the only app that made the list at the time.

Keep in mind that "an organization using a secure app" and "an organization wanting to spy on people" are pretty independent goals. I haven't poked around in the client source too much (although I have implemented some stuff for the Android client), but:

1) Nothing in the client seemed out of place. 2) I've seen every line of code running on the web backend and there's nothing untoward going on. 3) Given the culture, I think many of the high-level people would quit before they compromised the product. Especially Phil, who has been sued by the US government for exporting strong cryptography before.

Re: Disappearing messages for Signal

#172

Post by mi100hael »

uph wrote: post #91
Zhenya wrote: post #66

Everytime there is an update, I become more emboldened to continue to push my friends from whatsapp to Signal. I just wish we had way to see what's going on in their server.

https://www.whispersystems.org/bigbrother/ https://github.com/WhisperSystems/TextSecure-Server

The fact that their phone server isn't free makes me somewhat more concerned as time goes on. I used to think it was just because they were busy, then I thought maybe they just wanted more time to refine things, but now it's been nearly two years since they released the current re-vamped Signal 2.0 for iOS and over a year since releasing Signal for Android. At this point I'm running out of justifications for them for why their phone server is still proprietary & closed source.

Re: Disappearing messages for Signal

#173

Post by kuschku »

lorenzhs wrote: post #168
kuschku wrote: post #148

Earlier quoted context omitted.

> LibreSignal was abandoned according to their github, first of all. Yes, because Moxie threatened in the discussion you linked? > Secondly, the issue is that OWS doesn't want "others" using the servers that they own and maintain for Signal The issue is that Moxie refuses to federate, or allow others the right to develop third party apps interfacing with his server (Which, btw, he can’t prohibit in the EU anyway). >…

You're cherry-picking the bits of Jarwain's response that you like to respond to, ignoring the others, yet complain about the discussion culture and being down-voted (which is not appreciated on here) in your original post. Moxie is taking issue with others using the name "Signal", as that would lead to confusion. Forking and using your own name and servers is totally okay with him. And of course you can allow others…

Forking and using your own servers is exactly one of the things about XMPP Moxie hated si much that he created Signal in the first place!

The whole point why Moxie created it is so that everyone is on the same one, to avoid federation issues.

> stributing apps that interface with OWS servers despite their demand that you do not (which is certainly not okay in the EU).

I'm not a lawyer, but:

EU law very specifically allows you to create software interfacing with third party software or services, even if they tell you not to do so, and you can even decompile their software to learn how to do that interfacing (compare §69d UrhG), as long as you don't have to break their ToS doing so. (Which I don't, the only ones possibly breaking the ToS would be the users, and there's also a legal argument that you can't prevent users from modifying the software they use to access your service (see the AdBlockPlus vs. BILD case, LG Hamburg)).

Re: Disappearing messages for Signal

#174

Post by kuschku »

uph wrote: post #155
kuschku wrote: post #147

Earlier quoted context omitted.

> Please cite this. I’m sorry, what was this entire discussion then supposed to mean? https://github.com/LibreSignal/LibreSignal/issues/37#issueco... If they can’t fork it while still using your servers, and you refuse to allow federation, how the FUCK is it open in any way? How are users supposed to be able to verify the software running on their own systems when you only allow binaries compiled by yourself to commu…

> If they can’t fork it while still using your servers, and you refuse to allow federation, how the FUCK is it open in any way? What makes you think you have a right to demand federation? Run your own server if you don't like how they're doing it. You have access to the source under a Free Software license https://github.com/WhisperSystems but of course you don't want to actually do any work, you want to complain abo…

Also, regarding

> but of course you don't want to actually do any work, you want to complain about what other people do because they don't do it in the exact way you want it done for free.

Nah, I don't spend months of my own free time maintaining an open source IRC app, and working on creating tools to make IRC easier for users to use.

I don't actually spend time making open chat systems more useable to users, sure.

That accusation from you doesn't belong at all on HN, and is not only a personal attack, but also wrong.

I could just run a Signal fork with my own servers tomorrow, but one of my goals is to allow users to have one single place where they can send a message to a user, and it will arrive. No matter what service the other user uses, what app, what chat system, if they're on an obscure 20 people IRC network, on Signal, WhatsApp, etc.

My ideal goal would be a universal, federated protocol, but even having libraries for each protocol with a unified API would make things already easier.

And Moxie is fighting for the opposite.

He fights against any compatibility, and suggests I tell my mother to install yet another chat app, ignoring that her phone can't even install Signal in the first place because it only has 3MB of useable memory, left.

You and Moxie actively tell people to create more, and less interconnected, chat networks.

How the fuck is that going to help?

If everyone uses a different secure app, that doesn't help at all! People will just use the systems everyone has (case in point: usage of SMS in the US, or WhatsApp everywhere else), and thereby you ensure no one gets any security.

So stop insulting people you don't know, and claiming untrue motives to be theirs, just so you can justify your actions.

Re: Disappearing messages for Signal

#175

Post by cvwright »

tdkl wrote: post #154
darklajid wrote: post #138

Earlier quoted context omitted.

This is either new or wrong. I just posted a sibling comment to the GP: At least in August it wasn't optional and happened automatically on Android, unless you were running M: The permissions requested during installation (contact access, to even have a way to offer this feature) of the app were exercised without asking for further consent and your contacts were shared with their server unconditionally.

There'a a on/off switch to share contacts under Wire Settings/Options and it's off by default at installation, (it was at the end of August when I started using the service). Don't know though if the app asked for permission to access contacts like it should, since I don't have any device with M. This is from the Privacy whitepaper how they manage the data shared [1] : > Address books are uploaded to backend servers…

> There'a a on/off switch to share contacts under Wire Settings/Options and it's off by default at installation, (it was at the end of August when I started using the service).

