Worried About the Privacy of Your Messages? Download Signal • Hacker News Board

Re: Worried About the Privacy of Your Messages? Download Signal

#151

Post by JustSomeNobody » Thu, Dec 08, 2016, 10:06 PM UTC

kuschku wrote: post #138

JustSomeNobody wrote: post #102

Earlier quoted context omitted.

Re: Google Play Services. Here's is the way I understand this to work, so please do correct me if I'm wrong. Signal uses Google Play Services to notify me that I have an incoming message from Signal. The Signal app is then woken up and the signal app then retrieves my (encrypted) message. So, therefore, the only thing Google knows is that I received a Signal message, what time and if I have location services on, wher…

> So, therefore, the only thing Google knows is that I received a Signal message, what time and if I have location services on, where I was at the time, yes? Considering that Signal compiles code from Google into their app, there’s an actual issue there: the Google code could just intercept and take control of any of the messages. And there’s a lot of code from Google in there that no one has audited yet.

What about on iOS? Couldn't the libraries that are used on iOS do the same?

Re: Worried About the Privacy of Your Messages? Download Signal

#152

Post by hackuser » Thu, Dec 08, 2016, 10:07 PM UTC

zedred wrote: post #61

m3ta wrote: post #55

Earlier quoted context omitted.

They claim to have secure end-to-end encryption. In fact, I would say using wire.com is better than Signal because Signal does not make any guarantee of anonymity. With the wire desktop app you can take steps to anonymize your connection to their server, although on a mobile device it's probably roughly equivalent to Signal. Also, here is a handy chart that compares the differences between these two services (and oth…

You're promoting Wire for anonymity? Check out their privacy policy, Wire maintains a server side copy of your entire contact list, all the groups that you're in, the plaintext metadata for your groups (membership, plaintext group title, plaintext group avatar), etc etc. They have broken voice encryption, and leak enough data to reconstruct the audio of your calls. They leak tons of plaintext directly back to themsel…

Could you provide something that backs up these claims?

Re: Worried About the Privacy of Your Messages? Download Signal

#153

Post by eric_the_read » Thu, Dec 08, 2016, 10:12 PM UTC

james_pm wrote: post #88

I continue to be disappointed by headlines like, "Worried About the Privacy of Your Messages? Download Signal" which implies that only some people should be worried about privacy. You'd think that the revelations about the NSA, things like the UK law that requires ISPs to collect and store your Internet browsing history would have more people "worried" but yet it's still pretty much a lost cause to try to explain to…

It's pure exhaustion in my case. I can (and did, for a while last year) switch to Signal, but even getting my wife to care enough to bother was more work than I was willing to put in at the time, and she's the one person in the world who's most likely to listen to me. There's basically nobody else in my social circle who'd bother if she won't.

Re: Worried About the Privacy of Your Messages? Download Signal

#154

Post by eridius » Thu, Dec 08, 2016, 10:22 PM UTC

pwelch wrote: post #19

I found a weird issue on a friends phone when I suggested they download it for iOS. It says "This item is no longer available". They were able to download other apps from the store. When emailing Signal support they said nothing was wrong on their end. Still havent figured out why my friend cant download Signal from Apple App Store.

Which country store were they on?

Re: Worried About the Privacy of Your Messages? Download Signal

#155

Post by pdx » Thu, Dec 08, 2016, 10:29 PM UTC

xnull2guest wrote: post #68

I'm worried about the freedom of dissenting opinion in civil society from surveillance, not the privacy of my messages. Privacy is something I would easily give up for such freedom. Signal seems to me to one tool in a large profile to maintain freedom of information dissemination and information gathering activity. It seems to me that speaking to a large number of people anonymously is not possible with any of the ex…

  > It seems to me that speaking to a large number of people anonymously is not possible with 
  > any of the existing tools, Signal included

While it's still at the testnet stage, I have very high hopes for Maidsafe's SAFEnet. This will allow a completely anonymous internet, providing both users and publishers complete anonymity. Upon release of the actual network, it will live in the wild, just like bitcoin, with no company in control of it. Maidsafe's business model is to be one of many developers that will consult to companies who want to migrate their data storage onto the network. The network itself will be controlled by nobody.

It's peer to peer, but there are intermediate nodes which isolate content storage from those who view it, so neither IP addresses of storage nodes nor IP addresses of content consumers can be determined. Since there is no centralization, there's nobody for state actors to attack, legally or by force. All traffic is encrypted and even the ports are randomized, to avoid state firewalls from determining what the traffic is and blocking it.

I think it's our best hope to distribute large amounts of data to the world and avoid the censorship that many countries already have and that even those of us in the west see looming upon us.

You can learn more about it at https://safenetwork.org/ and https://safenetwork.org/documentation/ and https://safenetforum.org/

Re: Worried About the Privacy of Your Messages? Download Signal

#156

Post by [deleted] » Thu, Dec 08, 2016, 10:43 PM UTC

zedred wrote: post #61

m3ta wrote: post #55

Earlier quoted context omitted.

