Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technology Preview: Signal Private Group System

signal.org

Post reply on HN
Print view View original

51–60 of 153 posts

Re: Technology Preview: Signal Private Group System

#51

Post by atoav »

BLKNSLVR wrote: post #48
JoshTriplett wrote: post #19

Earlier quoted context omitted.

Honestly, the one and only feature I'm missing in Signal that would let me use it and recommend it to everyone without reservations (rather than exclusively for ephemeral-only communication) is the ability to keep identity and full message history when moving to a new device. Today, on iOS, you can't move your Signal history to a new device, and on Android you can only do so by manually making an encrypted backup fil…

I think I'm an exception in this instance, but I don't understand what value there is in message history. How often do you find yourself reminiscing by going back through a messaging log? If there are photos that should be kept then there are other ways to back them up. Is there valuable context in the conversation that was had around the delivery of the photo? Are messages backed up and restorable for other messagin…

I think if yoi know everything is gone you will decide actively what is worth keeping.

I keep a journal for exactlt these things

Re: Technology Preview: Signal Private Group System

#52

Post by kyboren »

eximius wrote: post #50
tptacek wrote: post #37

Earlier quoted context omitted.

No, what I'm saying is that without the cryptographic protections, a messaging provider can't claim not to be logging, because their serverside logic requires the log. Prior to doing this cryptographic work, Signal simply went without having these features at all.

You're both right. The other poster's claim is that we cannot verify the code running on the server. They could support this new scheme AND just store every thing in plain text. We can only verify the interface is the same (because that's what we're using). But you're also right it would be a long con to go without these features for so long, develop state of the art cryptography to add them securely and privately, t…

> They could support this new scheme AND just store every thing in plain text.

Could they?

I am not clear that this is possible. I thought the entire point of "Alice provides a zero-knowledge proof to the server that she possesses an AuthCredential matching some particular entry" is that the server learns nothing about Alice other than her possession of a matching AuthCredential. Indeed, the paper says: "Because of the zero-knowledge property, the server has assurance that the user possesses such an auth credential without learning the UID certified by the credential, or other information that might link this use of the credential to other uses or to credential issuance."

It would be nice if someone more knowledgeable could confirm whether it is indeed possible for Signal to compromise user privacy while using this scheme. Is SheinhardtWigCo right when they write, "In contrast, I cannot verify this new claim that my group memberships are protected. I have to trust them."?

Re: Technology Preview: Signal Private Group System

#53

Post by baybal2 »

myu701 wrote: post #5
noja wrote: post #3

Earlier quoted context omitted.

> This is either a reason you love Signal (raises hand) or can't stand Signal. Eh? Why either or? (and why are there people who can't stand it?)

I love Signal, and upsell it whenever I can. Signal has its ideosyncratic parts, some of which are being worked on, others not so much. Some of the more visible ones are IMO: Signal forces users to use phone numbers; some people don't like this because they want to use multiple ephemeral usernames so they can be 'Joe' to friends, 'kleptoclown' to their github group, 'dungeonmaster42' to their DND group, 'joesolutione…

If you are a client for Signal, rubberhose cryptoanalysis is a much bigger issue.

Here is a story what has happened to Doubi (SSr developer.) He was a very well aware of anonymity risks, and he evaded police for years on end. China literally tried to do geolocate him by turning off the internet in entire cities, but to no result — he caught on to that, and started randomising his release timing, and avoiding releasing "hotfixes". So, the entire Chinese police and MSS been looking him for 4-5 years.

What has happened? A few month before his arrest, he registered a Twitter handle with a throwaway SIM card. Those are being usually sold by "grannies" in Chinese 2nd tier cities who peddle things like fake tax receipts, anonymous train tickets and such.

China either hacked Twitter, or had somebody bribed there, and they got the number. They then tracked down the granny who sold him the SIM card, and went on and checking every person door to door in that small town. Then, they found him.

He got 5 years prison, and 4 years of laogai (gulag)

Re: Technology Preview: Signal Private Group System

#54

Post by tialaramex »

eximius wrote: post #50
tptacek wrote: post #37

Earlier quoted context omitted.

No, what I'm saying is that without the cryptographic protections, a messaging provider can't claim not to be logging, because their serverside logic requires the log. Prior to doing this cryptographic work, Signal simply went without having these features at all.

