7 ms·

If we were going to rank our priorities, they would be in this order: 1) Make mass surveillance impossible. 2) Stop targeted attacks against crypto nerds. It

by moxie 11y ago

If we were going to rank our priorities, they would be in this order: 1) Make mass surveillance impossible. 2) Stop targeted attacks against crypto nerds. It's not that we don't find #2 laudable, but optimizing for #1 takes precedence when we're making decisions. If you don't want to use your phone number, don't use it. You can register with any GV, Twilio, Voicepulse, or other throwaway VoIP number. If you don't want to run Chrome, use Chromium instead. If you don't want to use Google Play Services, use GcmCore. The world you want this software for is not the world that everyone else lives in. You can certainly make it work in that world with a little effort, but because of how we've prioritized our objectives, that's not the default experience.

fweespeech 11y ago
If someone was able to come up with a native equivalent, would you support that level of access or is that something you'd oppose? It seems to me, at least, it might be possible to do so if the API was consistently exposed and versioned.
darklajid 11y ago
Thank you for your reply. I really appreciate it. As I stated earlier, I feel bad about 'expecting more' here - I certainly see the appeal of a popular ~decent~ option. Without trying to derail this further, let me look at those points: If I use throwaway numbers: What happens if I lose access? Do I _need_ the number for anything in the future (say, device died)? Can someone else mess with me if they get access to this number, if the number gets reassigned? Searching for this kind of information is hard, because 'Signal' isn't exactly a word that search engines understand in context. Chromium and Chrome are the same thing for me: A browser I don't care for and only install on a dev machine for some tests. I wouldn't install either on my personal rig, ignoring the suffixes. And certainly not for an 'app'. It's both 'Not liking Google' and 'No general web browser to run an IM client'. The latter isn't solved by Chromium. As far as I'm aware there are no Google Play Services for FxOS (looking at this Flame right here) and I expect that there's no easy solution for SailfishOS either. I understand that I'm not the target audience. Please believe me when I say that I don't feel that I can (as in, it suits me/feels okay to do so) use Signal right now. I'm writing these messages here not to hit on your work, but to express that there is an audience with other preferences/goals. It's Christmas soon, after all - consider this my public, unrealistic, idealistic wishlist. (Edit: And I apologize that my critical comment ranks rather high right now. I might believe that I'm not completely bonkers and there are other people that feel the same way, but it still sucks to see this kind of feedback on an announcement post)
- moxie 11y ago
  That's a pretty big holiday wishlist. =) This is the world we live in: people do most of their communication on mobile devices running iOS or Android, use Chrome on the desktop, and expect contact discovery to be automatic in their social apps. The browser has won the desktop, iOS and Android have won mobile, and the velocity of the ecosystem is unlikely to make "distributed" communication mechanisms possible for some time. We're trying to make mass surveillance impossible within this world of ours. We want to produce technology that is privacy preserving but feels just like everything else people already use, not somehow convince everyone to fundamentally change their workflow and their expectations. It'd be sweet if we lived in an alternate reality where everyone ran SailfishOS or something (and maybe this year will be the year of Linux on the desktop!), but we can't just pretend that's already the case.
  - darklajid 11y ago
    If we ever meet I'll buy you a beer for the year of the Linux desktop line. But honestly: I understand mobile support for iOS/Android only. I don't understand Chrome as a platform (FF isn't dead. And the biggest reason for that is that I fail to understand why that client needs to be 'web based' and then again not. A web app in a silo) Mobile numbers.. Why? I mean, if 90% of the population WANT mum to see that they use a service and when they're online (or whatever metadata you want to exchange for contacts), just because they happen to know the phone number: Fine. But why isn't it possible to sign up, hit a box that says 'no phone number associated' and .. add contacts manually? I don't want the 99.999% to change, to make it harder for them. I just wish that Christmas brings an option that lets me opt-out of that. Chat contacts don't need my phone number. People that know my phone number are not chat contacts. I'll get back pretending that Linux has won and will try to surf the web in FxOS for 30min just .. to prove you wrong. :)
    - deleted 11y ago
      [deleted]
    - HappyTypist 11y ago
      Perhaps Signal just isn't for you. No one who I've introduced signal to has ever had a problem with it. Now if you add a randomly generated 128 bit account identifier, then people WILL have problems with it. Not with you, but with your mum/grandma. I really think Signal might not be for you. Signal is not about building the most secure or private system, it's about building the first mass-market encrypted that that's Good Enough. Signal is a infinite percent improvement over plaintext/https. It's not supposed to be as good as OTR.
nemoniac 11y ago
What is GcmCore? It doesn't show up on ddg or google.
- r0muald 11y ago
  It's probably this http://o9i.de/2015/10/23/howto-gmscore.html http://o9i.de/2015/10/23/howto-gmscore.html
- maxerickson 11y ago
  It's a typo of GmsCore: https://github.com/microg https://github.com/microg
- _jomo 11y ago
  It's GmsCore, moxie typo'd. However you can also install via F-Droid by adding this repo https://fdroid.eutopia.cz https://fdroid.eutopia.cz Moxie is probably going to hate you for it, but it works very well and doesn't require Google Services or anything else.
