5 ms·

No, it's not. By requiring a phone number, Signal does not defend privacy. This is a binary question, there's not a grey area here. It doesn't matter that they'

No, it's not. By requiring a phone number, Signal does not defend privacy. This is a binary question, there's not a grey area here. It doesn't matter that they're building a social network, or anything else. What matters is that it's not private so long as they require a phone number.

tptacek 8y ago
I'm not sure what was unclear about my summary of what Signal is doing. Here, let me put it differently for you: Signal's goal is to make all the messaging in the world that currently uses phone numbers as identifiers --- which, by a long ways, is most messaging in the world --- cryptographically secure. Hope that helps. You are welcome to have and to advocate for different goals. Please don't pretend your goals are Signal's, though.
- Sir_Cmpwn 8y ago
  >Signal's goal is to make all the messaging in the world that currently uses phone numbers as identifiers --- which, by a long ways, is most messaging in the world --- cryptographically secure. This is a better explanation. However, these goals do not protect privacy. If Signal's main goal is to protect privacy, then they need to change their secondary goals to accomodate it.
  - windexh8er 8y ago
    What is your qualification for "protecting" privacy? Clearly Signal has improved privacy compared to other messaging platforms as has been proven by subpoenas by law enforcement. That, in my mind, qualifies as privacy protection over many other messaging solutions that have not been proven or failed in that arena. Claiming Signal doesn't protect privacy because: phone numbers is an opinion given you haven't qualified your argument. Finally their goal is not predicated on what you claim just because you claim it. You're effectively creating a false argument so you can justify your position.
    - Sir_Cmpwn 8y ago
      >Clearly Signal has improved privacy compared to other messaging platforms as has been proven by subpoenas by law enforcement. Secure systems are not built on trust. They're built with math and with facts. Their goal isn't based on what tptacek said just because tptacek said it, either. If I'm wrong and privacy isn't their goal, well that speaks volumes on its own.
      - tptacek 8y ago
        Well, a lot of things seem to speak volumes to you. You're also someone who wants to sysadmin their phones (no judgement, perfectly valid lifestyle choice). When you determined that Signal was making it hard to run through F-Droid, you wrote a long blog post casting aspersions on Moxie Marlinspike's motives. There are two groups of people (among others) Signal clearly doesn't aim to serve: 1. People that are very sensitive about, and only have access to, their one phone number. 2. People who want to sysadmin their phones. I have perhaps more sympathy for people in group (1), but, unlike you, in neither case do I think the mismatch is a great moral dilemma. I do, however, believe that promoting inferior and untested cryptography is immoral. https://news.ycombinator.com/item?id=17723973 https://news.ycombinator.com/item?id=17723973 The two of us are far apart on these issues and perhaps we should just agree not to engage on them.
        Sir_Cmpwn 8y ago
        >I do, however, believe that promoting inferior and untested cryptography is immoral. So you're doubling down on the lie I called you out on the first time around, then?
        lrvick 8y ago
