Live data from Hacker News

Signal: Safety number updates

whispersystems.org

11–18 of 18 posts

Re: Signal: Safety number updates

#11

The problem is non security minded users probably won't take the time to verify the numbers in the first place. They should look into a method that verifies identities without user interaction. Possibly by having signal store users public keys after they verify their phone numbers or better yet provide users with signed certificates for verification purposes.

Congratulations, you've invented the iMessage security model.

The cryptographers behind signal are very smart; they have thought about these things.

The signal model has the advantage of not having to trust a third party server. With iMessage, it's possible for the government to force Apple to add pubkeys to a user's identity (although the user will be notified).

Re: Signal: Safety number updates

#12
One of Signals worst problems is that it entirely relies on Google to not provide a malicious APK during initial installation of the app.

(Yes, it is open source, but most people don't have the knowledge or time to compile software themselves)

I still think Signal is one of the best secure messengers though.

Re: Signal: Safety number updates

#13
post #12

One of Signals worst problems is that it entirely relies on Google to not provide a malicious APK during initial installation of the app. (Yes, it is open source, but most people don't have the knowledge or time to compile software themselves) I still think Signal is one of the best secure messengers though.

i can't get Signal to work here in germany - it always fails to register to the network - despite getting an SMS, and i suspect foul play.

Re: Signal: Safety number updates

#14
post #3

Enabling the advisory mode by default seems like a mistake, at least with the current UI. It is so unobtrusive that it carries a very distinct implication of "we've looked into this for you, and you don't need to worry about it" , which is not the case. The iconography of the shield also implies this - it says "Signal is protecting you". The message probably needs to be more explicit: "Voltairine de Cleyre isn't usin…

"Your correspondent had been replaced by a man-in-the middle for you convenience. Have a nice day."

Re: Signal: Safety number updates

#15
post #12

One of Signals worst problems is that it entirely relies on Google to not provide a malicious APK during initial installation of the app. (Yes, it is open source, but most people don't have the knowledge or time to compile software themselves) I still think Signal is one of the best secure messengers though.

i can't get Signal to work here in germany - it always fails to register to the network - despite getting an SMS, and i suspect foul play.

I had a problem with this before and figured out that it was due to reinstalling from Titanium Backup - could this apply to you? There are some other potential fixes posted here:

Android: http://support.whispersystems.org/hc/en-us/articles/21463462...

iOS: http://support.whispersystems.org/hc/en-us/articles/21313245...

Re: Signal: Safety number updates

#16
One features that Threema has is that you can see that you have verified the other persons key. I think Signal should have that too. If the other person reinstalls you just drop down back to a lower trust level.

Threema does it with 3 dots red, orange ad green, but other versions of this might be experented with.

Re: Signal: Safety number updates

#17
There was something weird going on when I set up Signal for my partner today. She had downloaded and installed Signal through the play store and we tried to scan and exchange safety numbers. My phone gave me the message that her version was outdated. The other way around gave her the same message.

When I updated my version it all worked out.

Re: Signal: Safety number updates

#18

Earlier quoted context omitted.

i can't get Signal to work here in germany - it always fails to register to the network - despite getting an SMS, and i suspect foul play.

I had a problem with this before and figured out that it was due to reinstalling from Titanium Backup - could this apply to you? There are some other potential fixes posted here: Android: http://support.whispersystems.org/hc/en-us/articles/21463462... iOS: http://support.whispersystems.org/hc/en-us/articles/21313245...

I'll check this out!
Post reply on HN