  - haffenloher 11y ago
    Using that websocket stuff instead of Play Services or GmsCore will make receiving Signal calls impossible.
  - patcon 11y ago
    > Moxie is probably going to hate you for it Overly dramatic...
Lazare 11y ago
> 1) Make mass surveillance impossible. A worthy goal. But let's be real; to stop mass surveillance by writing a new chat program, you need mass adoption of your new program, and that means you need truly amazing UX. If you write something which is technically perfect and would work if it was widely used, but nobody uses it because Telegram is just a little bit easier to get started with, and has nice cartoon drawings to explain their features (or whatever), then you've completely failed.
- morsch 11y ago
  Signal combines a competent and relatable user experience with a reliable security model. The latter is required to make a few people install it, the former is required to make their acquaintances install it, too.
deleted 11y ago
[deleted]
csandreasen 11y ago
Regarding #2, since it's worded somewhat ambiguously, should we read that as wanting to stop targeted attacks in general (I'm thinking specifically of criminal suspects/etc. when a valid warrant exists) or targeted attacks against specific targets (i.e. people being illegitimately targeted like crypto nerds)? As a follow-up, are there any situations in which you think it would be appropriate to give information or the plaintext content of encrypted messages for a specific user to a law enforcement agency?
peteretep 11y ago
Is there a technical limitation against having two phone numbers? I live between two countries, and have two phone numbers - friends and family in one country have the one, in the other have another. In places like Myanmar, people regularly have several SIMs with several numbers due to poor connectivity.
sukulaku 11y ago
> 1) Make mass surveillance impossible. That's an extremely noble goal, and it seems you've made great progress towards it, but.. Will the US government really just let you do it? Have they not interfered yet? It seems highly unlikely that they wouldn't somehow neutralize the threat your work represents, so I'm just.. cautiously optimistic instead of really excited.
- toyg 11y ago
  > Will the US government really just let you do it? Have they not interfered yet? Of course they did: the recent propaganda wave against "encryption" is all about preventing the next wave of privacy-conscious communication tools, to which Signal belongs. Smart governments don't have to "interfere": they just have to pass laws.
  - sukulaku 11y ago
    Making encryption illegal would certainly count as "interference".
Sir_Substance 11y ago
Could you tell me more about gcm core? I've removed play services from my phone and for the moment accept that this means some apps dont work. I'd love a substitute, but a quick search for 'gcm core' didn't give useful results.
devit 11y ago
Why not both? #1 is essential, but you really need to cater to #2 as well because "crypto nerds" are likely those who will eagerly adopt the software and advertise and praise it to others. Here is a simple non-exhaustive list of changes to better achieve #2: 1. If the phone number starts with +xx where xx is a reserved/invalid country code, the rest is the client's base10 public key. Verification happens by signing a challenge or simply successfully performing a DH handshake instead of by SMS. 2. Provide a "pull" notification socket in the Signal server, use it if GCM is not available 3. Package the mobile-sync Chrome app with node-webkit or simply as a standalone server that auto-opens your browser to localhost:port 4. Use libtextsecure-java to make a simple standalone desktop client that could either have a command line interface or a localhost web interface (please don't use the C library, since C is not suitable for secure software) Obviously these changes could be done by third parties, not necessarily by Open Whisper Systems.
- Natanael_L 11y ago
  #1: Will require really long numbers.
akshatpradhan 11y ago
Moxie, you really think crypto nerds are being attacked? They're not the ones with Keys to the Castle. Sysadmins have the keys! In fact, the NSA has been targeting sysadmins for a while. Sysadmins make great targets. Forget about their inability to implement a real security program, a sysadmin can barely get a security compliance regimen off the ground. Here's an article from Glen Greenwald's TheIntercept that details why Sysadmins are sitting ducks against both the NSA and Nation States: https://theintercept.com/2014/03/20/inside-nsa-secret-efforts-hunt-hack-system-administrators/ https://theintercept.com/2014/03/20/inside-nsa-secret-effort... It's Sysadmins who make for a delicious muskrat lunch, not the crypto nerds.
- throwaway7767 11y ago
  There is a bunch of overlap between those groups (though too many sysadmins indeed don't grasp the threats that face them, or don't take them seriously). I'm saying this as a sysadmin and crypto nerd who really wishes we had a secure messaging system that achieved both of Moxie's stated goals. Unfortunately, I don't want to use it in its current state for largely the same reasons as laid out by 'darklajid. Both goals are important and feed into each other. If we don't have #2, it's easy for NSA and friends to backdoor the software or services for #1, for example like they did with their trusting-trust trojaned XCode. Does anyone really believe these agencies will not react as we deploy "mass-surveillance-proof" software? What will be their next move to collect the data that they want? All of these attacks that people now write off as "crypto-nerd paranoia" will just become the new normal.
comzeradd 11y ago
You can't make mass surveillance impossible if you require a platform that is a mass surveillance nightmare. Also can we please stop calling this a Desktop app? It requires Chrome to run, so it's neither Desktop nor Web app.

