Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Moxie Marlinspike has a plan to reclaim our privacy

newyorker.com

Post reply on HN
Print view View original

11–20 of 237 posts

Re: Moxie Marlinspike has a plan to reclaim our privacy

#11

Post by bawolff »

3np wrote: post #2

I was vouching for Signal for all my friends for years, supported them with donations, and was really rooting for them. However, I regrettably can't trust in moxie having the best intentions with Signal anymore. Lost count of the number of times this has been recycled on HN so I'm not taking the time to formulate this extremely well but: * For the longest time, requires phone number as identifier. When asked to remov…

There is a reason why signal is relatively mainstream succesful (by crypto product standards) and PGP wasn't. Its because its willing to make tradeoffs in the name of usability (while still emphasizing security).

A secure messenger product nobody uses helps nobody's security.

Re: Moxie Marlinspike has a plan to reclaim our privacy

#12

Post by nickff »

cwyers wrote: post #9

Why is it, whenever Signal is brought up on Hacker News, we get inundated with the people who object to the core decisions of the Signal Project? Would Signal really be better if, instead of having a secure messenger available to the masses, it spent massive amounts of time implementing the things these people want? No. I would be comfortable recommending Signal (or WhatsApp) to a nontechnical friend and communicatin…

A great deal of human communication is dedicated to signalling high rank/superiority, or demonstrating familiarity/intimacy.[1] In the case of HN, very few people know much about Moxie, so the only useful signal they can convey is expertise. Many people come here because of their technical or product development background/interests, and the way they show expertise is by second-guessing technical, user interface, and other issues.

As a result of this combination of constraint and desire, we get a bunch of comments where HNers talk about how they'd make Signal (as well as every other product) better/more useful.

[1] From Deborah Tannen's works

Re: Moxie Marlinspike has a plan to reclaim our privacy

#13

Post by tptacek »

lrvick wrote: post #3
3np wrote: post #2

I was vouching for Signal for all my friends for years, supported them with donations, and was really rooting for them. However, I regrettably can't trust in moxie having the best intentions with Signal anymore. Lost count of the number of times this has been recycled on HN so I'm not taking the time to formulate this extremely well but: * For the longest time, requires phone number as identifier. When asked to remov…

These are all exact reasons I have never used Signal. Additionally I find concerning the choice to bet the farm on SGX which has been repeatedly broken with repeated opportunities to extract the keys, at which point cracking small numeric pins is trivial. Moxie simply promised they always patch right away and never take the keys when they have such opportunities to do so. I do believe him, today, but I don't believe…

You can't coherently be alarmed by Signal's use of SGX while at the same time endorsing systems that use no cryptography whatsoever to protect the metadata Signal uses SGX for.

Re: Moxie Marlinspike has a plan to reclaim our privacy

#14

Post by elevation »

It's frustrating to see Signal's reputation undermined in technical circles by the shortsighted zeitgeist.

Signal's constitutional emphasis on usability supports user demographics that no other security product can attract. My elderly relatives use Signal now instead of Skype. This drew in other family members who just wanted to video chat with grandma and grandpa. Matrix will never win markets like this.

When tech nerds nit pick Signal's implementation, they ignore that the unfederated nature of Signal limits the damage these decisions can cause. Thanks to Signal's security posture, global protection from weak ciphers, buffer overflows, and even SGX, is just one software update away. This even protects you from faults in your contact's clients! Like the key agility that makes the Axolotl Ratchet so superior to GPG, update agility makes Signal infinitely superior to every existing or proposed federated network.

The Signal group has an uncompromising commitment to user privacy and a poignant security philosophy. Signal has no competition in its usability class, making hypothetical protections from other products worse than useless for user cohorts who will probably switch back to skype or sms. Signal's detractors do a terrible disservice to the people they dissuade from using it.

Re: Moxie Marlinspike has a plan to reclaim our privacy

#15

Post by cwyers »

nickff wrote: post #12
cwyers wrote: post #9

Why is it, whenever Signal is brought up on Hacker News, we get inundated with the people who object to the core decisions of the Signal Project? Would Signal really be better if, instead of having a secure messenger available to the masses, it spent massive amounts of time implementing the things these people want? No. I would be comfortable recommending Signal (or WhatsApp) to a nontechnical friend and communicatin…

A great deal of human communication is dedicated to signalling high rank/superiority, or demonstrating familiarity/intimacy.[1] In the case of HN, very few people know much about Moxie, so the only useful signal they can convey is expertise. Many people come here because of their technical or product development background/interests, and the way they show expertise is by second-guessing technical, user interface, and…

Huh. I did not expect a serious and insightful answer to my entirely rhetorical question. Thank you!

