Why I won't recommend Signal anymore • Hacker News Board

Re: Why I won't recommend Signal anymore

#151

Post by tptacek » Sat, Nov 05, 2016, 9:54 PM UTC

nextos wrote: post #145

RubyPinch wrote: post #133

Earlier quoted context omitted.

are you part of that knife fight? calling the article writer a hipster in this comment, and what seems to amount to "It's not wrong to criticize Signal. but don't because telegram is worse and more likely to win" in your other comment (since they arn't asking for libresignal to take over, just for a decent alternative to exist which currently probably does not) It seems a really strong and a bit aggressive of an atti…

I think the author is mostly right. While Signal might have an excellent protocol, also well audited all this comes with some bad compromises. E.g. you are forced to run GCM, or you share your address book. Both are unacceptable to many people that really need secure end-to-end encryption.

GCM has practically nothing to do with the security/privacy of Signal, but it is the #1 "concern" that people who don't understand cryptographic messaging security feel they must relate about Signal.

Re: Why I won't recommend Signal anymore

#152

Post by cbsmith » Sat, Nov 05, 2016, 9:57 PM UTC

There's a fundamental assumption here: that there is a better way. I'm not saying there isn't, but there's a pretty good existence proof that Signal is the best combination of security & simplicity we can put together.

I would agree with this statement from the article: "there should be a tool that is fully free software (as defined by the GNU GPL), that respects users' freedoms to freely inspect, use, modify the software and distributed modified copies of the software. Also, this tool should not have dependencies on corporate infrastructure like Google’s (basically any partner in PRISM), that allows these parties to control the correct working of the software."

There are such tools. None of them are as easy to use as Signal. So for now, I recommend Signal. I can't, in good conscience, recommend anything else... and given the author doesn't speak to what they recommend, I'm curious about what their recommendation would be.

Re: Why I won't recommend Signal anymore

#153

Post by darklajid » Sat, Nov 05, 2016, 9:59 PM UTC

tptacek wrote: post #150

darklajid wrote: post #147

Earlier quoted context omitted.

I don't think we disagree. If you need secure messaging, go with Signal. I'd agree (with less credentials to back it up compared to people that work in that industry cough ). I said that for me they are basically equivalent. And for now I pick Telegram as the best compromise I'm going to get (still using my mobile number, still a silo, crappy encryption vs usability and cross-platform/multi-device support). You seem…

Look, that all makes perfect sense, and apart from the fact that I think Telegram is a deeply problematic project, I don't generally care what people use for casual communication. I use Slack, FFS! But please remember the article we're actually commenting on starts like this: One of the things I do is cryptography and infosec training for investigative journalists who have a need to keep either their sources and comm…

Right. You got me there. In THAT context I'm completely with you and the recommendation for these people probably should be Signal, keeping the technical/philosophical differences for places like this one here.

Wishing that Signal would do things differently? Fair. Not recommending Signal to these users if it is your job to train them? Not a good idea.

Re: Why I won't recommend Signal anymore

#154

Post by tptacek » Sat, Nov 05, 2016, 9:59 PM UTC

sandervenema wrote: post #80

tptacek wrote: post #41

The author of this post believes that by making a stand over Signal policies he doesn't like (the superficial GCM dep, the OWS-only server policy, the contact list discovery system), something more like LibreSignal will grow to take Signal's place. The author is wrong. LibreSignal won't replace Signal. Something like Telegram will: an "open source" messaging system with inferior cryptography, "opt-in" end-to-end mess…

Hi, author here. I don't think LibreSignal or indeed Signal will ever be the dominant mobile messenger out there. There's simply a lot of inertia to fight against. It's the same reason why it's hard to convince e.g. Facebook friends to move to a different social network, why Google+ failed, etc. Whenever the social aspect gets involved, companies can very easily create lock-in by being early, and then the social aspe…

You don't understand what I'm saying. I agree that crypto alone doesn't equal privacy --- it's table stakes. Clearly: it does not follow from that observation that crypto doesn't matter. If you cannot at least be cryptographically secure, the rest of what you do doesn't matter.

