4 ms·

Signal is bad as explained previously, it requires Google on your phone to even work. If you think Google is more trustworthy than Facebook, sure go ahead and

by antocv 10y ago

Signal is bad as explained previously, it requires Google on your phone to even work. If you think Google is more trustworthy than Facebook, sure go ahead and just use Hangouts or whatever. We cant have nice good encryption and safe communication when geeks push this Signal onto unsuspecting users, when the real option is to keep improving Tox.Chat and bitmessage.

padraic7a 10y ago
"Signal is bad as explained previously, it requires Google on your phone to even work. If you think Google is more trustworthy than Facebook, sure go ahead and just use Hangouts or whatever." Every time Signal comes up on HN people make this point (Signal is bad) as if it is true. And every time it is exposed as bs.
- otalp 10y ago
  A legitimate criticism is that they make it hard for people who don't want to use play services to user their app. For the privacy of the messages themselves, google really cannot interfere, unlike WhatsApp/Facebook.
  - padraic7a 10y ago
    There are certainly people who want to use Signal without Google services. I don't know how legitimate a complaint it is since Moxie et al have said that they would accept a well written pull request which provides similar functionality. But this just hasn't been forthcoming. What I dislike about Signal mentions on HN is that aggressive posters conflate a number of different issues people have with Signal - lack of federation, reliance on Google push notifications, lack of SMS support, etc - and somehow lump them in together. [Just to be clear - I am not saying you are doing this].
    - yoo1I 10y ago
      I don't have a lot of skin in the game, but I am genuinely curious as to what you mean. How else other than "lump[ing] them in together", would you comprehensively criticize it? I mean, two things good about Signal is that it let's you chat with friends and family in a secure manner. There are these following issues though: I doesn't federate, it relies on Google Push, it doesn't support SMS. Also, I don't like how Signal does [...]" Is that already an invalid way to make an argument ?
      - padraic7a 10y ago
        You're correct. That would be a fine way to make a comprehensive criticism. I was trying to express frustration with posters who start out with a nebulous complaint like "Signal is bad and OWS is evil". If called on this they come back with "It allows Google to spy on you", if countered they come back with "it doesn't allow freedom to federate" and so on. Rather than being a multi pronged criticism it's more like a bait and switch, with each new argument being deployed when the previous one is rendered invalid.
  - JJJollyjim 10y ago
    AFAIK, Play Services is controlled by Google and has system-level permissions, so it could easily access Signal messages post-decryption if Google wanted it to.
    - jononor 10y ago
      The JVM is also under Googles control, so they could similarly access it there? Or is that open and audited? How to verify which JVM my device runs? EDIT: of course the fewer attack vectors the better
      - xorcist 10y ago
        That part of Android is open source, so you could in theory audit it and build it yourself. I would be surprised if any big deliberate backdoors hid there. There are large downstream projects that use this source and builds on it which potentially would notice. The Play Services however pretty much amounts to a remote root shell open at all times. Google can remove or modify code at will, and they have been known to do it in practice for spyware removal. I can understand how an activist finds that problematic.
pilif 10y ago
> Signal is bad as explained previously, it requires Google on your phone to even work. only for notification delivery. The message payload is not part of the push notification.
- lucb1e 10y ago
  He never said it was. Google services aren't isolated like normal apps either, as far as I know they can access other app's data (when installing cyanogenmod, I had to install google apps in some weird way from the bootloader because it has to change protected things on the phone). His point of requiring google's stuff to be installed is valid, even if he wrote it thinking payload gets sent over it.
  - qznc 10y ago
    Even if you don't install Gapps, large parts of Android/CyanogenMod are from Google as well. How does installing Gapps make the security worse?
    - lucb1e 10y ago
      Because it's likely someone would have noticed if every AOSP phone called third party servers (or something like that). Plenty of people made Android derivatives, modded it, or just compiled it to toy with. Of course there's no guarantee without a full audit (and even with an audit, they might miss something), but I trust AOSP a lot more than a closed source app suite.
    - antocv 10y ago
      Good question. Stock Android does not, by inspecting network traffic, contact Google servers. Google play services and other GApps, do, and they can be exploited in this traffic, or told by Google to activate other backdoors. Signal with GApps, Google can know which phones, and which users, are using Signal, thats a security vulnerability. Google can infer from their Google-messaging thing, that notifications are sent, and have a high probability of knowing if it is to Signal. Who talks when is leaked to Google.
parent5446 10y ago
This makes no sense in so many ways. I suggest you read more on exactly how Signal relies on Google. It does not at all compromise the encryption protocol. Also Tox? Good luck with that.
- yoo1I 10y ago
  I am currently trying out tox with a small number of friends (ok, one friend). I am curious as to what your criticism of tox is. While it seems it's still a bit new, it seems it does all that it claims to do.
  - whyever 10y ago
    It is completely unusable on mobiles because it drains bandwidth and battery.
    - benoliver999 10y ago
      I use it all the time on desktop. Couldn't even get the mobile app to start.
speakr 10y ago
I guess it's worth mentioning that people are currently working on removing the Google services dependency in Signal: https://github.com/WhisperSystems/Signal-Android/pull/5962 https://github.com/WhisperSystems/Signal-Android/pull/5962
- lucb1e 10y ago
  That is good to know, thank you for sharing that! I'll be following this and try Signal again when it should finally work on my phone :)
- rthomas6 10y ago
  Looks like they are waiting for the calling portion of the app to become open source. Any ETA on that?

