Why I won't recommend Signal anymore • Hacker News Board

Re: Why I won't recommend Signal anymore

#141

Post by tptacek » Sat, Nov 05, 2016, 9:32 PM UTC

Arathorn wrote: post #132

tptacek wrote: post #44

Earlier quoted context omitted.

You mean the Signal Protocol. That's its name. Axolotl was a name for a major component of Signal Protocol. Moxie and Trevor Perrin designed the protocol for Signal, and it's under active development. They own the protocol, its direction, and its documentation. Other projects can adopt parts of the Signal Protocol, and doing that is certainly better than just making stuff up. But Signal owns the protocol, because the…

Yeah, just to clarify: Olm (matrix.org/git/olm) is an entirely independent implementation of the Double Ratchet algorithm (based on Trevor's original public domain spec sketch, which was originally called 'axolotl'). It's not connected to Signal or Signal Protocol or Open Whisper Systems, and subsequently we've added an entirely different new ratchet (Megolm - https://matrix.org/docs/spec/megolm.html ) to handle Matr…

Crypto engineers tend to like the Axolotl design, which is an unusually serious cryptographic design for a messaging protocol (historically, messaging crypto has been cryptographically slapdash, with the exception of OTR).

But the reason crypto people are so positive about Signal Protocol isn't just that they like the ratchet. It's also that they trust the entire design of the system, not just the ratchet but all the rest of the cryptographic details, and also the oversight of the protocol.

It's kind of the same way that crypto engineers like stream ciphers designed as simple hash cores running in counter mode, but really what they like is stuff that Dan Bernstein designs --- they aren't encouraging you to go design your own hash-core based stream cipher!

So: it's good that these other systems adopting "Axolotl" are at least starting from a cryptographically serious place. But it's a bit jarring to see them reference "Axolotl" as if it answered the question of "why should we trust this cryptography".

A better answer would be to provide the bios of the people who designed and implemented the crypto in these systems.

Re: Why I won't recommend Signal anymore

#142

Post by richardwhiuk » Sat, Nov 05, 2016, 9:37 PM UTC

If you aren't going to recommend anything else then sit down and shut up frankly. The world is made of compromises and saying I don't like your choices is pointless if it's effectively impossible to choose differently.

Re: Why I won't recommend Signal anymore

#143

Post by tptacek » Sat, Nov 05, 2016, 9:40 PM UTC

darklajid wrote: post #96

zigzigzag wrote: post #43

Like a lot of crypto-puritanism it is rather mixed up. He says he recommended Signal because it was easy to use (more consumer friendly I guess) and secure, then says he wouldn't have gone in the direction of making it easier to use and criticises the things that make it user friendly, like using phone numbers instead of usernames. He says he thinks the protocol is secure, then says he doesn't want it to use GCM beca…

I'm not a cryptographer. I .. am reasonably sure that no one would take me for a hipster. But two issues - or call it 'differences in opinion' - in that article are relevant for me: The inability to use the service without a mobile number and federation. I understand the rationale behind the former ("It's easier"), but I don't understand why it is mandatory. I could've been 1283783127356128531312 on Signal and option…

Signal and Telegram are not the same thing. Telegram has, according to Reuters, been actively compromised by people working for oppressive regimes (Iran, in particular).

If you're just using a secure messenger on general principles, it doesn't matter much which one you use. Probably WhatsApp is your best choice.

But if you actually need secure messaging, you should be using the safest secure messenger. Since we don't know who's reading these recommendations and what they're doing with them, we should employ the precautionary principle, and be clear with people that systems like Telegram, while probably fine for keeping messages out of the hands of jealous ex-partners, are simply not up to the task of protecting messages from serious, well-funded adversaries.

Re: Why I won't recommend Signal anymore

#144

Post by encryptawaa » Sat, Nov 05, 2016, 9:45 PM UTC

HashThis wrote: post #137

How does Signal compare to Telegram? Would you recommend Telegram as better or worse then Signal.

