3 ms·
Maybe they have an 'understanding' about the implementation of the cryptography as they do with WhatsApp, meaning the program doesn't notify you when your oppos
by gibson99 9y ago
Maybe they have an 'understanding' about the implementation of the cryptography as they do with WhatsApp, meaning the program doesn't notify you when your opposite's keys change, leaving unscrupulous users (most) susceptible to MitM attacks, which could be used by law enforcement or three-letter-agencies.
Plus, Skype probably still makes extensive use of meta-data, Signal allege that they don't, but we can't really assess what's actually running on their servers, despite the use of the AGPL.
- geofft 9y agoWhy would you want to assess what's actually running on their servers? Even if you know the code on it, you have no guarantee it's not running inside a hypervisor that logs the contents of memory, or something. In terms of cryptographic robustness, it's good for an app like Signal to have a closed-source server, because it forces you to not trust the server. (This is of course separate from whether it's good for the Signal server to be free software for inherent free-software morality reasons.)
- gibson99 9y agoTrue, but it seems like wishful thinking for Internet users to reasonably assess the dangers of trusting the 'Cloud' with private data. Still, I think the most important breaches of privacy are not necessarily in decoding the messages themselves, but rather everything from location data to contact lists including time and number of communications these apps have access to by default.
- ikawe 9y agoMaybe it’s beside the point, but to be clear, Signal Server source is available here: https://github.com/WhisperSystems/Signal-Server https://github.com/WhisperSystems/Signal-Server
- jlund 9y agoSignal takes metadata protection very seriously: https://signal.org/bigbrother/ https://signal.org/bigbrother/