Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio incident: What Signal users need to know

support.signal.org

Post reply on HN
Print view View original

411–420 of 512 posts

Re: Twilio incident: What Signal users need to know

#411

Post by dcow »

autoexec wrote: post #405
dcow wrote: post #388

Earlier quoted context omitted.

Let me make this clear: if the data is stored in a way that Signal's service cannot decipher it, then it's not collected by any reasonable definition of collected" . In order for Signal to collect it they would have to obtain it, which they don't, and can't, do. This term isn't just some loose word to be thrown around and abused on message boards. If we take your definition of collected where handling encrypted data…

> Let me make this clear: if the data is stored in a way that Signal's service cannot decipher it, then it's not collected by any reasonable definition of collected". I think this is misguided, and confuses the truth. Data collected and stored remotely is being "collected and stored remotely" regardless of how well protected it is. I will however concede that it is possible to design a system where data is encrypted…

Can you link to the implementation? I'll agree that a 4 digit pin is rather egregious and trivially crackable. I don't know a single serious cryptographer that would allow such nonsense which is why your comment sounds so unbelievable. I thought they were blending the pin with some device-local entropy to make a reasonably strong key. I'd like to verify your claim.

Re: Twilio incident: What Signal users need to know

#412

Post by [deleted] »

awinter-py wrote: post #288

the recommended fix here is to add a PIN + enable registration lock IIRC signal PIN was very controversial back in the day because they were 1) forcing users to do it and 2) forcing them to opt in to some data collection as part of creating a PIN. Signal backed down on requiring a PIN, but now it's unclear from their settings page whether setting a PIN will share data as well. The marketing copy on my droid device sa…

[deleted]

Re: Twilio incident: What Signal users need to know

#414

Post by tptacek »

SnowHill9902 wrote: post #413

How much can one trust Signal for secure communication?

It won the Levchin Prize at Real World Crypto, and is essentially the gold standard for messaging cryptography. People on HN hate its ergonomics. You could reasonably prefer something else, but you can't reasonably call it untrustworthy.

Re: Twilio incident: What Signal users need to know

#415

Post by autoexec »

godelski wrote: post #384
autoexec wrote: post #361

Earlier quoted context omitted.

The information they collect includes your name, your photo, your phone number, and a list of all the people you've been in contact with using Signal. They encrypt it using a pin which they ask you to set or one they generate for you. They (and anyone else) can decrypt that data by brute forcing what is often just a 4 digit number.

Can you show me this? I'd guess it would have to be in the server code, so where is it? I don't see any real information about this on their site. Their website suggests that this information is stored locally https://support.signal.org/hc/en-us/articles/360007459591-Si...

I know. I really wish they had a simple page that explains everything. They've gone to great lengths to be confusing about what they're collecting and how. There were several complaints about misleading communication when this change rolled out Examples:

https://community.signalusers.org/t/dont-want-pin-dont-want-...

https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...

They've never updated their privacy policy to cover their new data collection practices even after requests (see https://community.signalusers.org/t/can-signal-please-update...)

The scheme they came up with to store user data in the cloud was described here: https://signal.org/blog/secure-value-recovery/

The code is here: https://github.com/signalapp/SecureValueRecovery

This site does a pretty good job of explaining why this isn't a good design: https://palant.info/2020/06/16/does-signals-secure-value-rec...

Lots of discussion here: https://community.signalusers.org/t/proper-secure-value-secu... and also https://community.signalusers.org/t/sgx-cacheout-sgaxe-attac...

Even more details here: https://community.signalusers.org/t/wiki-faq-signal-pin-svr-...

The major change was that pins were mandatory initially but the UX was so bad they had to give people a way to opt out of setting a pin. There is no opting out of having your profile/contacts data collected and stored in the cloud though.

Re: Twilio incident: What Signal users need to know

#416

Post by Volundr »

int_19h wrote: post #401
Volundr wrote: post #379

Earlier quoted context omitted.

A quick google suggests that if you want your tank to have working guns and/or turret you need a Federal Destructive Device Permit, which includes a background check and ATF approval.

Destructive devices are NFA items, true. If you want to own a DD, you need to pay the $200 federal transfer tax, which is done by submitting a form to the ATF and getting a tax stamp from them. It's not a "permit", though. And there are no special limits on who can own one - if you can legally own a gun, you can legally own a DD or any other NFA item. One doesn't even need to be a US citizen or a permanent resident f…

This is the site that I was looking at: https://nationalfirearmsact.com/nfa-regulated-items/destruct..., which seems to spell out the background check as a requirement. It also says you need to be a resident of the US. Am I missing something?

