Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal adds a payments feature with a privacy-focused cryptocurrency

wired.com

Post reply on HN
Print view View original

631–640 of 665 posts

Re: Signal adds a payments feature with a privacy-focused cryptocurrency

#631

Post by codethief »

cookiengineer wrote: post #550
codethief wrote: post #548

Earlier quoted context omitted.

You're making very strong claims here. Signal regularly goes the extra mile to protect their users from 3rd-party tracking (by Giphy[0, 1] etc.) and, as they noted on GitHub at some point, they also consciously decided against UI/UX tracking and error reporting because they did not want to give off the impression that they themselves are surveilling their users. And now you're telling us that they deliberately includ…

> AFAIK the Signal app doesn't connect to the Google servers directly, so even if it exists, the cookie doesn't get transferred anywhere. The Firebase Cloud Messaging library / Google Play Services on your phone do connect to Google but they carry unique identifiers, anyway. It does connect to google's servers for pretty much everything [1] - you can look for these constants in the codebase and you'll find lots of th…

> Signal doesn't only use firebase for the sake of Push Notifications

For what else does it use Firebase?

> Also have in mind that push notifications/firebase is unnecessary with a high priority notification, which is what e.g. other f-droid FOSS forks of other apps use instead.

That's news to me. OTOH I'm not familiar with the term "high-priority notification" outside the FCM realm. Unfortunately, a quick Google search only yielded results related to FCM. Could you explain what you mean?

Re: Signal adds a payments feature with a privacy-focused cryptocurrency

#632

Post by AJ007 »

senectus1 wrote: post #387
airza wrote: post #25

Earlier quoted context omitted.

In my opinion a lot of the spicy regulatory issues around coins with private transactions are still not fully realized because none of them have mainstream adoption. The problem here is that Signal's goal to succeed as a mainstream encrypted messaging client could have the unpleasant side effect of bringing this technology under regulatory scrutiny. Hopefully things won't come to that, of course...

This is probably why they done sell (MobileCoin) to anyone in or from the US...

And they need to exhaustively verify who is really buying these to be sure they really aren’t in the US so they don’t end up in a Bitmex style situation.

The larger problem here for Signal is US legal claims could nuke it off the (very) centralized Apple App Stores and Google Play Store. Then what?

Re: Signal adds a payments feature with a privacy-focused cryptocurrency

#633

Post by codethief »

Ar-Curunir wrote: post #567
codethief wrote: post #173

Earlier quoted context omitted.

I haven't made up my mind regarding the payments feature yet but yeah, what's up with the server code? Why hasn't it been updated in over a year?[0] Also, why do the Signal developers trust SGX so much and have stayed completely silent about SGX vulnerabilities – even when the cryptographers whose quotes they used to put on the signal.org home page[1] are increasingly critical?[2] Finally, why is there no open commun…

the usage of SGX here is to protect against a fairly benign adversary: Signal themselves. The alternative to using SGX in these situations is to hand over the data in the clear to Signal servers.

> a fairly benign adversary

Given the Snowden leaks and everyone's experience with what Facebook etc. do with our data, I wouldn't call that a "benign" adversary at all. Besides, even if Signal itself is benign, someone who manages to hack the Signal infrastructure might not be.

> The alternative to using SGX in these situations is to hand over the data in the clear to Signal servers.

This is not correct. The alternative would be to tell users to choose a passphrase with enough entropy. In that case, SGX wouldn't be necessary. Unfortunately, they didn't do that, so now a lot of users have chosen a short PIN and their data will be compromised should SGX ever fail to live up to its promises. (This is what I meant by "Signal PIN UI fuckup" – the word "PIN" alone suggests choosing a short number over a long passphrase.)

Re: Signal adds a payments feature with a privacy-focused cryptocurrency

#634

Post by glsdfgkjsklfj »

lxgr wrote: post #523
glsdfgkjsklfj wrote: post #344

Earlier quoted context omitted.

> goes against easy to use or just respect reasonable limits? Does it make sense to destroy one feature for the illusion of having both? Elements.io and telegram (to a much lesser extent) are safes. You place something there and it is locked. Signal, whatsapp, et al promise to be safes, but as soon as you place something, a hidden camera scan all the documents and print copies in a hidden printer at your home safe. W…

How is Telegram a ”safe“ but Signal isn‘t? This doesn’t make sense. Telegram stores all history (except secret chats, which are a pain to use) server-side and effectively unencrypted.

i don't use telegram, thanks for correcting me. just move it to the right place on my safe-with-scanners-and-printers-connected-to-the-internet analogy.

But you are missing the point if you thought i was doing a pissing contest against signal/telegram.

My point was that what is considered easy of use based on open messaging apps, cannot even be considered a feature on the secure messaging app space.

Re: Signal adds a payments feature with a privacy-focused cryptocurrency

#635

Post by leppr »

whimsicalism wrote: post #626
leppr wrote: post #625

Earlier quoted context omitted.

