I don't trust Signal • Hacker News Board

Re: I don't trust Signal

#471

Post by eighthave » Mon, Aug 13, 2018, 8:24 AM UTC

angry_octet wrote: post #393

Hello71 wrote: post #329

Earlier quoted context omitted.

> You have to root your device to run it wtf. I have been using F-Droid for many years, and this has not been the case. as far as I know, this has never been the case, as Android has always had functions for third party app stores. in fact, even today, F-Droid recommends not using root for installs, since then you don't get the screen showing permissions. > allow third party code that's called running apps. tl;dr nic…

'allow third party code' means code which is not signed. Once you tick that any unsigned code can run, not only the app you downloaded. Makes exploitation significantly easier. It would be better if Android forced you to explicitly select which code could run, but too hard for most users.

Android explicitly forbids running unsigned APKs, it is not possible to do.

Re: I don't trust Signal

#472

Post by eighthave » Mon, Aug 13, 2018, 8:29 AM UTC

Vinnl wrote: post #71

> Off the bat, let me explain that I expect a tool which claims to be secure to actually be secure. I don’t view “but that makes it harder for the average person” as an acceptable excuse. If Edward Snowden and Bruce Schneier are going to spout the virtues of the app, I expect it to actually be secure when it matters - when vulnerable people using it to encrypt sensitive communications are targeted by smart and powerf…

I think Signal does a very good job at providing easy security for the masses. But for journalists and sources it can be dangerous since it is based on real phone numbers, and those phone numbers are sent to the server to be matched up. It is especially dangerous if the journalists and sources believe Signal is protecting them in that use case.

Re: I don't trust Signal

#473

Post by xorcist » Thu, Aug 16, 2018, 9:49 PM UTC

tptacek wrote: post #427

xorcist wrote: post #419

Earlier quoted context omitted.

He is indeed welcome to do so. It is perfectly rational for him to choose some other software. Far from not something that warrants a character assassination. Specifically, it's not something "clownish" that we should be "ashamed" to have on the front page. We get the community we deserve.

Please read what I wrote more carefully. Him wanting to use different software isn't clownish. I respect the prerogative of the phone sysadmins. Him saying that Moxie Marlinspike is untrustworthy because of a disagreement, and then urging people to use Matrix --- that's a clownish argument . And it is the bulk of his argument, paragraph by paragraph: all the reasons why the only rational reason anyone could disagree…

Literally nowhere in the article does he say that. The article presents two main arguments why the author chooses not to use Signal (and that by extension, other people with the same interest should do the same), that it requires Google services with root privileges, and that it doesn't federate or interoperate. There are no personal attacks on Signal's author, the author presents his reasons in a fairly objective light, so there should be no reason to chastise him.