111–120 of 169 posts
Even if Signal's server can't do it, what's to prevent a client from using a really large list of contacts? (Say, millions of contacts captured via a security leak?)
Even if Signal's server can't do it, what's to prevent a client from using a really large list of contacts? (Say, millions of contacts captured via a security leak?)
When will I be able to sign up without a phone number? The phone number requirement is ridiculous and makes true anonymity incredibly difficult.
I tried to use Signal and even gave it permission to use my contacts when I installed it. Once it found the handful of people I know using it I disabled those permissions. To my surprise, the app refused to let me use it. That's when I uninstalled it and stopped recommending it to people.
How they operate makes me think they're trying to build the illusion of security above all else (possibly with nefarious purposes?) or they're more concerned about driving up their user #s than they are about providing security.
Despite what security consultants like to tell people, end to end encryption is not rocket science. If you trust the publicly available algorithms (if you don't then this is moot) then it's relatively straightforward to assemble a system that should be secure over the wire.
Of course, that requires you to also trust that the app you're installing is using the same source as the one you vetted (or wrote) and that your device / computer hasn't been compromised somehow. Ditto the person you're talking to. You can trust the whole chain if you want but currently verifying it is impossible.
I like to do a thought experiment about what an actually secure messaging system would look like. The only truly secure system is an air-gapped one. (Yes, there are ways to bridge the air gap if you're in the vicinity, but that's not the point.)
How could you air gap a mobile phone? Well, you can't. What you could do is use a second phone with the radios physically disabled. You could then use this to encrypt your messages and then type those encrypted messages into email or SMS or whatever.
This is a bit laborious so you could send the encrypted info to the second phone and to a second app that brokers these messages. You could use the analog ports to modem these messages back and forth. Assuming your ADC is just an ADC, the standard analog audio port should not be hackable in any way.
This is a silly example but it's meant to illustrate a point. If you really have something to hide, an app isn't going to get your there. If you just want a little bit of privacy, you're better off with iMessage or whoever is offering end to end encryption. Signal is not a particularly good chat app and no, most of your friends aren't using it anyway.
Obligatory: https://www.schneier.com/essays/archives/2007/01/in_praise_o...
Even if Signal's server can't do it, what's to prevent a client from using a really large list of contacts? (Say, millions of contacts captured via a security leak?)
Assuming OWS doesn't rate limit, all that would do is let you tell what phone #s use signal. Which is slightly sensitive info, but radically less so than "who is communicating with whom", which is what the older method could leak.
But to avoid minimizing it, there is a scenario I've heard where it matters: crazy ex-boyfriend discovers you're using a new messaging service, just because he still has your phone number in his contacts.
Ideally, nobody should know you're using a new messaging service unless you've given explicit consent to share that info with them.
I don't really understand why this is an improvement on the existing architecture. In the current contact discovery implementation you need to fully trust the server, namely the open source component that is the contact discovery service. In this proposed new implementation, you still have to trust the server; you need to trust closed source processor hardware offering the Software Guard Extensions. Those extensions…
I am by no means an SGX expert, but my understanding has been that it allows you to shorten the "trust stack." What you're referring to as "the server" is really a technology stack that starts with the CPU hardware and extends to the service operator. Without SGX, the trust stack probably looks something like: Intel, the OS, the VM, the cloud provider (Amazon, Google, Microsoft), the server software, the server opera…
Earlier quoted context omitted.
To succinctly convey emotions, opinions, viewpoints, "feels". To simply have a non-verbal vocabulary, to have a different quality to certain parts of the communication, to signify a different quality of seriousness/playfulness/feeling. It's the new emoticon. :-)
I'm curious, are they used anything like memes that you can easily send more than once?
Some examples http://www.line-stickers.com/
Earlier quoted context omitted.
You can already send arbitrary images and attachments in Signal messages.
Sure, but compared to the stickers UI paradigm it's far clunkier to browse for an image file every time and to collect and arrange image files sent by other people, particularly on a mobile device. Also, stickers display with proper transparency, giving them the appearance of arbitrary shapes, whereas images on Signal are displayed in a rectangular frame and transparent areas get a black background. Compare: https://…
Earlier quoted context omitted.
I find it really unfortunate that this is stopping people from adopting Signal. However, I believe that this feature was added last year: https://signal.org/blog/doodles-stickers-censorship/
No, that's a different feature with the same name. That allows you to quickly layer graphics from a built-in set on top of existing photos, like in Snapchat. The "stickers" I'm referring to, in the Telegram/WeChat/LINE sense, are essentially custom emojis, or macros for sending one of a collection of reaction images as its own message. https://telegram.org/blog/stickers-revolution Various communities absolutely rely…