They claim to have secure end-to-end encryption. In fact, I would say using wire.com is better than Signal because Signal does not make any guarantee of anonymity. With the wire desktop app you can take steps to anonymize your connection to their server, although on a mobile device it's probably roughly equivalent to Signal. Also, here is a handy chart that compares the differences between these two services (and oth…

You're promoting Wire for anonymity? Check out their privacy policy, Wire maintains a server side copy of your entire contact list, all the groups that you're in, the plaintext metadata for your groups (membership, plaintext group title, plaintext group avatar), etc etc. They have broken voice encryption, and leak enough data to reconstruct the audio of your calls. They leak tons of plaintext directly back to themsel…

[deleted]

Re: Worried About the Privacy of Your Messages? Download Signal

#157

Post by mei0Iesh » Thu, Dec 08, 2016, 10:48 PM UTC

zedred wrote: post #98

mei0Iesh wrote: post #79

Earlier quoted context omitted.

You can't list a bunch of serious claims like the audio can be reconstructed with no additional information. There was a feud between the Signal people and Wire, so there is a lot of false info trying to smear Wire. GIF searches are obviously going to use a 3rd party service, and nobody should expect some kind of anonymous encrypted channel for GIF searches. That's ridiculous. I've not seen any lying about being open…

> GIF searches are obviously going to use a 3rd party service, and nobody should expect some kind of anonymous encrypted channel for GIF searches. That's ridiculous. GIF searches aren't being transmitted to a third party service, they're being transmitted directly to Wire in plaintext: https://github.com/wireapp/wire-android-sync-engine/blob/4d5... There's tons of stuff like that which leaks in the app. They store yo…

Thanks for trying, but it appears to me you're paranoid. The user directory in Wire is public. It is no secret that you're on there. They need information about whom you're connected to for the service to work. I'm not worried about GIF searches, or contact list. I'd prefer the contents of my conversations with family weren't archived on remote servers. Wire accomplishes that in the best way. It's a useless academic concern that audio level information would be in headers, and the paper you linked is of no relevance. I still see no reason why I'd not want to use Wire. For talking to family and friends in a reasonably private way we cannot get from using services from Facebook and Google, I think Wire is an excellent application.

Re: Worried About the Privacy of Your Messages? Download Signal

#158

Post by mei0Iesh » Thu, Dec 08, 2016, 10:53 PM UTC

hackuser wrote: post #152

zedred wrote: post #61

Earlier quoted context omitted.

You're promoting Wire for anonymity? Check out their privacy policy, Wire maintains a server side copy of your entire contact list, all the groups that you're in, the plaintext metadata for your groups (membership, plaintext group title, plaintext group avatar), etc etc. They have broken voice encryption, and leak enough data to reconstruct the audio of your calls. They leak tons of plaintext directly back to themsel…

Could you provide something that backs up these claims?

They did in another comment on this page. I do not see any evidence that worries me. Perhaps if you're a famous terrorist, you won't want to use it, because your GIF searches might expose your evil plans. But I only needed a way to talk to family and friends that was more private than Facebook and Google, while not sacrificing features and usability. I think Wire has done an excellent job. I've not found anything else that checks all the boxes.

Re: Worried About the Privacy of Your Messages? Download Signal

#159

Post by _b8r0 » Thu, Dec 08, 2016, 10:55 PM UTC

mrbiber wrote: post #116

_b8r0 wrote: post #14

All the privacy solutions on the market are varying degrees of bad (from a privacy/security/freedom perspective), by which I mean they're all flawed in their own ways. Signal requires Google Play Services on Android. That means it's put simply not a privacy messenger. Yes there's crypto, but it's also tied into Whisper Systems' infrastructure, there's no federation. I use Signal reluctantly, and only on IOS. Threema,…

Matrix.org/riot.im has working federation, end-to-end cryptography, works without Google Play and is completely open source. The encryption is audited, but not yet enabled by default, as there are still some rough edges. But the apps have tremendously improved over the last few weeks alone and I am very happy with it.

Thanks for posting this, I'm going to try and take a look over the christmas break.

Re: Worried About the Privacy of Your Messages? Download Signal

#160

Post by _b8r0 » Thu, Dec 08, 2016, 10:57 PM UTC

resonanttoe wrote: post #133

_b8r0 wrote: post #14

All the privacy solutions on the market are varying degrees of bad (from a privacy/security/freedom perspective), by which I mean they're all flawed in their own ways. Signal requires Google Play Services on Android. That means it's put simply not a privacy messenger. Yes there's crypto, but it's also tied into Whisper Systems' infrastructure, there's no federation. I use Signal reluctantly, and only on IOS. Threema,…

Geniune question. For Wire: what is missing from what code they have available? https://github.com/wireapp

Have they released the full server source yet? Last I checked they hadn't.