Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Worried About the Privacy of Your Messages? Download Signal

nytimes.com

Post reply on HN
Print view View original

131–140 of 247 posts

Re: Worried About the Privacy of Your Messages? Download Signal

#131

Post by uselpa »

zi0nman wrote: post #65
maxerickson wrote: post #51

Earlier quoted context omitted.

Signal never shares message content with the server. Telegram does so by default, you have to opt in to keep messages private from the server. You also see a lot of people criticizing the design of the secure Telegram protocol and praising the Signal protocol. There were some stories about governments actively compromising Telegram's security. There haven't been any about Signal. So if you are worried about privacy m…

Yes I'm seeing a lot of people criticizing Telegram on Twitter and in media. But after doing some research I couldn't find any proof of their claims that Telegram have a broken crypto. You can use secret chats, those messages are not stored on the company server.

It seems to be official now that Telegram has been hacked over and over again (article in German): https://netzpolitik.org/2016/bundeskriminalamt-knackt-44-tel...

Re: Worried About the Privacy of Your Messages? Download Signal

#132

Post by hannob »

arglebarnacle wrote: post #72

There are a lot of people on this thread crapping on Signal for its various flaws and downsides. It's nice to be smarter and more informed than everyone, but for the rest of us we really need advice about what we SHOULD do if we want a baseline amount of privacy from mass surveillance. I'm honestly asking here--I don't have the knowledge that many in this community do about the exact risk of Signal requiring Google P…

Use Signal. It's the best you can get right now.

I understand all the concerns people have about Signal and I share most of them. But these discussions really are for people who want to build something better, not for people who look for something they can use now.

Re: Worried About the Privacy of Your Messages? Download Signal

#133

Post by resonanttoe »

_b8r0 wrote: post #14

All the privacy solutions on the market are varying degrees of bad (from a privacy/security/freedom perspective), by which I mean they're all flawed in their own ways. Signal requires Google Play Services on Android. That means it's put simply not a privacy messenger. Yes there's crypto, but it's also tied into Whisper Systems' infrastructure, there's no federation. I use Signal reluctantly, and only on IOS. Threema,…

Geniune question. For Wire: what is missing from what code they have available?

https://github.com/wireapp

Re: Worried About the Privacy of Your Messages? Download Signal

#134

Post by bad_user »

woah wrote: post #113
ekidd wrote: post #106

Earlier quoted context omitted.

Thank you! tl;dr: You can fork the Signal code if you want, but if you do, Moxie Marlinspike asks you to change the app name and run your own servers. The server source code appears to be available at https://github.com/WhisperSystems/Signal-Server , but I've heard it doesn't include the voice component. So, for example, if you think that Signal ought to support a feature like iMessage's "Invisible Ink" ( https://mic…

I didn't realize that open source licenses required the maintainers to run infrastructure for you.

Open source requires the ability to fork and Signal isn't forkable.

Re: Worried About the Privacy of Your Messages? Download Signal

#135

Post by joecool1029 »

wonks wrote: post #80
cyberpunk wrote: post #11

Earlier quoted context omitted.

But.. But! Everyone in the geek press said it's "end to end" encrypted! That must mean it's totally safe! I'm sure everyone is reading the source code and building their own clients all the time, yea? Didn't some uber hacker somewhere with a big beard say that he read all the code and it's totally fucking solid and government proof? Surely you don't mistrust all that do you... I mean... Your seem a bit dubious. You c…

The lack of federation is unnerving, but the main server-less alternative I know of is PGP or maybe OTR, and PGP is way too hard for most people IMO. Also, OTR doesn't trust the fingerprint from first messages, so even that introduces an extra hoop to jump through.

For E2E? there's essentially PGP (sucks, see thread from the other day. worst user experience and questionable longterm security), OTR (most used, still annoying to have to re-establish sessions on restart, no multi-device), and OMEMO (based on signal, should be the future for XMPP). You could include most proprietary solutions like iMessage that usually miss authentication or are done unsafely.

OTR not trusting fingerprint is the default case for any authenticated standard. gnupg requires that you set the trust on a key. Signal allows it initially, warns if it changes.

