141–150 of 174 posts
Question: how and where message is stored when my phone is off and somebody will send me a message? How it is encrypted and then decrypted on my device once turned on?
They are using a modified OTR protocol: https://whispersystems.org/blog/asynchronous-security/
TextSecure for Android is only distributed via the Play Store. So I built it myself only to notice that Google Play Services are required for chat. I think depending on proprietary / data gathering apps is the wrong approach for an open source privacy app. It actually makes me sad. There was an issue about "This requires Google Play" on GitHub [0] which was closed by moxie with "TextSecure only requires GSF for data…
One question I always have with secure systems distributed by app stores, even the open source ones, is how to you verify the source you're reading is the app you're using?
Well, there are several ways to get read access to the iPhone's filesystem. You can grab the binary from the phone and verify that its the same as when you compile the app on your own machine. No one's going to do that for most apps though.
Earlier quoted context omitted.
I've contributed to the development of Signal 2.0, and you can also check out this blog post. https://whispersystems.org/blog/signal/ On Android you can use RedPhone for secure calls and TextSecure for secure text messages. These calls and text messages are compatible with calls and text messages in Signal iOS. Someday TextSecure and RedPhone on Android will be integrated into one unified product called Signal.
Great! The TextSecure brand is unfortunately dead to me. Although I liked the idea in theory of the SMS backwards compatibilty layer, in practice it confused people and caused technical problems which stopped many of my friends using it. With a reboot as a product with the new name Signal, I can market it again. Needs an Android version first though!
I installed it and texted my friend. It never asked me to verify his pubkey. How does key management work? Is it all done through Whisper Systems' servers? If that's the case, how is this effectively better than iMessage? iMessage is also (nominally) quite secure, except for the fact that you have to trust Apple to verify pubkeys, which makes it quite feasible to MITM if you can subvert Apple via legal or technical m…
Keys are trusted on first use, similar to SSH. The app also provides an interface you can use to verify fingerprints: https://github.com/WhisperSystems/Signal-iOS/wiki/FAQ#can-i-...
I was waiting for this, even donated some time ago. Went to install it but it requires iOS8 so my perfectly functioning iPhone 4 can't run it. Is very hard to keep older iOS support? Side rant: I hate Apple is leaving my hardware off the grid. It is well cared, like new, battery is ok, no reason to think about replacing other than iOS8, and that sucks.
They addressed it in this github issue: https://github.com/WhisperSystems/Signal-iOS/issues/614 I'm also disappointed in this. The people I most want to use this with are also the people who have an iphone4. I don't get the impression it'd be impossible to backport it from that post, so some enterprising individual could maybe do just that...
But if that's not an issue, and they can afford to support at least iOS7, maybe they should do it. However, I'd rather have them focus resources on bringing Signal to Android and to the desktop. I think those are much bigger priorities than enabling Signal for a few extra million iPhone 4/S users.
Can anyone explain what's the difference between using Signal and using WhatsApp (assuming TextSecure is the default protocol being used - is it?)?
Signal is a free open-source iOS app from whispersystems, licensed under the GPL. It's counterpart on Andriod is testsecure/redphone, which will eventually be reimplemented and rebranded as Signal for Andriod. It is secure by default, all messages are encrypted using private keys of the participants... whisper does not have they keys (so they can not turn the keys or content over to anyone). You can audit this since it is an open source app, and if you would like to fix a bug or work on a feature you can do that as well. It does not have nearly as big of a user base as WhatsApp, and needs some love before usability/features/bugginess are on-par which whatsapp (shouldn't be too hard to match as WhatsApp itself is not very feature rich and often quite buggy itself). Signal has taken it's time in development (Textsecure for iOS was 'on track' to be released in summer of 2013)...
You can also make secure phone calls with Signal/Redphone, but not WhatsApp.
This is huge. If you have an iPhone, install Signal.
I loaded it up and declined to let it access my contacts, but unfortunately it seems like it won't let me attempt to send any messages. I just get a screen that always says "None of your contacts have Signal!"
From what I understand, the reason it wants access to my contacts is to make it easier for me to find out which of my friends already use Signal or TextSecure. But none of my friends use these apps, and my goal is to get them to start. Unfortunately they'll refuse to use it if I have to tell them "Well, you'll need to let Signal upload all of your contacts to their server."
I was hoping for the ability to send a message by typing in a phone number directly. Does anyone know if this is possible? If not, would it be possible to add this feature?
Maybe it could work like this: You tap "new message" and then type in a phone number, just like how regular text messages normally work. Then when you're finished typing in the phone number, the app checks with Signal's server to find out whether that number uses Signal. If that number doesn't use Signal, then the app pops up a message saying "Your friend doesn't seem to be using Signal."
That way I can ask my friends to install Signal and send me a message. When they load up the app for the first time and Signal asks to access their contacts, they can click "no" and then type in my phone number directly.
It seems like many people won't be comfortable letting Signal upload all of their contacts, so unless there's some way to call or send a message by typing in a phone number directly, those people won't start using Signal. I'll have a hard time convincing my friends to use it without this.
Is there any documentation out there describing how the encrypted groupchat works? OTR can also give you 1-to-1 encryption, but not encrypted groupchat, so this is great news which I'd like to read more into.