Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Looking back at how Signal works

signal.org

Post reply on HN
Print view View original

31–40 of 301 posts

Re: Looking back at how Signal works

#31

Post by solinent »

DaftDank wrote: post #17

What happens to Signal when the EARN It Act passes? I assume that eventually the Apple App Store and Google Play Store will just stop allowing it to be downloaded if they do not add the backdoor in? Is there a workaround that will allow people to use it still? I've heard people mention locating the servers in other countries, but wouldn't the various App stores be bound by US law and still not allow them?

Signal started open-source, it was TextSecure, I'm sure there'll be an open-source alternative if the commercial entity fails, though I hope they do not.

Re: Looking back at how Signal works

#32

Post by billme »

wayoutthere wrote: post #27
gruez wrote: post #16

Earlier quoted context omitted.

Don't you have to keep paying for the sim, otherwise someone else might "steal" your account once your phone number gets reused?

Signal has an option to prevent this by locking the number with your PIN. This capability introduces plausible deniability that a phone number assigned to a SIM is actually associated with the number of a Signal account. Don't know if that matters legally or not. Also the people doing shady things are generally hopping accounts regularly anyway.

PIN only stops registration for a fixed amount of time, believe 7-days, then the entity controlling the number would be able to reclaim the account. If the “attacker” maintained control, new devices that add the number from their contact list would get no alert; that is, the users would have to figure out the number is controlled by someone else.

Re: Looking back at how Signal works

#33

Post by graham_paul »

DaftDank wrote: post #17

What happens to Signal when the EARN It Act passes? I assume that eventually the Apple App Store and Google Play Store will just stop allowing it to be downloaded if they do not add the backdoor in? Is there a workaround that will allow people to use it still? I've heard people mention locating the servers in other countries, but wouldn't the various App stores be bound by US law and still not allow them?

> the Apple App Store and Google Play Store will just stop allowing it to be downloaded

Time for a privacy focused app store!

Re: Looking back at how Signal works

#34

Post by thanksforfish »

wayoutthere wrote: post #27
gruez wrote: post #16

Earlier quoted context omitted.

Don't you have to keep paying for the sim, otherwise someone else might "steal" your account once your phone number gets reused?

Signal has an option to prevent this by locking the number with your PIN. This capability introduces plausible deniability that a phone number assigned to a SIM is actually associated with the number of a Signal account. Don't know if that matters legally or not. Also the people doing shady things are generally hopping accounts regularly anyway.

Isn't the pin lock just a time lock?

Re: Looking back at how Signal works

#35

Post by EmilioMartinez »

I'm glad to see the discussion about what privacy should look like progress, with increasingly big actors treat data as something too delicate to play warden until the next breach.

But it just feels cheap and detrimental to LARP as a tool for revolutionaries. I want a clear concept of privacy for a stable society to rely upon. That even the most trustworthy authority be kept out by design as a security principle. I don't want my messaging app to be opinionated, pick sides or declare themselves part of the ongoing "progress". Will they sing the same tune when it's other group taking the streets? Because everyone has a different idea of the kind of revolution that is needed, and certainly my phone should not have a say.

Re: Looking back at how Signal works

#36

Post by K2L8M11N2 »

gonehome wrote: post #26
K2L8M11N2 wrote: post #14

Earlier quoted context omitted.

In most European countries you need to submit your ID to get any sort of working SIM card.

If that’s the case doesn’t it matter even less that signal requires it since it’s already known anyway? Signal’s use of phone numbers as IDs means they don’t have to have any of your contacts sent to their servers. As shown in the article they have no metadata and nothing to reveal beyond your phone number and when you signed up. These other apps send your social graph to their servers, track and store metadata, don’…

Assuming you’re using Signal for organizing something the government doesn’t want you organizing, if one member of the group gets rubber-hosed into unlocking their phone, the govt instantly gets a list of verifiably correct names of people involved. In contrast, with a service that lets you use usernames that maneuver would reveal nothing but those usernames (which are as pseudonymous as it gets).

Re: Looking back at how Signal works

#37

Post by billme »

solinent wrote: post #31
DaftDank wrote: post #17

What happens to Signal when the EARN It Act passes? I assume that eventually the Apple App Store and Google Play Store will just stop allowing it to be downloaded if they do not add the backdoor in? Is there a workaround that will allow people to use it still? I've heard people mention locating the servers in other countries, but wouldn't the various App stores be bound by US law and still not allow them?

Signal started open-source, it was TextSecure, I'm sure there'll be an open-source alternative if the commercial entity fails, though I hope they do not.

As far as I know, while the DevOps code is not open source, the server and app code are on GitHub; that is you’re able to roll your own version however it defined by the licensing; recent attack on Signal by security researcher used a self-compiled app as a proof of concept; Signal patched the issue.

Re: Looking back at how Signal works

#38

Post by crorella »

Really nice design, in the future I see a market for "privacy tools that also happens to ..." kind of software, for example a Privacy tool that also happens to browse websites, or a Privacy tool that also happens to help you to send messages (like Signal); in summary, privacy aware services.

Re: Looking back at how Signal works

#39

Post by gonehome »

est31 wrote: post #30
gonehome wrote: post #26

Earlier quoted context omitted.

If that’s the case doesn’t it matter even less that signal requires it since it’s already known anyway? Signal’s use of phone numbers as IDs means they don’t have to have any of your contacts sent to their servers. As shown in the article they have no metadata and nothing to reveal beyond your phone number and when you signed up. These other apps send your social graph to their servers, track and store metadata, don’…

> roll their own cryptography Signal did the same thing. They invented their own cryptographic algorithms. https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm And the social graph IS sent to servers by Signal. It's protected only by hashing (trivial to circumvent) and by the Intel SGX technology (a bit harder to circumvent, but I doubt that the US govt can't do it).

My (limited) understanding is numbers are queried to see if accounts exist, but those queries are not connected to the users sending them (and they are obscured in transit).

Am I wrong?

Signal’s cryptography has also gotten a ton of attention, I don’t think the same is true for competitors.

Re: Looking back at how Signal works

#40

Post by gonehome »

K2L8M11N2 wrote: post #29
gonehome wrote: post #26

Earlier quoted context omitted.

If that’s the case doesn’t it matter even less that signal requires it since it’s already known anyway? Signal’s use of phone numbers as IDs means they don’t have to have any of your contacts sent to their servers. As shown in the article they have no metadata and nothing to reveal beyond your phone number and when you signed up. These other apps send your social graph to their servers, track and store metadata, don’…

I feel comfortable with giving my Telegram username out to random people on the internet and posting it on my website because it doesn’t mean anything outside of Telegram. I wouldn’t post my phone number publicly.

That’s fair, thanks - I think for secure communication with people you don’t know personally or trust, it’d be better to use something that doesn’t share your phone number.
Post reply on HN