4 ms·
>Signal doesn't work without Google services Not true, it has a websockets alternative to gcm. >and requires a phone number The phone number can be anything
by snthd 8y ago
>Signal doesn't work without Google services
Not true, it has a websockets alternative to gcm.
>and requires a phone number
The phone number can be anything you control.
>and turned-on phone iirc
Yes
>(and their profit model seems to be extorting companies like Wire and helping closed source software like Whatsapp advertise with Signal-level encryption).
It (now) has its own nonprofit backing it (and a generous benefactor). It's not trying to be profitable.
The "extortion" thing seems to have been about wire using signal code in breach of copyright (ie not complying with the open source license).
Signal has stated that the goal of working with WhatsApp (and others) is to make good crypto be used as widely as possible. Matrix crypto is also based on what's used in signal.
>Wire is the best of all, but the Android app drains battery and everything is web
Signal is very polished (at least on Android - I'm not familiar with the ios app).
- HIPisTheAnswer 8y agoYou do not control a phone number. You can control an SSL cert using DNSSEC. So you cannot control your signal end-point. Besides, the signal server is in total control of your identity. Plus anyone might still use the phone number to send plain-text SMS'. TLDR: If you don't control the server, there is no security guarantee. So signal, whatsapp and telegram are out.
- dbt00 8y agoDNSSEC is as secure as SMS.
- HIPisTheAnswer 8y agoBut signal also uses name servers to connect clients. HIP, the host identity protocol, is the answer. Check out my nick. I'm not a big fan of the current naming system of the internet. Self-certifying names are needed. Edit: If DNSSEC is as secure as sms, then signal is as secure as sms.
- acct1771 8y agoYou mean for metadata, of course. Not message contents etc.
- snthd 8y agoFor signal the phone number serves as a convenience to label a public key - the security comes from verifying the key. The design is to not trust the server. WhatsApp is the same but has things like key-change messages off by default. I believe telegram doesn't even encrypt by default, and has flawed crypto anyway. You're right that the whole thing is flawed to some degree unless both parties are clued up.