6 ms·

FYI, Signal has access to all metadata about messages and calls (but not the content of course). They claim not to store it and I believe them for now but someo

by woah 10y ago

FYI, Signal has access to all metadata about messages and calls (but not the content of course). They claim not to store it and I believe them for now but someone else could be storing it. They don't have access to group message membership directly. A group appears as a bunch of one to one messages between the participants, so they might still be able to infer it.

yincrash 10y ago
If they were storing that metadata, they would be lying in the response to their subpoena.
- CaptSpify 10y ago
  That doesn't prove they don't have it though. I'm skeptical of the suggestion as well, but people can lie.
  - 5ersi 10y ago
    Since their client apps are OSS you can check yourself: https://github.com/WhisperSystems/Signal-Android https://github.com/WhisperSystems/Signal-Android
    - CaptSpify 10y ago
      But isn't this server-side meta-data, not client-side meta-data? The service still routes through their system.
    - mi100hael 10y ago
      Notably, the source for the voice call server is not available as far as I know, and there's no guarantee that the text messaging server is running in an unaltered state on their production servers.
  - verandaguy 10y ago
    Lying in response to a subpoena would be an EXTREMELY unwise move by OWS, or most other bodies in this position.
    - CaptSpify 10y ago
      I don't disagree. But it still doesn't prove that they don't have the data. You can't prove a negative like that.
      - caf 10y ago
        OK, it doesn't prove they don't have the data. It's strong circumstantial evidence that they don't have the data.
- guelo 10y ago
  I think you misread woah's comment. Signal has access to the metadata but chooses not to store it in order to be able to remain unresponsive to queries like this.
  - rurban 10y ago
    So the real threat here is that the FBI wants to come in with a search warrant, install one of their famous splitters (a Windows machine btw) and routes all metadata traffic to the NSA. To legally get contact data in real-time for one criminal under investigation. Essentially the Lavabit case. Or is that what they called PRISM? Legal route splitting at the endpoint, i.e. legally declared as such by the secret FISA court, because there's oversight...
- erichocean 10y ago
  > they would be lying in the response to their subpoena The court can compel a business (or individual) to lie about that sort of thing.
CaptSpify 10y ago
> FYI, Signal has access to all metadata about messages and calls source for this?
- glibgil 10y ago
  It's the way the protocol works and its centralized infrastructure. They for sure have access
- lorenzhs 10y ago
  The messages and calls are routed through their servers, so they could (but do not) store whatever metadata is required to route messages and calls. This would at least be the recipient's account and IP address, the sender's IP address (but not necessarily their account), and the current time. I believe the GP is echoing zeverb's sentiment, that it would be preferable if OWS (Signal) could not even be ordered to collect such data. The thing I don't understand about the GP's post is "but someone else could be storing it". I would expect the entire message (including headers / metadata) to be encrypted in transit, with a pinned key, so that only OWS has access to the routing metadata. Please correct me if I'm wrong.
  - woah 10y ago
    Someone exploiting a security vulnerability in Signal's servers could be storing the metadata.
- faktorialas 10y ago
  https://en.wikipedia.org/wiki/Signal_(software) https://en.wikipedia.org/wiki/Signal_(software) Check the metadata portion. One thing to note, this isn't surprising at all. All of the centralized IM servers can do this and, usually more. The alternatives that try to minimize or obfuscate metadata are far from market-ready.
Aissen 10y ago
Yes, some mitm entity between OWS and the internet would be able to deduce who is speaking with whom once a big enough number of messages have been sent. In fact, any big ISP could do that for parties communicating from inside its network.
falcolas 10y ago
Even if they don't store it now, they could be forced by court-order to start storing it, even if for a limited number of endpoints. Remember LavaMail? This is pretty much what happened to them.
Paul-ish 10y ago
Could they be ordered to store metadata, with a gag order not allowing them to say they are doing so?

by woah 10y ago

yincrash 10y ago

If they were storing that metadata, they would be lying in the response to their subpoena.

CaptSpify 10y ago
That doesn't prove they don't have it though. I'm skeptical of the suggestion as well, but people can lie.
- 5ersi 10y ago
  Since their client apps are OSS you can check yourself: https://github.com/WhisperSystems/Signal-Android https://github.com/WhisperSystems/Signal-Android
  - CaptSpify 10y ago
    But isn't this server-side meta-data, not client-side meta-data? The service still routes through their system.
  - mi100hael 10y ago
    Notably, the source for the voice call server is not available as far as I know, and there's no guarantee that the text messaging server is running in an unaltered state on their production servers.
- verandaguy 10y ago
  Lying in response to a subpoena would be an EXTREMELY unwise move by OWS, or most other bodies in this position.
  - CaptSpify 10y ago
    I don't disagree. But it still doesn't prove that they don't have the data. You can't prove a negative like that.
    - caf 10y ago
      OK, it doesn't prove they don't have the data. It's strong circumstantial evidence that they don't have the data.
guelo 10y ago
I think you misread woah's comment. Signal has access to the metadata but chooses not to store it in order to be able to remain unresponsive to queries like this.
- rurban 10y ago
  So the real threat here is that the FBI wants to come in with a search warrant, install one of their famous splitters (a Windows machine btw) and routes all metadata traffic to the NSA. To legally get contact data in real-time for one criminal under investigation. Essentially the Lavabit case. Or is that what they called PRISM? Legal route splitting at the endpoint, i.e. legally declared as such by the secret FISA court, because there's oversight...
erichocean 10y ago
> they would be lying in the response to their subpoena The court can compel a business (or individual) to lie about that sort of thing.

CaptSpify 10y ago

> FYI, Signal has access to all metadata about messages and calls source for this?

glibgil 10y ago
It's the way the protocol works and its centralized infrastructure. They for sure have access
lorenzhs 10y ago
The messages and calls are routed through their servers, so they could (but do not) store whatever metadata is required to route messages and calls. This would at least be the recipient's account and IP address, the sender's IP address (but not necessarily their account), and the current time. I believe the GP is echoing zeverb's sentiment, that it would be preferable if OWS (Signal) could not even be ordered to collect such data. The thing I don't understand about the GP's post is "but someone else could be storing it". I would expect the entire message (including headers / metadata) to be encrypted in transit, with a pinned key, so that only OWS has access to the routing metadata. Please correct me if I'm wrong.
- woah 10y ago
  Someone exploiting a security vulnerability in Signal's servers could be storing the metadata.
faktorialas 10y ago
https://en.wikipedia.org/wiki/Signal_(software) https://en.wikipedia.org/wiki/Signal_(software) Check the metadata portion. One thing to note, this isn't surprising at all. All of the centralized IM servers can do this and, usually more. The alternatives that try to minimize or obfuscate metadata are far from market-ready.

Aissen 10y ago

Yes, some mitm entity between OWS and the internet would be able to deduce who is speaking with whom once a big enough number of messages have been sent. In fact, any big ISP could do that for parties communicating from inside its network.

falcolas 10y ago

Even if they don't store it now, they could be forced by court-order to start storing it, even if for a limited number of endpoints. Remember LavaMail? This is pretty much what happened to them.

Paul-ish 10y ago

Could they be ordered to store metadata, with a gag order not allowing them to say they are doing so?