Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal app downloads spike as US protesters seek message encryption

qz.com

Post reply on HN
Print view View original

201–210 of 367 posts

Re: Signal app downloads spike as US protesters seek message encryption

#201

Post by computerfriend »

izacus wrote: post #189
pwdisswordfish2 wrote: post #154

Earlier quoted context omitted.

Couldn't you just say "I really like the user interface." Or "The logo looks cool." Or "It had 4 stars." Of "It had lots of good reviews."

And the cop will say "I don't believe you you terrorist" and lock you up until you say something else. This has happened time and time again, including in the latest Hong Kong protests, on American border interrogations and it will happen in these US protests as well. Once you're on the list of suspects from someone elses Signal chat, you're not going to persuade a suspicious official by bullshitting.

Do you have a source for the claim that this has happened at protests in Hong Kong? I haven't heard of anyone being arrested here on the basis that they had Signal installed.

Re: Signal app downloads spike as US protesters seek message encryption

#202

Post by thinkingemote »

pwdisswordfish2 wrote: post #154
m12k wrote: post #114

Earlier quoted context omitted.

Yeah, if you're ever asked why you're on Signal, just say you wanted to stay in touch with a programmer friend who's not on Facebook/WhatsApp, and they suggested Signal (that is now literally true as well - I suggest you try Signal, friend)

Couldn't you just say "I really like the user interface." Or "The logo looks cool." Or "It had 4 stars." Of "It had lots of good reviews."

Rubbing ones hands together to stave off the chilling effect.

Re: Signal app downloads spike as US protesters seek message encryption

#203

Post by jwr »

est31 wrote: post #187
jwr wrote: post #168

What really hurts Signal are two things: * sub-par user experience: WhatsApp is just nicer and smoother, and people tend to like that * very few people understand that Signal DOES NOT get your full contact list, while Facebook (through WhatsApp) does Especially the second point is very relevant with the current situation — you do not necessarily want to expose your entire social graph to Facebook. But so few people u…

> Signal DOES NOT get your full contact list The full contact list is uploaded to Signal servers by the phones. The only protection layer that users have is the questionable security of Intel's SGX. It's still much better than what WhatsApp is doing, just not a black and white situation. To add a point to your list: Signal does not have automatic cloud backup of messages, unlike WhatsApp. On WhatsApp, 30% of users ha…

Not the full contact list, just hashes.

That was exactly my point: few people know about this.

Re: Signal app downloads spike as US protesters seek message encryption

#204

Post by maxerickson »

siberianbear wrote: post #165
kabacha wrote: post #161

Earlier quoted context omitted.

Using phone number as ID has been proven idiotic since forever now. As much as I like Signal this is such a design flaw that it makes their software not only untrustable but often unusable too. What's wrong with email logins?

I'm no expert on the subject, but probably the use of phone numbers (and confirmation by SMS) is helpful to limit the number of bots.

Phone numbers are used for contact discovery.

https://signal.org/blog/private-contact-discovery/

Re: Signal app downloads spike as US protesters seek message encryption

#205

Post by est31 »

jwr wrote: post #203
est31 wrote: post #187

Earlier quoted context omitted.

> Signal DOES NOT get your full contact list The full contact list is uploaded to Signal servers by the phones. The only protection layer that users have is the questionable security of Intel's SGX. It's still much better than what WhatsApp is doing, just not a black and white situation. To add a point to your list: Signal does not have automatic cloud backup of messages, unlike WhatsApp. On WhatsApp, 30% of users ha…

Not the full contact list, just hashes. That was exactly my point: few people know about this.

A hash of the phone number is as good as the phone number itself. Given a list of all phone numbers in use, it's trivial to build a rainbow table for them. And many you can also brute-force.

Re: Signal app downloads spike as US protesters seek message encryption

#206

Post by est31 »

acdha wrote: post #200
est31 wrote: post #187

Earlier quoted context omitted.

> Signal DOES NOT get your full contact list The full contact list is uploaded to Signal servers by the phones. The only protection layer that users have is the questionable security of Intel's SGX. It's still much better than what WhatsApp is doing, just not a black and white situation. To add a point to your list: Signal does not have automatic cloud backup of messages, unlike WhatsApp. On WhatsApp, 30% of users ha…

Do you have a reference for the claim that your full contact list is uploaded to servers? That seems important since their privacy policy says that they only use hashes, and it can’t be dependent on SGX since it runs on non-Intel hardware: https://signal.org/legal/#privacy-policy

The method is explained here: https://signal.org/blog/private-contact-discovery/

Yes, it's hashes of phone numbers instead of the phone numbers themselves, but that's a detail. Phone numbers are easy to brute-force especially for people the protesters are worried about, as well as easy to build rainbow tables for.

Re: Signal app downloads spike as US protesters seek message encryption

#207

Post by izacus »

computerfriend wrote: post #201
izacus wrote: post #189

Earlier quoted context omitted.

And the cop will say "I don't believe you you terrorist" and lock you up until you say something else. This has happened time and time again, including in the latest Hong Kong protests, on American border interrogations and it will happen in these US protests as well. Once you're on the list of suspects from someone elses Signal chat, you're not going to persuade a suspicious official by bullshitting.

Do you have a source for the claim that this has happened at protests in Hong Kong? I haven't heard of anyone being arrested here on the basis that they had Signal installed.

They got arrested by association. Signal chat group is such an association, just like other chat groups are. Except that Signal guarantees to give out your phone number (and by extension location and personal address) to every single person in a chat group.

There have been lynchings in India based on this kind of data leaked by WhatsApp which resulted in them finally allowing joining groups anonymously.

Re: Signal app downloads spike as US protesters seek message encryption

#208

Post by jhoechtl »

Vinnl wrote: post #119
jhoechtl wrote: post #107

Earlier quoted context omitted.

Will only ever happen once Signal ditches their dependency on mobile phone number.

I don't see how the two are related? They've already got a Desktop client.

The Desktop Client is only functional when you "pair" it to your phone client.

Re: Signal app downloads spike as US protesters seek message encryption

#209

Post by detaro »

jhoechtl wrote: post #107
enraged_camel wrote: post #37

Earlier quoted context omitted.

I would ditch WhatsApp in a heartbeat if Signal had a browser client.

Will only ever happen once Signal ditches their dependency on mobile phone number.

E2E in a browser client is always questionable, I doubt Signal is ever going to add one.

Re: Signal app downloads spike as US protesters seek message encryption

#210

Post by acdha »

est31 wrote: post #206
acdha wrote: post #200

Earlier quoted context omitted.

Do you have a reference for the claim that your full contact list is uploaded to servers? That seems important since their privacy policy says that they only use hashes, and it can’t be dependent on SGX since it runs on non-Intel hardware: https://signal.org/legal/#privacy-policy

The method is explained here: https://signal.org/blog/private-contact-discovery/ Yes, it's hashes of phone numbers instead of the phone numbers themselves, but that's a detail. Phone numbers are easy to brute-force especially for people the protesters are worried about, as well as easy to build rainbow tables for.

I think you might want a better way of phrasing that: it’s not the “full contact list” - most people would assume that includes names and all of the other metadata - and since it’s rate-limited there’s an interesting trade off where it’s not easy to brute-force but it is targetable if you are trying to track specific known people.
Post reply on HN