You're both right. The other poster's claim is that we cannot verify the code running on the server. They could support this new scheme AND just store every thing in plain text. We can only verify the interface is the same (because that's what we're using). But you're also right it would be a long con to go without these features for so long, develop state of the art cryptography to add them securely and privately, t…

> They could support this new scheme AND just store every thing in plain text.

Store _what_ in plain text?

Right at the top of the article are some commonplace things other "chat" systems, even if they claim end-to-end encryption - store in a central database. Metadata, like the name of the group, a logo or "avatar" and then also the core fact of the group, a list of its members.

Signal's server doesn't end up knowing /any/ of those things. It doesn't need them for anything it does, so it never gets told what they are. It couldn't store them in plain text any more than it could your Signal messages.

With the proposed enhancement Signal's server would store the data so as to serialise access, but it would still be encrypted with keys the server does not have so it's meaningless to the server.

Members of each group learn a key (picked at random by the group's founding member) -- which Signal's server doesn't know -- and that key lets them decrypt the metadata about the group and encrypt new data if they e.g. decided to change the group's name, invite somebody to the group or remove someone from the group.

The part we can't _prove_ Signal is doing as a result of this work is the new use of Anonymous Credentials and Roles. Maybe Signal will actually let Alice add an entry to the members list for my group Carolines And Tiaras even though Alice isn't a member. This won't work very well, because since Alice isn't a member she can't add _correct_ entries, for example she can't add herself or a collaborator, but she can add gibberish and maybe annoy the group members.

Re: Technology Preview: Signal Private Group System

#55

Post by tialaramex »

kyboren wrote: post #52
eximius wrote: post #50

Earlier quoted context omitted.

You're both right. The other poster's claim is that we cannot verify the code running on the server. They could support this new scheme AND just store every thing in plain text. We can only verify the interface is the same (because that's what we're using). But you're also right it would be a long con to go without these features for so long, develop state of the art cryptography to add them securely and privately, t…

> They could support this new scheme AND just store every thing in plain text. Could they? I am not clear that this is possible. I thought the entire point of "Alice provides a zero-knowledge proof to the server that she possesses an AuthCredential matching some particular entry" is that the server learns nothing about Alice other than her possession of a matching AuthCredential. Indeed, the paper says: "Because of t…

SheinhardtWigCo's central idea is that if someone receive a packet over the network it has an IP address in it, and that's the sender's "identity" and so the Signal servers can't avoid knowing Alice's "identity" when she does this, and then they can collect such data to try to re-assemble group membership in terms of IP address "identities".

For example let's say a packet arrives from 10.20.30.40 [[ all IPs used are from 10/8 as examples I am aware that Signal probably rejects packets claiming to be from an RFC1918 network ]] which contains proof that group #1 member #4 has authorised adding a new member #8

SheinhardtWigCo believes this tells us that this identity (10.20.30.40) is a member of this group, group #1 and they suppose that Signal's server could in fact store this, and then perhaps later tell some Spooks a list of such members of group #1 and it could do this on a vast scale, so that it would be able to say for any "identity" (IP address) the list of all identities (IP addresses) which seem to be members of groups which that identity is also a member of.

Now, I don't think Spooks would find that very useful, but there you go, that's what SheinhardtWigCo thinks is a big problem here.

[ Edited to clarify early paragraph ]

Re: Technology Preview: Signal Private Group System

#56

Post by e12e »

baybal2 wrote: post #53
myu701 wrote: post #5

Earlier quoted context omitted.

I love Signal, and upsell it whenever I can. Signal has its ideosyncratic parts, some of which are being worked on, others not so much. Some of the more visible ones are IMO: Signal forces users to use phone numbers; some people don't like this because they want to use multiple ephemeral usernames so they can be 'Joe' to friends, 'kleptoclown' to their github group, 'dungeonmaster42' to their DND group, 'joesolutione…

If you are a client for Signal, rubberhose cryptoanalysis is a much bigger issue. Here is a story what has happened to Doubi (SSr developer.) He was a very well aware of anonymity risks, and he evaded police for years on end. China literally tried to do geolocate him by turning off the internet in entire cities, but to no result — he caught on to that, and started randomising his release timing, and avoiding releasin…

But, in this story - had he used signal - if the police arrested anyone in contact with him, any one of those would be able to turn over his phone number? Which would be linked to the sim card in his phone?

Am I missing something? Or am I misinterpreting your story? You're saying that sign up bound to a Sim card is bad for Twitter and bad (worse) for signal?

Re: Technology Preview: Signal Private Group System

#57

Post by godelski »

mderazon wrote: post #43
JoshTriplett wrote: post #19

Earlier quoted context omitted.