by moxie 11y ago

fweespeech 11y ago

If someone was able to come up with a native equivalent, would you support that level of access or is that something you'd oppose? It seems to me, at least, it might be possible to do so if the API was consistently exposed and versioned.

darklajid 11y ago

Thank you for your reply. I really appreciate it. As I stated earlier, I feel bad about 'expecting more' here - I certainly see the appeal of a popular ~decent~ option. Without trying to derail this further, let me look at those points: If I use throwaway numbers: What happens if I lose access? Do I _need_ the number for anything in the future (say, device died)? Can someone else mess with me if they get access to this number, if the number gets reassigned? Searching for this kind of information is hard, because 'Signal' isn't exactly a word that search engines understand in context. Chromium and Chrome are the same thing for me: A browser I don't care for and only install on a dev machine for some tests. I wouldn't install either on my personal rig, ignoring the suffixes. And certainly not for an 'app'. It's both 'Not liking Google' and 'No general web browser to run an IM client'. The latter isn't solved by Chromium. As far as I'm aware there are no Google Play Services for FxOS (looking at this Flame right here) and I expect that there's no easy solution for SailfishOS either. I understand that I'm not the target audience. Please believe me when I say that I don't feel that I can (as in, it suits me/feels okay to do so) use Signal right now. I'm writing these messages here not to hit on your work, but to express that there is an audience with other preferences/goals. It's Christmas soon, after all - consider this my public, unrealistic, idealistic wishlist. (Edit: And I apologize that my critical comment ranks rather high right now. I might believe that I'm not completely bonkers and there are other people that feel the same way, but it still sucks to see this kind of feedback on an announcement post)

