Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal walks the line between anarchism and pragmatism

wired.com

Post reply on HN
Print view View original

131–140 of 342 posts

Re: Signal walks the line between anarchism and pragmatism

#131

Post by georgyo »

hnarn wrote: post #102
upofadown wrote: post #93

> It also required its users to think like engineers, which included participating in exceptionally nerdy activities like attending real-life “key-signing parties” to verify your identity to other users. In fairness to PGP, Signal uses exactly the same method as PGP does for verifying identities. You need to check a ridiculously long number which represents your correspondent's identity. It's a 40 digit hex "key fing…

I think it’s pretty important to point out that Signal allows you to import this number with a QR code, so it’s not very arduous to do to verification.

Various OpenPGP clients have this feature as well, such as OpenKeychain.

OpenGPG, the the most commonly used implemention of OpenPGP, doesn't have QR codes because it's meant to be a cli and a library.

With an open standard different clients will have different client facing features.

Re: Signal walks the line between anarchism and pragmatism

#132

Post by boredumb »

AndroidKitKat wrote: post #129
boredumb wrote: post #121

I've been using Matrix (and element as a client) for a little while now for personal and business stuff - I even wrote some fun little bot to shitpost random memes on my behalf. Anyone else using matrix actively for professional stuff? Any thing I may find later on that is a show stopper?

I believe parts of the French government are using Matrix for their communications [1]. I've been wanting to use Matrix more and more over IRC, but I've never really liked any of the Matrix clients. I think I'm just too stuck in my ways about my favorite IRC clients. [1]: https://element.io/case-studies/tchap

I have spent years using discord, slack and teams now so the migration to element as a client was definitely a welcome change. I like the idea of not having my companys historical communication tied directly to a single vendor and being able to host my own local server (and have options of which).

Not surprised governments are taking a look at it, the encryption and usability seem like a good fit and don't require them to rely on google/microsoft/salesforce for chatting.

Re: Signal walks the line between anarchism and pragmatism

#133

Post by bombolo »

gorgoiler wrote: post #47

”Signal [pioneered] end-to-end encryption, a feature that WhatsApp turned around and copied from Signal.” It wasn’t copied from Signal — at the protocol level, it is Signal: https://signal.org/blog/whatsapp/

We have no idea if whatsapp really implements it, and if it does but also adds a bunch of side channels for the NSA.

Re: Signal walks the line between anarchism and pragmatism

#134

Post by matt_kantor »

edrxty wrote: post #80
gorgoiler wrote: post #37

Earlier quoted context omitted.

I agree with you and the word “implicit” is crucial here. If the state is suspicious of you then they can come over, break in, tie you up, search all your stuff, and take anything they like home with them. It sounds infuriating but it’s what we need in order for the state to catch villains and the crucial part is they can only do it with a warrant . If a judge ordered you to unlock your phone and hand over all your m…

I consider technology to be an extension of mind. I'm not ok with the police literally cracking open my skull and probing my brain, not just because of the invasive torturous nature, but because it's an invasion of the very state that forms my existence. Similarly, the bits of my mind that I offload to other places.

That part that's literally (and legally, AFAIK) part of your mind is the code you use to unlock your phone. You can't be compelled to hand that over. I believe the same logic would apply to gorgoiler's scenario if you had a keypad lock on the door (the cops might be allowed to physically break it, but they couldn't compel you to share the code). I'm no lawyer/expert, though.

Re: Signal walks the line between anarchism and pragmatism

#135

Post by [deleted] »

upofadown wrote: post #93

> It also required its users to think like engineers, which included participating in exceptionally nerdy activities like attending real-life “key-signing parties” to verify your identity to other users. In fairness to PGP, Signal uses exactly the same method as PGP does for verifying identities. You need to check a ridiculously long number which represents your correspondent's identity. It's a 40 digit hex "key fing…

[deleted]

Re: Signal walks the line between anarchism and pragmatism

#136

Post by kasey_junk »

bombolo wrote: post #133
gorgoiler wrote: post #47

”Signal [pioneered] end-to-end encryption, a feature that WhatsApp turned around and copied from Signal.” It wasn’t copied from Signal — at the protocol level, it is Signal: https://signal.org/blog/whatsapp/

We have no idea if whatsapp really implements it, and if it does but also adds a bunch of side channels for the NSA.

This idea seems to rely on the flawed assumption that you can’t security audit closed source software. This is not an assumption I’ve ever seen an actual security researcher make.

Quite the opposite, they start with techniques they work on the binary and only use the source (if available) as a helpful reference. Hiding back doors in source has a long and storied history so relying on it to audit security has long been out of favor.

Re: Signal walks the line between anarchism and pragmatism

#137

Post by cmiles74 »

gcanyon wrote: post #8
wolverine876 wrote: post #2

> The motivations that led to end-to-end encryption going mainstream lie far out on the political fringe. The original impetus for Marlinspike’s entry into cryptography, around 2007, was to challenge existing power structures, particularly the injustice of how (as he put it) “Internet insecurity is used by people I don’t like against people I do: the government against the people.” But sticking to anarchism would imp…

There's a case to be made that encryption/private communication has gone through the same sort of progress as personal weaponry has, only on a much shorter time frame and to a much greater extent. In weaponry, it's taken ~200 years to go from bespoke muskets with a firing rate of a couple rounds per minute to semi-automatic and automatic weapons capable of firing multiple rounds per second. In just the last 20-30 yea…

In my opinion, the comparison to weaponry is pretty loaded and unreasonable. It evokes scenes of mass shootings, secure communication has no similar destructive power.

Warrants are still a thing! The government in the US can still get a warrant and they can compel you to show them the contents of your Signal messages. No fancy E2E backdoors are required. ;-)

Re: Signal walks the line between anarchism and pragmatism

#140

Post by jimllo »

bombolo wrote: post #133
gorgoiler wrote: post #47

”Signal [pioneered] end-to-end encryption, a feature that WhatsApp turned around and copied from Signal.” It wasn’t copied from Signal — at the protocol level, it is Signal: https://signal.org/blog/whatsapp/

We have no idea if whatsapp really implements it, and if it does but also adds a bunch of side channels for the NSA.

You can check it yourself with reverse engineering tools, e.g. on Android you could look at the APK with jadx and see the decompiled Signal implantation, and how it compares to the open source Java library from Signal that it is derived from.
Post reply on HN