I don't trust Signal

How much non-geek non-privacy-activist socialising have you done via Signal?

Without emoji and animated gifs, I suspect 70% of my Signal contacts wouldn't use it at all. It's hard enough to convince some of my friends to use it at all, "Can't I just Facebook message you?"

For me, amongst my group of friends - it seems Moxy is making all the right security/usability tradeoffs.

If you don't trust PlayStore, it seems not much of a jump to say you also shouldn't trust Android.

If you're _rightly_ that concerned (and I'll note that Snowden recommends Signal, so I wonder what it is you're up to that makes you more of a nation-state target than him), I don't have a clue what your options are - I suspect they start with "don't use the internet at all"...

Yeah - as of 1 Aug new apps or 1 Nov for updated apps - you need to "target" API level 26 (Android 8), but you can still set your minSdkVersion to whatever you like (we're still publishing version 16/Android 4.4 updated).

https://developer.android.com/distribute/best-practices/deve...

@mrguyorama - this means you can force the old landgrab user-hostile permissions to people running old Android versions, but you cannot force them onto users running Android 8.

It also requires there to not be a hardware sidechannel exploit on the device running SGX... such as the variants of Spectre that have ben trickling out every few weeks now all year... so yeah: Moxie's trust of SGX is pretty damning.

> There’s an alternative to the Play Store for Android. F-Droid is an open source app “store” (repository would be a better term here) which only includes open source apps (which Signal thankfully is). By no means does Signal have to only be distributed through F-Droid - it’s certainly a compelling alternative. This has been proposed, and Moxie has definitively shut the discussion down.

Adjunct to the rest of this discussion: just read through that GH issue and came away with markedly different conclusions than the author of the blog post.

It reads like someone who is trying hard to justify and prioritize dev time/resourcing in the face of what is a demanding and vitriolic minority. No evidence of disingenuous intent or desire to push a particular agenda. I see nothing that would have prevented the old OSS adage: "if you want to see it, do it".

Drew, I don't know you, or the background for the argument you're making, but it seems like you have something stuck in your craw here. Maybe take a little time and try to view the situation with fresh eyes? You're obviously passionate about this subject -- and the unique perspective is appreciated -- but it devalues the rest of the info presented, and I don't buy the precept you're proposing.

It's not at odds if you know how they work. The U.S. LEO's are multiple organizations with different focuses, legal authority, and so on. They also regularly lie to protect illegal methods and activities. Let's look at some data.

Now, first indication this isn't true was Alexander and Clapper saying they didn't collect massive data on Americans. If they did, they could've solved a lot of cases by your logic of action vs capability being contradictory, right? Yet, Snowden leaks showed they were collecting everything they could: not just metadata, not just on terrorism, and were sharing it with various LEO's. So, they already lie at that point to hide massive collection even if it means crooks walking.

Next, we have the umbrella program called Core Secrets. See Sentry Owl or "relationships with industry." It says Top Secret, Compartmented Programs are doing "SIGINT-enabling programs with U.S. companies." In same document, even those with TS clearance aren't allowed to know the ECI-classified fact that specific companies are weakening products to facilitate attacks.

https://theintercept.com/2014/10/10/core-secrets/

https://theintercept.com/document/2014/10/10/national-initia...

For Lavabit trial, see Exhibit 15 and 16 for the defense against pen register. Exhibit 17 makes clear the device they attach records data live and claims constitutional authority to order that. They claim only metadata but they lied about that before. Exhibit 18 upholds that the government is entitled to the information, Lavabit has to install the backdoor, the court trusts FBI not to abuse it, and they'll all lie to Lavabit customers that nobody has access to their messages (aka secrecy order about keys).

https://edwardsnowden.com/wp-content/uploads/2013/10/redacte...

That the judge asked for a specific alternative was hopeful, though. I came up with a high-assurance, lawful-intercept concept as a backup option for event where there was no avoiding an intercept but you wanted provable limitation of what they were doing.

https://www.schneier.com/blog/archives/2014/09/fake_cell_pho...

They regularly hide what techniques they have via parallel construction or dropping cases.

https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intel...

https://arstechnica.com/tech-policy/2015/04/fbi-would-rather...

So, you now have that backdrop where they're collecting everything, can fine companies out of existence, can jail their executives for contempt, are willing to let defendants walk to protect their secret methods, and constantly push for more power in overt methods. In the iPhone case, even Richard Clarke said he and everyone he knows believed the NSA could've cracked it. Even he, previously ardent defender of intelligence community, says FBI was trying to establish a precedent to let them bypass the crypto with legal means in regular courts.

https://www.newsweek.com/former-white-house-offiical-nsa-cou...

So, the questions would be:

(a) can they already do that legally or technically using methods like attaching hardware and software to vendors' networks/apps like in Lavabit trial?

(b) can the NSA or third parties bypass the security on iPhones publicly or in secret? Or did Apple truly make bulletproof security?

(c) did all this change just because FBI said they were honest, powerless agency hampered by unbreakable security in a press release?

I didn't think anything changed. I predicted they'd crack that iPhone the second they were blocked in court. They did. They knew they could the whole time. They lied the whole time. They wanted a precedent to expand their power like they did in the past. That simple.