3 ms·

I don't consider anything automatically "tainted." I'm considering the reason behind the Signal's decision to insist on acquiring the phone numbers and I don't

by acqq 8y ago

I don't consider anything automatically "tainted." I'm considering the reason behind the Signal's decision to insist on acquiring the phone numbers and I don't have any better explanation than that. It is just their insisting on the phone numbers is their action that for me makes use of their product problematic. And the "Open Technology Fund" is surely an interesting beast, worthy knowing about, as well as the stories about the "Radio Free X" for some X. Some fascinating insights on that topic: https://www.theglobeandmail.com/arts/books-and-media/review-a-mosque-in-munich-by-ian-johnson/article4324972/ https://www.theglobeandmail.com/arts/books-and-media/review-...

tptacek 8y ago
What does Radio Free Asia have to do with Signal? The only connection is that OTF, which is an RFA project, decided to spend money on open privacy and cryptography tools. Signal has repeated the reason they use phone number identifiers ad nauseam. The goal of Signal is to make text messaging secure. Those are the roots of the project. You're confusing the application with the underlying technology, which Signal has published and many other projects have exploited.
- acqq 8y ago
  > The goal of Signal is to make text messaging secure For whom is that messaging more “secure“ if the phone numbers are the (technically completely unneeded) requirement on which is insisted by the producers of Signal?
  - tptacek 8y ago
    I don't think you understand. By "has its roots in text messaging", I mean literally SMS text messaging, the most popular messaging network on the planet. That is the goal of the project: to take the largest mainstream messaging network in the world and make it cryptographically secure. That network already has identifiers and a network of relationships: phone numbers and contact books. That's how Signal bootstraps itself. If you don't and never would send an SMS text message, you are not Signal's model target user and never were. Use something else; you have lots of choices. If not Signal, I recommend Wire, though I think you'll come out behind on the privacy tradeoffs.
    - acqq 8y ago
      “It has roots in SMS” is of course absolutely miskeading as Signal is technologically completely different and there’s still on that level nothing that would prevent the producers of Signal to allow anybody to use any other way of identification. So I still claim that the fact they don’t has some very strong reasons that are completely opposite to the security of their users. And I still haven’t read here any argument that disproves that.
      - tptacek 8y ago
        There's nothing to "disprove". The project has a different goal than you have. That apparently makes you angry. That's fine; snipe at it all you want, and pick a different messenger. What you cannot get away with doing is making the argument that your disagreement with them is an indicator that they're compromised by the US Government. That's comically false. Snipe at them for things you can make actual arguments about (there are lots of those).
        acqq 8y ago
        > That apparently makes you angry "Apparently" because it's without any proof. > What you cannot get away with doing is making the argument that your disagreement with them is an indicator that they're compromised by the US Government. I'm not claiming that and I've never claimed that. I'm claiming only this: 1) there are no technical reasons for them insisting in their users giving them user's phone numbers and user's contact data: the underlying technology would not be any more complex without that. 2) There was(is?) actual monetary support of Signal development by the actual US spy organization (with the decades of historical support for these direct "spy" connections, some of which really amazing, see before). Which gives some additional context for the whole operation. Specifically "tainted" and "compromised by" were always only your formulations. I'd just say "given the circumstances, there can be observed some non-technical reasons behind some design decisions." Which would, I hope, be completely non-controversial if we would, for example, talk about Skype. Because for Skype we have the direct proofs from Snowden. And not having such for Signal we surely can say "we don't have proofs" but we also can't claim that "this time it's completely different." Even if Snowden himself talks nice (or something) about Signal. And downvoting my comments stating both is not changing these facts.
  - latang 8y ago
    i think you might be incorrectly equating 'secure' with 'anonymous AND secure'

by acqq 8y ago

tptacek 8y ago

What does Radio Free Asia have to do with Signal? The only connection is that OTF, which is an RFA project, decided to spend money on open privacy and cryptography tools. Signal has repeated the reason they use phone number identifiers ad nauseam. The goal of Signal is to make text messaging secure. Those are the roots of the project. You're confusing the application with the underlying technology, which Signal has published and many other projects have exploited.

acqq 8y ago
> The goal of Signal is to make text messaging secure For whom is that messaging more “secure“ if the phone numbers are the (technically completely unneeded) requirement on which is insisted by the producers of Signal?
- tptacek 8y ago
  I don't think you understand. By "has its roots in text messaging", I mean literally SMS text messaging, the most popular messaging network on the planet. That is the goal of the project: to take the largest mainstream messaging network in the world and make it cryptographically secure. That network already has identifiers and a network of relationships: phone numbers and contact books. That's how Signal bootstraps itself. If you don't and never would send an SMS text message, you are not Signal's model target user and never were. Use something else; you have lots of choices. If not Signal, I recommend Wire, though I think you'll come out behind on the privacy tradeoffs.
  - acqq 8y ago
    “It has roots in SMS” is of course absolutely miskeading as Signal is technologically completely different and there’s still on that level nothing that would prevent the producers of Signal to allow anybody to use any other way of identification. So I still claim that the fact they don’t has some very strong reasons that are completely opposite to the security of their users. And I still haven’t read here any argument that disproves that.
    - tptacek 8y ago
      There's nothing to "disprove". The project has a different goal than you have. That apparently makes you angry. That's fine; snipe at it all you want, and pick a different messenger. What you cannot get away with doing is making the argument that your disagreement with them is an indicator that they're compromised by the US Government. That's comically false. Snipe at them for things you can make actual arguments about (there are lots of those).
      - acqq 8y ago
        > That apparently makes you angry "Apparently" because it's without any proof. > What you cannot get away with doing is making the argument that your disagreement with them is an indicator that they're compromised by the US Government. I'm not claiming that and I've never claimed that. I'm claiming only this: 1) there are no technical reasons for them insisting in their users giving them user's phone numbers and user's contact data: the underlying technology would not be any more complex without that. 2) There was(is?) actual monetary support of Signal development by the actual US spy organization (with the decades of historical support for these direct "spy" connections, some of which really amazing, see before). Which gives some additional context for the whole operation. Specifically "tainted" and "compromised by" were always only your formulations. I'd just say "given the circumstances, there can be observed some non-technical reasons behind some design decisions." Which would, I hope, be completely non-controversial if we would, for example, talk about Skype. Because for Skype we have the direct proofs from Snowden. And not having such for Signal we surely can say "we don't have proofs" but we also can't claim that "this time it's completely different." Even if Snowden himself talks nice (or something) about Signal. And downvoting my comments stating both is not changing these facts.
- latang 8y ago
  i think you might be incorrectly equating 'secure' with 'anonymous AND secure'