21–30 of 298 posts
Since you are in the US how do you keep the US government from interfering with your mission because Signal uses strong encryption? How do you address the EARs (Export Administration Regulations) and ITARs (International Traffic in Arms Regulations)? These regulations look like a tar pit to me.
Since you are in the US how do you keep the US government from interfering with your mission because Signal uses strong encryption? How do you address the EARs (Export Administration Regulations) and ITARs (International Traffic in Arms Regulations)? These regulations look like a tar pit to me.
Why do you think strong encryption will have an export problem now when it hasn't for decades? Keep in mind that Signal is already open source and the algorithm is already widely distributed. Any restriction on export at this time would be closing the barn doors after the horses have all escaped.
I hate these regulations but EAR and ITAR with respect to crypto seem to be concerned with the key length and algorithm. Over a certain strength the software using the encryption seems to be still treated as a munition!? I've heard of people who ignore this getting huge fines.
And any export to Cuba, N. Kora, Sudan, Syria, and Iran is banned by OFAC (Office of Foreign Assets Control). Yes, the very countries that need Signal the most are banned!
Hopefully I'm wrong and we are free of regulatory issues in the US so I'm asking a serious question here - how does Signal solve this problem?
When is the ICO? No, I'm not kidding. Look at Telegram. Who would've thought an open source project would ever get close to a billion dollars in funding ? I don't want Signal to wither away or forever remain a niche chat application because of lack of funding, especially if Moxie one day decides he wants to pursue some other dreams of his and doesn't have time to deal with Signal anymore.
This seems like a much better setup - $50M and setup as a 501(c)3 - rather than taking on the weird regulatory risk and all the other weirdness associated with Telegram's (IMO crazy) ICO: https://www.forbes.com/sites/jasonbloomberg/2018/02/17/teleg...
To make this more tangible, doing an ICO means a prosecutor can personally threaten anyone on the team with violating securities laws. That's a stupid risk to take if you know, as an organization, you're going to fight the U.S. government in court one day.
This is freakin' awesome: A non-profit foundation with $50 million in the bank dedicated to providing usable encryption to the general public, with no other agenda other than the public good. Go read the blog post by Moxie and Brian Acton (who is joining Signal). Very exciting!
I wonder if they're in contact or work with each other.
Edit: Wait, haven't installed anything yet, but I read the getting started guide. I have to sign up using a phone number? That throws all expectation of anonymity and thus privacy out the window.
[0]: https://signal.org/blog/private-contact-discovery/
[1]: https://software.intel.com/en-us/forums/intel-software-guard...
[2]: https://github.com/lsds/spectre-attack-sgx
[3]: https://security.stackexchange.com/questions/176635/how-does...
This is freakin' awesome: A non-profit foundation with $50 million in the bank dedicated to providing usable encryption to the general public, with no other agenda other than the public good. Go read the blog post by Moxie and Brian Acton (who is joining Signal). Very exciting!
I know Moxie's position on federated protocols [1], but I think we must eventually agree that an open environment with a multitude of providers and implementations is the only way to provide long term privacy - any single provider is vulnerable. It would also be a very useful tool in the context of regulating communication platforms and breaking up monopolies.
[1] https://signal.org/blog/the-ecosystem-is-moving/
Edit: emphasize federated, not open, Signal is indeed an open protocol.