Signal for Android: RedPhone and TextSecure in one app • Hacker News Board

Re: Signal for Android: RedPhone and TextSecure in one app

#151

Post by nly » Wed, Nov 04, 2015, 4:00 AM UTC

vox_mollis wrote: post #76

IshKebab wrote: post #64

Earlier quoted context omitted.

But the centralisation and use of the phone number is necessary to make it not shit. Anyway you forgot the important features: * Nice modern UI * Integrates with SMS * Supports group chats * Uses MMS for group chat if not all members have Signal * Not really buggy or hard to use

Huge respect for Moxie, but the requirement of a phone number really is a dealkiller. 1. Phone number requires a service provider 2. Service provider owns the baseband and root of your phone. 3. $government makes a "lawful request" of Verizon et. al. to install keyloggers/screenshotters on your phone. 4. Your "secure" commms are compromised. Signal needs to work on comprehensively rooted devices connected only via wi…

> 2. Service provider owns the baseband and root of your phone.

My service provider doesn't own my baseband. They own the SIM I put in my phone, and that likely gives them a lot of access to my device, but I doubt it can be used to perform key or screen logging. (Nexus 4, bought SIM free)

Re: Signal for Android: RedPhone and TextSecure in one app

#152

Post by Splines » Wed, Nov 04, 2015, 4:40 AM UTC

junto wrote: post #121

finnn wrote: post #100

Earlier quoted context omitted.

Probably not because they check that against the list of people who have Signal installed so they can send encrypted messages to the people who support it. They talk more about how they try to do this privately in [0]. [0]: https://whispersystems.org/blog/contact-discovery/

I had a problem where one of my contracts uninstalled Textsecure, and went back to the vanilla SMS app. Now all the messages he received from me are garbled. Somehow they need a way to disassociate phones AFTER the app has been uninstalled.

This is one of the reasons why they don't do encrypted SMS anymore:

https://whispersystems.org/blog/goodbye-encrypted-sms/

Re: Signal for Android: RedPhone and TextSecure in one app

#153

Post by rogerbraun » Wed, Nov 04, 2015, 8:10 AM UTC

finnn wrote: post #103

rogerbraun wrote: post #83

Earlier quoted context omitted.

Just use Conversations. It can now use the same protocol and is the best XMPP client there is. I'm completely baffled that the Textsecure people insist on using the gapps package, which is of course an extreme privacy risk.

> It can now use the same protocol Conversations uses XMPP, not whatever custom stuff WhisperSystems worked up for Signal. Are you talking about OMEMO[0]? That's their implementation of Axolotl over XMPP. So same crypto, yes, but different protocol. [0]: http://conversations.im/omemo/

That's what I meant, sorry for the confusion.

Re: Signal for Android: RedPhone and TextSecure in one app

#154

Post by jugbee » Wed, Nov 04, 2015, 8:41 AM UTC

Guys, cut with the negativity. I'm a crypto nerd as well, and with my other truly paranoid friends we use Chatsecure which does not require your number, is compatible with Tor, etc. However, my mom uses Signal, my father yesterday called me via Signal and he's fuckin' 67 years old. That is truly amazing and I admire Moxie et.al for the work they do.

Do you seem to forget that it is encryption for the masses. Not only for the few tin foils like myself. And even if it uses GCM, it's still an great, since i could never persuade my non-paranoid friends to contact me only via Chatsecure. They would say - "why the fuck can't you be like a normal person and use whatsapp or fb messenger?".

Re: Signal for Android: RedPhone and TextSecure in one app

#155

Post by droopyar12 » Wed, Nov 04, 2015, 12:31 PM UTC

Redphone and Signal are all backdoor applications with bugs and exploits that i have found. Even the server is backdoor. Nobody in the security scene could use this, except a kid.

Re: Signal for Android: RedPhone and TextSecure in one app

#156

Post by portoperope » Wed, Nov 04, 2015, 3:44 PM UTC

unfamiliar wrote: post #112

vox_mollis wrote: post #76

Earlier quoted context omitted.

Huge respect for Moxie, but the requirement of a phone number really is a dealkiller. 1. Phone number requires a service provider 2. Service provider owns the baseband and root of your phone. 3. $government makes a "lawful request" of Verizon et. al. to install keyloggers/screenshotters on your phone. 4. Your "secure" commms are compromised. Signal needs to work on comprehensively rooted devices connected only via wi…

Plus it still leaves people open to metadata analysis. The phone number has to be verified, meaning a text message is sent from Signal HQ to your device, clearly marking you as a Signal user.

Nitpick: Currently the verification text messages are sent via Twilio.

Re: Signal for Android: RedPhone and TextSecure in one app

#157

Post by whyever » Fri, Nov 06, 2015, 10:25 PM UTC

unicornporn wrote: post #136

vox_mollis wrote: post #76

Earlier quoted context omitted.

Huge respect for Moxie, but the requirement of a phone number really is a dealkiller. 1. Phone number requires a service provider 2. Service provider owns the baseband and root of your phone. 3. $government makes a "lawful request" of Verizon et. al. to install keyloggers/screenshotters on your phone. 4. Your "secure" commms are compromised. Signal needs to work on comprehensively rooted devices connected only via wi…

I'd say only being available on Google Play is an even greater dealkiller. Telegram (which is, to be honest, not quite comparable) is on F-droid, that I like.

TextSecure used to be on F-droid, but Moxie wanted them to take it down, because it was not him signing the packages (a disadvantage to Google Play).

Re: Signal for Android: RedPhone and TextSecure in one app

#158

Post by frabcus » Sun, Nov 08, 2015, 3:47 PM UTC

whyoh wrote: post #144

IshKebab wrote: post #64

Earlier quoted context omitted.

But the centralisation and use of the phone number is necessary to make it not shit. Anyway you forgot the important features: * Nice modern UI * Integrates with SMS * Supports group chats * Uses MMS for group chat if not all members have Signal * Not really buggy or hard to use

>use of the phone number is necessary to make it not shit Why? People who actually care about encrypted communication the most will just see it as unnecessary leakage of private data. One of the best things about internet based communication is that we don't have to rely on traditional concepts like phones and phone numbers. I should be able to sign up and chat with anyone on any internet capable device, phone or no…

Because you need something paid for underneath it to stop spam.

This fantastic post from Mike Hearn, who was on the GMail spam team and now makes P2P decentarlized stuff, explains it all:

https://moderncrypto.org/mail-archive/messaging/2014/000780....

Essentially, every large provider (e.g. Facebook, GMail) of network services ultimately uses phone numbers now as a common thing that can't be infinitely reproduced. They underpin all high quality antispam on large Internet systems.