Gold or other physical scarce assets come pretty close to allowing you to escape this.

Ah yes, the constant value of gold https://www.macrotrends.net/1333/historical-gold-prices-100-... As I said, there is no escaping market mechanisms, as value is market contextual. Certainly, there are assets with more or less stable value, but that is still due to the whims of what people (ie. the "public") are willing to pay.

Yes, the point here is not about the total valuation of each asset, which affects every holder equally, but about how individuals can influence, or not, the relative distribution of said asset.

If I'm, say, from a persecuted cultural group, I'll want to keep my wealth in an asset that has the same value whether I or someone else own it. Precious metals fit this bill better than both fiat and public-ledger cryptocurrencies.

Re: Signal adds a payments feature with a privacy-focused cryptocurrency

#636

Post by Ar-Curunir »

codethief wrote: post #633
Ar-Curunir wrote: post #567

Earlier quoted context omitted.

the usage of SGX here is to protect against a fairly benign adversary: Signal themselves. The alternative to using SGX in these situations is to hand over the data in the clear to Signal servers.

> a fairly benign adversary Given the Snowden leaks and everyone's experience with what Facebook etc. do with our data, I wouldn't call that a "benign" adversary at all . Besides, even if Signal itself is benign, someone who manages to hack the Signal infrastructure might not be. > The alternative to using SGX in these situations is to hand over the data in the clear to Signal servers. This is not correct. The altern…

Sorry, the use case I had in mind was contact discovery. Existing cryptographic protocols for private contact discovery do not scale to Signal’s numbers.

Re: Signal adds a payments feature with a privacy-focused cryptocurrency

#637

Post by glenneroo »

po wrote: post #547
sammorrowdrums wrote: post #453

Earlier quoted context omitted.

Crypto integration was one of the things that arguably killed Keybase for a lot of users, and damaged trust. Given that trust is the selling point for these type of services, I really hope Signal don't lose it.

Yeah, it was a disaster for Keybase IMO. My messaging tools are already valuable enough to me, the last thing I wanted was a reward on hacking it. When keybase did their Stellar drop, I didn't activate it and it was just a nagging option in the UI forever. I don't like using SMS for 2FA because it encourages people to social engineer the phone company to port the victim's phone numbers. I wouldn't want crypto in my m…

> When keybase did their Stellar drop, I didn't activate it and it was just a nagging option in the UI forever.

Just FYI but those Stellar drops are worth over 500 USD right now.

Re: Signal adds a payments feature with a privacy-focused cryptocurrency

#638

Post by xvector »

MichaelMoser123 wrote: post #524
thiagocsf wrote: post #491

Earlier quoted context omitted.

It was $6 two weeks ago. Still a big jump but hardly “zero”.

my initial thought was: why didn't they choose monero (another coin that is privacy-focused but sort of more established). However monero is already much higher than that mark, in its valuation.

They didn’t choose Monero because it wouldn’t make them filthy rich.

Re: Signal adds a payments feature with a privacy-focused cryptocurrency

#639

Post by climb_stealth »

fsflover wrote: post #565
climb_stealth wrote: post #364

Earlier quoted context omitted.

> I've wasted my influence with my non-technical friends convincing them to adopt Signal, and I don't forsee convincing them to switch yet again to something different. This has bitten me before. Now I'm thinking that every recommendation and suggestion to adopt must come with a "for now this is the best way to do it, but it will probably change again". And somehow try to prepare the non-technical people for that.

> Now I'm thinking that every recommendation and suggestion to adopt must come with a "for now this is the best way to do it, but it will probably change again" Except for Matrix, because it is decentralized.

Hah, this almost feels like a matter of faith. It would be interesting to see though where Matrix would end up if it manages to becomes as popular as Whatsapp or even Signal.

Re: Signal adds a payments feature with a privacy-focused cryptocurrency

#640

Post by [deleted] »

codethief wrote: post #629
cookiengineer wrote: post #550

Earlier quoted context omitted.

> AFAIK the Signal app doesn't connect to the Google servers directly, so even if it exists, the cookie doesn't get transferred anywhere. The Firebase Cloud Messaging library / Google Play Services on your phone do connect to Google but they carry unique identifiers, anyway. It does connect to google's servers for pretty much everything [1] - you can look for these constants in the codebase and you'll find lots of th…

> It does connect to google's servers for pretty much everything [1] Have you actually looked at that code? It's for domain fronting[0], so nothing shady, and it's only used when you're in Egypt, UAE, Oman, Qatar, or Iran. Have a look at https://github.com/signalapp/Signal-Android/blob/d74e9f74103... vs https://github.com/signalapp/Signal-Android/blob/d74e9f74103... and, finally, https://github.com/signalapp/Signal-A…

[deleted]
Post reply on HN