Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I won't recommend Signal anymore

sandervenema.ch

Post reply on HN
Print view View original

281–290 of 350 posts

Re: Why I won't recommend Signal anymore

#281

Post by jhasse »

haffenloher wrote: post #211
codedokode wrote: post #208

Earlier quoted context omitted.

> Telegram has, according to Reuters, been actively compromised by people working for oppressive regimes (Iran, in particular). I just wanted to add some details: someone checked the Iranian phone numbers range at Telegram servers and learned which of them are registred with Telegram. Message contents or contact lists were not obtained. I guess this attack could be done with other apps that use phone numbers and phon…

I think tptacek was talking about actual takeovers of Telegram accounts. AFAIK there have been documented cases of this in Iran and Russia. See e.g. https://www.fredericjacobs.com/blog/2016/01/14/sms-login/

Private chats and your contact list can't be accessed by accessing your Telegram account though.

Re: Why I won't recommend Signal anymore

#282

Post by exo762 »

jhasse wrote: post #278
exo762 wrote: post #274

Earlier quoted context omitted.

> Good, so Open Whisper Systems has no metadata. Do any third parties retain metadata about Signal messages? I'll try to answer to the best of my knowledge (I'm not associated with project, I'm just a happy customer). Does your ISP know that you are communicating with Signal servers? Yes, IP addresses. Does it know to whom you are sending messages? No. Does Google know you are using Signal? Yes. Does it know whom of…

Does Google know you are using Signal? Does it know whom of your contacts use Signal? Does Google know you've sent a message? Does Google know that you are receiving a message? Does Google knows who from your contact list send this message? Can Google infer from pings who is communicating with whom? Yes to all of those, because they have root on your phone.

You are assuming that Android reports on every step you take. Do you have sources backing this claim?

Re: Why I won't recommend Signal anymore

#283

Post by jhasse »

tptacek wrote: post #41

The author of this post believes that by making a stand over Signal policies he doesn't like (the superficial GCM dep, the OWS-only server policy, the contact list discovery system), something more like LibreSignal will grow to take Signal's place. The author is wrong. LibreSignal won't replace Signal. Something like Telegram will: an "open source" messaging system with inferior cryptography, "opt-in" end-to-end mess…

> a long-term dependency on the telephone system for authentication

You can protect your Telegram account with a password (it's opt-in). Iran couldn't have compromised it then.

Re: Why I won't recommend Signal anymore

#284

Post by jhasse »

codedokode wrote: post #214
haffenloher wrote: post #211

Earlier quoted context omitted.

I think tptacek was talking about actual takeovers of Telegram accounts. AFAIK there have been documented cases of this in Iran and Russia. See e.g. https://www.fredericjacobs.com/blog/2016/01/14/sms-login/

Then it is a serious problem for Telegram and any app that relies on SMS or some phone identity to restore access to an account.

Not a problem for Telegram, as you can protect your account with a password.

Re: Why I won't recommend Signal anymore

#285

Post by jhasse »

vidyesh wrote: post #256
SamWhited wrote: post #5

I highly recommend Conversations (disclaimer: I've worked on it in the past, although I'm not a project "member" per say): https://conversations.im/ It's open source, uses a federated, open protocol, and can do multiple types of encryption including OTR and OMEMO (an XMPP wire format that uses the Axolotl ratched devised for signal). It does not do VoIP, so it would just be for chat (although there is a large bounty…

I never understood properly where Conversations app fit in. Is it a Jabber client to aggregate all the IM clients/accounts or is it also a independent highly secured instant messaging app on its own too?

A very good Jabber/XMPP client for Android. It's GPL and doesn't require Google services.

Re: Why I won't recommend Signal anymore

#286

Post by jhasse »

exo762 wrote: post #282
jhasse wrote: post #278

Earlier quoted context omitted.

Does Google know you are using Signal? Does it know whom of your contacts use Signal? Does Google know you've sent a message? Does Google know that you are receiving a message? Does Google knows who from your contact list send this message? Can Google infer from pings who is communicating with whom? Yes to all of those, because they have root on your phone.

You are assuming that Android reports on every step you take. Do you have sources backing this claim?

It's nearly impossible to find out. But if I trust corporations like Google not to exploit the possibilities, I wouldn't be looking for an open-source alternative to WhatsApp in the first place.

Re: Why I won't recommend Signal anymore

#287

Post by wruza »

codedokode wrote: post #214
haffenloher wrote: post #211

Earlier quoted context omitted.

I think tptacek was talking about actual takeovers of Telegram accounts. AFAIK there have been documented cases of this in Iran and Russia. See e.g. https://www.fredericjacobs.com/blog/2016/01/14/sms-login/

Then it is a serious problem for Telegram and any app that relies on SMS or some phone identity to restore access to an account.

Telegram sends activation code to known devices, no sms (and I don't remember when it happened, maybe 4 years ago, probably for all other competitors). Also creators of telegram told everyone to use secret chats if conversations are secret to ensure p2p and forward secrecy. And to check key fingerprints to identify peers.

As usual, security threads consist of ancient beliefs, non-users and stories of low-conscious people using high-tech software. And there is always someone who mentions whatsapp as an alternative. Things like wickr are not even mentioned here.

Re: Why I won't recommend Signal anymore

#288

Post by qwertyuiop924 »

SamWhited wrote: post #225
qwertyuiop924 wrote: post #156

Earlier quoted context omitted.

The bootstrap nodes were probably the first ones on the DHT: hence, no bootstrap needed. If it's a new bootstrap node, it's connected to the old bootstrap nodes, or some other set of nodes in the DHT, just like any other node: distributed, not federated. But once a node is acutually inside the DHT, it should never need to talk to the bootstrap nodes ever again: that's a pretty major win, in some respects.

Sorry, that was supposed to be a silly joke, but it also made it horribly unclear. I meant: How do you find the nodes to bootstrap yourself into the DHT in the first place? They must be IPs shipped with the client?

Yes, there are. However, they can be replaced with other servers if the user wishes.

Re: Why I won't recommend Signal anymore

#289

Post by Aoyagi »

haffenloher wrote: post #211
codedokode wrote: post #208

Earlier quoted context omitted.

> Telegram has, according to Reuters, been actively compromised by people working for oppressive regimes (Iran, in particular). I just wanted to add some details: someone checked the Iranian phone numbers range at Telegram servers and learned which of them are registred with Telegram. Message contents or contact lists were not obtained. I guess this attack could be done with other apps that use phone numbers and phon…

I think tptacek was talking about actual takeovers of Telegram accounts. AFAIK there have been documented cases of this in Iran and Russia. See e.g. https://www.fredericjacobs.com/blog/2016/01/14/sms-login/

Nothing in that article proves that the accounts were actually directly hacked or mentions whether they had 2FA enabled or not.

Re: Why I won't recommend Signal anymore

#290

Post by jhasse »

encryptawaa wrote: post #144
HashThis wrote: post #137

How does Signal compare to Telegram? Would you recommend Telegram as better or worse then Signal.

On Signal, every message uses end-to-end encryption. Signal's servers can't see the messages you are sending, only you and the recipient can read them. Signal's encryption protocol is carefully scrutinized and follows best-practices. Telegram sends messages in plain-text by default. Telegram servers have access to all plain-text messages that you send. Telegram's private chats use end-to-end encryption. But they use…

> Telegram sends messages in plain-text by default.

This sounds like everyone has access to those messages. Better: Telegram sends messages client-server encrypted by default and since you can't run your own Telegram servers, this is a problem.

Post reply on HN