4 ms·

Maybe a good opportunity to remember what is the main mission of Signal/Open Whisper Systems: they realized at the time that it was extremely complicated for no

by KeitIG 9y ago

Maybe a good opportunity to remember what is the main mission of Signal/Open Whisper Systems: they realized at the time that it was extremely complicated for non-technical people to use tools secure enough and respecting your privacy (PGP...), and that the tools used by everyone (Whatsapp, Messenger...) were popular because they were fun and easy to use. They believed that everyone should be able to have an easy way to communicate with everyone, with a nice UI/UX, AND have an app secure and respectful of your privacy. And this, leaded to the Signal protocal and the Signal app .

lucb1e 9y ago
While on the topic of things to remember, also remember that they're making compromises in order to keep things hidden from users. The Signal protocol may be sound, but as we've seen with today's WhatsApp news, there are still implementation-specific compromises being made. Not to mention that many of those companies ship a closed source product. They could publish a spec of what should be going over the wire to make it auditable without needing to go all open source, but they don't do that either. Things are really kept closed. I am not sure whether it's a net positive or a net negative when another user joins WhatsApp or a similar service, versus Telegram where encryption is opt-in but at least it's open source and not leaking metadata to BigCorps whose profit model is knowing you.
- KeitIG 9y ago
  Though I understand your points, Signal is a protocol, you can implement and build things around it the way you want. Sure you can say that WhisperSystems should enforce a secured architecture around it, but it is not their job, and I doubt Whatsapp, Messenger and Skype would be using Signal if they were forcing that. And I would definitely not say Telegram is the best tool here [1][2]. If you want something really secure, I would recommend the Signal app [3]. In the end, it is always who you decide to put your trust in. [1] https://security.stackexchange.com/questions/49782/is-telegram-secure#49802 https://security.stackexchange.com/questions/49782/is-telegr... [2] https://eprint.iacr.org/2015/1177.pdf https://eprint.iacr.org/2015/1177.pdf [3] https://signal.org/ https://signal.org/

by KeitIG 9y ago

lucb1e 9y ago

While on the topic of things to remember, also remember that they're making compromises in order to keep things hidden from users. The Signal protocol may be sound, but as we've seen with today's WhatsApp news, there are still implementation-specific compromises being made. Not to mention that many of those companies ship a closed source product. They could publish a spec of what should be going over the wire to make it auditable without needing to go all open source, but they don't do that either. Things are really kept closed. I am not sure whether it's a net positive or a net negative when another user joins WhatsApp or a similar service, versus Telegram where encryption is opt-in but at least it's open source and not leaking metadata to BigCorps whose profit model is knowing you.

KeitIG 9y ago
Though I understand your points, Signal is a protocol, you can implement and build things around it the way you want. Sure you can say that WhisperSystems should enforce a secured architecture around it, but it is not their job, and I doubt Whatsapp, Messenger and Skype would be using Signal if they were forcing that. And I would definitely not say Telegram is the best tool here [1][2]. If you want something really secure, I would recommend the Signal app [3]. In the end, it is always who you decide to put your trust in. [1] https://security.stackexchange.com/questions/49782/is-telegram-secure#49802 https://security.stackexchange.com/questions/49782/is-telegr... [2] https://eprint.iacr.org/2015/1177.pdf https://eprint.iacr.org/2015/1177.pdf [3] https://signal.org/ https://signal.org/