Why I won't recommend Signal anymore • Hacker News Board

Re: Why I won't recommend Signal anymore

#61

Post by tptacek » Sat, Nov 05, 2016, 6:23 PM UTC

antocv wrote: post #58

zigzigzag wrote: post #43

Like a lot of crypto-puritanism it is rather mixed up. He says he recommended Signal because it was easy to use (more consumer friendly I guess) and secure, then says he wouldn't have gone in the direction of making it easier to use and criticises the things that make it user friendly, like using phone numbers instead of usernames. He says he thinks the protocol is secure, then says he doesn't want it to use GCM beca…

There is a coherent argument which you just refuse to see. Signal was marketed as anti mass surveillance secure messaging system. It is but a mere user friendly email+gpg alternative. It actively avoid anti-mass surveillance methods and does the opposite - encourages centralization and collection of user statistics. Even Telegram is better, as people arent fooled by what it is. A better alternative is Ring.cx or Tox.…

I don't think you can reasonably post a top-level comment on a thread suggesting that Signal is a "honey pot", and then reply to a different comment on the same thread saying its author "refuses to see a coherent argument".

https://news.ycombinator.com/item?id=12881018

Re: Why I won't recommend Signal anymore

#62

Post by antocv » Sat, Nov 05, 2016, 6:23 PM UTC

zabuni wrote: post #42

"Also, there’s the issue of integrity. Google is still cooperating with the NSA and other intelligence agencies. PRISM is also still a thing. I’m pretty sure that Google could serve a specially modified update or version of Signal to specific targets for surveillance, and they would be none the wiser that they installed malware on their phones." Isn't part of the reason that Moxie went with the Google Store is that h…

Google has root on your phone. That is enough for them to replace any signatures, steal keys, replace apps without you knowing etc.

Re: Why I won't recommend Signal anymore

#63

Post by Veratyr » Sat, Nov 05, 2016, 6:23 PM UTC

heavenlyhash wrote: post #22

EDIT: this isn't a response to most of the article, but specifically to the "Moving Forward" section, asking about alternative tools. Come to the matrix! https://matrix.org/ It's free -- all FOSS, including the entirety of the server -- and yes, all of it: proof by existence: several of my friends run their own. It federates. I regularly join channels hosted on several different servers, and exchange messages without…

I'm also a Matrix convert. Tried getting Conversations + Prosody running for me and my wife but just couldn't get it to work properly. XMPP has so many XEPs (like MAM - XEP-0313) that you need to get things working nicely and there are very few clients (Conversations only afaik) that actually support them. We also found that Conversations just wouldn't send/receive messages sometimes and that when there was no connection, it'd pretend everything was fine and dandy but not actually send.

Switched to Matrix and setting up my own homeserver took about half an hour, comes with everything I need (history, "Carbons", notifications, attachments, voice/video) built in. Plus it's federated and has support for bridges so I can interact with pretty much anything else through it if I like.

Re: Why I won't recommend Signal anymore

#64

Post by antocv » Sat, Nov 05, 2016, 6:23 PM UTC

raverbashing wrote: post #15

- Lack of federation Use a federated secure protocol. Oh wait, there are none. Because if a problem appears you just can't fix it without breaking all federated clients. And then they will whine. - Dependency on Google Cloud Messaging Fair enough - Your contact list is not private Fair enough - The RedPhone server is not open-source While it would be nice that it was Open sourced I can understand them not releasing i…

Ring.cx and tox.im work better.

Signal is a honeypot by NSA/Google and the likes.

Re: Why I won't recommend Signal anymore

#65

Post by joecool1029 » Sat, Nov 05, 2016, 6:24 PM UTC

Veratyr wrote: post #57

SamWhited wrote: post #5

I highly recommend Conversations (disclaimer: I've worked on it in the past, although I'm not a project "member" per say): https://conversations.im/ It's open source, uses a federated, open protocol, and can do multiple types of encryption including OTR and OMEMO (an XMPP wire format that uses the Axolotl ratched devised for signal). It does not do VoIP, so it would just be for chat (although there is a large bounty…

I tried Conversations but I couldn't for the life of me get message history to work. There's just so much stuff you have to do when it comes to XMPP to get things working. Perhaps if I used someone else's server it wouldn't be a problem but I'd prefer not to do that.

