Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I don't trust Signal

drewdevault.com

Post reply on HN
Print view View original

421–430 of 473 posts

Re: I don't trust Signal

#421

Post by bigiain »

SquareWheel wrote: post #417
bigiain wrote: post #402

Earlier quoted context omitted.

How much non-geek non-privacy-activist socialising have you done via Signal? Without emoji and animated gifs, I suspect 70% of my Signal contacts wouldn't use it at all. It's hard enough to convince some of my friends to use it at all, "Can't I just Facebook message you?" For me, amongst my group of friends - it seems Moxy is making all the right security/usability tradeoffs. If you don't trust PlayStore, it seems no…

>I wonder what it is you're up to that makes you more of a nation-state target than him I don't know what it is you're talking about. The entire point of my comment was that I don't like animated gifs. They're distracting, bandwidth intensive, and could be easily replaced by a dozen better image formats.

Sorry - I hadn't intended to aim that accusation at you specifically, but at people who are "more of a nation-state target" than Snowden. Poor sentence construction on my part there...

And while I agree with you about animated gifs, I understand WhisperSystems reluctance to try and become the force that turns non-geek non-privacy-activist users (which they and I are hoping will widely adopt Signal) to find WebP or flif or whatever alternatives to giphy or where ever else they're finding their reaction gifs and topical memes and funny cat-riding-a-roomba animations from. That's how a _huge_ percentage of users want to communicate with each other. Moxy is trying to give them a secure way to communicate how they want to, not attempting to force them into new ways of communicating that have boring justifications like "bandwidth saving" or "animation format technical merit" as the only reasons why they can't have vast libraries of funny animations to send their friends... If they can't quickly reply with Ru Paul doing fingersnaps in Signal, they'll go do it on Facebook instead.

For that reason, I'm of the opinion that _not_ supporting animated gifs is significantly more counterproductive, if you're trying to become "the secure messaging mechanism the whole world will use" or if (like me) you'd like more and more personal communication to be exclusively between the participants, and not include advertising networks and data miners and sentiment analysers (and, yeah, law enforcement and government bureaucracy)...

Re: I don't trust Signal

#422

Post by Arnt »

bumholio wrote: post #61
Arnt wrote: post #46

Earlier quoted context omitted.

Does F-Droid support reproducible builds now? Or does it offer any other kind of assurance that the software downloaded actually comes from the purported origin?

Yes, they only publish the signed binaries produced from public sources according to a recipe anyone should be able to follow. https://f-droid.org/en/docs/Reproducible_Builds/

That's what Moxie does too, and F-Droid won't trust that. So what's different? Why are F-Droid's builds trustworthy?

Re: I don't trust Signal

#423

Post by bjoli »

snvzz wrote: post #412
bjoli wrote: post #326

Earlier quoted context omitted.

Well. I'd rather not have anyone suggest tox. The whole "we use nacl so we are safe" attitude from a couple of years ago seems to still be around. Good on them for using nacl. A shame they don't seem to realize that you can write bad crypto with it. The whole forward secrecy seems to be unresolved still. They have session keys,but other than that there is no rekeying. And then we have the whole issue with it relying…

>The whole "we use nacl so we are safe" attitude from a couple of years ago seems to still be around. Citation needed. >Well. I'd rather not have anyone suggest tox. I'm repeating myself, but for all the hate it gets, I'm unable to come up with a better suggestion than Tox. There's always some kind of flaw: Centralized, no forward secrecy, end to end encryption optional, no way to verify contacts and so on.

Regarding the citation, it is just a matter of reading how the core devs reply to potential security issues. Sure, it has gotten better, but it is not too far from the good old https://github.com/irungentoo/toxcore/issues/121

The fact is we mostly know what kind of attacks are possible on signal. We know metadata is a potential problem. We know what kind of tradeoffs we get with a centralised architecture. We know how that works and how to mitigate some things. Openwhispersystems have been clear about what Signal provides and what it does not provide (even the wording around disappearing messages is well chosen not to confuse people ).

With tox there is a lot we don't know. Are the supernodes an attack vector? Why aren't the devs clear about using a less distributed architecture for mobile clients? Why don't they provide proper forward secrecy yet they claim to do so? There might be lots of strange properties of doing crypto distributed.

I would not recommend it for secure communication until the amount of unknowns is smaller. It is really that simple.

Re: I don't trust Signal

#424

Post by mnm1 »

angry_octet wrote: post #405
mnm1 wrote: post #253

If the consequences of sending messages are torture and death, I wouldn't trust any form of electronic communication. That's what face to face meetings are for and have always been for. I did not think signal is insecure, but either party could be compromised in other ways like a key logger or other local software that intercepts messages on the device they are composed on. I certainly wouldn't trust any mobile os ba…

I would trust Signal on iOS, depending on who I was messaging. I'd turn on timed messages though, and the signal number wouldn't be my main phone number. Far less likely to be key logged on iOS. If you don't browse websites on the device that helps. You have to consider that face to face meetings are often observed by third parties, you can be tracked easily, extremely incriminating generally. The other person can ta…

The other person can show your signal messages to the wrong people just as well as they can talk about the conversation. At least with a conversation, you have plausible deniability although that may not count for much. You do also have to be careful of being recorded. Still, the point is, I would not trust a software platform. Ios or Android doesn't make a difference. They are both easily exploitable and have tons of security bugs no doubt, many that the biggest state actors are likely hoarding as 0 days for just such an occasion. There is no perfect solution.