Re: Moxie Marlinspike has a plan to reclaim our privacy

#16

Post by sk2020 »

schoolornot wrote: post #6
3np wrote: post #2

I was vouching for Signal for all my friends for years, supported them with donations, and was really rooting for them. However, I regrettably can't trust in moxie having the best intentions with Signal anymore. Lost count of the number of times this has been recycled on HN so I'm not taking the time to formulate this extremely well but: * For the longest time, requires phone number as identifier. When asked to remov…

I have some concerns around the Signal foundation: The initial $50M in funding was a loan, not a donation, from Brian Acton to the new nonprofit Signal Technology Foundation. By the end of 2018, the loan had increased to $105,000,400, which is due to be repaid on February 28, 2068. The loan is unsecured and at 0% interest.[5] The Foundation is completely controlled by Brian Acton, who is the sole "member" of the nonp…

Is there a reason to suspect Brian Acton’s motives? I’m always skeptical of celebrity-hackers, but I don’t know why I should be worried about Acton in particular.

Re: Moxie Marlinspike has a plan to reclaim our privacy

#17

Post by saagarjha »

nickff wrote: post #12
cwyers wrote: post #9

Why is it, whenever Signal is brought up on Hacker News, we get inundated with the people who object to the core decisions of the Signal Project? Would Signal really be better if, instead of having a secure messenger available to the masses, it spent massive amounts of time implementing the things these people want? No. I would be comfortable recommending Signal (or WhatsApp) to a nontechnical friend and communicatin…

A great deal of human communication is dedicated to signalling high rank/superiority, or demonstrating familiarity/intimacy.[1] In the case of HN, very few people know much about Moxie, so the only useful signal they can convey is expertise. Many people come here because of their technical or product development background/interests, and the way they show expertise is by second-guessing technical, user interface, and…

I think this is an uncharitable view, and while it might be true in some cases it is certainly not always the case. Many times the people who point out issues with Signal do it not because they think they want to show off, but because they honestly are frustrated that no product seems to meet their needs and Signal has specific issues that matter to them. I honestly believe “Signal is stupid for relying on phone numbers and SGX” is really just “I don’t trust this things, they have a track history of having issues, I would really like to use this service and am sad that you chose to do this”. Hacker News is often not very good at conveying what it is trying to say, but I remain optimistic that it’s more than a intellect measuring contest.

Re: Moxie Marlinspike has a plan to reclaim our privacy

#18

Post by dingaling »

cwyers wrote: post #9

Why is it, whenever Signal is brought up on Hacker News, we get inundated with the people who object to the core decisions of the Signal Project? Would Signal really be better if, instead of having a secure messenger available to the masses, it spent massive amounts of time implementing the things these people want? No. I would be comfortable recommending Signal (or WhatsApp) to a nontechnical friend and communicatin…

Signal only has any userbase due to advocacy; compared to the secure-enough-for-most WhatsApp which has literally billions of users and is the default choice, every user of Signal had to be convinced to install it.

So I think it's unfair to bash people who criticise the project. The 'drag' they apply to wider adoption is still miniscule.

Put it this way: why does Signal exist when WhatsApp is good enough? Wouldn't Mr Rosenfeld be better putting all that effort and ingenuity into a truly innovative new messenger?

Re: Moxie Marlinspike has a plan to reclaim our privacy

#19

Post by saagarjha »

tptacek wrote: post #13
lrvick wrote: post #3

Earlier quoted context omitted.

These are all exact reasons I have never used Signal. Additionally I find concerning the choice to bet the farm on SGX which has been repeatedly broken with repeated opportunities to extract the keys, at which point cracking small numeric pins is trivial. Moxie simply promised they always patch right away and never take the keys when they have such opportunities to do so. I do believe him, today, but I don't believe…

You can't coherently be alarmed by Signal's use of SGX while at the same time endorsing systems that use no cryptography whatsoever to protect the metadata Signal uses SGX for.

I’m not sure that that’s the only conclusion you can draw. Some systems choose to not handle that metadata, which often makes them a worse service but they make that choice by looking at the landscape and choosing to not use SGX. The other plausible argument is that Signal uses SGX, which is better than nothing, but in selling it as more secure than it is they do more harm than good.

Re: Moxie Marlinspike has a plan to reclaim our privacy

#20

Post by cwyers »

dingaling wrote: post #18
cwyers wrote: post #9

Why is it, whenever Signal is brought up on Hacker News, we get inundated with the people who object to the core decisions of the Signal Project? Would Signal really be better if, instead of having a secure messenger available to the masses, it spent massive amounts of time implementing the things these people want? No. I would be comfortable recommending Signal (or WhatsApp) to a nontechnical friend and communicatin…

Signal only has any userbase due to advocacy; compared to the secure-enough-for-most WhatsApp which has literally billions of users and is the default choice, every user of Signal had to be convinced to install it. So I think it's unfair to bash people who criticise the project. The 'drag' they apply to wider adoption is still miniscule. Put it this way: why does Signal exist when WhatsApp is good enough? Wouldn't Mr…

WhatsApp... uses the Signal Protocol. I don't understand this line of thinking at all.
Post reply on HN