I don't trust Signal

I would love to see more use of client certificates, but assuming good password practice is there a real security difference? Either way both parties authenticate themselves to the other.

> Next, Facebook is authenticated to you by its proof of possession of a Private Key corresponding to the Public Key in a certificate from a Trusted Third Party CA. An adversary could corrupt this CA, but hopefully that's difficult.

And hopefully Certificate Transparency would catch them if they did.

> Signal doesn't use passwords. Your device has randomly picked a Private Key, but unlike Facebook you don't have a certificate from a CA, instead you can compare the associated Public Key on your device with that shown for another participant on their phone, if they don't match there's a Man in the Middle. So immediately that's an improvement, no password guessing.

Well, depends what you're trying to verify. Verifying that someone is always using the same device is one choice with its own set of tradeoffs (e.g. many people change devices quite often). Verifying that someone always knows a given password is another. I think tied-to-device keys lose you more than you gain, though I appreciate there's room for disagreement here.

> Signal also has Forward Secrecy. In fact each message sent and received changes the keys used for future messages. As a result an adversary can only eavesdrop by actively impersonating one of the participants. In a two person conversation that's often likely to become obvious pretty quickly whereas passive eavesdropping is undetectable.

You don't have to actively participate as such - you can just forward messages between the two. And Signal's servers are already sitting in the right place to do that.

In theory PFS is a valuable benefit. But the level of compromise needed to incorporate it into a practical system where people want to be able to send offline messages and messages to new contacts who they haven't exchanged keys with beforehand... IMO the resulting level of protocol complexity compromises your security more than the fairly weak guarantees you get out of it in practice are worth. Certainly not when the cost is no federation and identity-tied-to-phone-number.

This is a massively undervalued point. As far as I can tell, most of the people relying on Signal/WhatsApp/Firechat/etc for life-or-death issues are neither hiding from exes nor fleeing the US government. The bulk of use seems to be journalists and protestors in places like Turkey or Bangladesh who have reason to fear state monitoring of communications, but are unlikely to face deep or targeted attacks like having been served a compromised APK from day one.

That Turkey example is seriously relevant. In 2013, the Turkish government created a fraudulent certificate allowing it to intercept traffic to all Google domains, potentially viewing things like gchat and gmail communications. This offered a whole bunch of lessons:

- That the CA web-of-trust model is seriously broken, as we've seen repeatedly.

- That even if companies secure their data and respect your privacy, non-E2E data transfer can still be unsafe.

- That any software or data obtained under a hostile network without a prior signed session is unsafe. Play Store Signal installs in that time could theoretically have been compromised, but "app store versus dedicated download site" and "checksum vs. signature" were irrelevant; all four paths could have been compromised via the same attack vector.

- That "secure download environment, insecure usage environment" is a major, meaningful category of use. That describes a journalist installing Signal in the US and flying to Turkey; an activist installing it prior to a regime change; or a protestor copying it from a trusted friend's installation.

So you're exactly right: Signal isn't a complete solution for an adversary with unlimited resources and direct access to every layer of a network, but it's still massively important even for dealing with most state actors.

Security is something which only makes sense in relation to an attacker model. Only after you specified that, then we can discuss if something is secure or not.

Signal is not secure if the NSA is after you. Signal is secure if your Chinese competitor is after your business data. Signal is secure if you are a journalist in Turkey.

https://news.ycombinator.com/item?id=10906999