Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Standalone Signal Desktop

signal.org

Post reply on HN
Print view View original

141–150 of 320 posts

Re: Standalone Signal Desktop

#141

Post by Jahava »

munin wrote: post #129
halayli wrote: post #124

Earlier quoted context omitted.

same logic can be applied to a native app that is using libpng and an attacker exploits the lib in one way or another.

things you can do in the native app to mitigate this risk: * run rendering in a sandbox * closely monitor your deps for vulnerabilities and ship patches as quickly as possible * choose deps with a better security track record, when possible * independently scan, test, and validate the deps you bring in things you can do in an electron app: * pray

In all fairness...

> run rendering in a sandbox

Most major browsers, including Edge and Chrome, do this and are really good at it.

> closely monitor your deps for vulnerabilities and ship patches as quickly as possible

Most major browsers do this too, and they have well-established update pipelines that can patch vulnerabilities in short order.

> choose deps with a better security track record, when possible

Most major browsers do this (e.g., "boringssl").

> independently scan, test, and validate the deps you bring in

Most major browsers do this as part of QA and vulnerability scanning.

> things you can do in an electron app: > * pray

* leverage all of the work that thousands at Microsoft, Google, Mozilla, etc., put into deploying what I suspect are the most heavily-attacked, heavily-scrutinized, and heavily-audited software platforms in existence.

Not that I'm specifically advocating web apps over native apps, but I don't think your list does a good job outlining their advantages.

Re: Standalone Signal Desktop

#142

Post by scott_karana »

acdha wrote: post #73
verbify wrote: post #14

It's ludicrous that you need javascript enabled to download a secure messaging app.

You are willing to run their code on your computer with full access to your data but not in the heavily-sandboxed browser environment?

Verbify didn't say that at all.

It's ludicrous that you can't download a security-focused app when your browser settings are unusually secure. ;)

Re: Standalone Signal Desktop

#143

Post by MarkSweep »

ktta wrote: post #127
amedvednikov wrote: post #53

Earlier quoted context omitted.

eul is a light (4 MB) native desktop client for all popular messengers: https://eul.im Signal support is coming later this year. Right now it supports Slack, Skype, Facebook, and Gmail.

Calling it 4MB is a bit ludicrous. On first run (on linux) it downloads half a GB worth (508 MB to be exact) of 'browser content'. On first run. So this isn't light or native. It uses the same Chromium codebase, but atleast twice the size of Electron apps. https://hardbin.com/ipfs/QmNttGPf65DZ3eeuNCCWemrxyNzaHxLhpAZ... If the rest of you are wondering where the bulk of it came from, check libcef.so (466 MB)- which is…

For what it's worth, it only uses that when adding an account initially to display the login webpage. The CEF is not used in normal operation of the app. It appears the app's GUI is created using OpenGL.

That said, I could not get the app to work with Google Hangouts or Facebook Messenger after 5 minutes of fiddling, so I gave up.

Re: Standalone Signal Desktop

#144

Post by jsnar »

jsnar wrote: post #101

Using Electron is a bad idea: it's not secure. Electron has many security vulnerabilities. The latest version is still based on old Chromium (58 & 59) so it inherits many of the security vulnerabilities published in Chromium 60, 61 and 62

submitted issue for this: https://github.com/WhisperSystems/Signal-Desktop/issues/1635

Re: Standalone Signal Desktop

#145

Post by superkuh »

orange8 wrote: post #112
jsnar wrote: post #101

Using Electron is a bad idea: it's not secure. Electron has many security vulnerabilities. The latest version is still based on old Chromium (58 & 59) so it inherits many of the security vulnerabilities published in Chromium 60, 61 and 62

what do you suggest they should they use instead

They could try not writing it in javascript and actually make a native application instead hiding behind semantics.

Re: Standalone Signal Desktop

#146

Post by bilkow »

nvr219 wrote: post #104
matt_kantor wrote: post #99

Earlier quoted context omitted.

This comment is not helpful.

Here you go: "One major problem Telegram has is that it doesn’t encrypt chats by default, something the FBI has advocated for. “There are many Telegram users who think they are communicating in an encrypted way, when they’re not because they don’t realize that they have to turn on an additional setting,” Christopher Soghoian, Principal Technologist and Senior Policy Analyst at the American Civil Liberties Union, told…

That's not entirely true. While Telegram's "cloud chats" are not end-to-end encrypted by default, they're encrypted at rest. They claim that "all data is stored heavily encrypted and the encryption keys in each case are stored in several other DCs in different jurisdictions."[0] It's not even close to perfect, but it's also not everything that the government wants.

For me, the problem with Signal is based mainly moxie's position on the LibreSignal fork, which aimed to be a Google-Free version of signal, but moxie said he was not OK with LibreSignal using the Open Whisper Systems servers and the name "Signal".[1] I kind of understand his position, but that's not what I'd expect of the free software community and definitely not what I expect from someone who's in the middle of my communications.

In the end, the hope's in matrix.org. It supports end-to-end encryption, works without a number and is fully federated. Maybe someday Telegram and Signal can even federate with matrix.

[0] https://telegram.org/privacy#2-storing-data [1] https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

Re: Standalone Signal Desktop

#147

Post by enraged_camel »

dbrgn wrote: post #82

Does it still store all data unencrypted on the disk? https://github.com/WhisperSystems/Signal-Desktop/issues/1017

Wow, reading that thread basically made me decide against using Signal.

For an app that is supposed to be the pinnacle of secure messaging, leaving anything unencrypted on the local device is just breathtakingly negligent.

The way moxie ushers people to take the discussion elsewhere doesn't help either. It just reinforces the perception that he doesn't care.

Re: Standalone Signal Desktop

#148

Post by superkuh »

pvg wrote: post #80
mfwoods wrote: post #74

Earlier quoted context omitted.

You're right, I clarified it a little.

Oh I meant the original poster, who claims you need a turned-on and present phone for Signal desktop to work. The person you originally corrected.

The original poster was correct though. Just because you only need to do it once doesn't mean it isn't required. As a person without a smart phone I can't use it.

Nor would I since it still requires a phone number to use.

Re: Standalone Signal Desktop

#149

Post by jacobsenscott »

smcleod wrote: post #106
maerek wrote: post #87

Earlier quoted context omitted.

Not sure what I'm missing here, but I see Signal using 37.5MB of memory. That doesn't seem egregious, but I'm also not familiar with what other Electron apps use.

I don't think you're looking at all the processes: A fresh launch without logging in or having it run for any period of time immediately uses 211.2MB: 1. Signal: 58.3MB 2. Signal Helper: 128.6MB 3. Signal Helper: 24.3MB After logging in and starting a few conversations I quickly see the total rise to over 350MB.

Memory usage isn't well understood. If you are using Activity Monitor on OSX the memory tab doesn't tell you much. Double click the process and look at the "Real memory size". That's a much more accurate picture of the physical ram being used by the process. It is typically much less than what you see on the memory tab overview.

Re: Standalone Signal Desktop

#150

Post by dopu »

kome wrote: post #19

Signal Desktop is not really standalone, because you still need to pair it with your phone. And the phone should be turned on. I am very privacy conscious, and I don't use a smartphone, at all, because it's basically a spying device in your pocket. Why Signal is all about privacy and then it forces me to pair it with a telephone? Telegram desktop is really standalone. They require a telephone number too (and that's v…

How can you be very privacy conscious yet lack ownership of the phone number that your Telegram account's registered on? Whoever takes ownership of that number can easily lock you out of your account while retaining access to everything you've ever posted.
Post reply on HN