Add a lack of real desktop to this.
Why I won't recommend Signal anymore
191–200 of 350 posts
Re: Why I won't recommend Signal anymore
#192Animated GIFS were the straw that broke the camels back?
Let's throw the best available solution under the bus.
This post will be my go to example of the myopia of some members of the security community. We have very few examples of well executed, consumer friendly privacy soloutions. Signal is the best for all possible scenarios: Open source, user friendly, buy in from a major Internet service.
I like wickr, but it falls short due to the closed source nature of the project.
Consumer friendly, usable security needs to be the number one priority for security advocates. We need to stop burning down houses because they are short a door or are the wrong color. The foundation is the hard part. Wait till there is a real alternative that can be used by people who are not c.s. majors before you argue that people should stop using the best available solution.
I appreciate the authors perspective and I agree with some of their points. Then they fuck it up by demonstrating purist jackassery. Worth a read as a useful persuasion antipattern.
Re: Why I won't recommend Signal anymore
#193Animated GIFS?
Let's throw the best available solution under the bus.
This post will be my house to example of the myopia of the security community. We have very few examples of well executed, consumer friendly privacy soloutions. Signal is the best for all possible scenarios: Open source, user friendly, buy in from a major Internet service.
I like wickr, but it falls short due to the closed source nature of the project.
Consumer friendly, usable security needs to be the number one priority for security advocates. We need to stop burning down houses because they are short a door or are the wrong color. The foundation is the hard part. Wait till there is a real alternative that can be used by people who are not c.s. majors before you argue that people should stop using the best available solution.
I appreciate the authors perspective and I agree with some of their points. Then they fuck it up by demonstrating purist jackassery. Worth a read as a useful persuasion antipattern.
Re: Why I won't recommend Signal anymore
#194Earlier quoted context omitted.
It's true that it's a big hunk of JSON. And I'll readily concede that when efficiency matters, I'm more partial to binary formats like CBOR. But XMPP is XML, which... isn't exactly lighter. There's another HN thread where I've talked more about XMPP vs Matrix here: https://news.ycombinator.com/item?id=9772968 -- long story short, I tried to write an XMPP client, and I got grey hairs, fast. The story for consistent de…
XMPP only has to turn the radio on full power mode when it gets a new message or creates a new connection (the tower sends the LTE radio a paging message telling it to wake up, then the long-lived TCP connection can receive data). Matrix has to turn the radio on every single time it wants to check for data, regardless of whether there is data to receive or not. This is the problem with HTTP based protocols; you might…
I don't believe this is true. The long-polling that Matrix does in the baseline impl is just a long-lived HTTP request which blocks until the server has something to send it. Radio-wise this is conceptually the same as an XMPP TCP connection.
The only difference is that (in the baseline impl) you start a new HTTP request after receiving each response - which chews some additional data relative to XMPP. The radio will already be spun up from receiving the previous data, though, so it shouldn't impact significantly on battery consumption.
Also, we put a timeout on the long-lived request (typically 30-60s), to aid recovery in case of the request or connectivity breaking - which could theoretically increase bandwidth and radio battery consumption, but in practice almost all Matrix use cases involve receiving events more frequently than the timeout, so the timeout doesn't actually have much impact on battery.
That said, there is (deliberately) huge scope for improvement with alternative transports - using strict push rather than long-polling; using transports with less overhead; using more efficient encodings, etc.
Re: Why I won't recommend Signal anymore
#195Earlier quoted context omitted.
Maybe not. Although there's this guy: https://eladnava.com/pushy-a-new-alternative-to-google-cloud... , it seems like his library doesn't work very well after Nougat.
From Android 6 on, Doze just terminates apps running in background after a while. The only network access that is allowed is GCM. Which causes the entire issue. I wrote a complaint to the EU privacy official responsible for them and the EU antitrust committee.
That's an excellent idea! Do you have a blog or something where you're going to post when (if) you get a response?
Re: Why I won't recommend Signal anymore
#196Earlier quoted context omitted.
On this: https://wikileaks.org/Op-ed-Google-and-the-NSA-Who-s.html there are links on that page that point out multiple e-mails from the STRATFOR leaks and other files that point to Google being deeply embedded with the U.S. security apparatus. Also: https://www.theguardian.com/world/2013/aug/23/nsa-prism-cost...
And Google became a PRISM partner in 2009, as the slides here from the Snowden collection prove: https://search.edwardsnowden.com/docs/PRISMUS-984XNOverview2...
And Google became a PRISM partner in 2009,
as the slides here from the Snowden collection prove
Re: Why I won't recommend Signal anymore
#197If they are only using GCM as a queue (and the messages are themselves encrypted) I don't understand what the problem is.
They could use anyone for that functionality. Even if the messages are given to an "adversary" what can they really get from that? Your phone app contacted the signal servers. That's really it.
Re: Why I won't recommend Signal anymore
#198Earlier quoted context omitted.
And Google became a PRISM partner in 2009, as the slides here from the Snowden collection prove: https://search.edwardsnowden.com/docs/PRISMUS-984XNOverview2...
And Google became a PRISM partner in 2009, as the slides here from the Snowden collection prove Read those slides more carefully: they say that collection from Google began on 1/14/09, not that Google became a willful partner of the PRISM program.
As the previous links from STRATFOR etc. prove, Google is deeply embedded in the security/intelligence apparatus. That part is definitely willing and beneficial to both parties. Of course, they're going to make changes and issue statements to the contrary regarding PRISM, because that would lose them customers.
This is also an interesting read, albeit a bit long: https://wikileaks.org/google-is-not-what-it-seems/
Google continues to coast on the goodwill of its "don't be evil" doublespeak, as Mr. Assange puts it. There's no reason to trust them now.
Re: Why I won't recommend Signal anymore
#199Earlier quoted context omitted.
GCM has practically nothing to do with the security/privacy of Signal, but it is the #1 "concern" that people who don't understand cryptographic messaging security feel they must relate about Signal.
My main concern with GCM is that it's unavailable on fully open OS builds, so requiring it compromises the security of the device as a whole, rather than Signal in particular.
Use iOS
Re: Why I won't recommend Signal anymore
#200If wishes were fishes we'd all live by the sea.