8 ms·

Here is moxie's reply in that matter https://news.ycombinator.com/item?id=10665520 https://news.ycombinator.com/item?id=10665520

by dbalan 10y ago

uola 10y ago
I don't buy his arguments. It's one thing to say we have to be on Google Play Store or we have to use phone numbers despite the privacy implications because that is what people use. But ignoring much of the developing countries (see whatsapp), China or the people who are your strongest user base by saying "you can just" isn't pragmatic at all. Nor is it actually reasonable that we should expect to or rely on a few people to secure something that should be a fundamental and a fundamental right of communication. Not to rant to much, but it feels like going to parties (conferences) and talking about how much good you do and then being dismissive in the real world is how much of the security industry operates and that Signal has just become the latest excuse to why nothing has to be fixed. I'll give him credit for the whatsapp integration though. More people in the field should consider working with companies where they can have a lot of impact.
- neerdowell 10y ago
  > But ignoring much of the developing countries (see whatsapp), China Moxie says Signal works fine in China: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217673506 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
  - uola 10y ago
    Signal itself works, but since Google is blocked no phones are sold with Google Play Store and even if you hack it onto your phone (which will break when it wants to update play services) it will drain your battery trying to connect to blocked services. Unless you use vpn (which will drain battery by itself and also eventually be blocked), but notifications probably still won't work because of the phones original firmware. So yes it works if you hack it onto your phone and then remove play services and checks the application manually. Until it wants to update the app that is, which is often. Point. It doesn't really work because it only supports the Google Play Store, even as most Chinese phones can load apps directly (because of the fragmented ecosystem). So at least it doesn't work in the "prevent mass surveillance" way. I guess maybe it works from the Apple App Store? (which isn't blocked)
  - acqq 10y ago
    I reproduce here the dead message from "uola" I think the message deserves a proper response and not to be flagged. "Signal itself works, but since Google is blocked no phones are sold with Google Play Store and even if you hack it onto your phone (which will break when it wants to update play services) it will drain your battery trying to connect to blocked services. Unless you use vpn (which will drain battery by itself and also eventually be blocked), but notifications probably still won't work because of the phones original firmware. So yes it works if you hack it onto your phone and then remove play services and checks the application manually. Until it wants to update the app that is, which is often. Point. It doesn't really work because it only supports the Google Play Store, even as most Chinese phones can load apps directly (because of the fragmented ecosystem). So at least it doesn't work in the "prevent mass surveillance" way. I guess maybe it works from the Apple App Store? (which isn't blocked)"
blablablaat 10y ago
I can understand that he sets his own priorities. But in this case someone else took the sourcecode, built the app and published it to F-Droid. The only thing Moxie had to do was not threaten them with legal action.
- oh_sigh 10y ago
  The problem is that, at that point, Moxie couldn't confirm that the uploaded binary was the same one as packaged by their official release. Secure communication protocols are irrelevant if the client which you are communicating on is compromised.
  - AstralStorm 10y ago
    So actually, the only thing he could do is to publish a validated binary into F-droid.
  - aexaey 10y ago
    What you have described is pretty much an opposite of how F-droid works. One can't just take binary (whether official or compromised) and upload it there. [1] Instead, to publish an app there, you need to provide source code repository [2], and their build farm would build it, sort-of [3] providing guarantee that source code you can inspect is the same one you got running on your phone. [1] There are exceptions, i.e. apps uploaded as binary-only (for example Firefox), but those come with big red warning that user sees before installing them. [2] https://f-droid.org/wiki/page/FAQ_-_App_Developers#Will_my_app_be_built_from_source.3F https://f-droid.org/wiki/page/FAQ_-_App_Developers#Will_my_a... [3] Sort-of because reproducible builds for Android not here yet, so you can't just rebuilt it yourself and compare sha256, unfortunately.
    - lorenzhs 10y ago
      Signal has reproducible builds for Android: https://whispersystems.org/blog/reproducible-android/ https://whispersystems.org/blog/reproducible-android/ ...that just doesn't work with F-Droid. And building on their farm means that you have to trust them, and their build farm becomes a prime target if you want to infect lots of apps at once. In the play store, you sign your build, and Android will only let you install builds signed with that same key as updates. By moving the signing to F-Droid, you have to completely trust them.
akerro 10y ago
>1) Make mass surveillance impossible. By giving NSA the only thing what they want: metadata from Google >2) Stop targeted attacks against crypto nerds. Who don't have google services on their devices and don't use google chrome... yeah. Thanks for helping me so much. The Senate is considering reauthorizing the law the NSA says authorizes it to collect hundreds of millions of online communications from providers like Facebook and Google as well as straight off the internet’s backbone:https://theintercept.com/2016/05/10/senate-kicks-off-debate-over-reauthorizing-controversial-nsa-programs/ https://theintercept.com/2016/05/10/senate-kicks-off-debate-...
- neerdowell 10y ago
  > By giving NSA the only thing what they want: metadata from Google What metadata does Google get from Signal messages? The time/date you received a message, the size of the message... Is there anything else?
  - jjnoakes 10y ago
    The person you are communicating with.
    - haffenloher 10y ago
      No, that's not how it works. The GCM message is empty, it just wakes up your device which then fetches the actual message from the Signal servers.
      - acqq 10y ago
        But the "observer" can still know which mobile phone is yours and who communicates with whom? Especially if the "observer" has the info from the Signal servers. Edit (as i can't post you reply to your answer): And based on the NSA principle of the "thee levels of distance" everybody is reachable as long as some common numbers are in our contact lists which we happily upload.
superkuh 10y ago
He's doing great and useful work, there's no doubt. But requiring a phone number for an internet instant messenger is still a deal breaker even with Chromium as an alternative.
- Freak_NL 10y ago
  The most useful piece of metadata available to anyone harvesting user profiles for surveillance or profit. Governments must love phone numbers. Getting an anonymous phone number for each separate service you register with is practically infeasible. I worry about how influential people like Moxie Marlinspike are seemingly turning the modern 'mobile-first' development paradigm into a 'mobile-only' mindset. I don't believe in secure and private computing when you are making it very hard for people to use your tools on (or via) anything but the two dominant mobile operating systems.
  - uola 10y ago
    Yes, phone numbers are public enough that they are shared everywhere, but unique enough to lead to a single person not to speak of that persons movements. And "just use twilio" isn't a motivation for using phone numbers in the first place. If he had said "the benefits of finding friends are greater than the privacy implications" or something like that there would at least been a case for a discussion, but now he's seemingly saying "oh, if you really care about privacy you could/should use a fake phone number".
  - acqq 10y ago
    Here I copy the "dead" message from "uola": "Yes, phone numbers are public enough that they are shared everywhere, but unique enough to lead to a single person not to speak of that persons movements. And "just use twilio" isn't a motivation for using phone numbers in the first place. If he had said "the benefits of finding friends are greater than the privacy implications" or something like that there would at least been a case for a discussion, but now he's seemingly saying "oh, if you really care about privacy you could/should use a fake phone number"." --- Personally, I don't know how "a fake phone number" setup can be implemented, especially in the countries where each phone number is assigned to one ID at the time of purchase, so to me "use a fake phone number" sounds like "let them eat cake."

