Earlier quoted context omitted.
> ...your account will be associated with this phone number anyways. Messages exchanged in Signal are repudiable. That said, in a recent blog post Signal indicated that arbitrary usernames is something they're working on. > ...unlike XMPP you cannot spin up your own server and have full control over it. Signal is a better alternative for the likes of PGP because it is centralized [0]. Spam notwithstanding, Matrix has…
> Signal indicated that arbitrary usernames is something they're working on. no offense but they've been saying this for years, the feature may eventually come but I'm not holding my breath
Signal says it won’t compromise on encryption
251–260 of 336 posts
Re: Signal says it won’t compromise on encryption
#252Big govt vs big tech, a battle that is being played out all over the world. Any country that value sovereignty and sees itself as an independent actor rather than a vassal state, must take the position India is taking, or else be susceptible to foreign owned apps influencing its citizenry. The only alternative would be to insist Signal hire its security agents into product / moderator roles, so that oversight can be…
Except Government of India seems to want more (unchecked) foreign influence.
>> Lok Sabha passes Bill to exempt political parties from scrutiny on foreign funds, without debate
https://www.thehindu.com/news/national/lok-sabha-passes-bill...
Re: Signal says it won’t compromise on encryption
#253Couldn’t one just do PGP over WhatsApp, over Telegram or whatever? Instead of sending a plaintext message you’d send the PGP message but using existing infrastructure. Then there’d only be metadata to harvest but content should definitely be secure.
Android's Messages app does this. RCS isn't end-to-end encrypted, but Messages adds the Signal protocol on top.
Re: Signal says it won’t compromise on encryption
#254Earlier quoted context omitted.
> your private key is protected only by a verification text message and short PIN. That's very low entropy compared to a full ED25519 keypair. Can you explain what you mean by this? In practice, I can see the argument that the only verified identity (phone number) for most users is the one protected by a flimsy SMS verification message, but I don't believe that that implies your private key is terribly vulnerable to…
> True that Signal's UI makes this hard to do Do you think so? The app provides a "Safety Number" and QR code with built-in scanner to verify that yup, your device and their device have nobody in the middle. It has a visible reminder that you checked this person's actual identity (if you did) and a message appears if the keys change. If you are "rigidly adhering" to protocol your response should be to arrange an in-p…
I agree that verification is easy. I think they have softened the warnings and behavior surrounding key changes to accommodate their users that have virtually no understanding of crypto (i.e. the majority of people). It's an understandable position for them to take, but yes, in my opinion the alarm bells when a key unexpectedly changes are more oriented towards casual users than a (to paraphrase c7DJTLrn) Snowden-level user. For the latter, I expect behavior more similar to an OpenSSH key mismatch (which is quite a bit more strongly worded than Signal's).
Re: Signal says it won’t compromise on encryption
#255Earlier quoted context omitted.
Signal is a nonprofit though. They shouldn't be under pressure to create business.
Non profit but still against federation or anyone running an alternative client. Why?
Because federation is seriously difficult — look at all the effort the Matrix team has put in, and it’s still not quite 100%.
Plus yes Signal has a bit of an NIH complex.
Re: Signal says it won’t compromise on encryption
#256Requiring handing over encryption keys as a requirement to do business there sounds like a good way to sanction yourself from the modern world.
Isn't this what Bill Barr and the Trump administration wanted, too? https://www.justice.gov/opa/pr/statement-attorney-general-wi...
What is it about that guy, that makes people unable to stop talking about him?
Was it not enough for him to be the top story in the news every day for 4 years?
Re: Signal says it won’t compromise on encryption
#257I have nothing against Signal, Moxie, etc — but it attracts high-value targets. As such, Signal is an extremely high-value target. >> Signal knows nothing about who you are. This is based on trust, not systematic proofs, Signal knows this, yet never tells its users. For example, Signal uses Intel’s Software Guard Extensions (SGX) - which is know to have multiple attacks, any of which Signal might be forced to run usi…
Signal does marketing by omission: "Intel’s SGX protects against introspection", "we depend on donations from our community", etc.
Re: Signal says it won’t compromise on encryption
#258Earlier quoted context omitted.
> Signal indicated that arbitrary usernames is something they're working on. no offense but they've been saying this for years, the feature may eventually come but I'm not holding my breath
i think SMS support was part of the reason they could not do it before, since usernames would break that feature. removing SMS makes this a non-issue. the phone number is now just an arbitrary ID string which can be replaced by any other
There's no reason they couldn't have done both.
Signal never used SMS as a transport. It only provided a UI to have unencrypted SMS messages alongside Signal chats. As far as Signal messenges themselves go, phone numbers always were an arbitrary ID string.
Having a username that isn't a phone number would have only more clearly segregated the SMS feature from Signal chat; and the desire for that segregation is one of the key excuses they came up with for dropping SMS support from the Signal app.
Re: Signal says it won’t compromise on encryption
#259Earlier quoted context omitted.
Is the Whatsapp client really a black box? APKs are fairly straightforward to decompile back to Smali or a reasonable approximation of Java, or people on rooted devices can hook it with Frida. Of course source code would be better, but it would be pretty brazen to stick a backdoor in an app store release. App versions for popular apps get archived by numerous third-party sites, so even a temporary backdoor in one spe…
It is very difficult to find a backdoor even in the open source code, in megabytes of closed source code it is nearly impossible. > That would be putting their reputation Does Facebook have any reputation left?
> Does Facebook have any reputation left?
Most people still think of WhatsApp and Facebook as separate. For a while, WhatsApp displayed a Facebook logo for a second whenever it started (and given how Android works, opening WhatsApp does not necessarily mean starting it, most of the time it just switches to an already started process), but even that does not happen anymore, since it was replaced by a "Meta" logo (and most people do not associate "Meta" with Facebook).
Re: Signal says it won’t compromise on encryption
#260Earlier quoted context omitted.
Non profit but still against federation or anyone running an alternative client. Why?
Because federation is seriously difficult — look at all the effort the Matrix team has put in, and it’s still not quite 100%. Plus yes Signal has a bit of an NIH complex.
Matrix federation is hard because they want to support large IRV style rooms with consistent history and strong controls to prevent room takeovers.
Signal is more focused on 1:1 or small group chats. Federation there can be much simpler, more like email/xmpp than IRC.
It does still add friction and slows down youe development as upgrading is difficult.