        You repeatedly accuse F-droid users as people wanting to do sysadmin on their phone, instead of just users with a different threat profile than you. Why can't we just be people that want better day to day security and privacy assurances than we get with stock devices? I have F-droid installed as a system app and the only method for installing apps on my device. It is an AOSP device without Google play services or anything proprietary save for the minimum blobs required to allow the device to boot and communicate with the cell networks. I don't enable root, as normally assumed of users that don't run stock. Doing so on Android is a well known terrible security idea. This is a hardened personal device where I choose to opt out of Google tracking, and backdoors like SprintDM.apk that Google bundles with their stock OS. In order to install signal without Google Play I would need to turn on unverified sources on my phone and open myself up to Man In The Disk style attacks, and other security issues. This is ridiculuous that a company that champions itself an advocate for security and privacy refuses to support users like me that opt out of proprietary software and the tracking systems that come with them. Moxie not only said he will never support third party signed installation methods like F-Droid but has been actively hostile to those trying to do this for him. Example: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... Moxie suggesting people fork and make their own private network that simply want a secure installation method of third party signed/verified binaries on security optimized Android devices is irresponsible and does not inspire trust.
- eadmund 8y ago
  > Signal's goal is to make all the messaging in the world that currently uses phone numbers as identifiers --- which, by a long ways, is most messaging in the world --- cryptographically secure. That goal is fundamentally broken, though, because phone numbers aren’t cryptographically secure. One can use any exploit which allows one to take over a phone number to take over someone’s Signal identity. Yes, all of the target's Signal contacts will receive a message stating they his keys have changed — but they are used to that. Signal's got some awesome crypto, but it also has some intriguing holes.
  - tptacek 8y ago
    If key change alerts don't generally work, we have bigger problems than phone numbers.
  - jlund 8y ago
    You can read more about the Registration Lock feature here: https://support.signal.org/hc/en-us/articles/360007059792-Registration-Lock https://support.signal.org/hc/en-us/articles/360007059792-Re...
ardy42 8y ago
> No, it's not. By requiring a phone number, Signal does not defend privacy. This is a binary question, there's not a grey area here. It doesn't matter that they're building a social network, or anything else. What matters is that it's not private so long as they require a phone number. I'm not so sure. A lot of the objections to Signal using phone numbers seem similar to objecting to SSL/TLS because it's not Tor.
- Sir_Cmpwn 8y ago
  Nice comparison, that gives me some pause. I think that Signal is better positioned to fix the shortcomings in their system than the rest of the world is to fix the shortcomings of SSL/TLS, though.
zaarn 8y ago
Privacy is not binary like Security isn't binary. The type and amount of privacy a user wants and what you can realistically achieve beyond that depend on your market and threat model. Thinking Privacy is binary is like thinking IT Security is binary; until it's 100% it doesn't exist. That kind of thinking doesn't allow thinking in incremental improvements.
- trash_panda 8y ago
  Privacy and security are intertwined. I believe Signal's decisions are based on the objective of making secure communications easy. If they catered to what some people want (no phone numbers and federated network) then the regular user would have different options to use Signal. Which one is the correct one? Are they all the same? No. if you decide to develop your own client (like the LibreSignal example), do you trust that the client is secure? If the end application has vulnerabilities, then the communication privacy is compromised. That's why I say they're intertwined. Even Signal suffered from this same thing with the Desktop client. It is not an easy problem to solve, and that's why Signal does not want to have random people creating custom client apps and having them associated with the project, as it could confuse non-technical users.

