Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal partners with Microsoft to bring end-to-end encryption to Skype

signal.org

Post reply on HN
Print view View original

261–270 of 350 posts

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#261

Post by jlund »

gibson99 wrote: post #23
nakedrobot2 wrote: post #5

I guess I'll be downvoted to hell, but.... This absolutely stinks. Signal is most likely blessed by the NSA. This is a ruse to get people comfortable with using Skype again for confidential conversations. Ever since Microsoft bought Skype and completely gutted it, it's been an open secret that they only did so to fulfill an $8B RFP by the NSA to break Skype's encryption. https://news.ycombinator.com/item?id=8106721 h…

Maybe they have an 'understanding' about the implementation of the cryptography as they do with WhatsApp, meaning the program doesn't notify you when your opposite's keys change, leaving unscrupulous users (most) susceptible to MitM attacks, which could be used by law enforcement or three-letter-agencies. Plus, Skype probably still makes extensive use of meta-data, Signal allege that they don't, but we can't really a…

Signal takes metadata protection very seriously: https://signal.org/bigbrother/

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#262

Post by emddudley »

uph wrote: post #259
marknadal wrote: post #243

Earlier quoted context omitted.

I don't know why but Signal has always scared me - I think it was when I noticed it sharing my contacts with their server to "find my friends" when I never consented. Matrix is looking good, but again not P2P only federated. This is why we are trying to do fully P2P end-to-end encryption like with https://hackernoon.com/so-you-want-to-build-a-p2p-twitter-wi... .

We’ve designed the Signal service to minimize the data we retain about Signal users, so the only information we can produce in response to a request like this is the date and time a user registered with Signal and the last date of a user’s connectivity to the Signal service. Notably, things we don’t have stored include anything about a user’s contacts (such as the contacts themselves, a hash of the contacts, any othe…

Ok, that's good. But Signal automatically created conversations with people in my address book who I never want to communicate with via Signal. I didn't authorize it, the app did it automatically. I think that is what the grandparent was referring to.

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#263

Post by bufferoverflow »

paule89 wrote: post #160

The thing is. How will Microsoft and Skype handle backdoors now. As far as I understood the reason Microsoft broke Skype so badly was because they used centralised servers with backdoors for countries who wanted them. Not always the good countries. But this. This baffles me. Deeply.

Easy. You leak the keys from the clients to the centralized servers.

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#264

Post by e12e »

Tepix wrote: post #219
yoavm wrote: post #188

Earlier quoted context omitted.

If by "perfectly fine" you mean highly likely to get into your recipient's spam folder - you're probably right. Having tried to self host my own mail server I can tell you it's never an easy task to actually get your message across.

That doesn't match my experience of running a mail sever for decades.

How long since you set up mail for a newly registered (possibly with previous owner) domain hosted on a VPN or rented dedicated server in an ip block that might have had previous owners?

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#265

Post by e12e »

Spivak wrote: post #199
yoavm wrote: post #188

Earlier quoted context omitted.

If by "perfectly fine" you mean highly likely to get into your recipient's spam folder - you're probably right. Having tried to self host my own mail server I can tell you it's never an easy task to actually get your message across.

This comes up a lot but the reality is that its really only nerds and spammers that self-host. It's hard to fault spam filters of being suspicious of random domains. This doesn't mean there aren't many alternatives -- just about any personal email provider will make sure they're off the blacklists.

With Gmail it appears to be a question of getting on a (secret, opaque) white list.

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#266

Post by Whitestrake »

qznc wrote: post #238
afuchs wrote: post #226

Earlier quoted context omitted.

It is difficult to make a p2p app on a mobile device work even between devices on the same LAN . A simplified explanation: Mobile devices will often ignore almost all incoming network traffic to reduce battery usage. The only way to reliably communicate with the device is through a centralized push notification service (e.g. APN and GCM).

SyncThing seems to do fine on my smartphone in my home LAN.

One thing that might explain this is that your phone could be pulling data from your computer, rather than your computer trying to connect to your phone to push data to it.

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#267

Post by QAPereo »

paule89 wrote: post #160

The thing is. How will Microsoft and Skype handle backdoors now. As far as I understood the reason Microsoft broke Skype so badly was because they used centralised servers with backdoors for countries who wanted them. Not always the good countries. But this. This baffles me. Deeply.

Which are “the good countries” in this context?

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#268

Post by lukedoolittle »

afuchs wrote: post #226
huhtenberg wrote: post #210

Earlier quoted context omitted.

This doesn't explain why after the change Skype started routing calls between machines on the same LAN through Microsoft servers.

It is difficult to make a p2p app on a mobile device work even between devices on the same LAN . A simplified explanation: Mobile devices will often ignore almost all incoming network traffic to reduce battery usage. The only way to reliably communicate with the device is through a centralized push notification service (e.g. APN and GCM).

I tried to make a demo app to perform very simple HTTP p2p and found this difficult on iOS. When an app is backgrounded you have ~17 seconds to stop execution or the OS will kill any active threads UNLESS the activity is among the Apple permitted exceptions. (Note that there is no iOS SyncThing app). In Android it is possible to use IntentService as a single threaded background HTTP server. It works for the most part but can be a little flakey. I'm not 100% sure how the OpenGarden SDK accomplishes this but I'm interested. My guess is that it makes heavy use of Bluetooth, which is one of the Apple permitted exceptions to the backgrounding rule.

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#269

Post by Whitestrake »

erikb wrote: post #87

You know, before Microsoft Skype had end to end encryption.

For a minute, I thought your comment had simply trailed off without finishing your thought.

Then I realised it wasn't "Microsoft Skype", but rather, "before Microsoft, Skype had..."

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#270

Post by lern_too_spel »

thepangolino wrote: post #230
MikeHolman wrote: post #191

Earlier quoted context omitted.

>the reason Microsoft broke Skype so badly was because they used centralised servers with backdoors for countries who wanted them. That seems like pretty unreasonable tinfoil. There is no reason for Microsoft to want to give information to governments. I assume they don't pay, and the cost is consumer trust. Makes a lot of sense to rearchitect such that you can't give in to government demands.

>That seems like pretty unreasonable tinfoil Doesn't seem so to me. >I assume they don't pay You're dead wrong, my friend. They do pay. A lot. Think of all those juicy government contracts.

If they pay for more access than is required, why wasn't that in the documents Snowden dumped? Instead, we saw the normal court rulings requiring companies to comply with data access requests.
Post reply on HN