moxie 11y ago
That's a pretty big holiday wishlist. =) This is the world we live in: people do most of their communication on mobile devices running iOS or Android, use Chrome on the desktop, and expect contact discovery to be automatic in their social apps. The browser has won the desktop, iOS and Android have won mobile, and the velocity of the ecosystem is unlikely to make "distributed" communication mechanisms possible for some time. We're trying to make mass surveillance impossible within this world of ours. We want to produce technology that is privacy preserving but feels just like everything else people already use, not somehow convince everyone to fundamentally change their workflow and their expectations. It'd be sweet if we lived in an alternate reality where everyone ran SailfishOS or something (and maybe this year will be the year of Linux on the desktop!), but we can't just pretend that's already the case.
- darklajid 11y ago
  If we ever meet I'll buy you a beer for the year of the Linux desktop line. But honestly: I understand mobile support for iOS/Android only. I don't understand Chrome as a platform (FF isn't dead. And the biggest reason for that is that I fail to understand why that client needs to be 'web based' and then again not. A web app in a silo) Mobile numbers.. Why? I mean, if 90% of the population WANT mum to see that they use a service and when they're online (or whatever metadata you want to exchange for contacts), just because they happen to know the phone number: Fine. But why isn't it possible to sign up, hit a box that says 'no phone number associated' and .. add contacts manually? I don't want the 99.999% to change, to make it harder for them. I just wish that Christmas brings an option that lets me opt-out of that. Chat contacts don't need my phone number. People that know my phone number are not chat contacts. I'll get back pretending that Linux has won and will try to surf the web in FxOS for 30min just .. to prove you wrong. :)
  - deleted 11y ago
    [deleted]
  - HappyTypist 11y ago
    Perhaps Signal just isn't for you. No one who I've introduced signal to has ever had a problem with it. Now if you add a randomly generated 128 bit account identifier, then people WILL have problems with it. Not with you, but with your mum/grandma. I really think Signal might not be for you. Signal is not about building the most secure or private system, it's about building the first mass-market encrypted that that's Good Enough. Signal is a infinite percent improvement over plaintext/https. It's not supposed to be as good as OTR.

nemoniac 11y ago

What is GcmCore? It doesn't show up on ddg or google.

r0muald 11y ago
It's probably this http://o9i.de/2015/10/23/howto-gmscore.html http://o9i.de/2015/10/23/howto-gmscore.html
maxerickson 11y ago
It's a typo of GmsCore: https://github.com/microg https://github.com/microg
_jomo 11y ago
It's GmsCore, moxie typo'd. However you can also install via F-Droid by adding this repo https://fdroid.eutopia.cz https://fdroid.eutopia.cz Moxie is probably going to hate you for it, but it works very well and doesn't require Google Services or anything else.
- haffenloher 11y ago
  Using that websocket stuff instead of Play Services or GmsCore will make receiving Signal calls impossible.
- patcon 11y ago
  > Moxie is probably going to hate you for it Overly dramatic...

Lazare 11y ago

> 1) Make mass surveillance impossible. A worthy goal. But let's be real; to stop mass surveillance by writing a new chat program, you need mass adoption of your new program, and that means you need truly amazing UX. If you write something which is technically perfect and would work if it was widely used, but nobody uses it because Telegram is just a little bit easier to get started with, and has nice cartoon drawings to explain their features (or whatever), then you've completely failed.

morsch 11y ago
Signal combines a competent and relatable user experience with a reliable security model. The latter is required to make a few people install it, the former is required to make their acquaintances install it, too.

deleted 11y ago

[deleted]

csandreasen 11y ago

Regarding #2, since it's worded somewhat ambiguously, should we read that as wanting to stop targeted attacks in general (I'm thinking specifically of criminal suspects/etc. when a valid warrant exists) or targeted attacks against specific targets (i.e. people being illegitimately targeted like crypto nerds)? As a follow-up, are there any situations in which you think it would be appropriate to give information or the plaintext content of encrypted messages for a specific user to a law enforcement agency?

