3 ms·

I feel like you didn't actually read the article or my comments in this thread. >Drew DeVault doesn't trust Signal because its Android incarnation uses the Goo

I feel like you didn't actually read the article or my comments in this thread. >Drew DeVault doesn't trust Signal because its Android incarnation uses the Google Play Store --- the app market virtually all of its real users use --- and not F-Droid It should use both. >the point of end-to-end encryption is that you don't have to trust Signal's server. All it does is arrange for the delivery of messages, which are secured client-to-client. Compare Signal's server to Wire's, which --- last I checked --- retains a record of every pair of users who have communicated in the past. My point is that Signal could just as easily keep a record of every pair of users who has communicated. We can't be sure because we can't run our own servers. I spoke about this in detail in the article. >† When this was pointed out downthread, DeVault responded: "[o]ther alternatives (which I have not reviewed in depth) include Tox, Telegram, Wire, and Ring". Telegram is a particularly funny reference to make, because not only is E2E not the default there, but --- last I checked --- it can't even do E2E group chat. Telegram's owners are adamant that TLS is adequate for group secure chat. Thanks for omitting all of the context which clarified that I hadn't researched them in depth and wasn't explicitly endorsing any of them, and the comment where I clarified that E2E encryption is enabled by default on Matrix.

tptacek 8y ago
I read your article, carefully, twice, once this morning (I briefly tweeted about it but didn't feel like I could do it justice and deleted the tweet) and again before writing this. I've read all of your comments in this thread to date and, as you can see, replied to some of them. I feel like I have fairly summarized your arguments. "It should use both", you say. Signal disagrees. That makes Signal evil, according to your argument. "That's not how the world works" is my rebuttal. Signal could easily keep a record of every pair of users. So can every other mainstream chat application --- and several of them do. Signal doesn't. My reply on the subthread about this issue explains what Signal does differently here, and it's not "publish the source code of the server". People can simply read your comment on the thread --- I made clear where the quote came from --- to see exactly what you said about Wire and Telegram and Tox and Ring. I'm satisfied that I've represented your argument well.
- ddevault 8y ago
  >"It should use both", you say. Signal disagrees. That makes Signal evil, according to your argument. You're oversimplifying this. For the full rebuttal, refer to the article. >Signal doesn't. You cannot know this. We don't need to have this conversation in two places, I'll just link it for others who want to follow along: https://news.ycombinator.com/item?id=17726574 https://news.ycombinator.com/item?id=17726574 >I'm satisfied that I've represented your argument well. I don't think so. >People can simply read your comment on the thread Fair enough: https://news.ycombinator.com/item?id=17724300 https://news.ycombinator.com/item?id=17724300 Full disclosure: I added the text in the parenthesis and the second paragraph of this comment about an hour after it was initially posted.
  - tptacek 8y ago
    I don't think you understand that I can, in fact, just observe that Signal disagrees with you, without making a point-by-point rebuttal of your argument. Similarly, you don't indicate anywhere that you understand that Moxie can do the same without acting in bad faith, which is something you accuse him of doing. You don't get to demand from strangers a debate on terms of your choosing.
- alexnewman 8y ago
  I read your comments, twice. Once now and once 5 minutes ago. You are hyperbolic, dishonest and clearly angry. Some clear examples, and I will do this with quotes: What you said was "Drew DeVault doesn't trust Signal because its Android incarnation uses the Google Play Store --- the app market virtually all of its real users use --- and not F-Droid" Clearly that's not what the author said. You representing him as saying that IS A LIE. You saying that you did not say that IS A LIE. Other lies and fallacies from you include: - You claim he claims that "signal is evil". This is a lie - This argument is clownish and we should be embarrassed it's on the front page. This is a fallacy - he's constructed an entire psychoanalysis of Moxie Marlinspike. This is a hyperbolic untruth. Please sir, I appreciate the fact that you are digging. That's good! We should focus on the details, because in security and security theatre the details are all that matters. Clearly the author has pointed out details where the security or security theatre is weak.

tptacek 8y ago

I read your article, carefully, twice, once this morning (I briefly tweeted about it but didn't feel like I could do it justice and deleted the tweet) and again before writing this. I've read all of your comments in this thread to date and, as you can see, replied to some of them. I feel like I have fairly summarized your arguments. "It should use both", you say. Signal disagrees. That makes Signal evil, according to your argument. "That's not how the world works" is my rebuttal. Signal could easily keep a record of every pair of users. So can every other mainstream chat application --- and several of them do. Signal doesn't. My reply on the subthread about this issue explains what Signal does differently here, and it's not "publish the source code of the server". People can simply read your comment on the thread --- I made clear where the quote came from --- to see exactly what you said about Wire and Telegram and Tox and Ring. I'm satisfied that I've represented your argument well.

ddevault 8y ago
>"It should use both", you say. Signal disagrees. That makes Signal evil, according to your argument. You're oversimplifying this. For the full rebuttal, refer to the article. >Signal doesn't. You cannot know this. We don't need to have this conversation in two places, I'll just link it for others who want to follow along: https://news.ycombinator.com/item?id=17726574 https://news.ycombinator.com/item?id=17726574 >I'm satisfied that I've represented your argument well. I don't think so. >People can simply read your comment on the thread Fair enough: https://news.ycombinator.com/item?id=17724300 https://news.ycombinator.com/item?id=17724300 Full disclosure: I added the text in the parenthesis and the second paragraph of this comment about an hour after it was initially posted.
- tptacek 8y ago
  I don't think you understand that I can, in fact, just observe that Signal disagrees with you, without making a point-by-point rebuttal of your argument. Similarly, you don't indicate anywhere that you understand that Moxie can do the same without acting in bad faith, which is something you accuse him of doing. You don't get to demand from strangers a debate on terms of your choosing.
alexnewman 8y ago
I read your comments, twice. Once now and once 5 minutes ago. You are hyperbolic, dishonest and clearly angry. Some clear examples, and I will do this with quotes: What you said was "Drew DeVault doesn't trust Signal because its Android incarnation uses the Google Play Store --- the app market virtually all of its real users use --- and not F-Droid" Clearly that's not what the author said. You representing him as saying that IS A LIE. You saying that you did not say that IS A LIE. Other lies and fallacies from you include: - You claim he claims that "signal is evil". This is a lie - This argument is clownish and we should be embarrassed it's on the front page. This is a fallacy - he's constructed an entire psychoanalysis of Moxie Marlinspike. This is a hyperbolic untruth. Please sir, I appreciate the fact that you are digging. That's good! We should focus on the details, because in security and security theatre the details are all that matters. Clearly the author has pointed out details where the security or security theatre is weak.