Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Statement on Recent Events Between Signal and the Anti-Censorship Community

github.com

Post reply on HN
Print view View original

261–270 of 290 posts

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#261

Post by dublinben »

csydas wrote: post #255
quasirandom wrote: post #158

Earlier quoted context omitted.

My read on that statement was "the censors can't just /dev/null anything with a plaintext CONNECT". Given its broad user base, it wouldn't hurt for Signal to clearly state "we can't keep the fact of the communication private, only the contents". That would short-circuit attempts to gain notoriety by pointing out obvious facts and calling them vulnerabilities. It's also common sense for anyone who knows their way arou…

I currently live in a country without such strong protections for individuals, and discussing this with a friend, I feel this is a disconnect between many of the HN posters who don't live in countries where such concerns are very common. This is not a judgement of "who has it worse", but more that from my observation, there are many important elements missing from the discussion that those who haven't had to consider…

What technology can address that threat model? Signal certainly doesn't try to.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#262

Post by upofadown »

kelnos wrote: post #244
upofadown wrote: post #183

Earlier quoted context omitted.

>decrypt your entire message history, even if you've deleted it from your endpoint But how many people actually delete their old messages? If they don't then forward secrecy doesn't help. They get your messages when they get you key material. Encrypted instant messaging is inherently less secure than something that can be performed offline like encrypted email because the key information is exposed all the time. So i…

> But how many people actually delete their old messages? I don't know, because I'm not in this position, but I would really really hope that someone who is having conversations that could get them killed or thrown in jail by an oppressive government would be using disappearing messages, or at least setting things up so messages are auto-deleted after some fairly short amount of time. > A private key that in the case…

Your private encryption key only can be used to decrypt the messages sent to you. Anyone with your public key can create a message to you. Without the signature there is actually no cryptographic proof that you created a particular message.

The really interesting thing about the PGP case is that you can do this and still insure that no one does a MITM attack on your messages. The encryption key is signed by the signature key (identity). So you can verify the identity but still leave no identity laying around.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#263

Post by _carbyau_ »

csydas wrote: post #255
quasirandom wrote: post #158

Earlier quoted context omitted.

My read on that statement was "the censors can't just /dev/null anything with a plaintext CONNECT". Given its broad user base, it wouldn't hurt for Signal to clearly state "we can't keep the fact of the communication private, only the contents". That would short-circuit attempts to gain notoriety by pointing out obvious facts and calling them vulnerabilities. It's also common sense for anyone who knows their way arou…

I currently live in a country without such strong protections for individuals, and discussing this with a friend, I feel this is a disconnect between many of the HN posters who don't live in countries where such concerns are very common. This is not a judgement of "who has it worse", but more that from my observation, there are many important elements missing from the discussion that those who haven't had to consider…

Disclaimer: I not a security expert by any means. Also I am NOT from a country "where such concerns are very common".

So I feel like I am missing something here.

I don't want to minimise empathy towards living under such a society but if The Adversary can obtain your friends unlocked phone, what do you want to have happen?

A sham-password for Signal that sends out a "I've been caught." message to all contacts? So you can "fat finger" the password in front of your captor?

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#264

Post by j-james »

ryanlol wrote: post #191
j-james wrote: post #189

Earlier quoted context omitted.

I feel like this is somewhat disingenuous. IME keylogging is a known, serious, and frequently exploited issue that affects a substantial portion of Signal users. Signal's "Incognito Keyboard" setting didn't mention that the flag can be ignored, which was misleading and dangerous. But yes, warning about accessibility settings if there's evidence of that being an attack vector seems like a good idea. I don't know about…

> frequently exploited Do you happen to have a source for this? There’s lots of speculation out there, but I’ve never seen anyone claiming to have proof of this being frequently exploited.

Yes, I linked it above.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#265

Post by j-james »

toast0 wrote: post #211
j-james wrote: post #174

Earlier quoted context omitted.

Signal discourages third-party clients. https://community.signalusers.org/t/how-to-get-signal-apks-o...

Fork the client and the server then. Yes, I've seen from other comments that the server repo is apparently rarely updated. If that's significant to getting a working client, probably fork the client from earlier; most likely, it you get a significant number of users, you're going to need to get really familiar with the server environment anyway. Running a server environment is probably time consuming ane expensive, b…

That then means you can't communicate with others running the normal Signal client. Signal is not a federated protocol.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#267

Post by toast0 »

j-james wrote: post #265
toast0 wrote: post #211

Earlier quoted context omitted.

Fork the client and the server then. Yes, I've seen from other comments that the server repo is apparently rarely updated. If that's significant to getting a working client, probably fork the client from earlier; most likely, it you get a significant number of users, you're going to need to get really familiar with the server environment anyway. Running a server environment is probably time consuming ane expensive, b…

That then means you can't communicate with others running the normal Signal client. Signal is not a federated protocol.

I would phrase that differently. You can't use your (forked) client to communicate with others who are not running your client. With a forked server, and a forked client, you're welcome to add federation, but Signal doesn't want it. But then again, the complaint is that people don't like how the Signal project is doing things.

Maybe running your own network will help explain why they do things the way you don't like. Maybe running your own network will help explain how running things the way you like can actually work.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#268

Post by konjin »

jononor wrote: post #57
konjin wrote: post #45

Earlier quoted context omitted.

Start their own app that's better. The fork option is there and always has been.

It would take years of effort and years of time to get people to switch to $BetterSignal. It is a last resort.

So they would rather steal the hard work of others. Doesn't make me any more sympathetic to them.

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#269

Post by henearkr »

jauer wrote: post #210
henearkr wrote: post #46

Earlier quoted context omitted.

I doubt that this will ever be an issue, because Signal is a messaging application, on which censoring/moderation is thus irrelevant. It's not a social network (contrary to e.g. Telegram which has tons of SNS features). Let's hope it will remain just a messaging/videocall app.

This ignores demonstrated harm* from the combination of human behavior and low-effort large-scale communications. * https://en.wikipedia.org/wiki/Indian_WhatsApp_lynchings

Moderation is still irrelevant.

You don't solve the problem you refer to with moderation, you solve it by privacy laws and their enforcement, because publishing the contact details of somebody without their consent is a crime.

The problem exists since long before WhatsApp: you have the same issue when an official or a celebrity gets their phone/email flooded...

Re: A Statement on Recent Events Between Signal and the Anti-Censorship Community

#270

Post by int_19h »

La1n wrote: post #13
nexthash wrote: post #8

It seems that a couple of security researchers from this community felt that Signal's implementation of a TLS-in-TLS proxy to allow its use in censored Iran didn't live up to their standards (it can be detected by censors and blocked). However, after Signal rejected this issue, they turned toxic and were prevented from posting anymore [1]. The above post is their reaction, which feels more like them lashing out rathe…

What could have been the more productive way? If their issues are closed (and Signal does not seem interested in discussing this) and they feel like this is actively putting peoples lives in danger I feel they should call this out.

For starters, don't name your proof-of-concept repo "fuck-signal-tls-proxy"?
Post reply on HN