Here is moxie's reply in that matter https://news.ycombinator.com/item?id=10665520 https://news.ycombinator.com/item?id=10665520

by dbalan 10y ago

Here is moxie's reply in that matter https://news.ycombinator.com/item?id=10665520 https://news.ycombinator.com/item?id=10665520

uola 10y ago

I don't buy his arguments. It's one thing to say we have to be on Google Play Store or we have to use phone numbers despite the privacy implications because that is what people use. But ignoring much of the developing countries (see whatsapp), China or the people who are your strongest user base by saying "you can just" isn't pragmatic at all. Nor is it actually reasonable that we should expect to or rely on a few people to secure something that should be a fundamental and a fundamental right of communication. Not to rant to much, but it feels like going to parties (conferences) and talking about how much good you do and then being dismissive in the real world is how much of the security industry operates and that Signal has just become the latest excuse to why nothing has to be fixed. I'll give him credit for the whatsapp integration though. More people in the field should consider working with companies where they can have a lot of impact.

neerdowell 10y ago
> But ignoring much of the developing countries (see whatsapp), China Moxie says Signal works fine in China: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217673506 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
- uola 10y ago
  Signal itself works, but since Google is blocked no phones are sold with Google Play Store and even if you hack it onto your phone (which will break when it wants to update play services) it will drain your battery trying to connect to blocked services. Unless you use vpn (which will drain battery by itself and also eventually be blocked), but notifications probably still won't work because of the phones original firmware. So yes it works if you hack it onto your phone and then remove play services and checks the application manually. Until it wants to update the app that is, which is often. Point. It doesn't really work because it only supports the Google Play Store, even as most Chinese phones can load apps directly (because of the fragmented ecosystem). So at least it doesn't work in the "prevent mass surveillance" way. I guess maybe it works from the Apple App Store? (which isn't blocked)
- acqq 10y ago
  I reproduce here the dead message from "uola" I think the message deserves a proper response and not to be flagged. "Signal itself works, but since Google is blocked no phones are sold with Google Play Store and even if you hack it onto your phone (which will break when it wants to update play services) it will drain your battery trying to connect to blocked services. Unless you use vpn (which will drain battery by itself and also eventually be blocked), but notifications probably still won't work because of the phones original firmware. So yes it works if you hack it onto your phone and then remove play services and checks the application manually. Until it wants to update the app that is, which is often. Point. It doesn't really work because it only supports the Google Play Store, even as most Chinese phones can load apps directly (because of the fragmented ecosystem). So at least it doesn't work in the "prevent mass surveillance" way. I guess maybe it works from the Apple App Store? (which isn't blocked)"

blablablaat 10y ago

I can understand that he sets his own priorities. But in this case someone else took the sourcecode, built the app and published it to F-Droid. The only thing Moxie had to do was not threaten them with legal action.