Re: I don't trust Signal

#425

Post by zaarn »

im3w1l wrote: post #415
tptacek wrote: post #305

Drew DeVault doesn't trust Signal because its Android incarnation uses the Google Play Store --- the app market virtually all of its real users use --- and not F-Droid. DeVault would also like it if Signal would interoperate with other chat programs. Instead, DeVault would prefer that you use Matrix, a system for which end-to-end encryption is (according to its own website) "in late beta", offered on a select subset…

If people are on a centralized service it will be much easier censor, surveil and kick out undesirables. And as we saw on the Gab thread, these are things you want to enable. You want a strong leader to say what goes and doesn't and you hope that Moxie will become that leader. I think I will stick with matrix.

Matrix? E2E isn't even enabled by default anywhere, the server uses a ridiculous amount of resources, alternative servers support half of the protocol, I cannot easily discover people I know from my contacts lists via mail/phone/address/ICQ number/etc, 70% of the bridges I would need hover between "barely functional" and "the compiler isn't complaining", guilds are not easily possible as in other chat applications and their clients draw more battery than any other chat program I tried, including Skype, which I think qualifies for an achievement award of some kind.

I think I'll stick with services that offer E2E and/or sensible feature-sets.

Once Matrix fixes all their problems I'll gladly install a homeserver and run it open for other users to sign up for, until then I'm on Signal.

Re: I don't trust Signal

#426

Post by zaarn »

hutzlibu wrote: post #230
move-on-by wrote: post #213

Earlier quoted context omitted.

> People who are into more secure communication do not randomly click on anything I think you overestimate people. I told my wife to install Signal because she needed a password for something and it was way to complicated for her to remember. I know what the signal app is and could likely avoid fakes - she would not. I think it is often the case that only one party of the conversation is security minded, while the ot…

People who do click on the wrong "Signal" probably clicked on many other wrong things, too. Their Security is not existent anyway, even if they accidently use the official Signal build.

So because a user clicked on a wrong thing we should completely abandon them and ignore all their security and privacy needs?

Re: I don't trust Signal

#427

Post by tptacek »

xorcist wrote: post #419
tptacek wrote: post #385

Earlier quoted context omitted.

That's a security concern he feels he can address for himself if Signal is made available to him on F-Droid. But for the overwhelming majority of Signal users, there isn't even in theory a security benefit, because they're exposed to their platform vendor no matter what Signal does. Signal has decided --- sensibly, I think! --- to focus on the needs of the "normie" users. DeVault disagrees with that decision. He is w…

He is indeed welcome to do so. It is perfectly rational for him to choose some other software. Far from not something that warrants a character assassination. Specifically, it's not something "clownish" that we should be "ashamed" to have on the front page. We get the community we deserve.

Please read what I wrote more carefully. Him wanting to use different software isn't clownish. I respect the prerogative of the phone sysadmins.

Him saying that Moxie Marlinspike is untrustworthy because of a disagreement, and then urging people to use Matrix --- that's a clownish argument. And it is the bulk of his argument, paragraph by paragraph: all the reasons why the only rational reason anyone could disagree with Drew DeVault is if they are sneakily trying to screw people over.

Re: I don't trust Signal

#428

Post by zaarn »

tptacek wrote: post #305

Drew DeVault doesn't trust Signal because its Android incarnation uses the Google Play Store --- the app market virtually all of its real users use --- and not F-Droid. DeVault would also like it if Signal would interoperate with other chat programs. Instead, DeVault would prefer that you use Matrix, a system for which end-to-end encryption is (according to its own website) "in late beta", offered on a select subset…

I basically agree here. Some people, like DeVault, don't seem to think that there is any other threat model than "protect sysadmins from nationstates like the US or big corporations or Mossad".

I find such viewpoints rather dissapointing because I myself as a sysadmin don't hold it. My threat model is "someone steals my phone" and "someone (I want me and my family to be reasonably secure against the background noise of the internet.

And of course not suck the battery dry like some thirsty vampire who was offered a bag of O-negative.

For this task, Signal is fully sufficient (until another messenger does it better or matrix fixes their long list of problems I have with them).

Re: I don't trust Signal

#429

Post by hutzlibu »

zaarn wrote: post #426
hutzlibu wrote: post #230

Earlier quoted context omitted.

People who do click on the wrong "Signal" probably clicked on many other wrong things, too. Their Security is not existent anyway, even if they accidently use the official Signal build.

So because a user clicked on a wrong thing we should completely abandon them and ignore all their security and privacy needs?

Nope, but we should not limit the freedom of other users, who know what they are doing, because of some, who do not.

Re: I don't trust Signal

#430

Post by zaarn »

hutzlibu wrote: post #429
zaarn wrote: post #426

Earlier quoted context omitted.

So because a user clicked on a wrong thing we should completely abandon them and ignore all their security and privacy needs?

Nope, but we should not limit the freedom of other users, who know what they are doing, because of some, who do not.

I heavily disagree. If we want to protect as much people as possible we will have to limit the freedom of some users to do as they want because other users will accidentally or intentionally abuse the freedoms given.

Not limiting freedom of the user because they know what they are doing at the expense of others is maximizing the protection and freedom of a small group, not society as a whole.

Post reply on HN