Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal app downloads spike as US protesters seek message encryption

qz.com

Post reply on HN
Print view View original

231–240 of 367 posts

Re: Signal app downloads spike as US protesters seek message encryption

#231

Post by AnonC »

Hamuko wrote: post #131
AnonC wrote: post #95

Earlier quoted context omitted.

I don't think that's a great idea until Signal stops exposing the phone number of the user to everyone else (for all the bashing that Telegram gets on cryptography, it has mechanisms to hide one's phone number and even the fact that one has a Telegram account from others).

How is that different from WhatsApp, which is the default for everyone in a lot of places?

GP here. It’s no different from WhatsApp in this sense. But WhatsApp is even worse because it shares communication metadata with Facebook (though message content is end to end encrypted).

Re: Signal app downloads spike as US protesters seek message encryption

#232

Post by mkup »

Blaiz0r wrote: post #171
pwdisswordfish2 wrote: post #154

Earlier quoted context omitted.

Couldn't you just say "I really like the user interface." Or "The logo looks cool." Or "It had 4 stars." Of "It had lots of good reviews."

no one would believe you...

How does that matter? You have the right to install any apps you want, and wacky questions deserve wacky answers.

Re: Signal app downloads spike as US protesters seek message encryption

#233

Post by georgyo »

jwr wrote: post #229
est31 wrote: post #206

Earlier quoted context omitted.

The method is explained here: https://signal.org/blog/private-contact-discovery/ Yes, it's hashes of phone numbers instead of the phone numbers themselves, but that's a detail. Phone numbers are easy to brute-force especially for people the protesters are worried about, as well as easy to build rainbow tables for.

I would disagree with the "that's a detail" statement. Properly salted hashes make building a social network graph much more difficult. It's only relatively easy to brute-force a single number.

I don’t think they are salted. When someone joins signal they are compared to your hashes. That is how you get notified that one of your contacts have joined signal.

If they were all individually salted, there would be no way to compare against new joiners.

Re: Signal app downloads spike as US protesters seek message encryption

#234

Post by deadwing0 »

izacus wrote: post #207
computerfriend wrote: post #201

Earlier quoted context omitted.

Do you have a source for the claim that this has happened at protests in Hong Kong? I haven't heard of anyone being arrested here on the basis that they had Signal installed.

They got arrested by association. Signal chat group is such an association, just like other chat groups are. Except that Signal guarantees to give out your phone number (and by extension location and personal address) to every single person in a chat group. There have been lynchings in India based on this kind of data leaked by WhatsApp which resulted in them finally allowing joining groups anonymously.

Do you have a source for this?

Re: Signal app downloads spike as US protesters seek message encryption

#235

Post by berdario »

smichel17 wrote: post #192
jwr wrote: post #164

Earlier quoted context omitted.

Sadly, Signal neglects user experience, and as a result people around me all tend to migrate to WhatsApp. They don't care that they are uploading their entire contact list to Facebook — "death before inconvenience".

Honestly I don't really understand this. I'm a longtime signal user who installed whatsapp recently (family group I had to join) and.. It feels more or less the same to me. Maybe it's because I haven't allowed any unnecessary permissions, but I don't see much functionality that's different. Statuses maybe?

I'm not using Signal as heavily as I was in the past (due to the fact that they dropped support for Chromeos), but issues that I personally was annoyed by:

- message delivery was not very reliable when your connection is poor and intermittent (think wifi in the underground between stations)

- when you need to resend a message in a group, you need to tap "retry" once for every recipient in the group

Issues that my friends complained about, justifying their non-use of Signal:

- you cannot create links to allow people to join groups (obviously this is a nonstarter, without first allowing people to be in groups pseudonymously)

Re: Signal app downloads spike as US protesters seek message encryption

#236

Post by antpls »

colordrops wrote: post #93
bawolff wrote: post #53

Earlier quoted context omitted.

There's a lot more than just crypto. Its much more common for systems to fail in the supporting code then it is for the crypto to be wrong. So first step is probably learn reverse engineering and verify the crypto is being used correctly. Then after that get a phd in cryptography.

The source code is available.

Great. So now, you need a Software Engineering degree AND a cryptography PhD

Re: Signal app downloads spike as US protesters seek message encryption

#237

Post by wscott »

0xADEADBEE wrote: post #51

Long-time Signal user but I'm on the verge of moving I think. There are several UX shortcomings but the new PIN nag is a bridge too far. What are my options for alternatives? I imagine Telegram is the next best bet but very open to suggestions.

Keybase has end-to-end encryption and you can connect to people without publishing the fact. But unfortunately, it was recently purchased by Zoom and probably won't be headed in a good direction in the future.

Of course, Keybase's main idea is to have a verifiable public identity which might not be what you want.

Re: Signal app downloads spike as US protesters seek message encryption

#238

Post by sadfklsjlkjwt »

Silhouette wrote: post #221
m12k wrote: post #114

Earlier quoted context omitted.

Yeah, if you're ever asked why you're on Signal, just say you wanted to stay in touch with a programmer friend who's not on Facebook/WhatsApp, and they suggested Signal (that is now literally true as well - I suggest you try Signal, friend)

FWIW, many of my friends actually could say this, for I am a programmer who's not on Facebook/WhatsApp and recommends Signal. It definitely needs to be more reliable, though. The last time I tried to call someone with Signal instead of just using it for messaging, I got a ringing indication but they heard nothing and then after a few seconds the call showed up as missed, and the same happened the other way around wit…

This is not unique to Signal though. I've had this happen with WhatsApp about 1-2% of the times I've tried to place a call in the last few months

Re: Signal app downloads spike as US protesters seek message encryption

#239

Post by romanr »

sorenjan wrote: post #169
AnonC wrote: post #92

The biggest drawback with Signal for protesters is that it exposes the user's phone number to everyone else in groups (just like WhatsApp does). There is no way to even hide the fact that you have an account on Signal. I can add phone numbers by enumeration into my contacts and Signal will show who among my contacts is on it. If the authorities don't use tactics like they did in Hong Kong, the protesters may be safe…

This was allegedly used by the authorities in Hong Kong during protests there in 2019, but using Telegram. Telegram responded by introducing a new setting that hides your number from people that aren't in your own contacts. https://telegram.org/blog/scheduled-reminders-themes#new-pri...

Telegram indeed have better UX and same level of e2e security. Why Signal is getting all the publicity?

Re: Signal app downloads spike as US protesters seek message encryption

#240

Post by nautilus12 »

colordrops wrote: post #93
bawolff wrote: post #53

Earlier quoted context omitted.

There's a lot more than just crypto. Its much more common for systems to fail in the supporting code then it is for the crypto to be wrong. So first step is probably learn reverse engineering and verify the crypto is being used correctly. Then after that get a phd in cryptography.

The source code is available.

Ugh...now I have to get a phd in "source code" too??
Post reply on HN