On Signal, every message uses end-to-end encryption. Signal's servers can't see the messages you are sending, only you and the recipient can read them. Signal's encryption protocol is carefully scrutinized and follows best-practices.

Telegram sends messages in plain-text by default. Telegram servers have access to all plain-text messages that you send.

Telegram's private chats use end-to-end encryption. But they use an encryption protocol that they invented themselves that doesn't follow best-practices. Encryption experts have been critical of Telegram's encryption protocol since it was released. So your private messages might not be so private, either.

If you are doing something sensitive and want to stay out of prison, use Signal.

Re: Why I won't recommend Signal anymore

#145

Post by nextos » Sat, Nov 05, 2016, 9:46 PM UTC

RubyPinch wrote: post #133

tptacek wrote: post #50

Earlier quoted context omitted.

I agree overwhelmingly with what you wrote, except that I want to point out that this isn't "crypto-puritanism". It's just hipsterism. The author isn't a cryptographer, and if you asked a panel of 10 cryptographic engineers what messaging system they'd recommend, 9 of them would say "Signal". The 10th wants you to use something else because they're working on an attack for that "something else", and want their paper…

are you part of that knife fight? calling the article writer a hipster in this comment, and what seems to amount to "It's not wrong to criticize Signal. but don't because telegram is worse and more likely to win" in your other comment (since they arn't asking for libresignal to take over, just for a decent alternative to exist which currently probably does not) It seems a really strong and a bit aggressive of an atti…

I think the author is mostly right.

While Signal might have an excellent protocol, also well audited all this comes with some bad compromises.

E.g. you are forced to run GCM, or you share your address book. Both are unacceptable to many people that really need secure end-to-end encryption.

Re: Why I won't recommend Signal anymore

#146

Post by ttam » Sat, Nov 05, 2016, 9:47 PM UTC

funny enough, I was going to try out Signal today but stopped right after seeing the permissions they request: https://pbs.twimg.com/media/CwhFsLzXcAIDcMH.jpg:large

Re: Why I won't recommend Signal anymore

#147

Post by darklajid » Sat, Nov 05, 2016, 9:49 PM UTC

tptacek wrote: post #143

darklajid wrote: post #96

Earlier quoted context omitted.

I'm not a cryptographer. I .. am reasonably sure that no one would take me for a hipster. But two issues - or call it 'differences in opinion' - in that article are relevant for me: The inability to use the service without a mobile number and federation. I understand the rationale behind the former ("It's easier"), but I don't understand why it is mandatory. I could've been 1283783127356128531312 on Signal and option…

Signal and Telegram are not the same thing. Telegram has, according to Reuters, been actively compromised by people working for oppressive regimes (Iran, in particular). If you're just using a secure messenger on general principles, it doesn't matter much which one you use. Probably WhatsApp is your best choice. But if you actually need secure messaging, you should be using the safest secure messenger. Since we don't…

I don't think we disagree. If you need secure messaging, go with Signal. I'd agree (with less credentials to back it up compared to people that work in that industry cough).

I said that for me they are basically equivalent. And for now I pick Telegram as the best compromise I'm going to get (still using my mobile number, still a silo, crappy encryption vs usability and cross-platform/multi-device support).

You seem to say that people should cheer for Signal so that people that NEED the secure messaging features aren't lured into the wrong direction. That makes sense. But if someone reads HN for secure messaging recommendations .. I kinda expect them to read more than a single comment and do a bit of research.

People are pointing out that Signal doesn't satisfy some requirements for their individual needs. It's not a "You shouldn't use Signal" (which would be bad), it's a "You might not like Signal, if .. " listing reasons like federation and identity. In this setting here I think that's fair and reasonable. No harm done, no danger for a random person stumbling upon these discussions and dismissing Signal because a random person online said that it doesn't support federation.