For all the above though, they aren't a packaged solution that is user friendly. Conversations is a great android client, but there's sadly nothing comparable on iOS (chatsecure, but it's alpha status still). The desktop situation is hit and miss too (I was a pidgin user and moved to bitlbee for OTR, still don't have an omemo solution... though my setup doesn't need it through a TLS secured ZNC).

Re: Worried About the Privacy of Your Messages? Download Signal

#136

Post by kuschku »

woah wrote: post #113
ekidd wrote: post #106

Earlier quoted context omitted.

Thank you! tl;dr: You can fork the Signal code if you want, but if you do, Moxie Marlinspike asks you to change the app name and run your own servers. The server source code appears to be available at https://github.com/WhisperSystems/Signal-Server , but I've heard it doesn't include the voice component. So, for example, if you think that Signal ought to support a feature like iMessage's "Invisible Ink" ( https://mic…

I didn't realize that open source licenses required the maintainers to run infrastructure for you.

And I didn’t realize companies can prevent people from using or creating third-party clients.

Especially if the original client is under an open source license.

Re: Worried About the Privacy of Your Messages? Download Signal

#137

Post by shadowban_me »

pwelch wrote: post #73
saycheese wrote: post #52

Earlier quoted context omitted.

What is the device and its version? What iOS version is being used? At the very least Signal requires iOS 8.0 or later.

Yeah thought of that. Made sure it was on the latest version and rebooted. Still didn't work.

It's on a device management policy, just not his.

Re: Worried About the Privacy of Your Messages? Download Signal

#138

Post by kuschku »

JustSomeNobody wrote: post #102
_b8r0 wrote: post #14

All the privacy solutions on the market are varying degrees of bad (from a privacy/security/freedom perspective), by which I mean they're all flawed in their own ways. Signal requires Google Play Services on Android. That means it's put simply not a privacy messenger. Yes there's crypto, but it's also tied into Whisper Systems' infrastructure, there's no federation. I use Signal reluctantly, and only on IOS. Threema,…

Re: Google Play Services. Here's is the way I understand this to work, so please do correct me if I'm wrong. Signal uses Google Play Services to notify me that I have an incoming message from Signal. The Signal app is then woken up and the signal app then retrieves my (encrypted) message. So, therefore, the only thing Google knows is that I received a Signal message, what time and if I have location services on, wher…

> So, therefore, the only thing Google knows is that I received a Signal message, what time and if I have location services on, where I was at the time, yes?

Considering that Signal compiles code from Google into their app, there’s an actual issue there: the Google code could just intercept and take control of any of the messages. And there’s a lot of code from Google in there that no one has audited yet.

Re: Worried About the Privacy of Your Messages? Download Signal

#139

Post by kuschku »

zedred wrote: post #98
mei0Iesh wrote: post #79

Earlier quoted context omitted.

You can't list a bunch of serious claims like the audio can be reconstructed with no additional information. There was a feud between the Signal people and Wire, so there is a lot of false info trying to smear Wire. GIF searches are obviously going to use a 3rd party service, and nobody should expect some kind of anonymous encrypted channel for GIF searches. That's ridiculous. I've not seen any lying about being open…

> GIF searches are obviously going to use a 3rd party service, and nobody should expect some kind of anonymous encrypted channel for GIF searches. That's ridiculous. GIF searches aren't being transmitted to a third party service, they're being transmitted directly to Wire in plaintext: https://github.com/wireapp/wire-android-sync-engine/blob/4d5... There's tons of stuff like that which leaks in the app. They store yo…

> They store your entire contact list server-side, your plaintext group membership, group info like plaintext group name and plaintext group avatar, etc etc.

One has to remember that Signal also stores some social graph data, which is equally problematic.

I can’t reocmmend either.

Re: Worried About the Privacy of Your Messages? Download Signal

#140

Post by kuschku »

viridian wrote: post #93
reacharavindh wrote: post #29

Earlier quoted context omitted.

Thanks for that link. I'll go through the build process and play with the apk. But even if I wanted to build my own apk, and run it on my custom Android build, it would'nt work right? Because of the need for Google Play store? Verifiable builds are atleast a step in the right direction.

Why do you need the play store? You can install apk files without it just fine, if you have the appropriate dev options enabled in your phone.

Signal requires the Google Play Services to work, and includes several proprietary libraries from Google in their app, too.
Post reply on HN