68.3% of people in China use third-party keyboards – many of them use Signal • Hacker News Board

Re: 68.3% of people in China use third-party keyboards – many of them use Signal

#71

Post by higerordermap » Sat, Jan 16, 2021, 2:58 PM UTC

xster wrote: post #7

ProAm wrote: post #4

I thought Signal came out with their own keyboard and I was excited.

Even if they did, creating a Chinese IME is a really difficult problem space. Since typing is generally done phonetically in mainland/HK/taiwan and the real words being typed are ideographic, there's a lot of inference to translate in between. Considering how quickly the language moves to keep up with internet culture and new newsworthy names, new parlances, new memes, an IME has to do the equivalent of staying up to…

Serious question and not trolling: Is Chinese/Mandarin very hard to romanize? In India we have indic IMEs but romanization works pretty well and it's rare to see people using Indic IME. Especially far-south languages have fewer consonants and there are very few ambiguities on how to pronounce. Is it not possible for Chinese?

Re: 68.3% of people in China use third-party keyboards – many of them use Signal

#72

Post by TaylorAlexander » Sat, Jan 16, 2021, 7:51 PM UTC

angry_octet wrote: post #66

TaylorAlexander wrote: post #61

Earlier quoted context omitted.

Of course signal is not the only way people get compromised in China but if the claim in TFA that 70% of Chinese users use a third party IME is correct, it seems reasonable that some of them, thinking their chat is secure, would say something that gets them in trouble. Naomi Wu has claimed this has happened and I have no reason to doubt her. Yes OWS is small, but a major security vulnerability for a country with over…

Since MSS are unlikely to tell us their decision making process it is quite opaque. It could have been CCTV, an informant, an unfounded denunciation, something they said on WeChat, one of the main compromised Chinese apps. It really isn't open to her claim this level of confidence. If the keyboard is leaking keystrokes or word searches on a wide basis it would be difficult to hide technically. DFIR techniques for thi…

Where we disagree is that I believe OWS should consider security advisories. This comes up multiple times if you read the whole thread linked in the top of this HN post (TFA). OWS wants to assume that users are normal people without much knowledge of opsec. They want the users to trust the engineers to guide them. Well, if everyone is saying “Signal is end to end encrypted and no one can read your chat” OWS might be able to help a lot of people by clarifying that while messages sent over the wire are encrypted, a compromised phone could still mean compromised conversations. This is painfully obvious to you or I, but regular people I speak to have no idea about things like this. Non technical folks I speak to still don’t understand the most basic opsec.

Re: 68.3% of people in China use third-party keyboards – many of them use Signal

#73

Post by resynth1943 » Sun, Jan 17, 2021, 8:13 PM UTC

yorwba wrote: post #43

resynth1943 wrote: post #18

Earlier quoted context omitted.

I chose to highlight the Chinese aspect, but you're absolutely right: any keyboard with personalisation puts Signal users at risk.

The guidelines exhort us to: > ... please use the original title, unless it is misleading or linkbait; don't editorialize. https://news.ycombinator.com/newsguidelines.html If you can still edit the title, you should change it to the original "Signal should warn users who are likely using insecure IME apps"

I'll bear it in mind in future. Thanks.

Re: 68.3% of people in China use third-party keyboards – many of them use Signal

#74

Post by angry_octet » Mon, Jan 18, 2021, 3:14 AM UTC

TaylorAlexander wrote: post #72

angry_octet wrote: post #66

Earlier quoted context omitted.

Since MSS are unlikely to tell us their decision making process it is quite opaque. It could have been CCTV, an informant, an unfounded denunciation, something they said on WeChat, one of the main compromised Chinese apps. It really isn't open to her claim this level of confidence. If the keyboard is leaking keystrokes or word searches on a wide basis it would be difficult to hide technically. DFIR techniques for thi…

Where we disagree is that I believe OWS should consider security advisories. This comes up multiple times if you read the whole thread linked in the top of this HN post (TFA). OWS wants to assume that users are normal people without much knowledge of opsec. They want the users to trust the engineers to guide them. Well, if everyone is saying “Signal is end to end encrypted and no one can read your chat” OWS might be…

Telegram/WhatsApp/iMessage/FB Messenger all go pretty far down the 'this is secure messaging' path, with far less justification. (And for a Chinese iPhone iMessage is completely broken.) Far more people use the big platforms. Getting a significant user base for Signal is a big comparative win, even if the handset security it weak.

Should they be less minimalistic on their website? Probably yes. Would anyone read it? Geeks, yes. Maybe people who are worried. But I think it is a small win at a high cost.

Maybe it's possible to write a basic phone opsec guide and just stick it on medium or something. Rely on the magic of Google to help people find it. (Would Baidu index it? I wonder.)