tptacek 8y ago

I'm not sure what was unclear about my summary of what Signal is doing. Here, let me put it differently for you: Signal's goal is to make all the messaging in the world that currently uses phone numbers as identifiers --- which, by a long ways, is most messaging in the world --- cryptographically secure. Hope that helps. You are welcome to have and to advocate for different goals. Please don't pretend your goals are Signal's, though.

Sir_Cmpwn 8y ago
>Signal's goal is to make all the messaging in the world that currently uses phone numbers as identifiers --- which, by a long ways, is most messaging in the world --- cryptographically secure. This is a better explanation. However, these goals do not protect privacy. If Signal's main goal is to protect privacy, then they need to change their secondary goals to accomodate it.
- windexh8er 8y ago
  What is your qualification for "protecting" privacy? Clearly Signal has improved privacy compared to other messaging platforms as has been proven by subpoenas by law enforcement. That, in my mind, qualifies as privacy protection over many other messaging solutions that have not been proven or failed in that arena. Claiming Signal doesn't protect privacy because: phone numbers is an opinion given you haven't qualified your argument. Finally their goal is not predicated on what you claim just because you claim it. You're effectively creating a false argument so you can justify your position.
  - Sir_Cmpwn 8y ago
    >Clearly Signal has improved privacy compared to other messaging platforms as has been proven by subpoenas by law enforcement. Secure systems are not built on trust. They're built with math and with facts. Their goal isn't based on what tptacek said just because tptacek said it, either. If I'm wrong and privacy isn't their goal, well that speaks volumes on its own.
    - tptacek 8y ago
      Well, a lot of things seem to speak volumes to you. You're also someone who wants to sysadmin their phones (no judgement, perfectly valid lifestyle choice). When you determined that Signal was making it hard to run through F-Droid, you wrote a long blog post casting aspersions on Moxie Marlinspike's motives. There are two groups of people (among others) Signal clearly doesn't aim to serve: 1. People that are very sensitive about, and only have access to, their one phone number. 2. People who want to sysadmin their phones. I have perhaps more sympathy for people in group (1), but, unlike you, in neither case do I think the mismatch is a great moral dilemma. I do, however, believe that promoting inferior and untested cryptography is immoral. https://news.ycombinator.com/item?id=17723973 https://news.ycombinator.com/item?id=17723973 The two of us are far apart on these issues and perhaps we should just agree not to engage on them.
      - Sir_Cmpwn 8y ago
        >I do, however, believe that promoting inferior and untested cryptography is immoral. So you're doubling down on the lie I called you out on the first time around, then?
      - lrvick 8y ago
        You repeatedly accuse F-droid users as people wanting to do sysadmin on their phone, instead of just users with a different threat profile than you. Why can't we just be people that want better day to day security and privacy assurances than we get with stock devices? I have F-droid installed as a system app and the only method for installing apps on my device. It is an AOSP device without Google play services or anything proprietary save for the minimum blobs required to allow the device to boot and communicate with the cell networks. I don't enable root, as normally assumed of users that don't run stock. Doing so on Android is a well known terrible security idea. This is a hardened personal device where I choose to opt out of Google tracking, and backdoors like SprintDM.apk that Google bundles with their stock OS. In order to install signal without Google Play I would need to turn on unverified sources on my phone and open myself up to Man In The Disk style attacks, and other security issues. This is ridiculuous that a company that champions itself an advocate for security and privacy refuses to support users like me that opt out of proprietary software and the tracking systems that come with them. Moxie not only said he will never support third party signed installation methods like F-Droid but has been actively hostile to those trying to do this for him. Example: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... Moxie suggesting people fork and make their own private network that simply want a secure installation method of third party signed/verified binaries on security optimized Android devices is irresponsible and does not inspire trust.
eadmund 8y ago
> Signal's goal is to make all the messaging in the world that currently uses phone numbers as identifiers --- which, by a long ways, is most messaging in the world --- cryptographically secure. That goal is fundamentally broken, though, because phone numbers aren’t cryptographically secure. One can use any exploit which allows one to take over a phone number to take over someone’s Signal identity. Yes, all of the target's Signal contacts will receive a message stating they his keys have changed — but they are used to that. Signal's got some awesome crypto, but it also has some intriguing holes.
- tptacek 8y ago
  If key change alerts don't generally work, we have bigger problems than phone numbers.
- jlund 8y ago
  You can read more about the Registration Lock feature here: https://support.signal.org/hc/en-us/articles/360007059792-Registration-Lock https://support.signal.org/hc/en-us/articles/360007059792-Re...

ardy42 8y ago

> No, it's not. By requiring a phone number, Signal does not defend privacy. This is a binary question, there's not a grey area here. It doesn't matter that they're building a social network, or anything else. What matters is that it's not private so long as they require a phone number. I'm not so sure. A lot of the objections to Signal using phone numbers seem similar to objecting to SSL/TLS because it's not Tor.

Sir_Cmpwn 8y ago
Nice comparison, that gives me some pause. I think that Signal is better positioned to fix the shortcomings in their system than the rest of the world is to fix the shortcomings of SSL/TLS, though.

zaarn 8y ago

Privacy is not binary like Security isn't binary. The type and amount of privacy a user wants and what you can realistically achieve beyond that depend on your market and threat model. Thinking Privacy is binary is like thinking IT Security is binary; until it's 100% it doesn't exist. That kind of thinking doesn't allow thinking in incremental improvements.

trash_panda 8y ago
Privacy and security are intertwined. I believe Signal's decisions are based on the objective of making secure communications easy. If they catered to what some people want (no phone numbers and federated network) then the regular user would have different options to use Signal. Which one is the correct one? Are they all the same? No. if you decide to develop your own client (like the LibreSignal example), do you trust that the client is secure? If the end application has vulnerabilities, then the communication privacy is compromised. That's why I say they're intertwined. Even Signal suffered from this same thing with the Desktop client. It is not an easy problem to solve, and that's why Signal does not want to have random people creating custom client apps and having them associated with the project, as it could confuse non-technical users.