Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal 2.0 released with private messaging support

whispersystems.org

Post reply on HN
Print view View original

151–160 of 174 posts

Re: Signal 2.0 released with private messaging support

#151

Post by pilif »

_jomo wrote: post #104

TextSecure for Android is only distributed via the Play Store. So I built it myself only to notice that Google Play Services are required for chat. I think depending on proprietary / data gathering apps is the wrong approach for an open source privacy app. It actually makes me sad. There was an issue about "This requires Google Play" on GitHub [0] which was closed by moxie with "TextSecure only requires GSF for data…

> I'll rather just stick to WhatsApp/Telegram

whatsapp and telegram also use google play services for background notifications. There is no other reliable way to ensure that messages are always delivered on both iOS (push notifications) and Android (Google Cloud Messaging).

Apps just don't get enough API access to do this on their own in a totally reliable way and even if they did, the overhead of multiple applications keeping multiple connections open (and the radio active) would cause a lot more drain on the battery.

Neither TextSecure not Signal use the platform provided notification features for unencrypted data though, so your messages are still safe.

Re: Signal 2.0 released with private messaging support

#152

Post by saghul »

pilif wrote: post #150
saghul wrote: post #144

Is there any documentation out there describing how the encrypted groupchat works? OTR can also give you 1-to-1 encryption, but not encrypted groupchat, so this is great news which I'd like to read more into.

https://whispersystems.org/blog/private-groups/ is going into some detail.

Thanks!

Re: Signal 2.0 released with private messaging support

#153

Post by unhammer »

higherpurpose wrote: post #145
frabcus wrote: post #101

Earlier quoted context omitted.

Great! The TextSecure brand is unfortunately dead to me. Although I liked the idea in theory of the SMS backwards compatibilty layer, in practice it confused people and caused technical problems which stopped many of my friends using it. With a reboot as a product with the new name Signal, I can market it again. Needs an Android version first though!

I agreed to that from the first day I used it. It's strange that the developers themselves don't realize it. Just kill SMS support. Nobody needs it anymore. I mean for crying out loud, data-only apps such as BBM and Whatsapp became most popular in poor countries, so I don't think the "but not everyone has money for data" argument works anymore.

I disagree. Most of my contact list doesn't use TextSecure/Signal; when I want to send someone a message I don't want to have remember if they use textsecure in order to open the optimal app for messaging them with. Maybe I'd even first open textsecure, then be disappointed that they're not in there and have to open the plain sms app. How annoying that would be.

Nobody needs SMS if everyone could just use the same app. But my brother uses a dumbphone and my mother uses an iPhone with nothing but iMessage and I use an Android and don't really feel like installing whatsapp or whatever the latest fad is just because one or two of my friends has it. Over SMS I can communicate with them all, and if any of them ever install textsecure I get encryption as a bonus.

Re: Signal 2.0 released with private messaging support

#154

Post by losvedir »

driverdan wrote: post #116
minot wrote: post #43

If anyone from Whisper Systems is reading, can you please tell me how I can disassociate my number from a Cyanogenmod installed version of TextSecure in my (now formatted and sold) Nexus 4 and get it working with my no sim Nexus 5 with Google Voice/Hangouts?

Good luck. When I tried TextSecure about a week ago I couldn't get it to work with Voice. I never received a confirmation.

I just set up TextSecure with my Google Voice number. The SMS failed, but after a couple minutes it went to a fallback verification by phone call that worked. I'm on Lollipop, not sure if that's important.

Re: Signal 2.0 released with private messaging support

#155

Post by scott_karana »

mahyarm wrote: post #124
WhitneyLand wrote: post #108

Earlier quoted context omitted.

It's not really a replacement, more of a secure alternative. Ideally it would be possible to totally replace iMessage with Signal allowing non-secure messages from legacy contacts. However, even if the team were so inclined Apple does not provide adequate messaging APIs. For example, there is no way to intercept an SMS message, see message history, etc.

TBH I think keeping SMS separate from an ip based communications method is better. Lets not pretend that SMS is secure. The only thing I would find missing are quick reply APIs.

