I don't trust Signal • Hacker News Board

Re: I don't trust Signal

#31

Post by therealmarv » Thu, Aug 09, 2018, 1:58 PM UTC

madeuptempacct wrote: post #3

Is there a preference of Telegram over Signal or vice versa?

Telegram is (with default settings) a cloud service where your messages are without time limits stored. Telegram cannot be compared to Signal/WhatsApp because they work in totally different ways (temporary encrypted e2e storing vs. encrypted cloud storing with keys in various countries).

Re: I don't trust Signal

#32

Post by bumholio » Thu, Aug 09, 2018, 1:58 PM UTC

The line about F-Droid doing no automated scanning is particularly troubling. Since he can't possibly imply that a Signal compromise would be detected this way, Moxie is making a political argument against the way people are using F-Droid to install other applications. He refuses - on principle, no less - the right for users to control their hardware and have full control over the software they install, and thinks the walled garden approach should be forced on every Signal user.

Sorry, there is no excuse for Signal not to be available on F-Droid. I understand the automatic updates argument if it was valid at the time, but Signal has no right to impose what other applications I run and how I get them.

Re: I don't trust Signal

#33

Post by ethagnawl » Thu, Aug 09, 2018, 1:59 PM UTC

r3bl wrote: post #7

madeuptempacct wrote: post #3

Is there a preference of Telegram over Signal or vice versa?

Telegram doesn't have end-to-end encryption by default (only in secret chats). That's all you need to understand to know that it's an inferior product in comparison to Signal.

Telegram's encryption algorithm is also homebrewed.

https://gizmodo.com/why-you-should-stop-using-telegram-right...

Re: I don't trust Signal

#34

Post by jhasse » Thu, Aug 09, 2018, 1:59 PM UTC

distantsounds wrote: post #22

"The APK direct download doesn’t even accomplish the stated goal of “harm reduction”. The user has to manually verify the checksum, and figure out how to do it on a phone, no less. A checksum isn’t a signature, by the way - if your government- or workplace- or abusive-spouse-installed certificate authority gets in the way they can replace the APK and its checksum with whatever they want." This is true for just about…

Signal doesn't need to solve it, because F-Droid would.

Re: I don't trust Signal

#35

Post by hprotagonist » Thu, Aug 09, 2018, 2:00 PM UTC

lmm wrote: post #26

hprotagonist wrote: post #16

But we have to trust that Moxie is running the server software he says he is. We have to trust that he isn’t writing down a list of people we’ve talked to, when, and how often. We have to trust not only that Moxie is trustworthy, but given that Open Whisper Systems is based in San Francisco we have to trust that he hasn’t received a national security letter, too (by the way, Signal doesn’t have a warrant canary). Mox…

If Open Whisper Systems had received a national security letter requiring them to collect more information and keep it secret that they were doing so, how would you expect them to have responded to that subpoena?

precisely the way they did, which was to challenge the gag order, and win. That’s where the documents above come from, in fact.

Re: I don't trust Signal

#36

Post by lmm » Thu, Aug 09, 2018, 2:00 PM UTC

api wrote: post #2

I trust it more than unencrypted SMS or Facebook Messenger. I trust it less than p2p chat over an encrypted network I control with layered defense in depth. Security is not a boolean.

Security is not a boolean, but when your whole selling point is security you'd better be good at it.

I trust Signal the same amount as Facebook Messenger or any other centralised messaging system that uses transport encryption (e.g. Skype, IRC+SSL, WhatsApp...). But what's the USP that means I should use Signal rather than any alternative?

Re: I don't trust Signal

#37

Post by shittyadmin » Thu, Aug 09, 2018, 2:01 PM UTC

distantsounds wrote: post #22

"The APK direct download doesn’t even accomplish the stated goal of “harm reduction”. The user has to manually verify the checksum, and figure out how to do it on a phone, no less. A checksum isn’t a signature, by the way - if your government- or workplace- or abusive-spouse-installed certificate authority gets in the way they can replace the APK and its checksum with whatever they want." This is true for just about…

Additionally with Android APKs, the APK has to be signed and additional updates will be verified to match the same vendor.

Re: I don't trust Signal

#38

Post by okatsu » Thu, Aug 09, 2018, 2:01 PM UTC

I don't know anything about Moxie derailing threads or anything like that but if we just listened to critics all the time then we just wouldn't have anything. Signal is better than a lot of what is out there and being used as scale and that counts for something. More secure is always better than not secure at all.

Re: I don't trust Signal

#39

Post by g_sch » Thu, Aug 09, 2018, 2:01 PM UTC

Some version of this post seems to circulate every few months or so. This one is more direct in its accusations of Moxie acting in bad faith. I think this is disingenuous. Moxie has been very clear[0] about the tradeoffs that Signal has made and the reasons for them. It's fine to be dissatisfied with those choices. It's another thing entirely to accuse Moxie of dissimulating.

Personally, I'd like to see Signal replace WhatsApp. That's why I support the path Signal took, and why I also have a distaste for the author's snarky dismissals of features like GIF search.

[0] https://signal.org/blog/the-ecosystem-is-moving/

Re: I don't trust Signal

#40

Post by r3bl » Thu, Aug 09, 2018, 2:02 PM UTC

> P.S. If you’re looking for good alternatives to Signal, I can recommend Matrix.

Yes, if you're looking for alternatives to Signal, you should totally use a solution that hasn't rolled out end-to-end encryption by default[0]. /s

...and that only two clients have implemented so far, out of 50ish that they list on their website.

[0] https://matrix.org/docs/guides/faq.html#what-is-the-status-o...