oh_sigh 10y ago
The problem is that, at that point, Moxie couldn't confirm that the uploaded binary was the same one as packaged by their official release. Secure communication protocols are irrelevant if the client which you are communicating on is compromised.
- AstralStorm 10y ago
  So actually, the only thing he could do is to publish a validated binary into F-droid.
- aexaey 10y ago
  What you have described is pretty much an opposite of how F-droid works. One can't just take binary (whether official or compromised) and upload it there. [1] Instead, to publish an app there, you need to provide source code repository [2], and their build farm would build it, sort-of [3] providing guarantee that source code you can inspect is the same one you got running on your phone. [1] There are exceptions, i.e. apps uploaded as binary-only (for example Firefox), but those come with big red warning that user sees before installing them. [2] https://f-droid.org/wiki/page/FAQ_-_App_Developers#Will_my_app_be_built_from_source.3F https://f-droid.org/wiki/page/FAQ_-_App_Developers#Will_my_a... [3] Sort-of because reproducible builds for Android not here yet, so you can't just rebuilt it yourself and compare sha256, unfortunately.
  - lorenzhs 10y ago
    Signal has reproducible builds for Android: https://whispersystems.org/blog/reproducible-android/ https://whispersystems.org/blog/reproducible-android/ ...that just doesn't work with F-Droid. And building on their farm means that you have to trust them, and their build farm becomes a prime target if you want to infect lots of apps at once. In the play store, you sign your build, and Android will only let you install builds signed with that same key as updates. By moving the signing to F-Droid, you have to completely trust them.

akerro 10y ago

>1) Make mass surveillance impossible. By giving NSA the only thing what they want: metadata from Google >2) Stop targeted attacks against crypto nerds. Who don't have google services on their devices and don't use google chrome... yeah. Thanks for helping me so much. The Senate is considering reauthorizing the law the NSA says authorizes it to collect hundreds of millions of online communications from providers like Facebook and Google as well as straight off the internet’s backbone:https://theintercept.com/2016/05/10/senate-kicks-off-debate-over-reauthorizing-controversial-nsa-programs/ https://theintercept.com/2016/05/10/senate-kicks-off-debate-...

neerdowell 10y ago
> By giving NSA the only thing what they want: metadata from Google What metadata does Google get from Signal messages? The time/date you received a message, the size of the message... Is there anything else?
- jjnoakes 10y ago
  The person you are communicating with.
  - haffenloher 10y ago
    No, that's not how it works. The GCM message is empty, it just wakes up your device which then fetches the actual message from the Signal servers.
    - acqq 10y ago
      But the "observer" can still know which mobile phone is yours and who communicates with whom? Especially if the "observer" has the info from the Signal servers. Edit (as i can't post you reply to your answer): And based on the NSA principle of the "thee levels of distance" everybody is reachable as long as some common numbers are in our contact lists which we happily upload.

superkuh 10y ago

He's doing great and useful work, there's no doubt. But requiring a phone number for an internet instant messenger is still a deal breaker even with Chromium as an alternative.

Freak_NL 10y ago
The most useful piece of metadata available to anyone harvesting user profiles for surveillance or profit. Governments must love phone numbers. Getting an anonymous phone number for each separate service you register with is practically infeasible. I worry about how influential people like Moxie Marlinspike are seemingly turning the modern 'mobile-first' development paradigm into a 'mobile-only' mindset. I don't believe in secure and private computing when you are making it very hard for people to use your tools on (or via) anything but the two dominant mobile operating systems.
- uola 10y ago
  Yes, phone numbers are public enough that they are shared everywhere, but unique enough to lead to a single person not to speak of that persons movements. And "just use twilio" isn't a motivation for using phone numbers in the first place. If he had said "the benefits of finding friends are greater than the privacy implications" or something like that there would at least been a case for a discussion, but now he's seemingly saying "oh, if you really care about privacy you could/should use a fake phone number".
- acqq 10y ago
  Here I copy the "dead" message from "uola": "Yes, phone numbers are public enough that they are shared everywhere, but unique enough to lead to a single person not to speak of that persons movements. And "just use twilio" isn't a motivation for using phone numbers in the first place. If he had said "the benefits of finding friends are greater than the privacy implications" or something like that there would at least been a case for a discussion, but now he's seemingly saying "oh, if you really care about privacy you could/should use a fake phone number"." --- Personally, I don't know how "a fake phone number" setup can be implemented, especially in the countries where each phone number is assigned to one ID at the time of purchase, so to me "use a fake phone number" sounds like "let them eat cake."