How are IP and SMS traffic different, other than "packet" size and encoding constraints? Both are easily interceptable and spoofable, necessitating strong crypto.

I don't see how chacha20/poly1305 is somehow "worse" over SMS.

Re: Signal 2.0 released with private messaging support

#156

Post by nzp »

scott_karana wrote: post #155
mahyarm wrote: post #124

Earlier quoted context omitted.

TBH I think keeping SMS separate from an ip based communications method is better. Lets not pretend that SMS is secure. The only thing I would find missing are quick reply APIs.

How are IP and SMS traffic different, other than "packet" size and encoding constraints? Both are easily interceptable and spoofable, necessitating strong crypto. I don't see how chacha20/poly1305 is somehow "worse" over SMS.

The difference is mostly that in case of SMS, metadata leaks to carriers. In case of Signal/TextSecure/RedPhone, some limited metadata leaks to Google Cloud Messaging and Apple's equivalent platform (I can't remember the name). That's necessary because of scaling problems with push messages, but I understand there is work going on to develop a self contained alternative using WebSockets.

Re: Signal 2.0 released with private messaging support

#157

Post by nzp »

unhammer wrote: post #153
higherpurpose wrote: post #145

Earlier quoted context omitted.

I agreed to that from the first day I used it. It's strange that the developers themselves don't realize it. Just kill SMS support. Nobody needs it anymore. I mean for crying out loud, data-only apps such as BBM and Whatsapp became most popular in poor countries, so I don't think the "but not everyone has money for data" argument works anymore.

I disagree. Most of my contact list doesn't use TextSecure/Signal; when I want to send someone a message I don't want to have remember if they use textsecure in order to open the optimal app for messaging them with. Maybe I'd even first open textsecure, then be disappointed that they're not in there and have to open the plain sms app. How annoying that would be. Nobody needs SMS if everyone could just use the same ap…

They're planning to drop support for encrypted SMS fallback (a decision I have mixed feelings about), but plain SMS functionality will remain in the Android client for the forseeable future.

Re: Signal 2.0 released with private messaging support

#158

Post by nzp »

aw3c2 wrote: post #46
cryptomilk wrote: post #40

Earlier quoted context omitted.

Signal/TextSecure is Free Open Source Software. There is no company behind the development of the App. It is the Software with the best security model so far. The cryptography behind Telegram is not what you would expect of todays crypto standards. A lot of security researcher have commented on this already.

Sure there is a company (Whispersystems) doing most the work behind it. As they state: "dedicated development is supported by community donations and grants". This is good, it allows for very focused development.

Open WhisperSystems isn't a company. WhisperSystems was a company, it was acquired by Twitter which open sourced TextSecure. OWS, is just a name for the community effort around these tools: https://whispersystems.org/about/

Re: Signal 2.0 released with private messaging support

#159

Post by nzp »

clpwn wrote: post #118
dombili wrote: post #115

Congrats on the launch of Signal 2.0. I hope it'll be a popular app, but I have a question slightly off topic: Why can't we get an app like Signal for the desktop? Yes, I'm aware there are alternatives for the desktop (mainly Pidgin + OTR), but none of them work like Signal does (ease of use) and frankly I don't really trust using them. I'd like to think I'm ignorant on the subject and there's a good alternative out…

That's currently in the works as a browser extension: https://github.com/whispersystems/textsecure-browser You can keep track of its progress there :).

But I wonder if it's a good idea. You know, JavaScript/in-browser crypto being considered harmful and all that...

Re: Signal 2.0 released with private messaging support

#160

Post by driverdan »

losvedir wrote: post #154
driverdan wrote: post #116

Earlier quoted context omitted.

Good luck. When I tried TextSecure about a week ago I couldn't get it to work with Voice. I never received a confirmation.

I just set up TextSecure with my Google Voice number. The SMS failed, but after a couple minutes it went to a fallback verification by phone call that worked. I'm on Lollipop, not sure if that's important.

I tried that, didn't work either. I'm also on Lollipop. I'll give it another try incase it's working now.
Post reply on HN