Live data from Hacker News

Signal 2.0 released with private messaging support

whispersystems.org

131–140 of 174 posts

Re: Signal 2.0 released with private messaging support

#131

Earlier quoted context omitted.

While this is true, they also, through TextSecure, support many android phones that are probably in much worse shape on that front. It's also not like web browsers refuse to use TLS because your computer's running a compromiseable version of Windows.

That analogy sure stopped and made me think. What a sticky issue. SHOULD browsers do that? What if your bank website refused to allow you to sign in from a machine running unpatched XP? I think right now there might not be enough exploits targeting banking on XP machines to justify that inconvenience, but it seems like a responsable argument could be made for both cases.

It might seem like a good idea on the surface, but think about the impact this might have on people who can least afford it (consider why people might be using old phones or old operating systems, and what impact lack of access to their bank could have on them for even a day if it's the wrong day), in the name of protecting them from something theoretical.

Re: Signal 2.0 released with private messaging support

#132

Question: how and where message is stored when my phone is off and somebody will send me a message? How it is encrypted and then decrypted on my device once turned on?

It will either be on the remote device, or os Signal's servers, depending on how the implementation works. Either way doesn't really matter; the whole point of encryption like this is to prevent third-party access to your communications. It could be stored at NSA central for all it matters, and you'd still be the only one able to read the message (using the keys on your device).

I know how encryption works. My question was rather design wise. I.e. Which keys are used to encrypt messages on WhisperSystems servers (my public key? Or sender's?). But I'll have a look on the link below describing modified OTR protocol.

Re: Signal 2.0 released with private messaging support

#134
post #129

Earlier quoted context omitted.

Yeah, I'm aware of that, but doesn't that require a smartphone with TextSecure installed? I don't own a smartphone. (I accept that I'm a weirdo.)

No, just requires a phone number. It's still under development, but if you're curious you can check out install instructions here: https://github.com/WhisperSystems/TextSecure-Browser/blob/ma...

Huh, I didn't know that. Thanks for the link.

Re: Signal 2.0 released with private messaging support

#135
post #6

Awesome. Is there a rough timeline for Signal on Android? What about the desktop version - will there still be one? (at least a Whatsapp Web/Pushbullet style "desktop app")

Signal for Android is already available, kinda... It's split into TextSecure for the messaging portion and RedPhone for the call portion[0]. [0] https://whispersystems.org/

There are some compatibility problems between Signal and RedPhone. I can't seem to get the two to work together for international calling. Googling "Signal can't connect to RedPhone" shows that I'm not alone in this. Guess I'll have to wait for the Android version of Signal.

Re: Signal 2.0 released with private messaging support

#137
post #107

Earlier quoted context omitted.

They addressed it in this github issue: https://github.com/WhisperSystems/Signal-iOS/issues/614 I'm also disappointed in this. The people I most want to use this with are also the people who have an iphone4. I don't get the impression it'd be impossible to backport it from that post, so some enterprising individual could maybe do just that...

I'm surprised they didn't mention how amazingly insecure it is to be running a phone that old. If you're running a private messenger like Signal, you might not want to install it on a device vulnerable to bootrom exploits that negate all the advantages of disk encryption.

The idea is to get everyone to routinely use encryption like Signal. This increases the cost of drag-net surveillance, forcing instead more specific targets.

For that scenario, it doesn't matter if you're also vulnerable to direct hacks. You can still help normalise encryption.

Re: Signal 2.0 released with private messaging support

#138
post #94

I was waiting for this, even donated some time ago. Went to install it but it requires iOS8 so my perfectly functioning iPhone 4 can't run it. Is very hard to keep older iOS support? Side rant: I hate Apple is leaving my hardware off the grid. It is well cared, like new, battery is ok, no reason to think about replacing other than iOS8, and that sucks.

They addressed it in this github issue: https://github.com/WhisperSystems/Signal-iOS/issues/614 I'm also disappointed in this. The people I most want to use this with are also the people who have an iphone4. I don't get the impression it'd be impossible to backport it from that post, so some enterprising individual could maybe do just that...

So they don't want to do the work. However, if someone sends a pull request, would they reject it?

Re: Signal 2.0 released with private messaging support

#139

Presumably there are still multiple ways for messages to be intercepted from the user's iPhone: - Physical access or confiscation of the device - Possible backdoor in iOS or the physical iPhone hardware? - Compromise or physical access to a host machine where the user backs up their device. Although, I'm not sure what can be done to stop this.

I recently learned about Sancus [0]. It provides a way to protect an application from the operating system. It requires hardware support though. So not available in any mainstream hardware right now. It also allows very secure DRM.

[0] https://www.usenix.org/conference/usenixsecurity13/technical...

Post reply on HN