See my comment below. You need a server with the XEP support for it. (XEP-313 I believe)

Re: Why I won't recommend Signal anymore

#66

Post by Sylos » Sat, Nov 05, 2016, 6:24 PM UTC

1024core wrote: post #54

> Another issue, and a plus for using usernames, is that you may want to use Signal with people you don’t necessarily want to give your phone number to. So, how do you know that the Edward.Snowden@signal you're communicating with is the same Ed Snowden that we all know about, and not some TLA stooge?

By making user-names unique...?

Re: Why I won't recommend Signal anymore

#67

Post by latkin » Sat, Nov 05, 2016, 6:28 PM UTC

> this tool should not have dependencies on corporate infrastructure like Google’s (basically any partner in PRISM)

Free yourself from the bonds of corporate infrastructure by installing this tool on your Google Android or Apple iPhone device (Microsoft Windows desktop version coming soon).

Re: Why I won't recommend Signal anymore

#68

Post by resonanttoe » Sat, Nov 05, 2016, 6:29 PM UTC

Joeboy wrote: post #16

reacharavindh wrote: post #6

This. I didn't know much of the insides of Signal. But, When WhatsApp decide to go in bed with FB to share my contacts and usage, one of the alternatives I explored was Signal. Threw it out the moment it asked for ownership of my contacts (no way to opt out). I for one am not going to trust a guy's pinky promise to be good with my contacts and meta-data. If I'm going to give up the convenience of reaching anybody by…

I doubt you'd want to use it if it didn't use your contacts, though. Not many people are prepared to deal with a whole separate set of contact ids for the sake of a small amount of arguable extra privacy.

Sure, most won't right. But clearly in this thread some people are willing to do that and I'm not convinced that there is a large burden/cost to signal to allow this.

The problem for me is that my contact list of Signal users is quite small (1 or 2 people) and everyone else isn't using it. I don't see the reason to allow Signal access to that list of people "Just in case" they decide to. It's incredibly unlikely bordering on near impossible.

This isn't the golden bullet of reasons that it should be this way, but the fact that in design Signal has made the choice to force access to contacts to me, says one of two things.

1. We haven't thought about cases outside of our own experience and expressly reject those as being outside of the market we're interested in. "You're not the user we're looking for."

2. There is value/commoditisation in that contact list that signal is interested in and this is the price to play in their system.

The problem is that either of these two options run pretty counter to the idea of secure privacy focused messaging client designed to be seperate from the user.

People's value of privacy is nuanced enough that making broad scoped decisions like this can run afoul of their expectations. Considering that Signal is aiming itself at the privacy conscious (Over-conscious in a lot of instances I'm sure), it's very weird that they would forgo this obvious affordance of information.

Re: Why I won't recommend Signal anymore

#69

Post by joesmo » Sat, Nov 05, 2016, 6:29 PM UTC

"Otherwise, we’ll be in danger of ending up in an neo-90s Internet, with walled gardens and pay walls all over the place. You already see this trend happening in journalism."

The internet will never be less walled, more free, and more federated than it was in the 90's. With such a poor understanding of the internet and its history, even if he did make a compelling argument (he doesn't), it'd be hard to take seriously.

Re: Why I won't recommend Signal anymore

#70

Post by Canada » Sat, Nov 05, 2016, 6:29 PM UTC

Nothing is stopping anyone from running their own servers, changing the username scheme, and implementing the voice signaling. Moxie doesn't complain about such usage. But that's more work than simply complaining and telling OWS what they should do.

As far as usernames go, that would require the signaling key to be remembered by the user. That doesn't work well in practice. As far as contact sync goes, has anyone submitted a patch for the android client to add an advanced option to disable that? On IOS access to the address book is user controlled at runtime. destinations will be validated by the server at compose time. Regarding federation, let's see some code. It's ridiculous to demand the small team that is OWS solve every single problem.