Live data from Hacker News

Grand jury subpoena for Signal user data, Central District of California

signal.org

551–560 of 618 posts

Re: Grand jury subpoena for Signal user data, Central District of California

#551

> this subpoena requested a wide variety of information we don’t have, including the target’s name, address, correspondence, contacts, groups, calls. Couldn't they easily use the phone number associated with the Signal account to find the target's name? Even if the account uses a pre-paid SIM without a credit card attached, the telco could still reveal the location of the device and probably its IMEI, which could be…

For what it’s work, as far as I know, Signal has never claimed to be an anonymous communication service. They are a secure communication service.

This means they minimize the information that is in the clear and do this quite well.

Now to your specific concern about the phone number. Signal only has your phone number and sign up time. This means that for someone to request your information, they’ll pretty much need that already. If you look at the subpoena you’ll see that the FBI is asking for data associated with the persons name or phone number. Name is something Signal doesn’t have. You’re right that it’s trivial to get with the phone number (and the FBI has obviously done this), but they must necessarily have this information to even request data from Signal.

In other words, Signal doesn’t provide a means of leaking your name. What using a phone number identifier does do is allow someone to go from name to phone number to Signal request, though that Signal request with turn up very little data.

Re: Grand jury subpoena for Signal user data, Central District of California

#552
post #500

Earlier quoted context omitted.

It's not exactly a secret and any discussion of Tor's history will immediately bring it up, but sure. > For the onion router to work properly, the Navy needed to step back from running it. A cloaking system is not useful if all the cloaks say “Navy” on them. “If you have a system that’s only a Navy system, anything popping out of it is obviously from the Navy,” Syverson says. “You need to have a network that carries…

Ah - wow, dang. I believed the cover-story that Tor was a side-project of a humanitarian org in the US gov that wanted to provide people in firewalled countries a way to access the wider internet - of course, Tor does do that (just as a nice side-effect, and to be fair, the US does benefit and encourage democratic (...and neoliberal) ideals worldwide as its in their own interests to). ...it's kinda like how we were a…

> just as a nice side-effect, and to be fair, the US does benefit and encourage democratic (...and neoliberal) ideals worldwide as its in their own interests to

To be clear, they encourage democratic ideals where/if it's in their own interests to. There are plenty of places where they encourage non-democratic ideals as well (or directly fund their own coups to put usually military leaders they like in power).

Re: Grand jury subpoena for Signal user data, Central District of California

#553

Signal, please stop asking for mandatory phone number to register and use Signal. This raises privacy concerns and negates all the end-to-end encryption goodness you're offering.

> negates all the end-to-end encryption goodness you're offering.

It literally does not. Source: the OP

Using a phone number means that an agency can ask Signal if you have a Signal account, but they can’t access any other info about you.

Re: Grand jury subpoena for Signal user data, Central District of California

#554
post #270

While I applaud Signal's response I expect this entire event (subpoena and response) will be provided as one of the exhibits to congress by the Department of Justice to justify their request that it be unlawful to provide such services. The DoJ will say, "See, here is this horrible crime we are investigating and because this company chose to make it impossible for law enforcement, with a warrant and a subpoena to get…

This is why there should not be a single entity that runs the network. Make it fully decentralized with economic incentives for node operators. some projects trying to do this now are Status, Session, Sylo

Aren't both XMPP and matrix networks decentralized? XMPP has been around since 1999 according to wikipedia. It is my understanding that providers could keep metadata/logs about accounts involved.

Re: Grand jury subpoena for Signal user data, Central District of California

#555

If we're talking about pure messaging here and not sending a jpg or other attachment, why not create an app that simply uses plaintext, like a terminal. Generate some 4096 bit keys and make it decentralised. Public keys could be shared among people willing to communicate. Anytime you have a central location where data is parsed, the time stamps and other metadata can be gleaned. The app could even fudge time stamps.…

The problem is not the encryption. The problem is adoption and ease of use.

There are very many ways to encrypt messaging data by sharing public keys. There are also several decentralized, federated encrypted messenger apps. They are great options for folks, but frankly aren’t as easy to use or feature rich and thus not as widely used.

Re: Grand jury subpoena for Signal user data, Central District of California

#556
post #151

What worries me is that even though they don't own the data, they could be forced to push an update that will upload decrypted messages from people's phones. Not owning the client would be better

Not owning any server would also help. Metadata, contacts and groups can easily be recorded if you own the server. Federation is a big reason why I consider XMPP superior to Signal.

Federated servers are still servers. It’s nothing for the FBI to subpoena any server you’ve connected to and then any server that server connected to, etc.

The important thing is minimizing the data that is collected, period. Otherwise you’re just obscuring the data storage.

Re: Grand jury subpoena for Signal user data, Central District of California

#558

Related: does anyone know why the Signal-Server code allows for toggling request logging? [0] If this allows for logging raw HTTP(S) requests server-side, presumably this could be grabbing the passwords generated and held on each device used for authentication [1]? There's also no mention of TLS termination in the Signal-Server repository on GitHub, or TLS between the Redis cluster in use. If FBI or NSA has compromis…

The HTTP request does not have the users private keys. That never leaves your phone.

The DB table looks like signal creates UUIDs to represent users and devices. This isn’t really sensitive information but really just how you can see and revoke devices associated with your account. Maybe I’m misreading something tough. Do you have any reason to believe otherwise?

Re: Grand jury subpoena for Signal user data, Central District of California

#559
post #151

Earlier quoted context omitted.

Not owning any server would also help. Metadata, contacts and groups can easily be recorded if you own the server. Federation is a big reason why I consider XMPP superior to Signal.

Federated servers are still servers. It’s nothing for the FBI to subpoena any server you’ve connected to and then any server that server connected to, etc. The important thing is minimizing the data that is collected, period. Otherwise you’re just obscuring the data storage.

> It’s nothing for the FBI to subpoena any server you’ve connected to

I can choose to use a server outside the US. I can choose to run a server in my basement and still talk to all my contacts. You simply do not have this freedom with Signal. Finally, I do not have to trust anyone about what (meta-)data is collected.

Re: Grand jury subpoena for Signal user data, Central District of California

#560

Earlier quoted context omitted.

Are you actually serious? You don’t know which race the US discriminated against in the past 100 years? Japanese people. Who got their expensive real estate in places like Santa Monica seized during WW2 and were placed in camps?

Are you actually serious? You don’t know which race the US discriminated against in the past 100 years? Native Americans. Who stole pretty much all of their land, sent them on death marches [1] and kept them out of politics with discriminatory policies? https://en.m.wikipedia.org/wiki/Trail_of_Tears

How can you be taken seriously if your idea of 100 years different from everyone else's?
Post reply on HN