Signal is a nice project, I'd recommend it for everyone that has hard requirements for their secure messaging solution. I still don't want to use it myself and feel that it's fair to point out why Signal cannot cater to everyone. That doesn't harm Signal or its global perception, I think.

Re: Why I won't recommend Signal anymore

#148

Post by aisofteng » Sat, Nov 05, 2016, 9:51 PM UTC

zigzigzag wrote: post #43

Like a lot of crypto-puritanism it is rather mixed up. He says he recommended Signal because it was easy to use (more consumer friendly I guess) and secure, then says he wouldn't have gone in the direction of making it easier to use and criticises the things that make it user friendly, like using phone numbers instead of usernames. He says he thinks the protocol is secure, then says he doesn't want it to use GCM beca…

I disagree with your criticisms entirely and I think you are conflating things.

First, ease of use: the distinction you miss is ease of use from a UX point of view. Managing your own security is hard for the vast majority of people. It is an advantage that there is ease of use with respect to the security aspects - no command line commands to generate keys, for example - and ease of use from a UX point of view is completely different. Making a decision to to ease the UX can indeed negatively affect privacy elements, and there is no contradiction there.

Which brings me to the second point, which is that there is no contradiction in the discussion of security. The service could be using insecure protocols or algorithms, but the author says it isn't - from the point of view of cryptography, those choices are said to be sound. On the other hand, having your communication routed through a PRISM partner is a different concern. There is no contradiction in saying that the part of security under their control is sound, but that the part routed through Google may not be.

Cryptography is complex and rigorous. What you call puratinism is actually rigor with respect to sound practices. The points the article makes are, in fact, coherent; where you call puratinism and hipsterism on the article, I call cynicism and likely uninformed reasoning on your comment.

Re: Why I won't recommend Signal anymore

#149

Post by hkt » Sat, Nov 05, 2016, 9:52 PM UTC

reacharavindh wrote: post #6

This. I didn't know much of the insides of Signal. But, When WhatsApp decide to go in bed with FB to share my contacts and usage, one of the alternatives I explored was Signal. Threw it out the moment it asked for ownership of my contacts (no way to opt out). I for one am not going to trust a guy's pinky promise to be good with my contacts and meta-data. If I'm going to give up the convenience of reaching anybody by…

Ring looks promising, re GNU projects.

I've personally reached the conclusion that software isn't enough for this, though: it is people who choose to flog your data and it is money that buys it (think FB and WhatsApp). In my view a collectively owned version of something like Signal would offer protection from what is termed corporate surveillance by allowing people with skin in the game to directly influence decisions on things like privacy policies and development roadmaps. I've sketched this in a bit more detail here: https://news.ycombinator.com/item?id=12881917

Re: Why I won't recommend Signal anymore

#150

Post by tptacek » Sat, Nov 05, 2016, 9:52 PM UTC

darklajid wrote: post #147

tptacek wrote: post #143

Earlier quoted context omitted.

Signal and Telegram are not the same thing. Telegram has, according to Reuters, been actively compromised by people working for oppressive regimes (Iran, in particular). If you're just using a secure messenger on general principles, it doesn't matter much which one you use. Probably WhatsApp is your best choice. But if you actually need secure messaging, you should be using the safest secure messenger. Since we don't…

I don't think we disagree. If you need secure messaging, go with Signal. I'd agree (with less credentials to back it up compared to people that work in that industry cough ). I said that for me they are basically equivalent. And for now I pick Telegram as the best compromise I'm going to get (still using my mobile number, still a silo, crappy encryption vs usability and cross-platform/multi-device support). You seem…

Look, that all makes perfect sense, and apart from the fact that I think Telegram is a deeply problematic project, I don't generally care what people use for casual communication. I use Slack, FFS!

But please remember the article we're actually commenting on starts like this:

One of the things I do is cryptography and infosec training for investigative journalists who have a need to keep either their sources and communications confidential so they can more safely do their work in the public interest.