Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Worried About the Privacy of Your Messages? Download Signal

nytimes.com

Post reply on HN
Print view View original

61–70 of 247 posts

Re: Worried About the Privacy of Your Messages? Download Signal

#61

Post by zedred »

m3ta wrote: post #55
lima wrote: post #48

Earlier quoted context omitted.

It doesn't have the scrutiny regarding cryptography and implementation that Signal has had.

They claim to have secure end-to-end encryption. In fact, I would say using wire.com is better than Signal because Signal does not make any guarantee of anonymity. With the wire desktop app you can take steps to anonymize your connection to their server, although on a mobile device it's probably roughly equivalent to Signal. Also, here is a handy chart that compares the differences between these two services (and oth…

You're promoting Wire for anonymity? Check out their privacy policy, Wire maintains a server side copy of your entire contact list, all the groups that you're in, the plaintext metadata for your groups (membership, plaintext group title, plaintext group avatar), etc etc.

They have broken voice encryption, and leak enough data to reconstruct the audio of your calls. They leak tons of plaintext directly back to themselves, like GIF searches, and rolled their own messaging crypto that experts say is broken.

They have been caught lying about what kind of encryption they provide, they lied about being open source for years, they lied about being based in switzerland. From what I can tell, the only people promoting Wire after all that are usually on Wire's marketing team.

Re: Worried About the Privacy of Your Messages? Download Signal

#62

Post by antocv »

visarga wrote: post #60

But downloading Signal after news like these will tag people as trying to hide something from the state.

Not only tag, but also get their identity and possibly use backdoors, because Signal is only on Google Play, which in order to access it requires a gazillion identifying data.

Signal is a joke if your adversary is NSA and its likes. You cant run Signal unless you give up who you are, and that you are using it, and its not very difficult to analyze _when_ you receiveor send a message due to the Signal requiring google messaging system.

Signal should just really rename itself to "Google Signal, no really we are not evil for certain."

Re: Worried About the Privacy of Your Messages? Download Signal

#63

Post by arglebarnacle »

visarga wrote: post #60

But downloading Signal after news like these will tag people as trying to hide something from the state.

I think it is a mistake to buy into the logic that using encryption means you have something to hide.

Regardless of the framing of the article, many people likely read this and thought, "yes, it would be nice to be confident my messaging is private even from mass government surveillance."

This does not mean they are drug dealers. It means that they have concluded wide-dragnet surveillance programs are worth opting out of, especially if it's very easy to do so.

Re: Worried About the Privacy of Your Messages? Download Signal

#64

Post by tekromancr »

joecool1029 wrote: post #46
whyever wrote: post #39

Earlier quoted context omitted.

You call that a temper tantrum? I thought he was being very reasonable.

We'll agree to disagree. If he said "Please don't use our servers with your custom client, shit might break. You could run your own infra and keep it up to date with us and we'll federate", this would be reasonable. Instead, if you read that thread a bit more he throws up his hands and says federation is a thing of the past because he had a bad experience with CM. Yeah, because we don't still use federated standards…

Yes, and because it's a federated protocol, it still sends every damn thing in cleartext by default.

Re: Worried About the Privacy of Your Messages? Download Signal

#65

Post by zi0nman »

maxerickson wrote: post #51
zi0nman wrote: post #47

I am really interested why Signal. Why not Telegram? I prefer Telegram over Signal because of much more better UI and rich functionalities i.e. bots. Signal app seems clunky and buggy. That's my 2 cents.

Signal never shares message content with the server. Telegram does so by default, you have to opt in to keep messages private from the server. You also see a lot of people criticizing the design of the secure Telegram protocol and praising the Signal protocol. There were some stories about governments actively compromising Telegram's security. There haven't been any about Signal. So if you are worried about privacy m…

Yes I'm seeing a lot of people criticizing Telegram on Twitter and in media. But after doing some research I couldn't find any proof of their claims that Telegram have a broken crypto.

You can use secret chats, those messages are not stored on the company server.

