Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Registration without a phone number on Signal will use zero-knowledge proofs

community.signalusers.org

Post reply on HN
Print view View original

71–80 of 201 posts

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#71

Post by bawolff »

ranger_danger wrote: post #65
mmooss wrote: post #22

Earlier quoted context omitted.

> Is it your expectation that E2E is broken by these "dragnet surveillance" networks? Surely not? While I disagree with these critiques of Signal, the surveillance networks can capture metadata - who talks to who and when - without breaking E2E. The metadata is as valuable as the data. I think Signal has a feature to protect users, but I can't imagine how it works if the attacker can see all parties' Internet connect…

> the surveillance networks can capture metadata - who talks to who and when If this is part of your threat model then I would suggest a different tool such as SimpleX since it uses onion routing and can be configured to always use private routing/relays.

I'm not familiar with SimpleX, but keep in mind only some types of onion routing is secure against a global passive adversary. Famously Tor is not.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#72

Post by NooneAtAll3 »

what wrote: post #60
purpleidea wrote: post #18

Signal needs to release all the infra automation code behind their backend. How they setup and manage it all should not be secret. It also makes it easy to rebuild if for some reason they are compromised. They've ghosted multiple people about this question. There's no reason a 501(c)(3) shouldn't release it.

OpenAI is 501c3, should they also be required to release everything?

"open" is literally in the name, so yes

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#73

Post by Cider9986 »

sysguest wrote: post #70

any link to presentations/papers on this? I'm interested on learning ZKPs -- they seem so much like "fairy-tale come true" because I don't know much

nym.com might have some. They use stuff like that heavily and there's a bunch of academics involved.

Also ZCash.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#74

Post by Cider9986 »

bawolff wrote: post #71
ranger_danger wrote: post #65

Earlier quoted context omitted.

> the surveillance networks can capture metadata - who talks to who and when If this is part of your threat model then I would suggest a different tool such as SimpleX since it uses onion routing and can be configured to always use private routing/relays.

I'm not familiar with SimpleX, but keep in mind only some types of onion routing is secure against a global passive adversary. Famously Tor is not.

Nym is apparently good against a global adversary.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#75

Post by Grombobulous »

NooneAtAll3 wrote: post #72
what wrote: post #60

Earlier quoted context omitted.

OpenAI is 501c3, should they also be required to release everything?

"open" is literally in the name, so yes

Apple should make their products edible as well.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#76

Post by godelski »

opengrass wrote: post #29
Cider9986 wrote: post #24

Earlier quoted context omitted.

It says something about Play Billing being used specifically to mitigate spam? I understand using play payments initially but hopefully eventually there's a way to buy an account without going through google.

Add ability to pay for a signal login. https://github.com/signalapp/Signal-Android/commit/7da3357b5...

Wouldn't that be related to data storage? Which they offer now? Or is that different?

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#77

Post by Cider9986 »

2Gkashmiri wrote: post #59
Cider9986 wrote: post #57

Earlier quoted context omitted.

And WhatsApp is E2EE with the same protocol so I don't see the big deal.

The big deal is, having talked to security people, they are "fine" with WhatsApp because the theory is, they get data from whatsapp so they have some sort of backdoor access. They are pretty chill with WhatsApp which id unexplainable

Maybe WhatsApp gives them a ton of metadata like all their contacts, when they chat and with who, IPs, etc. Signal only gives out either time registered or last used last time I checked.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#79

Post by akoboldfrying »

gbriel wrote: post #68
what wrote: post #60

Earlier quoted context omitted.

OpenAI is 501c3, should they also be required to release everything?

Non profit doesn't necessitate open sourcing their whole product. If you don't like that, don't donate. As long as they are transparent about their decisions that is the only obligation they have.

Perhaps it shouldn't necessitate it, but I can't think of a good reason why not.

If it were expensive to release it, that would be a reason. But it costs roughly zero dollars to create a public repo on GitHub and a cron job to push to it once a day.

Making the system public potentially increases the likelihood of a hack, which would be bad for Signal users. But relying on this argument to keep the source secret is, I think, a confession that your security is below par. Or to put it the other way round: A secure software system remains secure even if its source code is public, so making your source public is a strong signal that you are confident in your security measures. Security isn't something I expect all non-profits to focus on, but I think it would be telling for Signal to hide behind this reason.

What other reasons are there?

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#80

Post by vlovich123 »

what wrote: post #60
purpleidea wrote: post #18

Signal needs to release all the infra automation code behind their backend. How they setup and manage it all should not be secret. It also makes it easy to rebuild if for some reason they are compromised. They've ghosted multiple people about this question. There's no reason a 501(c)(3) shouldn't release it.

OpenAI is 501c3, should they also be required to release everything?

OpenAI is a 501c4 not a 501c3. Also the structure is much more complicated for OpenAI.

Nevertheless the point stands - I don’t see what relationship company organizational mission has with their technical responsibilities. Indeed, if the open sourced everything, standing up a clone would be easier which creates funding risk due to a race to the bottom of people who didn’t invest into the R&D investing very little additional to compete.

Post reply on HN