4 ms·

You're mischaracterizing my claims. GCM allows Google to extract metadata about who you are messaging and when you are messaging them. They then have the capa

You're mischaracterizing my claims. GCM allows Google to extract metadata about who you are messaging and when you are messaging them. They then have the capability to reconstruct your social network graph and select you for further targeting via silent updates if needed.

tptacek 10y ago
No, it does not. GCM is used to wake the app, and for no other purpose. No message metadata is sent over it.
- gkejxncnd 10y ago
  And why do you suppose that they're unable to record the wake events? They don't need metadata from Signal: they can make their own, which is precisely what I've been trying to say this entire time. That's enough for them to reconstruct your social graph. Signal is seemingly built around providing the image of anonymity and security, but has glaring design flaws which negate these.
  - tptacek 10y ago
    I'm sorry, I seem to have given the impression that I doubt your ability to play six-degrees-of-Google-breaking-Signal. I do not doubt that. You've ably demonstrated your ability.
    - gkejxncnd 10y ago
      You're trying to cast a blind eye to Signal leaking metadata. There's no other way to put it: Google is a known NSA collaborator and there is no valid reason to trust them with securing a private messaging app marketed to those seeking anonyminity. Your tone, not mine, is completely inappropriate for HN.
      - sctb 10y ago
        Please stop commenting using a collection of throwaway accounts like this (see https://news.ycombinator.com/item?id=12529147 https://news.ycombinator.com/item?id=12529147).
        cndjcncnfj 10y ago
        I've always posted this way and I always will.
ekiru 10y ago
Assuming you are in fact the other newly created account with the random-looking username above, then you explicitly stated that Signal "forces you to send messages over Google servers". This is straightforwardly false: the user does not send anything over Google servers in the course of using Signal. Signal sends an empty push notification over GCM to users who have received a message; while technically true, to, in a discussion of a messaging platform, refer to empty push notifications as sending "messages over Google servers" is prone to misinterpretation as false statements that the "messages" going over Google servers contain any information about the messages being sent over the messaging platform. Additionally, the use of GCM only allows Google to extract metadata about when a user receives messages; GCM messages aren't necessary to notify you when you've sent a message, so I'm not sure how you propose that Google can infer when a user sends a message and who that user is messaging. Could you elaborate on this?

tptacek 10y ago

No, it does not. GCM is used to wake the app, and for no other purpose. No message metadata is sent over it.

gkejxncnd 10y ago
And why do you suppose that they're unable to record the wake events? They don't need metadata from Signal: they can make their own, which is precisely what I've been trying to say this entire time. That's enough for them to reconstruct your social graph. Signal is seemingly built around providing the image of anonymity and security, but has glaring design flaws which negate these.
- tptacek 10y ago
  I'm sorry, I seem to have given the impression that I doubt your ability to play six-degrees-of-Google-breaking-Signal. I do not doubt that. You've ably demonstrated your ability.
  - gkejxncnd 10y ago
    You're trying to cast a blind eye to Signal leaking metadata. There's no other way to put it: Google is a known NSA collaborator and there is no valid reason to trust them with securing a private messaging app marketed to those seeking anonyminity. Your tone, not mine, is completely inappropriate for HN.
    - sctb 10y ago
      Please stop commenting using a collection of throwaway accounts like this (see https://news.ycombinator.com/item?id=12529147 https://news.ycombinator.com/item?id=12529147).
      - cndjcncnfj 10y ago
        I've always posted this way and I always will.

ekiru 10y ago

Assuming you are in fact the other newly created account with the random-looking username above, then you explicitly stated that Signal "forces you to send messages over Google servers". This is straightforwardly false: the user does not send anything over Google servers in the course of using Signal. Signal sends an empty push notification over GCM to users who have received a message; while technically true, to, in a discussion of a messaging platform, refer to empty push notifications as sending "messages over Google servers" is prone to misinterpretation as false statements that the "messages" going over Google servers contain any information about the messages being sent over the messaging platform. Additionally, the use of GCM only allows Google to extract metadata about when a user receives messages; GCM messages aren't necessary to notify you when you've sent a message, so I'm not sure how you propose that Google can infer when a user sends a message and who that user is messaging. Could you elaborate on this?