peteretep 11y ago

Is there a technical limitation against having two phone numbers? I live between two countries, and have two phone numbers - friends and family in one country have the one, in the other have another. In places like Myanmar, people regularly have several SIMs with several numbers due to poor connectivity.

sukulaku 11y ago

> 1) Make mass surveillance impossible. That's an extremely noble goal, and it seems you've made great progress towards it, but.. Will the US government really just let you do it? Have they not interfered yet? It seems highly unlikely that they wouldn't somehow neutralize the threat your work represents, so I'm just.. cautiously optimistic instead of really excited.

toyg 11y ago
> Will the US government really just let you do it? Have they not interfered yet? Of course they did: the recent propaganda wave against "encryption" is all about preventing the next wave of privacy-conscious communication tools, to which Signal belongs. Smart governments don't have to "interfere": they just have to pass laws.
- sukulaku 11y ago
  Making encryption illegal would certainly count as "interference".

Sir_Substance 11y ago

Could you tell me more about gcm core? I've removed play services from my phone and for the moment accept that this means some apps dont work. I'd love a substitute, but a quick search for 'gcm core' didn't give useful results.

devit 11y ago

Why not both? #1 is essential, but you really need to cater to #2 as well because "crypto nerds" are likely those who will eagerly adopt the software and advertise and praise it to others. Here is a simple non-exhaustive list of changes to better achieve #2: 1. If the phone number starts with +xx where xx is a reserved/invalid country code, the rest is the client's base10 public key. Verification happens by signing a challenge or simply successfully performing a DH handshake instead of by SMS. 2. Provide a "pull" notification socket in the Signal server, use it if GCM is not available 3. Package the mobile-sync Chrome app with node-webkit or simply as a standalone server that auto-opens your browser to localhost:port 4. Use libtextsecure-java to make a simple standalone desktop client that could either have a command line interface or a localhost web interface (please don't use the C library, since C is not suitable for secure software) Obviously these changes could be done by third parties, not necessarily by Open Whisper Systems.

Natanael_L 11y ago
#1: Will require really long numbers.

akshatpradhan 11y ago

Moxie, you really think crypto nerds are being attacked? They're not the ones with Keys to the Castle. Sysadmins have the keys! In fact, the NSA has been targeting sysadmins for a while. Sysadmins make great targets. Forget about their inability to implement a real security program, a sysadmin can barely get a security compliance regimen off the ground. Here's an article from Glen Greenwald's TheIntercept that details why Sysadmins are sitting ducks against both the NSA and Nation States: https://theintercept.com/2014/03/20/inside-nsa-secret-efforts-hunt-hack-system-administrators/ https://theintercept.com/2014/03/20/inside-nsa-secret-effort... It's Sysadmins who make for a delicious muskrat lunch, not the crypto nerds.

throwaway7767 11y ago
There is a bunch of overlap between those groups (though too many sysadmins indeed don't grasp the threats that face them, or don't take them seriously). I'm saying this as a sysadmin and crypto nerd who really wishes we had a secure messaging system that achieved both of Moxie's stated goals. Unfortunately, I don't want to use it in its current state for largely the same reasons as laid out by 'darklajid. Both goals are important and feed into each other. If we don't have #2, it's easy for NSA and friends to backdoor the software or services for #1, for example like they did with their trusting-trust trojaned XCode. Does anyone really believe these agencies will not react as we deploy "mass-surveillance-proof" software? What will be their next move to collect the data that they want? All of these attacks that people now write off as "crypto-nerd paranoia" will just become the new normal.

comzeradd 11y ago

You can't make mass surveillance impossible if you require a platform that is a mass surveillance nightmare. Also can we please stop calling this a Desktop app? It requires Chrome to run, so it's neither Desktop nor Web app.