Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal says it won’t compromise on encryption

theverge.com

Post reply on HN
Print view View original

281–290 of 336 posts

Re: Signal says it won’t compromise on encryption

#281

Post by stiltzkin »

pseudo0 wrote: post #112
shiomiru wrote: post #103

Earlier quoted context omitted.

In the context of privacy, you can pretty much assume every black box is compromised. With Telegram this black box is the server (the client is open source); with WhatsApp, it's the client. I suppose there's threat models where WA still wins, but knowing it's owned by Meta, I have a hard time imagining what such a threat model would look like.

Is the Whatsapp client really a black box? APKs are fairly straightforward to decompile back to Smali or a reasonable approximation of Java, or people on rooted devices can hook it with Frida. Of course source code would be better, but it would be pretty brazen to stick a backdoor in an app store release. App versions for popular apps get archived by numerous third-party sites, so even a temporary backdoor in one spe…

Telegram has more reputation that Meta.

Re: Signal says it won’t compromise on encryption

#282

Post by halJordan »

BuckRogers wrote: post #272
cvwright wrote: post #256

Earlier quoted context omitted.

What is it about that guy, that makes people unable to stop talking about him? Was it not enough for him to be the top story in the news every day for 4 years?

He was our president, every former president is newsworthy. Even when they just speak out. January 6th and the theft of top secret documents including nuclear secrets guarantees that he's not leaving the news cycle anytime soon. If he's not charged with a crime that is disqualifying for president, most expect him to run and deny any loss, ensuring our republic is overthrown by a banana republic as well. Many folks ar…

The FBI desires that you are referencing through Trump have been policy goals since the 80s when source code had to be exported as pages on a book. So it rings false when you claim he's just another president. You do get into your real reasons at least, but the soapbox betrays the real nugget of the question. Why cant we have a policy discussion because someone must derail it with their absolute need to tell us how badly they disagree with him.

Re: Signal says it won’t compromise on encryption

#283

Post by joshuamorton »

tialaramex wrote: post #235
411111111111111 wrote: post #167

Earlier quoted context omitted.

It's a non profit so it can receive donations, but the developer is a LLC that's run for profit. It's a similar story in almost all software companies that market themselves as non-profit foundations (Mozilla too btw) https://en.m.wikipedia.org/wiki/Signal_Foundation#Signal_Mes...

There are some things non-profits are not allowed to do. But, owning a for-profit isn't one of them, and the for-profit is allowed to do those things. So hence this is a common strategy. Example: Suppose I bulk buy T-shirts printed with my cool logo for $15 each and I sell them to consumers for $50 each. That's a for-profit activity, if Walmart was allowed to have a "non-profit" arm which did this I'm sure they would…

That's decidedly not what "nonprofit" means. A nonprofit can absolutely fundraise like that, and pay the employees above market salaries, or they can use the funds for other things, they just can't return them to shareholders (of which there aren't any), or the board.

Re: Signal says it won’t compromise on encryption

#284

Post by thomastjeffery »

cesarb wrote: post #261
thomastjeffery wrote: post #258

Earlier quoted context omitted.

There's no reason they couldn't have done both. Signal never used SMS as a transport. It only provided a UI to have unencrypted SMS messages alongside Signal chats. As far as Signal messenges themselves go, phone numbers always were an arbitrary ID string. Having a username that isn't a phone number would have only more clearly segregated the SMS feature from Signal chat; and the desire for that segregation is one of…

> Signal never used SMS as a transport. Signal is a merge of the TextSecure and RedPhone applications; back when it was still called TextSecure, it did use SMS as a transport for encrypted messages.

OK, that's historically interesting, though it really doesn't change my point.

Re: Signal says it won’t compromise on encryption

#285

Post by sliken »

JoshTriplett wrote: post #213
yeoldereason wrote: post #200

Earlier quoted context omitted.

