4 ms·

Despite this excellent explanation by wtbob, despite Moxie's blog posting, despite EFF, Snowden, Poitras, Schneider supporting it, I distrust Whispersystems for

Despite this excellent explanation by wtbob, despite Moxie's blog posting, despite EFF, Snowden, Poitras, Schneider supporting it, I distrust Whispersystems for persisting Signal must have access to the addressbook by refusing to work without. I tried it several times during the years, hoping they would have reverted this and allow usage without access to the addressbook. Everytime I deregistered again. Today I will delete Signal from my devices because earlier this month Wire.com included PFS [0] without requiring access to the addressbook. I’ll start using Wire.com despite it not being fully opensource. Until now I was using iMessage and FaceTime Audio as they seem the most secure PFS solutions till date that don’t require the addressbook to be uploaded. For some contacts I have no option but using WhatsApp which is quite a hassle without allowing WhatsApp access to the addressbook. From today I’ll switch to Wire.com as it seems more secure than Apple’s offering as Wire.com allows signature verification. Regretfully Tom’s Hardware [1] doesn’t mention the addressbook in it’s comparison-table neither mentions Apple's offerings. Neither does wikipedia [2] Edit: found a German video-blog [3] that does mention the Address book capabilities of Wire.com [0] http://www.reuters.com/article/us-dataprotection-messaging-wire-idUSKCN0WC2GM http://www.reuters.com/article/us-dataprotection-messaging-w... [1] http://www.tomshardware.com/news/wire-app-complete-end-to-end-encryption,31389.html http://www.tomshardware.com/news/wire-app-complete-end-to-en... [2] https://en.wikipedia.org/wiki/Comparison_of_instant_messaging_clients#Secure_messengers https://en.wikipedia.org/wiki/Comparison_of_instant_messagin... [3] https://www.youtube.com/watch?v=9kCsFjBuH0o&t=74 https://www.youtube.com/watch?v=9kCsFjBuH0o&t=74

wtbob 11y ago
> Despite this excellent explanation by wtbob, despite Moxie's blog posting, despite EFF, Snowden, Poitras, Schneider supporting it, I distrust Whispersystems for persisting Signal must have access to the addressbook by refusing to work without. The mechanism I explained would permit Signal to work without uploading one's address book to the Signal servers. It would, of course, still require access to the address book itself in order to perform contact discovery. I personally don't mind allowing access to the address book itself; what I mind is uploading its contents.
- smartbit 11y ago
  > what I mind is uploading its contents. You're correct that uploading its contents is what it is all about for me. And why doesn't Signal use the new CNContactPickerViewController on iOS? But if I'm not able to verify the code, why does Signal require access? If that is their business model, that is fine for Moxie etal but not for me. @wtbob thanks for the clarification. I wonder what you think of Wire.com?
newman314 11y ago
I would want to find out more info about Wire first. There just does not seem to be a whole lot of information available as well as people (that I would generally trust their opinion on) on the relative security of Wire. BTW, I did notice that Wire added E2E after the fact and not out the box so not clear if there's some tradeoff there. Also, Wire appears to use SRTP instead of ZRTP.
simoncion 11y ago
> ...I distrust Whispersystems for persisting Signal must have access to the addressbook by refusing to work without. Signal works just fine when I tell Cyanogenmod to deny it read and write access to my contacts. I can draft new messages by entering a phone number.

wtbob 11y ago

> Despite this excellent explanation by wtbob, despite Moxie's blog posting, despite EFF, Snowden, Poitras, Schneider supporting it, I distrust Whispersystems for persisting Signal must have access to the addressbook by refusing to work without. The mechanism I explained would permit Signal to work without uploading one's address book to the Signal servers. It would, of course, still require access to the address book itself in order to perform contact discovery. I personally don't mind allowing access to the address book itself; what I mind is uploading its contents.

smartbit 11y ago
> what I mind is uploading its contents. You're correct that uploading its contents is what it is all about for me. And why doesn't Signal use the new CNContactPickerViewController on iOS? But if I'm not able to verify the code, why does Signal require access? If that is their business model, that is fine for Moxie etal but not for me. @wtbob thanks for the clarification. I wonder what you think of Wire.com?

newman314 11y ago

I would want to find out more info about Wire first. There just does not seem to be a whole lot of information available as well as people (that I would generally trust their opinion on) on the relative security of Wire. BTW, I did notice that Wire added E2E after the fact and not out the box so not clear if there's some tradeoff there. Also, Wire appears to use SRTP instead of ZRTP.

simoncion 11y ago

> ...I distrust Whispersystems for persisting Signal must have access to the addressbook by refusing to work without. Signal works just fine when I tell Cyanogenmod to deny it read and write access to my contacts. I can draft new messages by entering a phone number.