Live data from Hacker News

I don't trust Signal

drewdevault.com

11–20 of 473 posts

Re: I don't trust Signal

#11

Is there a preference of Telegram over Signal or vice versa?

Telegram has a history of obvious backdoors, everyone should avoid telegram. http://habrahabr.ru/post/206900/

Some people may try to blame this on incompetence, but they still won't be able to explain how exactly someone might arrive at this implementation without malicious intent.

Re: I don't trust Signal

#13
TL;DR he doesn’t trust Signal because he doesn’t trust the Android operating system, and something about federation.

> No doubt these are non-trivial problems to solve. But I have personally been involved in open source projects which have collectively solved similarly difficult problems a thousand times over with a combined budget on the order of tens of thousands of dollars.

Shut up and code then. I’ll personally review your fully decentralized and secure chat app which nobody uses because it’s not available on any app store. Let me know when it’s done.

Re: I don't trust Signal

#14
"If Edward Snowden and Bruce Schneier are going to spout the virtues of the app, I expect it to actually be secure when it matters - when vulnerable people using it to encrypt sensitive communications are targeted by smart and powerful adversaries."

Because if the adversary is, say, an abusive ex that happens to work for the telco, for example, then it doesn't matter. Unless you're actively hunted by a G7 country your problems are inconsequential.

Re: I don't trust Signal

#16
But we have to trust that Moxie is running the server software he says he is. We have to trust that he isn’t writing down a list of people we’ve talked to, when, and how often. We have to trust not only that Moxie is trustworthy, but given that Open Whisper Systems is based in San Francisco we have to trust that he hasn’t received a national security letter, too (by the way, Signal doesn’t have a warrant canary). Moxie can tell us he doesn’t store these things, but he could. Truly secure systems don’t require trust.

We have at least one data point that says that Signal stores exactly two integers about you, or did when the subpoena was issued: https://www.aclu.org/open-whisper-systems-subpoena-documents

things can always change, but that’s evidence submitted in court under the penalty of perjury, which is a fairly strong claim.

Post reply on HN