4 ms·

No, you have factually incorrect information. OWS shut down this fork because it removed Google Cloud Messaging: https://github.com/LibreSignal/LibreSignal ht

No, you have factually incorrect information. OWS shut down this fork because it removed Google Cloud Messaging: https://github.com/LibreSignal/LibreSignal https://github.com/LibreSignal/LibreSignal In what way is it out of bounds to point out deeply suspicious behavior?

tptacek 10y ago
Moxie has explained this over and over again, and comments like this continue to pretend that he hasn't, while re-raising the falsehood that Google sees Signal messages. This is tendentious trolling, not good-faith conversation and debate. Which is why your last comment was flagged off the site.
- fnrjcjdnnsx 10y ago
  You're mischaracterizing my claims. GCM allows Google to extract metadata about who you are messaging and when you are messaging them. They then have the capability to reconstruct your social network graph and select you for further targeting via silent updates if needed.
  - tptacek 10y ago
    No, it does not. GCM is used to wake the app, and for no other purpose. No message metadata is sent over it.
    - gkejxncnd 10y ago
      And why do you suppose that they're unable to record the wake events? They don't need metadata from Signal: they can make their own, which is precisely what I've been trying to say this entire time. That's enough for them to reconstruct your social graph. Signal is seemingly built around providing the image of anonymity and security, but has glaring design flaws which negate these.
      - tptacek 10y ago
        I'm sorry, I seem to have given the impression that I doubt your ability to play six-degrees-of-Google-breaking-Signal. I do not doubt that. You've ably demonstrated your ability.
        gkejxncnd 10y ago
        You're trying to cast a blind eye to Signal leaking metadata. There's no other way to put it: Google is a known NSA collaborator and there is no valid reason to trust them with securing a private messaging app marketed to those seeking anonyminity. Your tone, not mine, is completely inappropriate for HN.
        sctb 10y ago
        Please stop commenting using a collection of throwaway accounts like this (see https://news.ycombinator.com/item?id=12529147 https://news.ycombinator.com/item?id=12529147).
        cndjcncnfj 10y ago
        I've always posted this way and I always will.
  - ekiru 10y ago
    Assuming you are in fact the other newly created account with the random-looking username above, then you explicitly stated that Signal "forces you to send messages over Google servers". This is straightforwardly false: the user does not send anything over Google servers in the course of using Signal. Signal sends an empty push notification over GCM to users who have received a message; while technically true, to, in a discussion of a messaging platform, refer to empty push notifications as sending "messages over Google servers" is prone to misinterpretation as false statements that the "messages" going over Google servers contain any information about the messages being sent over the messaging platform. Additionally, the use of GCM only allows Google to extract metadata about when a user receives messages; GCM messages aren't necessary to notify you when you've sent a message, so I'm not sure how you propose that Google can infer when a user sends a message and who that user is messaging. Could you elaborate on this?
maldeh 10y ago
To say "OWS shut down this fork" is a rather drastic distortion of the truth. The project was simply not entitled to running on OWS servers, or of re-using the Signal trademark, both of which are perfectly understandable. And if you look at the repo that you linked, this is called out right at the top of the README: In the same thread, Marlinspike said that he would be willing to consider "a clean, well written, and well tested" pull request that would add WebSocket support to the Android version of Signal. This would effectively eliminate Signal's dependency on GCM and thus allow the official Signal app to function on custom Android ROMs that do not include Google Play Services. There is now a bounty on making this pull request, and the person/team making the pull request would also receive whatever the BitHub payout would be at the time. ... To be clear, Signal relying on GCM is only an issue for people who use a custom Android ROM without Google Play Services. For the vast majority of people who do have Google Play on their phone, this issue is completely irrelevant. Signal is designed so that GCM is only used for a wakeup event and never sees any of the encrypted Signal messages.

tptacek 10y ago

Moxie has explained this over and over again, and comments like this continue to pretend that he hasn't, while re-raising the falsehood that Google sees Signal messages. This is tendentious trolling, not good-faith conversation and debate. Which is why your last comment was flagged off the site.

fnrjcjdnnsx 10y ago
You're mischaracterizing my claims. GCM allows Google to extract metadata about who you are messaging and when you are messaging them. They then have the capability to reconstruct your social network graph and select you for further targeting via silent updates if needed.
- tptacek 10y ago
  No, it does not. GCM is used to wake the app, and for no other purpose. No message metadata is sent over it.
  - gkejxncnd 10y ago
    And why do you suppose that they're unable to record the wake events? They don't need metadata from Signal: they can make their own, which is precisely what I've been trying to say this entire time. That's enough for them to reconstruct your social graph. Signal is seemingly built around providing the image of anonymity and security, but has glaring design flaws which negate these.
    - tptacek 10y ago
      I'm sorry, I seem to have given the impression that I doubt your ability to play six-degrees-of-Google-breaking-Signal. I do not doubt that. You've ably demonstrated your ability.
      - gkejxncnd 10y ago
        You're trying to cast a blind eye to Signal leaking metadata. There's no other way to put it: Google is a known NSA collaborator and there is no valid reason to trust them with securing a private messaging app marketed to those seeking anonyminity. Your tone, not mine, is completely inappropriate for HN.
        sctb 10y ago
        Please stop commenting using a collection of throwaway accounts like this (see https://news.ycombinator.com/item?id=12529147 https://news.ycombinator.com/item?id=12529147).
        cndjcncnfj 10y ago
        I've always posted this way and I always will.
- ekiru 10y ago
  Assuming you are in fact the other newly created account with the random-looking username above, then you explicitly stated that Signal "forces you to send messages over Google servers". This is straightforwardly false: the user does not send anything over Google servers in the course of using Signal. Signal sends an empty push notification over GCM to users who have received a message; while technically true, to, in a discussion of a messaging platform, refer to empty push notifications as sending "messages over Google servers" is prone to misinterpretation as false statements that the "messages" going over Google servers contain any information about the messages being sent over the messaging platform. Additionally, the use of GCM only allows Google to extract metadata about when a user receives messages; GCM messages aren't necessary to notify you when you've sent a message, so I'm not sure how you propose that Google can infer when a user sends a message and who that user is messaging. Could you elaborate on this?

maldeh 10y ago

To say "OWS shut down this fork" is a rather drastic distortion of the truth. The project was simply not entitled to running on OWS servers, or of re-using the Signal trademark, both of which are perfectly understandable. And if you look at the repo that you linked, this is called out right at the top of the README: In the same thread, Marlinspike said that he would be willing to consider "a clean, well written, and well tested" pull request that would add WebSocket support to the Android version of Signal. This would effectively eliminate Signal's dependency on GCM and thus allow the official Signal app to function on custom Android ROMs that do not include Google Play Services. There is now a bounty on making this pull request, and the person/team making the pull request would also receive whatever the BitHub payout would be at the time. ... To be clear, Signal relying on GCM is only an issue for people who use a custom Android ROM without Google Play Services. For the vast majority of people who do have Google Play on their phone, this issue is completely irrelevant. Signal is designed so that GCM is only used for a wakeup event and never sees any of the encrypted Signal messages.