Signal 2.0 released with private messaging support • Hacker News Board

Re: Signal 2.0 released with private messaging support

#81

Post by cheald » Mon, Mar 02, 2015, 10:27 PM UTC

jlund wrote: post #59

wyager wrote: post #57

I installed it and texted my friend. It never asked me to verify his pubkey. How does key management work? Is it all done through Whisper Systems' servers? If that's the case, how is this effectively better than iMessage? iMessage is also (nominally) quite secure, except for the fact that you have to trust Apple to verify pubkeys, which makes it quite feasible to MITM if you can subvert Apple via legal or technical m…

Keys are trusted on first use, similar to SSH. The app also provides an interface you can use to verify fingerprints: https://github.com/WhisperSystems/Signal-iOS/wiki/FAQ#can-i-...

The latter part is the critical bit here; by comparing fingerprints out-of-band you can guarantee that your keys haven't been intercepted and replaced during exchange.

Re: Signal 2.0 released with private messaging support

#82

Post by higherpurpose » Mon, Mar 02, 2015, 10:28 PM UTC

TheLoneWolfling wrote: post #33

higherpurpose wrote: post #24

Earlier quoted context omitted.

Is there no option in the store for developers to "sign" the apps in some way and for phones to detect when the app doesn't use the developer's signature? If such a feature doesn't exist in the app stores, it should.

There is no way to do this in a secure manner that doesn't lead to a closed garden, that I know of at least.

And that would be different from the current iOS store, how?

Re: Signal 2.0 released with private messaging support

#83

Post by cheald » Mon, Mar 02, 2015, 10:28 PM UTC

guelo wrote: post #53

mayneack wrote: post #35

Earlier quoted context omitted.

I've been using textsecure for a long time now: so far I haven't had any issues messaging new iOS users including mixed groups. In my experience, there might be some mms edge cases when mixing with other messaging apps, but not too many and bug reports are monitored regularly on github.

I gave up on TextSecure after I irrevocably lost several MMS photos that were sent to me :(

TextSecure lets you save photos out of the conversation and onto (unsecure) external storage.

Re: Signal 2.0 released with private messaging support

#84

Post by mperham » Mon, Mar 02, 2015, 10:29 PM UTC

I installed 2.0 and added the phone number of a friend also using 2.0. I click the + icon and I see my friend's name grayed out so I can't send him a message. What does that mean?

Re: Signal 2.0 released with private messaging support

#85

Post by mekal » Mon, Mar 02, 2015, 10:29 PM UTC

Has anybody with an iphone bothered to check the privacy policy yet? https://whispersystems.org/signal/privacy (404 with a link to Moxie's homepage)

Annnd its fixed the second after I post...dang it. 404's still link you to thoughtcrime.org. Possibly a mistake.

Re: Signal 2.0 released with private messaging support

#86

Post by cheald » Mon, Mar 02, 2015, 10:31 PM UTC

aw3c2 wrote: post #48

13 wrote: post #2

Still asks for a phone number. Useless.

Not useless, but not as great as it could be indeed. I would love to publish my textsecure contact details online but I would never publish my phone number.

Why not use a disposable number, like from Google Voice?

Re: Signal 2.0 released with private messaging support

#87

Post by mullen » Mon, Mar 02, 2015, 10:33 PM UTC

mperham wrote: post #84

I installed 2.0 and added the phone number of a friend also using 2.0. I click the + icon and I see my friend's name grayed out so I can't send him a message. What does that mean?

Has your friend installed the 2.0 client on their iOS device? My wife has not, so her status is also greyed out on my iPhone with 2.0 installed.

Re: Signal 2.0 released with private messaging support

#88

Post by 13 » Mon, Mar 02, 2015, 10:50 PM UTC

cheald wrote: post #86

aw3c2 wrote: post #48

Earlier quoted context omitted.

Not useless, but not as great as it could be indeed. I would love to publish my textsecure contact details online but I would never publish my phone number.

Why not use a disposable number, like from Google Voice?

Google Voice is US only.

Re: Signal 2.0 released with private messaging support

#89

Post by rakoo » Mon, Mar 02, 2015, 10:51 PM UTC

moxie wrote: post #51

jscheel wrote: post #37

What's the difference between this and Telegram? I'm starting to feel a bit overwhelmed with what messaging app I'm supposed to use. Also, why is ios8 required?

I'm a Signal/TextSecure contributor. There's been a lot of controversy over the Telegram encryption protocol, and any cryptographer that looks at it cringes. Beyond doubts with the protocol itself, I think the more important consideration is that most people never use it. Telegram is not encrypted by default. Users have to create a special "secret chat" with contacts that is ephemeral, and some Telegram clients don't…

> I'm a Signal/TextSecure contributor.

That's a bit of an understatement.

Anyway, thank you for your work, and congratulations for the release !

Re: Signal 2.0 released with private messaging support

#90

Post by vitno » Mon, Mar 02, 2015, 10:56 PM UTC

iaskwhy wrote: post #67

Can anyone explain what's the difference between using Signal and using WhatsApp (assuming TextSecure is the default protocol being used - is it?)?

Signal is open-source while WhatsApp is proprietary.

WhatsApp also uses the 2-part ratcheting developed in Aoxotle my understanding is, but they are not mutually compatable on-the-wire transport.