Earlier quoted context omitted.
I think the argument would be that with end-to-end encryption this is unnecessary, which is good because it's impossible. There's a counter-argument that there is still useful metadata a server can glean from its users, but it's certainly minimised with a good protocol... like the Signal protocol.
Wait, how would end-to-end encryption help this problem at all? I agree that it is impossible (currently), but not sure how E2E helps anything? E2E encryption only helps you verify WHO you are connecting to, not what they are doing with your connection once it is established.
Signal Server code on GitHub is up to date again
101–110 of 206 posts
Re: Signal Server code on GitHub is up to date again
#102Earlier quoted context omitted.
Then the reality is that those users cannot expect privacy anymore
This part I disagree with. They can (and should) lobby for laws that protect their privacy. Users don't want to give up convenience, but if the majority are using the services of BigCorp, and we push to force BigCorp to provide privacy through legislation, then society still wins.
Just try this: Use a default browser without adblocking/tracking protection etc. for a week and look how the ads are targeting you more and more. That's the internet for the average user. We just don't see it as much because we default to protect ourselves.
Re: Signal Server code on GitHub is up to date again
#103Earlier quoted context omitted.
This is an unhelpful attitude, IMHO. Your best chance, as a privacy-conscious, tech-savvy individual is to push for mass-market adoption of strong encryption and good government privacy regulations that will help everyone. Lacking those, you will stand out like a sore thumb as one of a tiny number of "weirdos" using Matrix, or Brave, or Tor or GrapheneOS or whatever other hardcore self-hosted, federated niche tools y…
Especially if your interest is in not necessarily your personal privacy, but that of lawyers, journalists, whistleblowers, etc.
Re: Signal Server code on GitHub is up to date again
#104After people started to realize that WhatsApp, owned by Facebook, started changing their privacy settings from terrible to slightly differently terrible, people flocked to and were recommended Signal by so called experts. Yet no one at that time bothered to point out that signal has been opaque as fuck about just about anything they do. On the other hand a free, self-hostable, highly transparent, highly secure altern…
For all its problems, WhatsApp was an improvement to the status quo. User messages went from being fully public to only being accessible by Facebook. Signal was also an improvement. User messages were finally encrypted from end-to-end, even though Signal retained control of the infrastructure and kept some of it opaque. Things are improving and there is no reason to believe Signal will have any more staying power than WhatsApp or any other platform.
As for why Signal beat out Matrix, I think the technical hurdles are a relatively minor factor. After all, signing up with Element doesn't require hardly any technical understanding. I think Signal was just a better known brand with a larger established userbase, streamlined on-boarding process, and ubiquitous feature support across many platforms.
I don't think it's appropriate to call Signal's users or the techies who recommended it "stupid". I think most of them just realized a communication platform is only valuable if the people you communicate with actually use it and that Signal would be an easier short-term sell. I think the chaps at Element realize that and are trying to position themselves as the next logical alternative once Signal eventually has its own mass-exodus.
There is still hope for Matrix. Just keep championing it and show some patience to your fellow human.
Re: Signal Server code on GitHub is up to date again
#105After people started to realize that WhatsApp, owned by Facebook, started changing their privacy settings from terrible to slightly differently terrible, people flocked to and were recommended Signal by so called experts. Yet no one at that time bothered to point out that signal has been opaque as fuck about just about anything they do. On the other hand a free, self-hostable, highly transparent, highly secure altern…
I'm disappointed WhatsApp became the defacto solution for secure communication. I am also disappointed Signal became the defacto alternative. I also think Matrix is a better solution and I'm rooting for it. But I think your response is unreasonably pessimistic and, frankly, arrogant. For all its problems, WhatsApp was an improvement to the status quo. User messages went from being fully public to only being accessibl…
Re: Signal Server code on GitHub is up to date again
#106Earlier quoted context omitted.
Oh wow. That’s incredibly suspicious...
It could just be an arguably-legitimate desire to keep the hot new feature secret until the big announcement; this particular bit is... sub-optimal... but it doesn't seem like it needs to be nefarious.
Re: Signal Server code on GitHub is up to date again
#107Is there any mechanism to validate that the code running on Signal's servers is the same as on Github?
No. If Signal /was/ federated it would be a strong hint that the server code stays the same. And even if it's not the same, people would be able to run their own trusted servers.
Anyway, Signal is designed to handle all the private bits at the client side with e2ee so you have to put as little trust in the server as possible.
Re: Signal Server code on GitHub is up to date again
#108Earlier quoted context omitted.
I'm disappointed WhatsApp became the defacto solution for secure communication. I am also disappointed Signal became the defacto alternative. I also think Matrix is a better solution and I'm rooting for it. But I think your response is unreasonably pessimistic and, frankly, arrogant. For all its problems, WhatsApp was an improvement to the status quo. User messages went from being fully public to only being accessibl…
That's such a nice response that i just want to thank you for it. Thank you, it really made my day! I'm just depressed from being stuck inside due to covid for such a long time, maybe that made me lose hope there..
Re: Signal Server code on GitHub is up to date again
#109A lot of these comments are just manifestations of the kneejerk HN "crypto bad" reflex. Here's the deal: - Whether or not Signal's server is open source has nothing to do with security. Signal's security rests on the user's knowledge that the open source client is encrypting messages end to end. With that knowledge, the server code could be anything, and Signal inc. would still not be able to read your messages. In f…
The issue a lot of people have with Signal is that your definition here of where security comes from is an extremely narrow & technical one, and many would rather look at security in a more holistic manner.
The problem with messaging security is that there's two ends, and individually we only control one of them. Ok, screenshotting & leaking your messages will always be a concern no matter what technology we develop, but the other challenge is just getting the other end to use Signal in the first place and that's governed by the network effect of competitors.
Open Source is essential for security because one of the most fundamental security features we can possibly hope to gain is platform mobility. Signal doesn't offer any. If Signal gains mass adoption and the server changes, we're right back to our current security challenge: getting your contacts onto the new secure thing.
Re: Signal Server code on GitHub is up to date again
#110Earlier quoted context omitted.
You're right that the damage to trustworthiness was always there. (I.e. they did the damage when they stopped publishing their source code, and they compounded that damage the longer they declined to publish their code). My point was more that the damage now seems to be directly attributable to the new payments integration. Prior to seeing this post, I was already concerned that adding a crypto/payments integration w…
Reading the other article on HN definitely helped me understand more. I think really it comes down to me not understanding why they had so much trustworthiness to begin with. They've been obscuring their code for about a year and even then, it's not like Signal has always come out and said "we love the passion our fellow developers have for our commitment to privacy and security". They just let people sell their rela…
But the standard Free Software development/distribution model does lack in some areas. And so Signal got a bunch of community leeway for going against the grain, in the hopes that a fresh approach would somehow bear fruit.
We're now apparently seeing some of the fruit from that approach.