Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal 2.0 released with private messaging support

whispersystems.org

Post reply on HN
Print view View original

161–170 of 174 posts

Re: Signal 2.0 released with private messaging support

#161

Post by whyever »

higherpurpose wrote: post #145
frabcus wrote: post #101

Earlier quoted context omitted.

Great! The TextSecure brand is unfortunately dead to me. Although I liked the idea in theory of the SMS backwards compatibilty layer, in practice it confused people and caused technical problems which stopped many of my friends using it. With a reboot as a product with the new name Signal, I can market it again. Needs an Android version first though!

I agreed to that from the first day I used it. It's strange that the developers themselves don't realize it. Just kill SMS support. Nobody needs it anymore. I mean for crying out loud, data-only apps such as BBM and Whatsapp became most popular in poor countries, so I don't think the "but not everyone has money for data" argument works anymore.

If I recall correctly, Moxie stated that SMS support was a mistake.

Re: Signal 2.0 released with private messaging support

#162

Post by mdaniel »

cheald wrote: post #77
minot wrote: post #43

If anyone from Whisper Systems is reading, can you please tell me how I can disassociate my number from a Cyanogenmod installed version of TextSecure in my (now formatted and sold) Nexus 4 and get it working with my no sim Nexus 5 with Google Voice/Hangouts?

Try these: * https://whispertool.cyanogenmod.org/ * https://github.com/daveio/whisperpush-unregister Set up TextSecure with the Voice option, then go to Settings -> untick "Push messages". That should perform unregistration, then you can re-register.

Someone should warn cyanogenmod that their SSL cert is expired: https://www.ssllabs.com/ssltest/analyze.html?d=whispertool.c... (although I guess at 5 months over, it falls squarely into the couldn't-be-bothered bucket)

Re: Signal 2.0 released with private messaging support

#163

Post by _jomo »

pilif wrote: post #151
_jomo wrote: post #104

TextSecure for Android is only distributed via the Play Store. So I built it myself only to notice that Google Play Services are required for chat. I think depending on proprietary / data gathering apps is the wrong approach for an open source privacy app. It actually makes me sad. There was an issue about "This requires Google Play" on GitHub [0] which was closed by moxie with "TextSecure only requires GSF for data…

> I'll rather just stick to WhatsApp/Telegram whatsapp and telegram also use google play services for background notifications. There is no other reliable way to ensure that messages are always delivered on both iOS (push notifications) and Android (Google Cloud Messaging). Apps just don't get enough API access to do this on their own in a totally reliable way and even if they did, the overhead of multiple applicatio…

Well, I installed Telegram via F-Droid and WhatsApp from their website. Took about half a minute each and they work - without any Google Apps installed.

Re: Signal 2.0 released with private messaging support

#164

Post by dTal »

ultramancool wrote: post #125
anonbanker wrote: post #112

Earlier quoted context omitted.

Install textsecure from F-droid. EDIT: not only is textsecure not on f-droid, but f-droid itself is woefully insecure: https://github.com/WhisperSystems/TextSecure/issues/127

It actually seems to indicate that F-Droid has addressed every last obstacle Moxie has posed, even the more ridiculous ones. They're now even willing to distribute developer signed versions if reproducible by their build server. He seems to be standing by this ridiculous "F-Droid is harmful" non-sense with no good reasoning at this point. Hopefully someone will talk some sense into him sooner rather than later.

What's weird is that F-Droid uses the same distribution model as any ordinary Linux distro, where it is assumed that all binaries are compiled from source by the distro maintainers, if for no other reason than to build them against system libraries. The binaries themselves are guaranteed to be built directly from public upstream repositories, in an automated fashion - rather like FreeBSD's ports or Arch's PKGBUILDs.

The real reason Moxie doesn't like F-Droid seems to be that it doesn't provide him with analytics "with a nice web interface that displays graphs and trends of time" - rather a nasty conflict of interest in a product that bills itself as "private" and "secure", if you ask me.