Re: 68.3% of people in China use third-party keyboards – many of them use Signal

#75

Post by nucleardog » Tue, Jan 19, 2021, 9:09 AM UTC

higerordermap wrote: post #71

xster wrote: post #7

Earlier quoted context omitted.

Even if they did, creating a Chinese IME is a really difficult problem space. Since typing is generally done phonetically in mainland/HK/taiwan and the real words being typed are ideographic, there's a lot of inference to translate in between. Considering how quickly the language moves to keep up with internet culture and new newsworthy names, new parlances, new memes, an IME has to do the equivalent of staying up to…

Serious question and not trolling: Is Chinese/Mandarin very hard to romanize? In India we have indic IMEs but romanization works pretty well and it's rare to see people using Indic IME. Especially far-south languages have fewer consonants and there are very few ambiguities on how to pronounce. Is it not possible for Chinese?

Not a Chinese speaker, but I know like 10 words.

They already have some romanizations like Pinyin that are largely phonetic.

But take something like "mao". Without any accents to indicate the tone, that could be:

  * 毛 - like a dozen distinct meanings
  * 猫 - a few meanings, but mostly "cat"
  * 冒 - half a dozen meanings
  * 昴 - one meaning
  * 懋 - a few meanings
  * 帽 - a few meanings
  * 貌 - a few meanings
  * 牦 - one meaning
  * 矛 - one meaning
  * 铆 - a couple meanings
  * 锚 - one meaning
  * 贸 - one meaning
  * 茂 - two meanings

To be honest, I got tired of compiling the list at this point. There's lots more.

When someone uses a romanized keyboard to type "m", "a", "o" you've got like two dozen possible characters that becomes. If you're trying to figure out from context which one the person might be intending, you need to look at like 60 different possible meanings in context and figure out which characters are most appropriate. And that's given the previous several things they've entered have been narrowed down to one character, but likely still have several meanings.

A lot of (I'd dare say most?) Chinese people do use romanized input (the alternative I've seen is very slowly drawing out each individual character on the screen), but whether the keyboard sees you type "I have a cute... mao" and decides you want 'anchor' or 'cat' has a huge impact on day-to-day usability for people actually using it.

The written language is vastly more complicated than the spoken one as far as I can tell. A syllable that can have 60 meanings is relatively easy to figure out in context, but when written the meaning has to be made explicit. As a really basic example, "ta" is both he and she. So they just don't have masculine and feminine pronouns, right? Wrong. 他 is he, 她 is she. These are said exactly the same so even given accents to indicate tone they're romanized identically. But when written, the distinction is made.

And if you make a mistake somewhere in all of this?

Well, baba (爸爸) is dad. baba is also poop (㞎㞎).

Wo ai ni, baba. I love you, poop.

Re: 68.3% of people in China use third-party keyboards – many of them use Signal

#76

Post by cutitout » Tue, Jan 19, 2021, 4:06 PM UTC

matsemann wrote: post #33

cutitout wrote: post #27

Earlier quoted context omitted.

> But if a person has something important to say, calling people that don't know about the issue assholes is not a great way to go about it. I don't mind it at all. If someone uses "being called asshole" as a reason to not even inform anyone, they would have found another excuse. Some people simply register it as strong language and otherwise focus on the content. At any rate, it's very easy to judge what someone say…

> That's what we're focusing on? That's my point. By presenting the issue the way she did, people moved the conversation away from the issue and instead ended up in a meta-discussion about the discourse. If her points were laid out in a nicer manner, she would be closer to actually achieving her goal.

> By presenting the issue the way she did, people moved the conversation away from the issue

By HER doing A, OTHERS did B? That doesn't even parse as English, and betrays doublethink.

Re: 68.3% of people in China use third-party keyboards – many of them use Signal

#77

Post by cutitout » Tue, Jan 19, 2021, 4:11 PM UTC

chickenpotpie wrote: post #37

cutitout wrote: post #27

Earlier quoted context omitted.

> But if a person has something important to say, calling people that don't know about the issue assholes is not a great way to go about it. I don't mind it at all. If someone uses "being called asshole" as a reason to not even inform anyone, they would have found another excuse. Some people simply register it as strong language and otherwise focus on the content. At any rate, it's very easy to judge what someone say…

Open source devs are horribly mistreated for a service they provide for free/very low income. I will gladly focus the conversation on someone being rude to someone that has dedicated their life to making the world a better place. Signal is a nonprofit organization dedicated to the betterment of mankind. They want to a good job and they’re not assholes.

"Making the world a better place" is terribly generic, and not impressive in context of stubbornly refusing to even acknowledge, much less warn users about, an issue that puts actual lives in danger. If they ignored her for so long, what was the excuse before she dared to say "asshole" to adults who dabble with something as serious as this?