Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal for Android: RedPhone and TextSecure in one app

whispersystems.org

Post reply on HN
Print view View original

141–150 of 158 posts

Re: Signal for Android: RedPhone and TextSecure in one app

#141

Post by gozo »

anonbanker wrote: post #130
redwards510 wrote: post #128

Wow, tough room! So much negativity. Whisper Systems, thanks for making encryption simple enough that my Mom can use it, and open enough that I can trust it. That is the success story here.

I can't wait to see the number of pull requests to their repositories for all the bugs/features people are demanding!

That's not really how the world works though. People have de facto ownership over projects. A lot of the features are things which the project have repeatedly rejected. Very few people are going to spend time on things they believe are futile. The technology isn't the problem here, it's the leadership of the project.

Re: Signal for Android: RedPhone and TextSecure in one app

#142

Post by gcb0 »

haffenloher wrote: post #123
gcb0 wrote: post #118

Earlier quoted context omitted.

It is not opensource. the client WAS. the server i don't think was ever.

These are the client (GPLv3) and server (AGPLv3) repositories: https://github.com/WhisperSystems/TextSecure https://github.com/WhisperSystems/TextSecure-Server

sorry, i briefly followed the discussion on fdroid. from there it appeared that they couldn't build the latest versions from the provided sources.

Re: Signal for Android: RedPhone and TextSecure in one app

#143

Post by oggy »

This is great news, and thanks to everyone involved. I've been using TextSecure for a while, and it's really "pretty good security made easy". Yes it is not perfect for the super privacy-conscious (depends on Google Play services and all that) and a fork with these features might be useful, but if I understand the motivation correctly, the main goal is to make good crypto accessible to the masses.

I do have a personal gripe with that, though. I'm hoping a "high up" might read it so I am posting it here. The only people in my contact list who use the app are crypto nerds. It's really hard to get traction. I thought that the TextSecure people had a great idea to solve this chicken and egg problem; a unified messaging app that would handle your sms, and send secure messages wherever possible. One feature that I find is missing though, is the ability to semd broadcast (unencrypted) sms texts. In my experience (Europe, people around 30) this is used a lot, and a drop-in replacement for the built-in messenger would need to have this.

Actually, I would like to see this happen so much that I would be willing to do the work, if someone is willing to provide the handholding...

Re: Signal for Android: RedPhone and TextSecure in one app

#144

Post by whyoh »

IshKebab wrote: post #64
Tepix wrote: post #55

Signal is pretty awesome, it's by far the best that we have right now: • state of the art crypto • open source • free as in beer • Available for Android and iOS There are a few minor features that are missing but I can live with that. However, there are also a couple of important shortcomings: • no decentralization • use of the phone number I hope they can be fixed sooner or later.

But the centralisation and use of the phone number is necessary to make it not shit. Anyway you forgot the important features: * Nice modern UI * Integrates with SMS * Supports group chats * Uses MMS for group chat if not all members have Signal * Not really buggy or hard to use

>use of the phone number is necessary to make it not shit

Why? People who actually care about encrypted communication the most will just see it as unnecessary leakage of private data.

One of the best things about internet based communication is that we don't have to rely on traditional concepts like phones and phone numbers. I should be able to sign up and chat with anyone on any internet capable device, phone or no phone.

Re: Signal for Android: RedPhone and TextSecure in one app

#145

Post by anonbanker »

probablypat wrote: post #111
iheartmemcache wrote: post #20

Earlier quoted context omitted.

I'm not associated with Signal or Moxie (though I've been a silent fanboy for ~15 years-- [[hey Moxie if you're reading this and still are hiring, ping me - contact info is in my profile]]), but I'd inherently trust the application more than an average application or company because: a) Moxie has a track history of having a lot of personal integrity with regards to security. Some might say this is blasphemous but I'd…

In terms of privacy tools, I work for a company that makes one aimed for the general internet user (i.e. someone who doesn't know what DNS is). Do you have any comments on our extension? https://redmorph.com We aimed to put adblock/ublock/donottrack all in one extension and coupled it with vpn and proxy paid services.

If you weren't located in the US (or FIVEEYES) in any way, I'd use you in a heartbeat, and recommend all my friends.

Re: Signal for Android: RedPhone and TextSecure in one app

#146

Post by horusx »

junto wrote: post #121
finnn wrote: post #100

Earlier quoted context omitted.