We now have two examples --- CryptoCat and Telegram --- of "secure messaging" systems being used by governments as a way of hunting down activists. Why do we need more? Can't the question be settled now?

As gently as I can, I'm going to push a little further. I poked around your site a little to get a sense of where you're coming from. Your post today opens up like this:

One of the things I do is cryptography and infosec training for investigative journalists who have a need to keep either their sources and communications confidential so they can more safely do their work in the public interest.

Can I ask what your qualifications are in training journalists in keeping their communications secure? Investigative journalists working in hostile regimes, even in smaller countries, are facing adversaries that are better funded than almost any other imaginable threat. Cryptography is incredibly hard. Elsewhere on the thread, you said "I'm not a cryptographer". Neither am I! I've spent the better part of 10 years getting decent at breaking cryptosystems for clients, and I still refuse to do privacy implementation work, because I'm simply not up to the challenge. Are you sure you are?

Re: Why I won't recommend Signal anymore

#155

Post by nextos » Sat, Nov 05, 2016, 10:00 PM UTC

tptacek wrote: post #151

nextos wrote: post #145

Earlier quoted context omitted.

I think the author is mostly right. While Signal might have an excellent protocol, also well audited all this comes with some bad compromises. E.g. you are forced to run GCM, or you share your address book. Both are unacceptable to many people that really need secure end-to-end encryption.

GCM has practically nothing to do with the security/privacy of Signal, but it is the #1 "concern" that people who don't understand cryptographic messaging security feel they must relate about Signal.

And? Even if GCM was completely secure, you are forced to use closed source libraries to pass messages onto GCM or root your phone to load microg.

Both can compromise you.

Re: Why I won't recommend Signal anymore

#156

Post by qwertyuiop924 » Sat, Nov 05, 2016, 10:02 PM UTC

SamWhited wrote: post #138

qwertyuiop924 wrote: post #130

Earlier quoted context omitted.

Tox has DHT bootstrap nodes, but they aren't hardcoded.

Who bootstraps the bootstrap nodes?

The bootstrap nodes were probably the first ones on the DHT: hence, no bootstrap needed. If it's a new bootstrap node, it's connected to the old bootstrap nodes, or some other set of nodes in the DHT, just like any other node: distributed, not federated.

But once a node is acutually inside the DHT, it should never need to talk to the bootstrap nodes ever again: that's a pretty major win, in some respects.

Re: Why I won't recommend Signal anymore

#157

Post by tptacek » Sat, Nov 05, 2016, 10:02 PM UTC

nextos wrote: post #155

tptacek wrote: post #151

Earlier quoted context omitted.

GCM has practically nothing to do with the security/privacy of Signal, but it is the #1 "concern" that people who don't understand cryptographic messaging security feel they must relate about Signal.

And? Even if GCM was completely secure, you are forced to use closed source libraries to pass messages onto GCM or root your phone to load microg. Both can compromise you.

Not so much, no.

Re: Why I won't recommend Signal anymore

#158

Post by Kliment » Sat, Nov 05, 2016, 10:05 PM UTC

tptacek wrote: post #151

nextos wrote: post #145

Earlier quoted context omitted.

I think the author is mostly right. While Signal might have an excellent protocol, also well audited all this comes with some bad compromises. E.g. you are forced to run GCM, or you share your address book. Both are unacceptable to many people that really need secure end-to-end encryption.

GCM has practically nothing to do with the security/privacy of Signal, but it is the #1 "concern" that people who don't understand cryptographic messaging security feel they must relate about Signal.

My main concern with GCM is that it's unavailable on fully open OS builds, so requiring it compromises the security of the device as a whole, rather than Signal in particular.

Re: Why I won't recommend Signal anymore

#159

Post by Arathorn » Sat, Nov 05, 2016, 10:08 PM UTC

pvg wrote: post #107

sandervenema wrote: post #100

Earlier quoted context omitted.

