5 ms·

"Signal is bad as explained previously, it requires Google on your phone to even work. If you think Google is more trustworthy than Facebook, sure go ahead and

"Signal is bad as explained previously, it requires Google on your phone to even work. If you think Google is more trustworthy than Facebook, sure go ahead and just use Hangouts or whatever." Every time Signal comes up on HN people make this point (Signal is bad) as if it is true. And every time it is exposed as bs.

otalp 10y ago
A legitimate criticism is that they make it hard for people who don't want to use play services to user their app. For the privacy of the messages themselves, google really cannot interfere, unlike WhatsApp/Facebook.
- padraic7a 10y ago
  There are certainly people who want to use Signal without Google services. I don't know how legitimate a complaint it is since Moxie et al have said that they would accept a well written pull request which provides similar functionality. But this just hasn't been forthcoming. What I dislike about Signal mentions on HN is that aggressive posters conflate a number of different issues people have with Signal - lack of federation, reliance on Google push notifications, lack of SMS support, etc - and somehow lump them in together. [Just to be clear - I am not saying you are doing this].
  - yoo1I 10y ago
    I don't have a lot of skin in the game, but I am genuinely curious as to what you mean. How else other than "lump[ing] them in together", would you comprehensively criticize it? I mean, two things good about Signal is that it let's you chat with friends and family in a secure manner. There are these following issues though: I doesn't federate, it relies on Google Push, it doesn't support SMS. Also, I don't like how Signal does [...]" Is that already an invalid way to make an argument ?
    - padraic7a 10y ago
      You're correct. That would be a fine way to make a comprehensive criticism. I was trying to express frustration with posters who start out with a nebulous complaint like "Signal is bad and OWS is evil". If called on this they come back with "It allows Google to spy on you", if countered they come back with "it doesn't allow freedom to federate" and so on. Rather than being a multi pronged criticism it's more like a bait and switch, with each new argument being deployed when the previous one is rendered invalid.
- JJJollyjim 10y ago
  AFAIK, Play Services is controlled by Google and has system-level permissions, so it could easily access Signal messages post-decryption if Google wanted it to.
  - jononor 10y ago
    The JVM is also under Googles control, so they could similarly access it there? Or is that open and audited? How to verify which JVM my device runs? EDIT: of course the fewer attack vectors the better
    - xorcist 10y ago
      That part of Android is open source, so you could in theory audit it and build it yourself. I would be surprised if any big deliberate backdoors hid there. There are large downstream projects that use this source and builds on it which potentially would notice. The Play Services however pretty much amounts to a remote root shell open at all times. Google can remove or modify code at will, and they have been known to do it in practice for spyware removal. I can understand how an activist finds that problematic.

otalp 10y ago

A legitimate criticism is that they make it hard for people who don't want to use play services to user their app. For the privacy of the messages themselves, google really cannot interfere, unlike WhatsApp/Facebook.

padraic7a 10y ago
There are certainly people who want to use Signal without Google services. I don't know how legitimate a complaint it is since Moxie et al have said that they would accept a well written pull request which provides similar functionality. But this just hasn't been forthcoming. What I dislike about Signal mentions on HN is that aggressive posters conflate a number of different issues people have with Signal - lack of federation, reliance on Google push notifications, lack of SMS support, etc - and somehow lump them in together. [Just to be clear - I am not saying you are doing this].
- yoo1I 10y ago
  I don't have a lot of skin in the game, but I am genuinely curious as to what you mean. How else other than "lump[ing] them in together", would you comprehensively criticize it? I mean, two things good about Signal is that it let's you chat with friends and family in a secure manner. There are these following issues though: I doesn't federate, it relies on Google Push, it doesn't support SMS. Also, I don't like how Signal does [...]" Is that already an invalid way to make an argument ?
  - padraic7a 10y ago
    You're correct. That would be a fine way to make a comprehensive criticism. I was trying to express frustration with posters who start out with a nebulous complaint like "Signal is bad and OWS is evil". If called on this they come back with "It allows Google to spy on you", if countered they come back with "it doesn't allow freedom to federate" and so on. Rather than being a multi pronged criticism it's more like a bait and switch, with each new argument being deployed when the previous one is rendered invalid.
JJJollyjim 10y ago
AFAIK, Play Services is controlled by Google and has system-level permissions, so it could easily access Signal messages post-decryption if Google wanted it to.
- jononor 10y ago
  The JVM is also under Googles control, so they could similarly access it there? Or is that open and audited? How to verify which JVM my device runs? EDIT: of course the fewer attack vectors the better
  - xorcist 10y ago
    That part of Android is open source, so you could in theory audit it and build it yourself. I would be surprised if any big deliberate backdoors hid there. There are large downstream projects that use this source and builds on it which potentially would notice. The Play Services however pretty much amounts to a remote root shell open at all times. Google can remove or modify code at will, and they have been known to do it in practice for spyware removal. I can understand how an activist finds that problematic.