I see no reason to back-up my history ever. I don't use signal for anything that needs to be archived. Nor do any of my friends. One of the selling points of signal is the feature that it doesn't automatically save photos, this is a good feature. You manually save the photos you want to save. And I thought people regularly backed up everything worth saving from phones to non phone archive anyway.

> I see no reason to back-up my history ever. I don't use signal for anything that needs to be archived. Every single time this comes up, someone chimes in saying they don't need it. That does not invalidate the users who do need it. If I can't keep my messages from device to device, I'm not going to use Signal. With far more manual effort than should be required, I can move my messages from Android device to Android…

Signal on Android has backups and migrations. Maybe the IOS signal doesn't?

Re: Signal says it won’t compromise on encryption

#286

Post by em-bee »

thomastjeffery wrote: post #258
em-bee wrote: post #218

Earlier quoted context omitted.

i think SMS support was part of the reason they could not do it before, since usernames would break that feature. removing SMS makes this a non-issue. the phone number is now just an arbitrary ID string which can be replaced by any other

There's no reason they couldn't have done both. Signal never used SMS as a transport. It only provided a UI to have unencrypted SMS messages alongside Signal chats. As far as Signal messenges themselves go, phone numbers always were an arbitrary ID string. Having a username that isn't a phone number would have only more clearly segregated the SMS feature from Signal chat; and the desire for that segregation is one of…

of course they could have, but it would have made for a more complex UI and add potential confusion to users. nothing that would be a serious problem that could not be overcome, but any of these things are tradeoffs. cost, complexity, etc.

SMS wasn't removed to make way for arbitrary user IDs. that would have been surprising even though i prefer IDs over SMS support. but if SMS was on the way out already it made sense to wait with implementing arbitrary user ID support until then. and now they have one less excuse not to implement it

Re: Signal says it won’t compromise on encryption

#287

Post by O__________O »

tssva wrote: post #276
O__________O wrote: post #233

Earlier quoted context omitted.

Regardless if they were “compeled” - nation security letter related activities have included actions. For example, this included a room and split: - https://wikipedia.org/wiki/33_Thomas_Street My understanding is that vendors that execute national security letters offer system integration technology to be locally installed to ingest the related data. Signal has the data, it just requires them collecting it — hence my…

Those actions were not the result of a national security letter. NSLs can only require the production of existing records. They cannot require the release of the content of communications nor the collection of records which don't already exist. They must also specify the time period the records request covers which can only include up to the date the NSL was received.

As I said, they’re related. That is All Writs Act is a United States federal statute, codified at 28 U.S.C. § 1651, which authorizes the United States federal courts to issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law. A writ is a form of written command in the name of a court or other legal authority to act, or abstain from acting, in some way.

Also my understanding that the National Security Letters vendors can simply reissue them automatically to maintain persistent data feeds. Disclosing actions taken via All Writs Act to enable national security letters would likely be a disclosure of them similar to warrant canary.

Re: Signal says it won’t compromise on encryption

#288

Post by notfed »

nrvn wrote: post #147

Encryption is just a tip of the iceberg here. There are several major problems with Signal: - it is not that private after all since it requires a phone number. Yes, you can override this by using some virtual throwaway number if you are geeky enough but your account will be associated with this phone number anyways. - as a consequence you _will_ receive spam from bots fanning out messages to phone numbers. You can’t…

> requires a phone number ... as a consequence you _will_ receive spam from bots

Weird take. Can you imagine the number of bots if it didn't require a phone number?

Re: Signal says it won’t compromise on encryption

#289

Post by brational »

cfhhgtyg wrote: post #130
betwixthewires wrote: post #55

Earlier quoted context omitted.

Matrix is great, but it leaks a ton of data.

So does Signal: who when with whom Matrix does leak more meta data though, e.g. message relationships for instance, but what does that matter?

That's false - Signal has had sealed sender on by default since 2018. (the setting you can turn on is just to see an icon in the ui).
Post reply on HN