Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio incident: What Signal users need to know

support.signal.org

Post reply on HN
Print view View original

321–330 of 512 posts

Re: Twilio incident: What Signal users need to know

#321

Post by stormbrew »

tptacek wrote: post #311
stormbrew wrote: post #308

Earlier quoted context omitted.

That may be their product management premise, but it's not why I use it. I use it because people I need to talk to are there and it has proper e2e messaging. I'm not beholden to their expectations of why I want to use their product. Also I'm not advocating for anything to be kept server side, nor do I see any reason why other identifiers couldn't be kept client side. An address book is just a list of identifiers, it'…

Signal replaces messaging services that were all keyed by phone number. Use something else. I don't think anybody can do better than explaining why Signal works this way, and what the benefits are, vs. the (amply articulated) liabilities. This is one of the most boring repeated conversations that occurs on HN. It's incessant. Avoiding these incessant superficial conversations is, in fact, part of the premise of HN.

I agree, it's an exhausting repeated conversation. It's almost as if there's a frustrating unmet need with signal as it stands for a lot of people that isn't actually placated by the repetition of an argument about how they grow as a ~~business~~ (sorry, as a non-profit).

And again, signal is the only thing that can talk to people on signal so "use something else" is not helpful.

Re: Twilio incident: What Signal users need to know

#322

Post by sgc »

g_sch wrote: post #239
gsdofthewoods wrote: post #194

Earlier quoted context omitted.

Signal's SMS registration codes expire after a few minutes, so you wouldn't even need to know the duration of the incident. Let's be conservative and say the codes expire after 5 minutes (it's probably shorter), then Signal is registering 380 devices a minute.

My reading of the post is that they determined the "1,900 users" figure by the number of users who had requested a code during the duration of the Twilio incident, as the attacker could have accessed their SMS messages at any point during the compromise: > During the window when an attacker had access to Twilio’s customer support systems it was possible for them to attempt to register the phone numbers they accessed…

At least number of requests + number of open unverified and unexpired requests. So you need to guess average length of time to verify and the abandon rate.

It also seems like there is also a buffer period when the numbers are registered and not yet purged from the twilio system:

> 1) their phone numbers were potentially revealed as being registered to a Signal account, or 2) the SMS verification code used to register with Signal was revealed.

We don't know how often Signal purges that, so, although unlikely, it could be a day or a week or more of registrations.

Re: Twilio incident: What Signal users need to know

#323

Post by tptacek »

stormbrew wrote: post #321
tptacek wrote: post #311

Earlier quoted context omitted.

Signal replaces messaging services that were all keyed by phone number. Use something else. I don't think anybody can do better than explaining why Signal works this way, and what the benefits are, vs. the (amply articulated) liabilities. This is one of the most boring repeated conversations that occurs on HN. It's incessant. Avoiding these incessant superficial conversations is, in fact, part of the premise of HN.

I agree, it's an exhausting repeated conversation. It's almost as if there's a frustrating unmet need with signal as it stands for a lot of people that isn't actually placated by the repetition of an argument about how they grow as a ~~business~~ (sorry, as a non-profit). And again, signal is the only thing that can talk to people on signal so "use something else" is not helpful.

They're not a business.

Re: Twilio incident: What Signal users need to know

#325

Post by pseudo0 »

lrvick wrote: post #208
pseudo0 wrote: post #197

Earlier quoted context omitted.

> You can not buy a sim without KYC in almost all countries. I'd be curious to see stats on this. At least in the US, it is very easy to buy a SIM and sign up for a pre-paid plan with zero KYC.

The US is actually the only exception I am aware of world wide which gives us a distorted view of this problem.

Unless things have changed in the last few years, there are apparently countries in Europe that don't require registration: https://www.reddit.com/r/europe/comments/9ziqfi/european_cou...

And that's a quite high regulation part of the world, I'd be surprised if South American or African countries were stricter.

Re: Twilio incident: What Signal users need to know

#326

Post by uneventual »

awinter-py wrote: post #288

the recommended fix here is to add a PIN + enable registration lock IIRC signal PIN was very controversial back in the day because they were 1) forcing users to do it and 2) forcing them to opt in to some data collection as part of creating a PIN. Signal backed down on requiring a PIN, but now it's unclear from their settings page whether setting a PIN will share data as well. The marketing copy on my droid device sa…

They do some monkey business with sgx to make brute forcing harder but yeah it's worrisome.

https://blog.cryptographyengineering.com/2020/07/10/a-few-th...

https://signal.org/blog/secure-value-recovery/

Re: Twilio incident: What Signal users need to know

#327

Post by mr_toad »

pr0zac wrote: post #252
Varqu wrote: post #128

Is it not possible to use an Authenticator app for Signal, given their privacy setup?

Signal uses phone numbers as (the only) unique identifier in their system currently so SMS (or phone call) is necessary to verify the device owns the number. They've been talking about moving away from phone numbers as identifiers for a while and have implemented features like account pins that head in that direction but it hasn't happened yet.

Using a phone number as an identifier wouldn’t preclude using TFA.

Re: Twilio incident: What Signal users need to know

#328

Post by jabbany »

ianopolous wrote: post #296
MikeKusold wrote: post #169

Earlier quoted context omitted.

I love Keybase, but I would never recommend it today. Zoom acqui-hired the team in 2020: https://blog.zoom.us/zoom-acquires-keybase-and-announces-goa...

If you're looking for a Keybase replacement, check out Peergos ( https://peergos.org ). Peergos is a P2P E2EE global filesystem and application protocol that's: * fully open source (including the server) and self hostable * has a business model of charging for a hosted version * designed so that you don't need to trust your server * audited by Cure53 * fine-grained access control * identity proofs with controllable v…

Hmm, I'm looking for a Keybase replacement but one of the main reasons I use Keybase is their native apps that let you mount the cloud storage as a FUSE or FUSE-like (Dokan) native storage device.

This is great for distributing encrypted keychains/configuration files and the such across various platforms (where many apps are not cloud-aware but are happy interacting with the filesystem). So far the "mount" approach seems to have also performed considerably better than syncing-based services (dropbox, G drive, OneDrive etc.) which from time to time have resulted in hard to untangle merge errors.

Peergos looks promising but it also looks to be a web-only service, so not exactly a replacement yet. Would be nice to see an option for local native mounting. Preferably via a native app with a FUSE-like mount point, but I'd also probably be OK with something like WebDAV maybe.

Re: Twilio incident: What Signal users need to know

#329

Post by FightingSpirit »

"All users can rest assured that their message history, contact lists, profile information, whom they'd blocked, and other personal data remain private and secure and were not affected."

I do not understand how you can re-register someone's account to a new phone and not have the data read. If it is re-registered successfully, then you should be able to login. If you can login, you can see the data...right?

Re: Twilio incident: What Signal users need to know

#330

Post by mhitza »

FightingSpirit wrote: post #329

"All users can rest assured that their message history, contact lists, profile information, whom they'd blocked, and other personal data remain private and secure and were not affected." I do not understand how you can re-register someone's account to a new phone and not have the data read. If it is re-registered successfully, then you should be able to login. If you can login, you can see the data...right?

No, because a key is generated every time you reinstall/register in the app, and it sends along your contacts when you login (hashed). So there shouldn't be a way to see anything shared in the past .
Post reply on HN