Re: Twilio incident: What Signal users need to know

#417

Post by batiudrami »

tptacek wrote: post #414
SnowHill9902 wrote: post #413

How much can one trust Signal for secure communication?

It won the Levchin Prize at Real World Crypto, and is essentially the gold standard for messaging cryptography. People on HN hate its ergonomics. You could reasonably prefer something else, but you can't reasonably call it untrustworthy.

I don’t really know why, even. I get the account vs phone number argument (though I prefer phone number as it is familiar to regular people in a way that usernames are not) but aside from that it has every feature I could want, and I feel like I am a fairly demanding user. It is is my primary messaging app and I send hundreds of messages a day to my friends, both individually and in group, on my phone and on my desktop.

Re: Twilio incident: What Signal users need to know

#418

Post by autoexec »

dcow wrote: post #411
autoexec wrote: post #405

Earlier quoted context omitted.

> Let me make this clear: if the data is stored in a way that Signal's service cannot decipher it, then it's not collected by any reasonable definition of collected". I think this is misguided, and confuses the truth. Data collected and stored remotely is being "collected and stored remotely" regardless of how well protected it is. I will however concede that it is possible to design a system where data is encrypted…

Can you link to the implementation? I'll agree that a 4 digit pin is rather egregious and trivially crackable. I don't know a single serious cryptographer that would allow such nonsense which is why your comment sounds so unbelievable. I thought they were blending the pin with some device-local entropy to make a reasonably strong key. I'd like to verify your claim.

Basically, they planned to get around much of the problem by depending on a very insecure secure enclave to make up for a lack of basic sound security practices.

The scheme they came up with to store user data in the cloud was described here: https://signal.org/blog/secure-value-recovery/

The code is here: https://github.com/signalapp/SecureValueRecovery

This site does a pretty good job of explaining why this isn't a good design: https://palant.info/2020/06/16/does-signals-secure-value-rec...

I'm sure I've linked to it already, but please review the discussion here as well: https://community.signalusers.org/t/sgx-cacheout-sgaxe-attac...

Even more details here: https://community.signalusers.org/t/wiki-faq-signal-pin-svr-...

Re: Twilio incident: What Signal users need to know

#419

Post by sneak »

autoexec wrote: post #415
godelski wrote: post #384

Earlier quoted context omitted.

Can you show me this? I'd guess it would have to be in the server code, so where is it? I don't see any real information about this on their site. Their website suggests that this information is stored locally https://support.signal.org/hc/en-us/articles/360007459591-Si...

I know. I really wish they had a simple page that explains everything. They've gone to great lengths to be confusing about what they're collecting and how. There were several complaints about misleading communication when this change rolled out Examples: https://community.signalusers.org/t/dont-want-pin-dont-want-... https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin... They've never updated their privacy p…

Link to the lines of code on the server that store the data in the way you describe or stop slinging mud.

You linked to a repository that uses Intel SGX which is used in this instance specifically to address your false claim that the e2e encryption used is easily bruteforced.

It also doesn't store any lists of who you contact; this claim is false. You've already been asked once for code references for your inaccurate claims, it's time for PoC or GTFO.

Re: Twilio incident: What Signal users need to know

#420

Post by tptacek »

batiudrami wrote: post #417
tptacek wrote: post #414

Earlier quoted context omitted.

It won the Levchin Prize at Real World Crypto, and is essentially the gold standard for messaging cryptography. People on HN hate its ergonomics. You could reasonably prefer something else, but you can't reasonably call it untrustworthy.

I don’t really know why, even. I get the account vs phone number argument (though I prefer phone number as it is familiar to regular people in a way that usernames are not) but aside from that it has every feature I could want, and I feel like I am a fairly demanding user. It is is my primary messaging app and I send hundreds of messages a day to my friends, both individually and in group, on my phone and on my deskt…

Transacting in phone numbers doesn't feel right to people who have been soaking in message board and IRC culture for (in some cases) decades, even though it's absolutely natural to ordinary people (remember, WhatsApp was for a very long time the most popular messaging service in the world).

And those same people have very strong feelings about services where you can't build your own client from scratch, and a viscerally negative reaction to Signal's principle that open clients create a lowest-common-denominator anchor for security. I get that too, even though the point is kind of indisputable (see: what happened with Matrix E2E crypto).

Signal has a clear vision for how security and privacy work in messaging, and they're uncompromising about it. I deeply respect that, since there are a lot of things they could do to pick up Internet points that they don't do because they haven't worked out the privacy details yet. But opinions differ.

Post reply on HN