4 ms·

What's the point of a secure cryptographic protocol if your messaging app a.) Sends back telemetry data b.) Accepts arbitrary software updates without user ap

What's the point of a secure cryptographic protocol if your messaging app a.) Sends back telemetry data b.) Accepts arbitrary software updates without user approval c.) Contains proprietary components with unknown workings and d.) Forces you to send all of your messages over hostile servers?

raverbashing 10y ago
Funny how you created a throwaway account just for trolling
baby 10y ago
I can reply for d): end-to-end encryption.
- adzm 10y ago
  That's pretty much the reply for all of them. Except c) but I thought the protocol itself was open if not the server end.
eps 10y ago
Elaborate on a) ? That's indeed very troubling and completely unacceptable if it's true.
- deleted 10y ago
  [deleted]
- dom0 10y ago
  That piece is called Android, actually.
l2dy 10y ago
That document is placed in the public domain. If you hate Signal that much, write another one yourself.
adilparvez 10y ago
On (a) This https://whispersystems.org/bigbrother/eastern-virginia-grand-jury/ https://whispersystems.org/bigbrother/eastern-virginia-grand..., claims they only store "date and time a user registered with Signal and the last date of a user's connectivity to the Signal service". However I think the parent might be concerned that OWS could be compelled to change their server code to log more meta data, currently we must trust them. For (b) Not sure what could be done about this, maybe an independent service audits each release, subsequent audits would take less time since the diff of the code base would be small. Don't really know, I'd like to know of there are any solutions to this, it seems less like a technical problem than the others though. For (c) Opening up the server code would encourage people to run their own, see See https://whispersystems.org/blog/the-ecosystem-is-moving/ https://whispersystems.org/blog/the-ecosystem-is-moving/ for why moxie doesn't want federation. On (d) Using GCM means Google can get all the meta data too if they want/are compelled to. This is a legitimate concern but OWS is very clear what signal does, they don't claim to tackle e.g. traffic analysis. A world with everyone using end to end encryption would be much closed to the crypto-utopia.

raverbashing 10y ago

Funny how you created a throwaway account just for trolling

baby 10y ago

I can reply for d): end-to-end encryption.

adzm 10y ago
That's pretty much the reply for all of them. Except c) but I thought the protocol itself was open if not the server end.

eps 10y ago

Elaborate on a) ? That's indeed very troubling and completely unacceptable if it's true.

deleted 10y ago
[deleted]
dom0 10y ago
That piece is called Android, actually.

l2dy 10y ago

That document is placed in the public domain. If you hate Signal that much, write another one yourself.

adilparvez 10y ago

On (a) This https://whispersystems.org/bigbrother/eastern-virginia-grand-jury/ https://whispersystems.org/bigbrother/eastern-virginia-grand..., claims they only store "date and time a user registered with Signal and the last date of a user's connectivity to the Signal service". However I think the parent might be concerned that OWS could be compelled to change their server code to log more meta data, currently we must trust them. For (b) Not sure what could be done about this, maybe an independent service audits each release, subsequent audits would take less time since the diff of the code base would be small. Don't really know, I'd like to know of there are any solutions to this, it seems less like a technical problem than the others though. For (c) Opening up the server code would encourage people to run their own, see See https://whispersystems.org/blog/the-ecosystem-is-moving/ https://whispersystems.org/blog/the-ecosystem-is-moving/ for why moxie doesn't want federation. On (d) Using GCM means Google can get all the meta data too if they want/are compelled to. This is a legitimate concern but OWS is very clear what signal does, they don't claim to tackle e.g. traffic analysis. A world with everyone using end to end encryption would be much closed to the crypto-utopia.