Re: Signal 2.0 released with private messaging support

#165

Post by dTal »

pilif wrote: post #151
_jomo wrote: post #104

TextSecure for Android is only distributed via the Play Store. So I built it myself only to notice that Google Play Services are required for chat. I think depending on proprietary / data gathering apps is the wrong approach for an open source privacy app. It actually makes me sad. There was an issue about "This requires Google Play" on GitHub [0] which was closed by moxie with "TextSecure only requires GSF for data…

> I'll rather just stick to WhatsApp/Telegram whatsapp and telegram also use google play services for background notifications. There is no other reliable way to ensure that messages are always delivered on both iOS (push notifications) and Android (Google Cloud Messaging). Apps just don't get enough API access to do this on their own in a totally reliable way and even if they did, the overhead of multiple applicatio…

There's been a lot of talk over the years of implementing a data modem over GSM voice - as far as I can tell, this would solve basically all the issues with the current crop of encryption products. Instead of constantly polling or faffing about with third party servers, one phone could simply initiate a two-way connection to another phone the old fashioned way: via phone call. There's your "push messaging". You wouldn't even have to leave your data on. Your text messages would also probably arrive faster than an SMS.

I'm very disappointed that despite numerous papers on the subject in the past decade (even a DEFCON presentation), no implementation has yet appeared, not even a demo.

Re: Signal 2.0 released with private messaging support

#166

Post by jlund »

StavrosK wrote: post #146
jlund wrote: post #59

Earlier quoted context omitted.

Keys are trusted on first use, similar to SSH. The app also provides an interface you can use to verify fingerprints: https://github.com/WhisperSystems/Signal-iOS/wiki/FAQ#can-i-...

What's the point of that? Why not just indicate somewhere that the conversation isn't completely secure, rather than have the user believe it is when it's not?

TOFU has proven to be quite resilient against MITM attacks. Do you think it's a stretch to say that SSH is secure?

Re: Signal 2.0 released with private messaging support

#167

Post by StavrosK »

jlund wrote: post #166
StavrosK wrote: post #146

Earlier quoted context omitted.

What's the point of that? Why not just indicate somewhere that the conversation isn't completely secure, rather than have the user believe it is when it's not?

TOFU has proven to be quite resilient against MITM attacks. Do you think it's a stretch to say that SSH is secure?

I think it's a stretch to say that there can be security without verifying keys.

Re: Signal 2.0 released with private messaging support

#168

Post by jlund »

edwintorok wrote: post #56
13 wrote: post #25

Earlier quoted context omitted.

I'm just astonished that there's even justification for it not being an option. Bang on about easy discovery all you want, there's lots of people who don't want to give out their phone number for no good reason to some strangers.

Having a way to work without a phone number would also be a requirement to use it on a desktop/laptop or tablet.

You can install Signal on a WiFi-only iPad and use any phone number to register. This will also be the case for the upcoming desktop client.

Re: Signal 2.0 released with private messaging support

#169

Post by jlund »

StavrosK wrote: post #167
jlund wrote: post #166

Earlier quoted context omitted.

TOFU has proven to be quite resilient against MITM attacks. Do you think it's a stretch to say that SSH is secure?

I think it's a stretch to say that there can be security without verifying keys.

That's like saying that SSH isn't more secure than Telnet unless you personally drive to the data center and verify the fingerprints of every single server by hand.

In reality, TOFU is a form of key verification and it is highly effective against MITM attacks because there's no way for an adversary to reliably determine whether or not a user is seeing a fingerprint for the first time. If at any point the fingerprint changes, the users are warned.

Users can also easily check and compare fingerprints too. They are not mutually exclusive.

Re: Signal 2.0 released with private messaging support

#170

Post by StavrosK »

jlund wrote: post #169
StavrosK wrote: post #167

Earlier quoted context omitted.

I think it's a stretch to say that there can be security without verifying keys.

That's like saying that SSH isn't more secure than Telnet unless you personally drive to the data center and verify the fingerprints of every single server by hand. In reality, TOFU is a form of key verification and it is highly effective against MITM attacks because there's no way for an adversary to reliably determine whether or not a user is seeing a fingerprint for the first time. If at any point the fingerprint…

I'm talking about absolute terms and you're replying with relative terms. I didn't say that SSH isn't more secure than telnet, I said that you can't be secure against an active MITM unless you verify the keys. That's a fact, I'm not sure how one can argue against it.

Sure, TOFU is better than nothing, and might even be very good, but there's still a way for an active adversary to MITM you.

Post reply on HN