Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We can do better than Signal

icyphox.sh

Post reply on HN
Print view View original

111–120 of 290 posts

Re: We can do better than Signal

#111

Post by LockAndLol »

xrisk wrote: post #32
marcinzm wrote: post #8

I'm confused about this piece. If there's true E2E encryption (verified by open source client code and review of released binaries) then why does it matter if the server code is backdoored or not? The whole point of E2E is that you don't need to care about the server being able to ever see the text of your messages because it never can.

Copy pasting my comment: Consider this paragraph from the Signal protocol > ...For example, they may compare public key fingerprints manually, or by scanning a QR code. Methods for doing this are outside the scope of this document. > If authentication is not performed, the parties receive no cryptographic guarantee as to who they are communicating with . Nobody I know in practice does this authentication. If an activ…

It might be solvable with an external identity server that keeps the ID + key of users, but then you just move the problem of trust to another party.

Additionally, that ID+key would have to be updated somehow by the user and now you have a new problem: how do you verify that the user is who they say they are? Telling them to digitally sign something is possible, but what if the private key is gone?

The Signal protocol solves what it can solve for now. If cryptography experts have suggestions to improve it, I'm sure they can contribute.

Is there any protocol that solves the issue you're describing? And that has a good app? And that isn't centralized? We're asking for the "eierlegende Wollmilchsau" aka unicorn.

Re: We can do better than Signal

#112

Post by OmniiTyler »

Hey icy, the issue you raise about Signal not being decentralized, I think, is a valid one.

You should check out a decentralized messaging and social media app I have been working on - Omnii.

Omnii allows each user to manage their encryption keys, and all data exists in a decentralized manner - only on endpoints (users' phones), and not on a backend.

https://omnii.co is our website if you are interested.

Re: We can do better than Signal

#113

Post by cevn »

bilal4hmed wrote: post #85
solstice wrote: post #24

Earlier quoted context omitted.

If all the interesting stuff happens on the client and the server "just" forwards encrypted messages, why would the server need frequent updates?

if you go to the main git page https://github.com/signalapp you can see that changes were made to the server 8 hours ago. So something is happening on the server, the public cant see it. I definitely would like to see whats happening given. I trust them, but we definitely need to see whats on the server code.

I believe the 8 hours ago activity is from someone opening a PR, not some weird trick to update git repositories without being seen.

Re: We can do better than Signal

#114

Post by justapassenger »

mft_ wrote: post #83
justapassenger wrote: post #61

Signal will have very hard time competing as a product with WhatsApp. Their main value proposal is that they aren’t backed by Facebook, but other than that, there’s no real difference to end user. That’s enough for geeks, but not very compelling argument to break to mainstream. To break into such a highly competitive market, they need more unique features. Or they can count on Facebook to keep on shooting themselves…

Not sure about this - I’ve seen more acquaintances install Signal in the past two weeks than the previous two years. What (I suspect) will work is something providing enough of an incentive for enough people to install it to then provide a network effect which is self-sustaining. The recent coverage about WhatsApp/Insta/FB’s egregious data collection (thanks to Apple) plus the high profile recommendations of Signal h…

They get great PR right now. They should utilize this moment as much as possible, but it won’t last for more than maybe few more weeks (it’s already fading away).

Network effects are hugely important, but they aren’t enough. Even if you have most of your social graph on both signal and WhatsApp, you need to not only change your habits, but also outages and bugs will quickly scare you away. And there’s tons of subtle tweaks that are done to keep you more sticky to one app.

Big tech isn’t usually that scared of other apps trying to do the same things as they do successfully. They’re scared of new paradigms that they can miss the boat on, and you can see that in what acquisitions they do. They don’t pay big bucks for copies of their services, but for new ideas that can be/are taking off.

Re: We can do better than Signal

#115

Post by bilal4hmed »

xiphias2 wrote: post #107

Signal, telegram and matrix (or at least 1 of the 3) should work on cross-app E2E communication. Instead of creating a new protocol, why not just have a competition between clients using the current protocols?

Matrix has bridges for Telegram and Signal

Matrix tried with Signal but it didnt yield anything https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom

Re: We can do better than Signal

#116

Post by toomuchtodo »

colordrops wrote: post #60
asutekku wrote: post #43

Earlier quoted context omitted.

And that then is extremely easy to abuse as soon as you have enough people with high rank enough deciding to start to misbehave.

Sounds like IRL

Turns out most problems are people problems, not tech problems. Tech is just how the symptoms present.

Re: We can do better than Signal

#118

Post by Mediterraneo10 »

ThePhysicist wrote: post #89

I never understood what problem E2E encryption actually solves if you don't have full control over the client. All it would take Signal or WhatsApp to extract all your private messages is a single update of the client, which is trivial to do and currently very hard to validate as e.g. Apple does not even (to my knowledge) provide checksums to end users. The problem of messaging as it is today is that we missed the op…

Signal’s Android client moved to reproducible builds some time ago already.

Re: We can do better than Signal

#119

Post by walrus01 »

alerighi wrote: post #86
stavros wrote: post #10

I'm a bit annoyed at "we can do better than X" when, you know what? Maybe we can't. Yes, it's nice that you and I can install Element and deal with the finicky crypto handshake that for some reason always shows red for me because a friend opened the web UI and closed it before he completed the handshake and now we can never actually make that check go green, and it's nice that Mastodon is distributed but mastodon.hos…

Nobody thinks about it but the most professionally used communication medium is the email, and part if not all of its success if not all its success is that is decentralized. A company cannot afford to use a service that can be closed and loose all the communications. Centralized services are single point of failure, and in that regard Signal is no better than WhatsApp, because yes, in theory you can run your own ser…

> Well in theory in countries where you can go into a shop and buy a SIM card cash yes, but in a lot of countries you have to give your ID

another huge problem with using phone numbers as IDs, which software developers in the US/Canada often don't think about, is that in many developing nation environments there is no such thing as local number portability, or the ability to move your phone number between any of the major national-scale mobile phone network operators or VoIP providers as you wish.

As you can do in the USA if you become unsatisfied with your Tmobile service and want to move to ATT, keeping your phone number. This is one of the reasons why dual (and even triple) SIM phones are so popular outside of North America.

In a lot of countries I don't see number portability in the SS7/PSTN system ever becoming a political reality, due to regulatory capture on the part of the national telecom regulator. At least not before pure IP based communications and apps make the concept of a PSTN phone number irrelevant entirely.

Re: We can do better than Signal

#120

Post by bilal4hmed »

tailspin2019 wrote: post #110
bilal4hmed wrote: post #85

Earlier quoted context omitted.

if you go to the main git page https://github.com/signalapp you can see that changes were made to the server 8 hours ago. So something is happening on the server, the public cant see it. I definitely would like to see whats happening given. I trust them, but we definitely need to see whats on the server code.

I think those changes could just be Pull Requests? Not necessarily code merged to master/main. Unless you’re spotting something that I’m not?

the last PR was 9 hours ago https://github.com/signalapp/Signal-Server/pulls

while the main page says update was 8. Thats what threw me off

Post reply on HN