Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Statement on Recent Events Between Signal and the Anti-Censorship Community

github.com

Post reply on HN
Print view View original

71–80 of 290 posts

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#71

Post by gclawes »

UncleMeat wrote: post #53
ralfn wrote: post #21

Earlier quoted context omitted.

It's more important how we all feel about each other and our drama than the fact there isn't a currently easily available obvious way to have private secure conversations. Your "they are not being constructive enough" is actually very unconstructive, because it drags the conversation into more drama. The tone is not more important than the facts. It never is. Im not suggesting you have some alternative motive to defl…

Tone can often be more important than facts. At one point in my career I had a somewhat public facing role. I made a tough decision that aggravated a user, who decided to send me several death threats. Suddenly that tough decision wasn’t so tough anymore. Any possible resolution was gone. These situations involve people. We aren’t fact machines.

> Tone can often be more important than facts.

Exactly: https://www.edge.org/response-detail/27181

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#72

Post by dunefox »

fredmorcos wrote: post #62
ralfn wrote: post #21

Earlier quoted context omitted.

It's more important how we all feel about each other and our drama than the fact there isn't a currently easily available obvious way to have private secure conversations. Your "they are not being constructive enough" is actually very unconstructive, because it drags the conversation into more drama. The tone is not more important than the facts. It never is. Im not suggesting you have some alternative motive to defl…

> So what should we use instead of signal? Threema is one alternative.

I recently bought Threema and I can only say that I like it more than Signal. Now it even has local (meaning your images don't leave your phone) object detection in images, global search in chats, etc. The only thing that's missing is usage on multiple devices and a native desktop client - but the app itself is great so far.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#73

Post by hiq »

The answer from Moxie to these people: https://github.com/signalapp/Signal-TLS-Proxy/pull/15#issuec...

I think that says it all.

I'm also a bit concerned that "security researchers" don't seem to understand the threat model. Signal has never claimed to be able to hide that it was being used. The TLS proxy is only meant to help circumvent censorship, not obfuscate its protocol. And indeed, as a temporary solution, it's not ideal even to circumvent censorship. But they're apparently working on something better, and all this distraction is not helping.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#74

Post by abc-xyz »

edent wrote: post #31

Moxie - and the Signal team - seems to have a real issue taking feedback from outside experts. See the way he has been completely dismissive of the IME vulnerability highlighted by Naomi Wu and others. I remember back when it was TextSecure - I tried to raise some usability and security issues. First I was ignored, then dismissed, then - a few years later - they implemented some of the changes. I still use Signal. Bu…

[flagged]

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#75

Post by cyphar »

fmajid wrote: post #38
La1n wrote: post #18

Earlier quoted context omitted.

> this can't possibly put peoples lives in more danger than using signal without a proxy a week ago would've. I see one reason it could, it filters out people who do "need" to use it. It could even be people who did not use it before, but think it's undetectable now. Signal implies it can't be detected, at least to non-technical readers. >Unlike a standard HTTP proxy, connections to the Signal TLS Proxy look just lik…

If the mere use of Signal is banned, traffic analysis tools an DPI can be used to identify users and bring them the unwelcome attention of the regime’s well-staffed secret police. I’m sure the Chinese are selling them surveillance tech, and if not Iranians are quite capable of developing it themselves. It’s not a simple issue to resolve. WireGuard is better in that it only establishes a flow if authenticated, but UDP…

> I’m sure the Chinese are selling them surveillance tech, and if not Iranians are quite capable of developing it themselves.

Actually it seems more likely that it's US-built censorship tools -- specifically BlueCoat, which was detected in 2013[1]. BlueCoat claimed they didn't sell the hardware to Iran because it would violate sanctions but that's not much consolation for the people who are being surveilled using their tools.

[1]: https://www.washingtonpost.com/world/national-security/repor...

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#76

Post by Zash »

sneak wrote: post #63
upofadown wrote: post #51

Earlier quoted context omitted.