Probably not because they check that against the list of people who have Signal installed so they can send encrypted messages to the people who support it. They talk more about how they try to do this privately in [0]. [0]: https://whispersystems.org/blog/contact-discovery/

I had a problem where one of my contracts uninstalled Textsecure, and went back to the vanilla SMS app. Now all the messages he received from me are garbled. Somehow they need a way to disassociate phones AFTER the app has been uninstalled.

You can ask your contact to use the unregister app here https://whispersystems.org/textsecure/unregister/

Apple offer a similar tool when leaving iOS https://selfsolve.apple.com/deregister-imessage

Re: Signal for Android: RedPhone and TextSecure in one app

#147

Post by JshWright »

amluto wrote: post #108

What happened to short authentication strings? The SAS protocol is nicely documented in the Silent Circle Instant Messaging Protocol paper [1], but when I go to "Verify identity" in the app I'm asked to verify an obnoxiously long pair of hexadecimal strings. The phone call feature supports it (with a curious lack of documentation), but it would be easy to imagine a UI that allowed verification without making a phone…

Axolotl (the crypto protocol used by Signal/TextSecure) never used SAS. The calling feature uses ZRTP, which does do SAS.

Re: Signal for Android: RedPhone and TextSecure in one app

#149

Post by corney91 »

moxie wrote: post #80
corney91 wrote: post #2

I really want to start using TextSecure (or Signal now I guess), but the only thing holding me back is it depends on Google Play Services. I love what they're doing and can understand the decision, but still thinks it sucks a bit that the best option for secure communications is so tied into Google.

It seems like you don't want to install Google Play Services on your device. My sense is that this isn't because you find the communication over GCM to be inherently offensive (it's just a tickle, after all), but because you don't want to run proprietary software. There's a very small number of people who find this to be very important, and my experience has been that the strategy is to loudly complain whenever anyth…

Close, it's less about propriety software and more about centralisation of services. I definitely tend towards open-source but it's not a dealbreaker, I just don't want to live in a world where my life is completely tied to Google. As good as a lot of their apps are, I hate the idea of the "ecosystem" that these companies are building.

I just want a messaging app that messages and doesn't imply a bunch of other services from another company. I'm aware that's easier said than done, I just hope the end-game of instant messaging isn't "Apple or Google?". To continue your comparison with mobile phones, you can have a SIM from any network and still communicate with people.

I'm going to try GcmCore that's been posted in this thread, it sounds interesting.

To be completely honest, it's not a die-hard opinion and will no doubt change a bit in the future. Technology is progressing and changing so fast, I don't want to go with the flow without questioning directions it's going in.

I know this is a niche choice, I don't expect anybody to cater to it specifically, I'm just happier putting together smaller apps that do what I want instead of installing an entire ecosystem. Hope that all makes sense.

EDIT: Just realised after pressing send that the difference in my mobile phone analogy is the customer obviously pays to use it, maybe I'd be happier with paying for the network, I don't know. Doubt there's a market for that though!

Re: Signal for Android: RedPhone and TextSecure in one app

#150

Post by a3_nm »

moxie wrote: post #80
corney91 wrote: post #2

I really want to start using TextSecure (or Signal now I guess), but the only thing holding me back is it depends on Google Play Services. I love what they're doing and can understand the decision, but still thinks it sucks a bit that the best option for secure communications is so tied into Google.

It seems like you don't want to install Google Play Services on your device. My sense is that this isn't because you find the communication over GCM to be inherently offensive (it's just a tickle, after all), but because you don't want to run proprietary software. There's a very small number of people who find this to be very important, and my experience has been that the strategy is to loudly complain whenever anyth…

I'm not an Android developer so I hope my mental picture of what GCM does isn't off.

> My sense is that this isn't because you find the communication over GCM to be inherently offensive (it's just a tickle, after all),

Using GCM still means that Google could suddenly stop to relay the messages for some users, right? (Say, those who seem to be using a non-official reimplementation of GCM...). Then the service would suddenly stop working for these users. So I'd still rather be able to avoid relying on the GCM backend at all, if that's possible.

> What I don't understand is why nobody just writes an API-compatible open source implementation of play services

Couldn't the Play Services API change without warning? It is sensibly designed so another implementation wouldn't be too hackish?

People shouldn't have to reimplement such things by mimicking Google's API. In principle, there should be a documented and stable standard, not hacky reimplementations.

I agree, though, that probably the way to go would be to first build a different messaging system like this (maybe using XMPP as a backend?).

Post reply on HN