4 ms·

It seems that if you really want proper secure channel you need to write one yourself. Anything out there is subject to being compromised. Is there open source

It seems that if you really want proper secure channel you need to write one yourself. Anything out there is subject to being compromised. Is there open source alternative for Signal?

holri 10y ago
from the article: XMPP
_0ffh 10y ago
You don't have to look far. The actual Signal client source is licensed under GPLv3. Edit: And server code under AGPLv3.
- em3rgent0rdr 10y ago
  well LibreSignal was shut down because Moxie didn't like them using WhisperSystem's servers. I guess the libre community could figure out how to setup and fund an alternative server, but since Signal's server code isn't federated, then I don't believe there would be a straightforward way to send messages between the two systems. https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
  - angry_octet 10y ago
    Obviously they can run an alternative server, and if their version is sufficiently more attractive people will switch their client. They could 'solve' all these usability problems, fix the use of google interfaces the tin foil hat brigade detest, and deploy it on a non-existent non-proprietary secure phone platform. Oh and make it federated but keep it immune from spam. Yeah, seems like that is a bit hard.
  - vurpo 10y ago
    Moxie and Whisper Systems is clearly against decentralization and federation, based on that blog post they wrote. This means it's unlikely that Signal is ever going to have any support for federation.
    - temprature 10y ago
      > This means it's unlikely that Signal is ever going to have any support for federation. Signal had support for federation. Their server was federated with Cyanogen's for a while[0]. That being the disaster it was is why that blog post happened and no one seems to be forthcoming with solutions to the problems they had. [0] https://whispersystems.org/blog/cyanogen-integration/ https://whispersystems.org/blog/cyanogen-integration/
  - temprature 10y ago
    > but since Signal's server code isn't federated The Signal server code has supported federation since the first commit in the git history. Whisper Systems' instance of the server doesn't federate with any other server anymore but there is nothing stopping the LibreSignal crowd from standing up their own network of federation-enabled servers.
em3rgent0rdr 10y ago
also on F-Droid you can find "Silence" which is a fork of "Signal" but only for SMS texts.
- jacobush 10y ago
  True, but you still need to be aware of who your potential adversary is. If it is someone with access to SMS network texts logs, these encrypted texts will light up like a Christmas tree for someone looking for something unusual.
  - em3rgent0rdr 10y ago
    The threat model is that google and cell phone networks are untrusted adversaries. So your same concern can be said about Signal messages going through Google servers under the surveillance of the NSA. Either way the adversary sees a bunch of suspicious encrypted messages, but can't read them. But if the user has proprietary google code installed on their phone (i.e. Google Play Services), then the backdoor which this blog is warning about is the fact that now your phone software is/could be potentially compromised.
    - jacobush 10y ago
      It depends on who you are hiding from. In some freer countries, encrypted texts at most get you flagged on some kind of list. In others you may get enhanced interrogation.
Angostura 10y ago
Or use Signal on iOS? (This is a genuine question)
- angry_octet 10y ago
  This would arguably be more secure. Depends who you trust least I guess, Apple or Google + OEMs. I think Apple has a lot to lose if they were to produce a backdoored firmware. Some android handset contract manufacturer or OEM? Not so much.
vurpo 10y ago
Matrix is decentralized, proper open source, modern, has audited end-to-end encryption and all that. Be aware that if you install the Riot app from the Play Store, it uses GCM (which means that client is technically vulnerable to the same attack as described in the article), but if you install it from F-Droid it does not. One strength of Matrix over Signal is indeed that you are free to choose or develop your own client to use with it. You can also host your own server for the decentralized Matrix network, but that point is kind of orthogonal and not related to this specific issue.

It seems that if you really want proper secure channel you need to write one yourself. Anything out there is subject to being compromised. Is there open source alternative for Signal?

holri 10y ago

from the article: XMPP

_0ffh 10y ago

You don't have to look far. The actual Signal client source is licensed under GPLv3. Edit: And server code under AGPLv3.

em3rgent0rdr 10y ago
well LibreSignal was shut down because Moxie didn't like them using WhisperSystem's servers. I guess the libre community could figure out how to setup and fund an alternative server, but since Signal's server code isn't federated, then I don't believe there would be a straightforward way to send messages between the two systems. https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
- angry_octet 10y ago
  Obviously they can run an alternative server, and if their version is sufficiently more attractive people will switch their client. They could 'solve' all these usability problems, fix the use of google interfaces the tin foil hat brigade detest, and deploy it on a non-existent non-proprietary secure phone platform. Oh and make it federated but keep it immune from spam. Yeah, seems like that is a bit hard.
- vurpo 10y ago
  Moxie and Whisper Systems is clearly against decentralization and federation, based on that blog post they wrote. This means it's unlikely that Signal is ever going to have any support for federation.
  - temprature 10y ago
    > This means it's unlikely that Signal is ever going to have any support for federation. Signal had support for federation. Their server was federated with Cyanogen's for a while[0]. That being the disaster it was is why that blog post happened and no one seems to be forthcoming with solutions to the problems they had. [0] https://whispersystems.org/blog/cyanogen-integration/ https://whispersystems.org/blog/cyanogen-integration/
- temprature 10y ago
  > but since Signal's server code isn't federated The Signal server code has supported federation since the first commit in the git history. Whisper Systems' instance of the server doesn't federate with any other server anymore but there is nothing stopping the LibreSignal crowd from standing up their own network of federation-enabled servers.

em3rgent0rdr 10y ago

also on F-Droid you can find "Silence" which is a fork of "Signal" but only for SMS texts.

jacobush 10y ago
True, but you still need to be aware of who your potential adversary is. If it is someone with access to SMS network texts logs, these encrypted texts will light up like a Christmas tree for someone looking for something unusual.
- em3rgent0rdr 10y ago
  The threat model is that google and cell phone networks are untrusted adversaries. So your same concern can be said about Signal messages going through Google servers under the surveillance of the NSA. Either way the adversary sees a bunch of suspicious encrypted messages, but can't read them. But if the user has proprietary google code installed on their phone (i.e. Google Play Services), then the backdoor which this blog is warning about is the fact that now your phone software is/could be potentially compromised.
  - jacobush 10y ago
    It depends on who you are hiding from. In some freer countries, encrypted texts at most get you flagged on some kind of list. In others you may get enhanced interrogation.

Angostura 10y ago

Or use Signal on iOS? (This is a genuine question)

angry_octet 10y ago
This would arguably be more secure. Depends who you trust least I guess, Apple or Google + OEMs. I think Apple has a lot to lose if they were to produce a backdoored firmware. Some android handset contract manufacturer or OEM? Not so much.

vurpo 10y ago

Matrix is decentralized, proper open source, modern, has audited end-to-end encryption and all that. Be aware that if you install the Riot app from the Play Store, it uses GCM (which means that client is technically vulnerable to the same attack as described in the article), but if you install it from F-Droid it does not. One strength of Matrix over Signal is indeed that you are free to choose or develop your own client to use with it. You can also host your own server for the decentralized Matrix network, but that point is kind of orthogonal and not related to this specific issue.