One major reason for the push back against Signal promotion is that it does not represent any sort of federated protocol. It is a complete silo. So if it did become popular it would eventually be a serious problem and would need to be fought against.

> It is a complete silo. So if it did become popular it would eventually be a serious problem and would need to be fought against. This is an explicit design decision. It used to federate, and they found that to be terrible, so they stopped, and now it's better. Maybe you should find something else to fight against. https://signal.org/blog/the-ecosystem-is-moving/ Worth noting: Google Talk used to federate, via XMPP.…

> Google Talk found that almost nobody actually used the federation functionality,

Compared to the number of GTalk users, a bunch of self-hosted users probably didn't count for much.

> and something like 99%+ of the federation traffic was inbound spam

I heard this too, not sure if it was the only reason.

Too bad Google doesn't know how to manage spam. Good thing they don't have any other federated communication products. /s

> Federated protocols aren't very good, and don't evolve.

What makes you say this? XMPP has come a long way since 1999 and is still evolving to this day. Even email is slowly evolving. Is Matrix not evolving? HTTP isn't really federated, but Moxie also mentions the web being stuck on HTTP/1.1, because HTTP/2 and HTTP/3 don't exist.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#77

Post by maqp »

lionkor wrote: post #4

Offtopic, but what's with all the PGP signatures? One message is literally just "this message is signed with my key", followed by a key and a previous key. Is this a meta joke, automated signing (like signed emails), or am I tripping?!

It's useful when e.g. Roger Dingledine who represents the entire Tor Project wants to make a public statement. It's pseudo-intellectual BS when some random GitHub account with edgy repos like https://github.com/studentmain/fuck-signal-tls-proxy does it.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#78

Post by olah_1 »

motohagiography wrote: post #70

Even if I agree with the principles of the anti-censorship people, to be an activist to apply pressure on Signal for features instead of forking and building solutions is suspicious to me. Signal does a great job of frustrating mass interception, which I think was its original point. Inventing new criteria and re-framing their product as inadequate for this scope change as an activism play seems insincere. We can exp…

> instead of forking and building solutions

What would you fork? The signal server code that hasn’t been updated in almost a year[1]?

If that is truly the same code that we use with signal today, would your fork work with this same network? Or would it be it’s own 1-server network all alone?

[1]: https://github.com/signalapp/Signal-Server

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#79

Post by maqp »

fmajid wrote: post #42
sneak wrote: post #28

Earlier quoted context omitted.

I've seen a growing number of anti-Signal posts and activism lately, mostly surrounding the (well-documented) design tradeoffs that Signal makes for usability and privacy (such as opting to use phone numbers for usernames, to avoid having to store contact lists/social graphs on Signal servers), or their famous decision not to federate/interoperate. Perhaps it's just criticism growing in lockstep with Signal's overall…

Did you know Signal, like Tor, was financed by an offshoot of the CIA? https://www.opentech.fund/results/supported-projects/open-wh... https://pando.com/2015/03/01/internet-privacy-funded-by-spoo... Now if I were an Iranian dissident, I would be reasonably confident Signal is designed to withstand the Iranian regime’s interception efforts (but not necessarily traffic analysis). If I were someone on the US government’…

Except Snowden said he uses the app everyday and is still alive. OTF money doesn't come with strings attached, if you can _prove_ otherwise, you might actually have something valuable to contribute to this conversation, but now it's just words that should be dismissed as conspiratorial.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#80

Post by maqp »

swiley wrote: post #67
sneak wrote: post #66

Earlier quoted context omitted.

> Why can't the user just be expected to deal with their contact list? They are; they let the user maintain their own list of phone numbers for their contacts, precisely like the phone company in your example. > They require the phone number as an anti-spam/moderation measure and hide behind privacy. This is (inaccurate) speculation from ignorance. Signal, unlike almost every other phone-number-using-service on the p…

Then why not let users sign up with a random unique ID number that they can share with their contacts?

Usernames are coming.
Post reply on HN