by antocv 10y ago

padraic7a 10y ago

"Signal is bad as explained previously, it requires Google on your phone to even work. If you think Google is more trustworthy than Facebook, sure go ahead and just use Hangouts or whatever." Every time Signal comes up on HN people make this point (Signal is bad) as if it is true. And every time it is exposed as bs.

otalp 10y ago
A legitimate criticism is that they make it hard for people who don't want to use play services to user their app. For the privacy of the messages themselves, google really cannot interfere, unlike WhatsApp/Facebook.
- padraic7a 10y ago
  There are certainly people who want to use Signal without Google services. I don't know how legitimate a complaint it is since Moxie et al have said that they would accept a well written pull request which provides similar functionality. But this just hasn't been forthcoming. What I dislike about Signal mentions on HN is that aggressive posters conflate a number of different issues people have with Signal - lack of federation, reliance on Google push notifications, lack of SMS support, etc - and somehow lump them in together. [Just to be clear - I am not saying you are doing this].
  - yoo1I 10y ago
    I don't have a lot of skin in the game, but I am genuinely curious as to what you mean. How else other than "lump[ing] them in together", would you comprehensively criticize it? I mean, two things good about Signal is that it let's you chat with friends and family in a secure manner. There are these following issues though: I doesn't federate, it relies on Google Push, it doesn't support SMS. Also, I don't like how Signal does [...]" Is that already an invalid way to make an argument ?
    - padraic7a 10y ago
      You're correct. That would be a fine way to make a comprehensive criticism. I was trying to express frustration with posters who start out with a nebulous complaint like "Signal is bad and OWS is evil". If called on this they come back with "It allows Google to spy on you", if countered they come back with "it doesn't allow freedom to federate" and so on. Rather than being a multi pronged criticism it's more like a bait and switch, with each new argument being deployed when the previous one is rendered invalid.
- JJJollyjim 10y ago
  AFAIK, Play Services is controlled by Google and has system-level permissions, so it could easily access Signal messages post-decryption if Google wanted it to.
  - jononor 10y ago
    The JVM is also under Googles control, so they could similarly access it there? Or is that open and audited? How to verify which JVM my device runs? EDIT: of course the fewer attack vectors the better
    - xorcist 10y ago
      That part of Android is open source, so you could in theory audit it and build it yourself. I would be surprised if any big deliberate backdoors hid there. There are large downstream projects that use this source and builds on it which potentially would notice. The Play Services however pretty much amounts to a remote root shell open at all times. Google can remove or modify code at will, and they have been known to do it in practice for spyware removal. I can understand how an activist finds that problematic.

pilif 10y ago

> Signal is bad as explained previously, it requires Google on your phone to even work. only for notification delivery. The message payload is not part of the push notification.

lucb1e 10y ago
He never said it was. Google services aren't isolated like normal apps either, as far as I know they can access other app's data (when installing cyanogenmod, I had to install google apps in some weird way from the bootloader because it has to change protected things on the phone). His point of requiring google's stuff to be installed is valid, even if he wrote it thinking payload gets sent over it.
- qznc 10y ago
  Even if you don't install Gapps, large parts of Android/CyanogenMod are from Google as well. How does installing Gapps make the security worse?
  - lucb1e 10y ago
    Because it's likely someone would have noticed if every AOSP phone called third party servers (or something like that). Plenty of people made Android derivatives, modded it, or just compiled it to toy with. Of course there's no guarantee without a full audit (and even with an audit, they might miss something), but I trust AOSP a lot more than a closed source app suite.
  - antocv 10y ago
    Good question. Stock Android does not, by inspecting network traffic, contact Google servers. Google play services and other GApps, do, and they can be exploited in this traffic, or told by Google to activate other backdoors. Signal with GApps, Google can know which phones, and which users, are using Signal, thats a security vulnerability. Google can infer from their Google-messaging thing, that notifications are sent, and have a high probability of knowing if it is to Signal. Who talks when is leaked to Google.

parent5446 10y ago

This makes no sense in so many ways. I suggest you read more on exactly how Signal relies on Google. It does not at all compromise the encryption protocol. Also Tox? Good luck with that.

yoo1I 10y ago
I am currently trying out tox with a small number of friends (ok, one friend). I am curious as to what your criticism of tox is. While it seems it's still a bit new, it seems it does all that it claims to do.
- whyever 10y ago
  It is completely unusable on mobiles because it drains bandwidth and battery.
  - benoliver999 10y ago
    I use it all the time on desktop. Couldn't even get the mobile app to start.

speakr 10y ago

I guess it's worth mentioning that people are currently working on removing the Google services dependency in Signal: https://github.com/WhisperSystems/Signal-Android/pull/5962 https://github.com/WhisperSystems/Signal-Android/pull/5962

lucb1e 10y ago
That is good to know, thank you for sharing that! I'll be following this and try Signal again when it should finally work on my phone :)
rthomas6 10y ago
Looks like they are waiting for the calling portion of the app to become open source. Any ETA on that?