Honestly, the one and only feature I'm missing in Signal that would let me use it and recommend it to everyone without reservations (rather than exclusively for ephemeral-only communication) is the ability to keep identity and full message history when moving to a new device. Today, on iOS, you can't move your Signal history to a new device, and on Android you can only do so by manually making an encrypted backup fil…

I actually going in the other direction with Signal I turned on timer (1 week) for all of my conversation. Nothing stays more than a week and I do not keep any backup. It's not for security or privacy reasons. I feel like I don't need a full history of all my conversations with everyone from the beginning of time. This fits more to the real life model of having a conversation with someone. I don't record my conversat…

I just limit the message number.

BUT I've heard a lot of people request the feature of porting messages. I didn't realize people care about this till they started telling me (I have convinced a good number of my friends to switch to Signal). So I'd say that because the market is asking for it, implement it. (I do notice that it is only iPhone users asking me about how they can do this. Might be selection bias)

BTW, you can do this! [0] I'd think the easiest thing to do (I don't know iOS or Android at all) would be to create a backup to iCloud or Drive that will hold an encrypted file. Then a function for the reverse. Since I don't do anything remotely near mobile, is this not fairly easy to implement? Encrypted backup is one of the top requested features [1] and seems one of the easiest to implement.

[0] https://github.com/signalapp

[1] https://community.signalusers.org/c/feature-requests?order=v...

Side note: the only features I want are

- Not being tied to a phone number, or a way to add a user without a phone number

- domain fronting (... thanks Amazon... )[2]

I think both are in the spirit of what Signal is trying to do and would specifically help protestors in authoritative countries. That they can decrypt their phones and not reveal others in the group chats. But I understand that these requests are much more difficult than asking for encrypted backup.

[2] https://signal.org/blog/looking-back-on-the-front/

Re: Technology Preview: Signal Private Group System

#58

Post by e12e »

tptacek wrote: post #14
pepijndevos wrote: post #10

I really want Signal to succeed. Or rather, I want anything that has decent cryto and is not FAANG to succeed. The problem is not which messaging app I want to use, it's which messaging app my friends are using. That said, if I had to choose, I think Matrix has a slight edge in my books because it's a protocol rather than a silo. Even though Signal is private and open source, they are hostile towards people running t…

Matrix and Signal aren't comparable from a security perspective. Because Matrix is a protocol rather than a silo, many (most?) of its implementations don't even support E2E, and because Matrix has its roots in an ecosystem where E2E was a nonstandard add-on, Matrix will never be as safe as Wire or Signal.

Never seems a bit strong? Surely over the next decades we could have a Matrix 2.0 that is still federated, but mandates e2e (especially with Signal doing some of the research)?

Re: Technology Preview: Signal Private Group System

#59

Post by zrth »

baybal2 wrote: post #53
myu701 wrote: post #5

Earlier quoted context omitted.

I love Signal, and upsell it whenever I can. Signal has its ideosyncratic parts, some of which are being worked on, others not so much. Some of the more visible ones are IMO: Signal forces users to use phone numbers; some people don't like this because they want to use multiple ephemeral usernames so they can be 'Joe' to friends, 'kleptoclown' to their github group, 'dungeonmaster42' to their DND group, 'joesolutione…

If you are a client for Signal, rubberhose cryptoanalysis is a much bigger issue. Here is a story what has happened to Doubi (SSr developer.) He was a very well aware of anonymity risks, and he evaded police for years on end. China literally tried to do geolocate him by turning off the internet in entire cities, but to no result — he caught on to that, and started randomising his release timing, and avoiding releasin…

That's super interesting, thanks for sharing! Would you mind posting a link or a two about the story of Doubi. I can't find much and would love to dig into this story.

Re: Technology Preview: Signal Private Group System

#60

Post by stilisstuk »

tptacek wrote: post #2

Again, in the theme of "features every group messaging system had already, but Signal didn't, because they hadn't figured out a way to implement it without turning Signal's central servers into a database of who's talking to who about what". Signal didn't even have user profiles until recently, for the same reason. Here, they've slightly expanded the state of the art in MAC-based anonymous credentials to accomplish t…

Been using signal since textsecure I think (I even think there was another name before that). In all that time, one thing keeps me thinking about backing out: phone numbers. When a contact decides to uninstall signal, I lose contact. Signal still thinks that the recipient has a signal account, and hence won't deliver messages via SMS.
Post reply on HN