Re: Worried About the Privacy of Your Messages? Download Signal

#67

Post by antocv »

cyberpunk wrote: post #43
_b8r0 wrote: post #14

All the privacy solutions on the market are varying degrees of bad (from a privacy/security/freedom perspective), by which I mean they're all flawed in their own ways. Signal requires Google Play Services on Android. That means it's put simply not a privacy messenger. Yes there's crypto, but it's also tied into Whisper Systems' infrastructure, there's no federation. I use Signal reluctantly, and only on IOS. Threema,…

Chaps. I think it's time we just admitted that everything we type/tap/say into any device, regardless of how it's being wrapped up in transit, is absolutely and irrepairably insecure and we're not going to be able to fix that anytime soon. Even with really smart crypto or some slick app; what makes you think that your messages aren't just being read by your os? Would you really notice? Why would you assume that the a…

> I think it's time we just admitted that everything we type/tap/say into any device, regardless of how it's being wrapped up in transit, is absolutely and irrepairably insecure and we're not going to be able to fix that anytime soon.

We dont have to set the bar that high. Just lower it slightly and we can achieve great success.

Can we make the job of NSA and CIA harder? Not necessarily impossible, just to increase the costs they have to spend on whatever it is they are doing, much higher than it is now.

That would be nice.

We can do that with bitmessage, avoid Signal, use Telegram which means outsource to Russia/KGB - so NSA will for sure need to spend more resources if they want to access your "secure chat" on Telegram.

EDIT: but of course, as you say, the problem is socio systematic - any technical system which can or would be used to subvert the state is a threat to the state and will be neutrialized, by takeover, sabotage, lack of funding, the means the state has are enormous. The list we have of secure or safe systems are still zero. Only another state can go against the state.

For example, it was mandated that GSM had backdoors. Any system used for communication, especially mass/group communication, is not free and not allowed to exist. So simple is that. They even tried to go after the creators of secure systems, wasnt the PGP guy scrutinized?

Re: Worried About the Privacy of Your Messages? Download Signal

#68

Post by xnull2guest »

I'm worried about the freedom of dissenting opinion in civil society from surveillance, not the privacy of my messages. Privacy is something I would easily give up for such freedom.

Signal seems to me to one tool in a large profile to maintain freedom of information dissemination and information gathering activity.

It seems to me that speaking to a large number of people anonymously is not possible with any of the existing tools, Signal included, and it seems that this set of tools is the next set that is needed.

Candidates for this include implementations of "Dining Cryptographer Nets," though there exist scalability and DoSability concerns.

Re: Worried About the Privacy of Your Messages? Download Signal

#69

Post by arglebarnacle »

antocv wrote: post #62
visarga wrote: post #60

But downloading Signal after news like these will tag people as trying to hide something from the state.

Not only tag, but also get their identity and possibly use backdoors, because Signal is only on Google Play, which in order to access it requires a gazillion identifying data. Signal is a joke if your adversary is NSA and its likes. You cant run Signal unless you give up who you are, and that you are using it, and its not very difficult to analyze _when_ you receiveor send a message due to the Signal requiring google…

Most people only have the NSA as an adversary in the minimal sense that they're caught up in a very broad mass surveillance net. It's true that if you're a whistleblower with sensitive government information Signal is not a complete solution for you. But who cares? Almost nobody is in that situation, and people in that situation have access to other tools that actually do help.

Your last sentence is extremely unfair to Signal and dramatically underrates the privacy it provides to ordinary people. It's dangerous to suggest that because it requires a phone number and lives on an app store it provides no useful protection at all, because that implies it's no better than e.g. WhatsApp when in fact it has a much better featureset.

Re: Worried About the Privacy of Your Messages? Download Signal

#70

Post by [deleted] »

zedred wrote: post #61
m3ta wrote: post #55

Earlier quoted context omitted.

They claim to have secure end-to-end encryption. In fact, I would say using wire.com is better than Signal because Signal does not make any guarantee of anonymity. With the wire desktop app you can take steps to anonymize your connection to their server, although on a mobile device it's probably roughly equivalent to Signal. Also, here is a handy chart that compares the differences between these two services (and oth…

You're promoting Wire for anonymity? Check out their privacy policy, Wire maintains a server side copy of your entire contact list, all the groups that you're in, the plaintext metadata for your groups (membership, plaintext group title, plaintext group avatar), etc etc. They have broken voice encryption, and leak enough data to reconstruct the audio of your calls. They leak tons of plaintext directly back to themsel…

[deleted]
Post reply on HN