Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I don't trust Signal

drewdevault.com

Post reply on HN
Print view View original

381–390 of 473 posts

Re: I don't trust Signal

#381

Post by barbs »

abawany wrote: post #318
394549 wrote: post #248

Earlier quoted context omitted.

> Are you going to pay for him to do that? I donated some money to them a while back. How hard could it be to push the binaries out to a second app store?

I published an app on F-Droid once: it is a very light-weight process. One gives them access to the open source repo where the code is with build instructions and they then take care of pulling updates and publishing new versions.

That process can be more complicated than it seems.

I tried to publish my open-source game on F-Droid, but the build process involves building native components with a specific third-party version of the NDK toolchain, as well as shell scripts to move files around, so it never made it to the store.

Re: I don't trust Signal

#382

Post by UncleMeat »

zzzcpan wrote: post #294
lordlimecat wrote: post #289

Earlier quoted context omitted.

SSL provides integrity guarantees.

Only a bit of transport level integrity. But it doesn't make your average hosting provider into a high assurance one or its servers, OSes, software stacks, etc. Quite known problem since the cryptocurrency era.

And f-droid somehow is immune to this?

Re: I don't trust Signal

#383

Post by bufferoverflow »

xorcist wrote: post #334
bufferoverflow wrote: post #319

Earlier quoted context omitted.

Additionally, I'm pretty sure it's trivial to verify the APKs that Google Play serves are identical to the ones the devs published.

That's not the interesting question. How easy is it to verify that the APKs are built from the published source code, without any added funny business? The F-Droid devs put a lot of work on reproducible builds. Not all software complies, but with an interest in information security there's no exucse not to. That's the use case of F-Droid, and comparing it to self publishing APKs without even as much as a GPG signatur…

But that's not the argument the author makes. He is worried about the apps getting compromised at the platform level.

Re: I don't trust Signal

#384

Post by UncleMeat »

lmm wrote: post #358
jdietrich wrote: post #341

Earlier quoted context omitted.

GPG has an infinitesimally small user base. Many tech savvy users still struggle to use it correctly. Moxie has explicitly stated that his aim is not to build the perfect secure messenger app, but a messenger app that provides the greatest amount of security to the greatest number of users. He has explicitly stated that he has made some design decisions that slightly compromise the ultimate security of Signal, but ar…

> GPG has an infinitesimally small user base. Many tech savvy users still struggle to use it correctly. Moxie has explicitly stated that his aim is not to build the perfect secure messenger app, but a messenger app that provides the greatest amount of security to the greatest number of users. But what's the threat model where Signal makes sense? For a less-than-nation-state attacker, basic TLS as virtually all messen…

The threat model is "the backend server has a security flaw and gets exploited, dumping a bunch of information about my chats" or "the backend server is run by a company that wants to use the contents of my messages for analytics and I don't want that" or "a rogue employee with access to databases but not enough access to ship rogue code wants to read my messages".

Re: I don't trust Signal

#385

Post by tptacek »

bufferoverflow wrote: post #383
xorcist wrote: post #334

Earlier quoted context omitted.

That's not the interesting question. How easy is it to verify that the APKs are built from the published source code, without any added funny business? The F-Droid devs put a lot of work on reproducible builds. Not all software complies, but with an interest in information security there's no exucse not to. That's the use case of F-Droid, and comparing it to self publishing APKs without even as much as a GPG signatur…

But that's not the argument the author makes. He is worried about the apps getting compromised at the platform level.

That's a security concern he feels he can address for himself if Signal is made available to him on F-Droid. But for the overwhelming majority of Signal users, there isn't even in theory a security benefit, because they're exposed to their platform vendor no matter what Signal does.

Signal has decided --- sensibly, I think! --- to focus on the needs of the "normie" users. DeVault disagrees with that decision. He is welcome to do so, but it was Signal's decision to make, not his.