Oh, thanks that's good to know. And impossible to find out without just installing the app.

> Entries are then hashed (using SHA- 256) and base-64 encoded before being transmitted to the server.

This signals that they care about privacy, but it doesn't really provide much protection against someone who wants to break it. Maybe it's just about keeping honest people honest. It would be very straightforward to dictionary attack the un-salted hash. Using a password cracking program like HashCat, you could probably recover most of the numbers in a few hours.

Re: Disappearing messages for Signal

#176

Post by Zhenya »

mi100hael wrote: post #172
uph wrote: post #91

Earlier quoted context omitted.

https://www.whispersystems.org/bigbrother/ https://github.com/WhisperSystems/TextSecure-Server

The fact that their phone server isn't free makes me somewhat more concerned as time goes on. I used to think it was just because they were busy, then I thought maybe they just wanted more time to refine things, but now it's been nearly two years since they released the current re-vamped Signal 2.0 for iOS and over a year since releasing Signal for Android. At this point I'm running out of justifications for them for…

I keep thinking about this concept of a "glass server".

They can run it, but allow developers to somehow see running processes, and write (rate-limited) queries to test things.

I haven't solidified this concept in my head but it seems like a step towards federation without the problems of federation.

Re: Disappearing messages for Signal

#177

Post by mi100hael »

Zhenya wrote: post #176
mi100hael wrote: post #172

Earlier quoted context omitted.

The fact that their phone server isn't free makes me somewhat more concerned as time goes on. I used to think it was just because they were busy, then I thought maybe they just wanted more time to refine things, but now it's been nearly two years since they released the current re-vamped Signal 2.0 for iOS and over a year since releasing Signal for Android. At this point I'm running out of justifications for them for…

I keep thinking about this concept of a "glass server". They can run it, but allow developers to somehow see running processes, and write (rate-limited) queries to test things. I haven't solidified this concept in my head but it seems like a step towards federation without the problems of federation.

Hmm that's an interesting idea. I'm assuming their phone server is Java, same as their text server, so the builds should theoretically be identically reproducible for both. It seems like it should be possible to include a field in each response with some sort of signature so users can verify which build is serving requests. It'd have to be in every response so that they can't just reverse-proxy /status to the valid build and serve other requests from a modified build, and it'd have to be somehow dependent on some changing external factor or input so they can't just hard-code the valid build's signature.

Re: Disappearing messages for Signal

#178

Post by lenish »

lorenzhs wrote: post #166
lenish wrote: post #87

Earlier quoted context omitted.

It is a similar problem, however: https://en.wikipedia.org/wiki/Birthday_problem#Same_birthday...

That's still not the problem considered here. You're not asking "does anyone have the key I'm seeing here", you're asking "does this person next to me have the key I'm seeing here". No birthday paradoxes of any kind involved.

Forgive me, as I haven't used signal, but I don't see how whether they are sitting next to you or not changes the problem.

If I can generate a key that hashes to the same value as your key, I can convince anyone I am you. If I can generate a second collision for a third party's key, I can convince you you are talking to that third party, as well. Generating hash collisions is, as I understand it, pretty well modelled with the birthday paradox (and variations like the one I linked). Physical proximity seems entirely unrelated.

Re: Disappearing messages for Signal

#179

Post by uph »

kuschku wrote: post #174
uph wrote: post #155

Earlier quoted context omitted.

> If they can’t fork it while still using your servers, and you refuse to allow federation, how the FUCK is it open in any way? What makes you think you have a right to demand federation? Run your own server if you don't like how they're doing it. You have access to the source under a Free Software license https://github.com/WhisperSystems but of course you don't want to actually do any work, you want to complain abo…

Also, regarding > but of course you don't want to actually do any work, you want to complain about what other people do because they don't do it in the exact way you want it done for free. Nah, I don't spend months of my own free time maintaining an open source IRC app, and working on creating tools to make IRC easier for users to use. I don't actually spend time making open chat systems more useable to users, sure.…

> My ideal goal would be a universal, federated protocol, but even having libraries for each protocol with a unified API would make things already easier.

And Moxie is fighting for the opposite.

Yet here you are, pissed off that your goals don't align with someone elses. Use your open source IRC app to talk to your mom and I'll use Signal to talk with mine. No one is forcing you to do anything. Considering your goals and ideas are superior surely whatever you're suggesting will become the one service everyone uses, problem solved.

Re: Disappearing messages for Signal

#180

Post by kuschku »

uph wrote: post #179
kuschku wrote: post #174

Earlier quoted context omitted.

Also, regarding > but of course you don't want to actually do any work, you want to complain about what other people do because they don't do it in the exact way you want it done for free. Nah, I don't spend months of my own free time maintaining an open source IRC app, and working on creating tools to make IRC easier for users to use. I don't actually spend time making open chat systems more useable to users, sure.…

> My ideal goal would be a universal, federated protocol, but even having libraries for each protocol with a unified API would make things already easier. And Moxie is fighting for the opposite. Yet here you are, pissed off that your goals don't align with someone elses. Use your open source IRC app to talk to your mom and I'll use Signal to talk with mine. No one is forcing you to do anything. Considering your goals…

> surely whatever you're suggesting will become the one service everyone uses, problem solved.

That shows even more how much you misunderstand the entire market even worse than Google does.

An app can’t win because it is the best, but only through network lock-in effects (which Moxie tries to use for Signal, too) and marketing combined.

Post reply on HN