Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I don't trust Signal

drewdevault.com

Post reply on HN
Print view View original

131–140 of 473 posts

Re: I don't trust Signal

#131

Post by jhasse »

JustSomeNobody wrote: post #105

What's wrong with using Google Play Services? Correct me if I'm wrong, but I assume it has to do with message notifications. So, by using GCM, Signal would be leaking some metadata about when and who, etc. I assume. But wouldn't someone be able to get that same information from your ISP (with a little more work)? You're losing the benefits of longer battery life for basically nothing. Security isn't absolute. I don't…

It allows Google to easily circumvent any end-to-end encryption since it's a rootkit.

Re: I don't trust Signal

#132

Post by phyzome »

« those are all really convenient excuses for an argument which allows him to design systems which serve his own interests. »

I wish the author would actually lay out what they think Moxie's interests are.

Re: I don't trust Signal

#134

Post by leetbulb »

guiraldelli wrote: post #69
hprotagonist wrote: post #16

But we have to trust that Moxie is running the server software he says he is. We have to trust that he isn’t writing down a list of people we’ve talked to, when, and how often. We have to trust not only that Moxie is trustworthy, but given that Open Whisper Systems is based in San Francisco we have to trust that he hasn’t received a national security letter, too (by the way, Signal doesn’t have a warrant canary). Mox…

I am happy to see I am not the only person in the world that feels like this about Signal. The interesting fact is that I "Ctrl+F" this page for Wire and I have seen nothing, even though this comment is about something that made me switch over Wire from Signal: to date, that's the unique instant messaging that has FOSS'ed both the server and the clients. (OK, the article also says about Matrix.) I admire Wire for a n…

I love wire. Never have any issues with the desktop client nor mobile app. Even though it's Electron, it seems to be extremely focused on security. Unfortunately, it suffers from the same metadata issues as Signal. If you really need higher security messaging, p2p is your best bet, but then you may face correlation attacks by ISPs and whatnot... Maybe we all just need to get our HAM radio licenses :)

Re: I don't trust Signal

#135

Post by jsgo »

okatsu wrote: post #64
pmlnr wrote: post #49

Earlier quoted context omitted.

Read the end of an article as well. We have solutions like Matrix, and like XMPP with OMEMO.

Signal did what those things failed to do which is to actually gain some popularity outside of HN. I hope Matrix takes off! In the meantime if people are convincing their families and friends to get on Signal then that's a net positive to me.

@ynniv - because if you can coax a friend who isn't on anything but Facebook to use Signal over, say, Messenger, then it is a net win. Is it perfect? No. Is it a better situation than the current? Yes.

Re: I don't trust Signal

#136

Post by tekromancr »

lowry wrote: post #88
g_sch wrote: post #39

Some version of this post seems to circulate every few months or so. This one is more direct in its accusations of Moxie acting in bad faith. I think this is disingenuous. Moxie has been very clear[0] about the tradeoffs that Signal has made and the reasons for them. It's fine to be dissatisfied with those choices. It's another thing entirely to accuse Moxie of dissimulating. Personally, I'd like to see Signal replac…

I would agree with you if only Signal would not ask for so many permissions on my phone.

Can you elaborate? I just set it up on a new phone yesterday and all it asked for on mine was; contacts (makes sense) files (to send pictures, files, etc) receive and send texts (if you want it as your default texting app/validating phone number via sms) Access to camera and microphone (for calls and in app photography)

These all seem like reasonable permissions for the features available.

Re: I don't trust Signal

#137

Post by drb91 »

Nasrudith wrote: post #112
gruez wrote: post #67

Earlier quoted context omitted.

source?

The big Apple vs FBI high profile lawsuit for one. Granted that was a telegraphed precedent seeking exercise by "accidentally" losing access to the work phone after the terrorists destroyed their personal phones before the attack.

That was not an NSL.

Re: I don't trust Signal

#139

Post by drb91 »

3pt14159 wrote: post #77

Signal is not for state-proof encrypted communication. Not large states like the USA or Russia. If you think it is, you've been misinformed. For state actor proof communications you need to evaluate every action you take and think: "What are the assumptions that I'm making here?" One assumption is that you're not currently on anyone's radar. Are you willing to bet the entire enterprise on this assumption? How certain…

Well if you’re ignoring state actor security and trusting a provider, what does signal offer over irc/tls?

Re: I don't trust Signal

#140

Post by jhasse »

apeace wrote: post #85
jMyles wrote: post #60

Earlier quoted context omitted.

The author expressly endorses Matrix.

And which operating system does the author expect people to use Matrix on? The one he personally wrote and reviews every commit to? Does he expect everyone to only chat on "trusted" open-source desktop operating systems and not their phones? The F-Droid argument is a really empty one. Packages are cryptographically signed? Are you verifying those signatures? In an article about "trust", can you explain how exactly yo…

> In an article about "trust", can you explain how exactly you trust F-Droid packages and not Google Play ones?

It's easier for Google to manipulate a package on Google Play than on F-Droid.

> Signal has introduced state-of-the-art encryption to millions of people in an accessible way.

WhatsApp has done that to even more people, so what's the point of Signal?

Post reply on HN