4 ms·

Worried About the Privacy of Your Messages? Download Signal

13 points by siavosh 10y ago

hackuser 10y ago
Doesn't Signal require input of users' telephone numbers?
- newscracker 10y ago
  Yes, it does require the phone number to activate the account. The same issue exists with Telegram too, which requires a phone number to create an account. Wire [1], which is a similar app, does not require a phone number and can work with an email address. [1]: https://wire.com https://wire.com
DrScump 10y ago
Here are the permissions Signal demands upon installation (Android): - Device and App history - Identity - Calendar - Contacts - Location - SMS - Phone - Photos/Media/Files - Camera - Microphone - WiFi Connection Info - Device ID and call info WTF? How is my privacy improved by installing Signal, really?
- secfirstmd 10y ago
  Open Whisper Systems have answered that question in very large detail here: "What are all these permissions" https://support.whispersystems.org/hc/en-us/articles/212535858-What-are-all-these-permissions- https://support.whispersystems.org/hc/en-us/articles/2125358... Also, worth remembering that Open Whisper Systems is a non-profit and needs donations to survive. Donate here: https://support.whispersystems.org/hc/en-us/articles/212940158-How-can-I-donate- https://support.whispersystems.org/hc/en-us/articles/2129401... Or contribute code or translations here: https://support.whispersystems.org/hc/en-us/articles/213134287-How-do-I-help- https://support.whispersystems.org/hc/en-us/articles/2131342... Or just tell your friends, family, co-workers to use it.
  - DrScump 10y ago
    Being Open Source doesn't make it impervious to being a vector for exploits, as Heartbleed brutally demonstrated. It shouldn't be requiring permissions it doesn't need or isn't using "yet". Permissions used rarely or only in certain configurations can be prompted for granting on the fly in current Android releases, can't they? Does the Play Store really limit you to one copy of your app to span every supported major release of Android?
  - Amir6 10y ago
    With all due respect for the project, and those who endorse it, the details they provide on that page is (and I'm use the words Snowden used before) Horse Shit! I wish I had time to go into details and write a good post about it.
- newscracker 10y ago
  This is more of an Android permission management issue than a Signal app issue. If you use Android 6 (Marshmallow) or above, you should be able to grant only the permissions you're comfortable with granting to the app. For older versions of Android, there are apps that allow you to restrict the permissions granted to apps (I don't have first hand experience, but look for "app permission manager").
  - DrScump 10y ago
    Yes, and that's a much better mechanism. The question is: what does Signal do if it seeks an inappropriate permission and is denied? For example: Gallery, which is the default picture viewer on the Samsung GS5, at least. They updated it to demand several unnecessary permissions, such as for your Calendar. Clicking on an image (invoking Gallery, in its most basic instance) results in a prompt, "Allow Gallery to access your calendar?" If you Deny Calendar access, it exits, or crashes.

13 points by siavosh 10y ago

hackuser 10y ago

Doesn't Signal require input of users' telephone numbers?

newscracker 10y ago
Yes, it does require the phone number to activate the account. The same issue exists with Telegram too, which requires a phone number to create an account. Wire [1], which is a similar app, does not require a phone number and can work with an email address. [1]: https://wire.com https://wire.com

DrScump 10y ago

Here are the permissions Signal demands upon installation (Android): - Device and App history - Identity - Calendar - Contacts - Location - SMS - Phone - Photos/Media/Files - Camera - Microphone - WiFi Connection Info - Device ID and call info WTF? How is my privacy improved by installing Signal, really?

secfirstmd 10y ago
Open Whisper Systems have answered that question in very large detail here: "What are all these permissions" https://support.whispersystems.org/hc/en-us/articles/212535858-What-are-all-these-permissions- https://support.whispersystems.org/hc/en-us/articles/2125358... Also, worth remembering that Open Whisper Systems is a non-profit and needs donations to survive. Donate here: https://support.whispersystems.org/hc/en-us/articles/212940158-How-can-I-donate- https://support.whispersystems.org/hc/en-us/articles/2129401... Or contribute code or translations here: https://support.whispersystems.org/hc/en-us/articles/213134287-How-do-I-help- https://support.whispersystems.org/hc/en-us/articles/2131342... Or just tell your friends, family, co-workers to use it.
- DrScump 10y ago
  Being Open Source doesn't make it impervious to being a vector for exploits, as Heartbleed brutally demonstrated. It shouldn't be requiring permissions it doesn't need or isn't using "yet". Permissions used rarely or only in certain configurations can be prompted for granting on the fly in current Android releases, can't they? Does the Play Store really limit you to one copy of your app to span every supported major release of Android?
- Amir6 10y ago
  With all due respect for the project, and those who endorse it, the details they provide on that page is (and I'm use the words Snowden used before) Horse Shit! I wish I had time to go into details and write a good post about it.
newscracker 10y ago
This is more of an Android permission management issue than a Signal app issue. If you use Android 6 (Marshmallow) or above, you should be able to grant only the permissions you're comfortable with granting to the app. For older versions of Android, there are apps that allow you to restrict the permissions granted to apps (I don't have first hand experience, but look for "app permission manager").
- DrScump 10y ago
  Yes, and that's a much better mechanism. The question is: what does Signal do if it seeks an inappropriate permission and is denied? For example: Gallery, which is the default picture viewer on the Samsung GS5, at least. They updated it to demand several unnecessary permissions, such as for your Calendar. Clicking on an image (invoking Gallery, in its most basic instance) results in a prompt, "Allow Gallery to access your calendar?" If you Deny Calendar access, it exits, or crashes.