Re: I don't trust Signal

#386

Post by angry_octet »

The author is a delusional crank. He is very deliberately ignoring the very cogent arguments for the Signal architecture in favour of some specious moaning about how play store is subverted by the NSA.

If you want a federated / onion-routed message transport, start coding. You can use the signal ratchet mechanism if you want, you just can't call the resulting shibboleth Signal. Distribute only by obscure methods, easily subverted by users installing malware versions with higher search rankings. Then stand back and watch as hardly anyone used your app.

Re: I don't trust Signal

#387

Post by moogly »

As a Signal user, I just wish I could make my own personal fork of the desktop app and still talk to everyone without having to use the beta servers and fear of having access cut off, because the visual design and UX of the desktop app is absolutely atrocious. And the latest update that was pushed a few days ago was a massive step back; the bloated UI now looks like some iOS app from 2007. It's just embarrassing. And don't even get me started on the lack of a search function -- something the mobile client has.

Re: I don't trust Signal

#388

Post by jdietrich »

lmm wrote: post #358
jdietrich wrote: post #341

Earlier quoted context omitted.

GPG has an infinitesimally small user base. Many tech savvy users still struggle to use it correctly. Moxie has explicitly stated that his aim is not to build the perfect secure messenger app, but a messenger app that provides the greatest amount of security to the greatest number of users. He has explicitly stated that he has made some design decisions that slightly compromise the ultimate security of Signal, but ar…

> GPG has an infinitesimally small user base. Many tech savvy users still struggle to use it correctly. Moxie has explicitly stated that his aim is not to build the perfect secure messenger app, but a messenger app that provides the greatest amount of security to the greatest number of users. But what's the threat model where Signal makes sense? For a less-than-nation-state attacker, basic TLS as virtually all messen…

There are nation-state attackers and nation-state attackers. Most oppressive regimes don't have the technological resources to perform complex attacks on relatively tough systems, but they can perform pervasive monitoring on layer 1, use dodgy certificates to undermine TLS and bribe or coerce corporate actors. Most people in functioning democracies aren't particularly worried about becoming the target of the full might of a three-letter agency, but they might be worried about bulk collection via L1 or PRISM intercepts.

Signal is a vast improvement over SMS, plaintext email or any commercial messaging application, but it's no more difficult to use. It's relatively foolproof, in that user error can't fatally undermine the security model in most cases. It's not perfect, but it's easily the most secure chat app that I could confidently persuade non-techies to actually use. A highly secure app that you don't know how to use offers you no security at all.

Re: I don't trust Signal

#389

Post by UncleMeat »

stratosmacker wrote: post #66
gruez wrote: post #27

>Google Play use yalp store > Packages on F-Droid are reviewed by a human being and are cryptographically signed >The app has to update itself, using a similarly insecure mechanism. F-Droid handles updates and actually signs their packages so are all android APKs. granted it's trust on first use: it accepts any signature for the first install, and only enforces the signature if you try to install an update. >A checks…

This doesn't even touch on the fact that Signal depends on Play Services. It has a websocket option, but the setting is actually not in the GUI

So? Only an incredibly tiny population of android users aren't running play services. If your goal is to get as many people as possible to use e2e messaging, why spend time designing for the 0.001% of people who aren't running play services?

Re: I don't trust Signal

#390

Post by angry_octet »

soperj wrote: post #270
dublinben wrote: post #257

Earlier quoted context omitted.

They've already made the APK available directly on their website for over a year now.[0][1] It works just fine (albeit a little heavy on battery usage) without the Google Play Store or Google Play Services. What more do you really want? [0] https://signal.org/android/apk/ [1] https://whispersystems.discoursehosting.net/t/how-to-get-sig...

>What more do you really want? For it to be on F-Droid. I think that much was clear.

You can get Signal from the developers, Play Store or Apple App Store. No where else is genuine, all possibly backdoored. Why dilute that message for the 0.01% of users who would use F-Droid?
Post reply on HN