Agree. I'm not a cryptographer and never claimed to be either. -- and I think it would be difficult to mistake me for a hipster. For one, I don't have that snazzy majestic beard.. Anyway, on to the point. :) Yes, the phone number thing is a policy decision by the Signal people. As I write in my article, it's maybe marginally easier to get connected using phone numbers, but I may want to communicate via Signal with so…

Moxie has written at some length about the problems they've had with federation in the specific case of their experience with Signal and also more generally about federation and its potential impact of the development of network technologies. Your answer to all that is "I heard it's hard but really, versioning/XMPP and also, it's not hard". How well has 'proper versioning' worked out for SSL/TLS? Federation hasn't re…

It's unquestionable that federation and decentralisation increase complexity significantly. For context, prior to Matrix the Matrix team used to write commercial comms app silos for telcos - and then we had the epiphany that building silos is harmful to end-users and the industry as a whole, and shifted entirely to the longer-term mission to build an entirely decentralised & open alternative. Despite the fact that we already had an entirely functional centralised implementation, it took about 1.5x longer to create Matrix. And if had been starting from an entirely clean slate, I suspect it'd have been 3-4x longer.

However, we very strongly feel that the resulting freedom and choice from the resulting open ecosystem is worth the additional complexity.

Users can choose any service provider without compromising interoperability. They can run their own servers. They can write their own clients. They can write their own servers. They can choose precisely who they trust with their data. They can contribute to the spec and help define the ecosystem. They aren't forced into trusting a provider who may be trustworthy today, but who knows in future.

I believe Moxie's viewpoint is that privacy is paramount, and any complexity which could introduce bugs which could undermine security/privacy is anathema. From a cryptography dev perspective, this makes perfect sense.

On the other hand, Matrix believes that there is more to life than just privacy, though (as critical as privacy is, of course) - and it is possible to have both privacy and freedom.

Yes, it slows down the rate of development a bit. Yes, it means you have to think much more carefully about layering the protocol to allow the different layers to evolve as independently and efficiently as possible, with the necessary mechanisms (both technical and organisational) to upgrade and lock out obsolete clients and servers. Yes, it means there's more complexity, where bugs could hide. Yes, it means that you may not be able to force the world to upgrade as rapidly as a silo might in the face of a critical security issue.

However, we think it's worth it.

Re: Why I won't recommend Signal anymore

#160

Post by Mz » Sat, Nov 05, 2016, 10:09 PM UTC

darklajid wrote: post #96

zigzigzag wrote: post #43

Like a lot of crypto-puritanism it is rather mixed up. He says he recommended Signal because it was easy to use (more consumer friendly I guess) and secure, then says he wouldn't have gone in the direction of making it easier to use and criticises the things that make it user friendly, like using phone numbers instead of usernames. He says he thinks the protocol is secure, then says he doesn't want it to use GCM beca…

I'm not a cryptographer. I .. am reasonably sure that no one would take me for a hipster. But two issues - or call it 'differences in opinion' - in that article are relevant for me: The inability to use the service without a mobile number and federation. I understand the rationale behind the former ("It's easier"), but I don't understand why it is mandatory. I could've been 1283783127356128531312 on Signal and option…

You are not a cryptographer and not a hipster and apparently never had your life on the line in a way that made it imperative that your communications not be associated with your phone number.

Whether you are a journalist or an abused individual hiding from the ex spouse/parents/whomever that abused you, if your life and/or the lives of other people are on the line, this detail (and perhaps others, as I am not super technically literate) is a serious deal breaker.

It has nothing whatsoever to do with some kind of vague, hand-wavy preference, like preferring red phones over blue ones because you like the color red. It has to do with "If I use this, will I or others end up dead, maimed, in jail for a lot of years or otherwise basically have one's life utterly ruined?" Like that movie scene where they blow up everything "because you made a phone call" (Enemy of the State, IIRC).