4 ms·

Yes, signal is better than FB or sms.. But the whole requiring phone number puts a nail in it on my end. So Signal can learn who talks with whom via requests g

Yes, signal is better than FB or sms.. But the whole requiring phone number puts a nail in it on my end. So Signal can learn who talks with whom via requests going through their LDAP-like server. They can get an idea how long calls are, and if it was a vid or audio call. They know the times of communication. You know, they can see the metadata. When's the last time we had problems with metadata? The POTS network? Yep. And you're indeed right the client has reproducible builds. But the server side certainly doesn't. And we have no way to ascertain that.

feanaro 8y ago
> You know, they can see the metadata. When's the last time we had problems with metadata? The POTS network? Yep. Yes, metadata is a problem, particularly with calls. However, Signal recently added the sealed sender (https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/) feature which makes the server blind to who the sender of a message is. > And you're indeed right the client has reproducible builds. But the server side certainly doesn't. That's true, but the server side is much less important when it comes to cryptographic assurances. Signal is definitely not a panacea, but by many counts it's better than anything else that currently exists and has any semblance to something a typical user can use.
- Forbo 8y ago
  For what it's worth, they don't retain any of that metadata. This has been tested in court: > We’ve designed the Signal service to minimize the data we retain about Signal users, so the only information we can produce in response to a request like this is the date and time a user registered with Signal and the last date of a user’s connectivity to the Signal service. https://signal.org/bigbrother/eastern-virginia-grand-jury/ https://signal.org/bigbrother/eastern-virginia-grand-jury/ This was even before sealed sender, so if anything my confidence in the Signal Foundation has only increased.
ReptileMan 8y ago
Threema is ok. No number. But paid.
bronco21016 8y ago
Everytime Signal is brought up someone just has to chime in saying ‘we must abandanon Signal at all costs because metadata’. The metadata limitation is well known and if metadata interception is a problem for your threat model there are steps to obscure your identity or you should use a different tool. For the 99% of other cases where I just don’t want anyone snooping on my conversation with friends and family but don’t care that people know I’m obviously conversing with my friends and family Signal is great. Let’s not throw Signal out just because the metadata is still there.
- StudentStuff 8y ago
  Briar is good if metadata is a prime concern, but even Matrix, XMPP and email have very similar metadata problems to Signal, plus contact discovery problems as you can't casually gather that your friend or relative is on the platform (phone numbers mostly solve this).
- e12e 8y ago
  If metadata is good enough to drone strike weddings, it's probably good enough to throw you in a concentration camp too. And since data never dies, it might be enough to throw your grand kids in concentration camps. Now, protecting everyone's meta data is hard (probably impossible), and I don't mean to be defeatist - but "it's just metadata" doesn't sit well in a post Snowden world. We know all large intelligence agencies hoover up this stuff. And we also know that agencies are made up of people, and some people abuse their access.
  - bronco21016 8y ago
    I certainly don’t mean to discount the importance of metadata. I specifically mentioned ensuring Signal fits your threat model. To suggest that metadata of communication over Signal between my spouse and I will be used against my grand kids one day is a bit absurd though. Of course there’s tons of metadata connecting my spouse and I. It would be more suspicious if there wasn’t.
    - e12e 8y ago
jwr 8y ago
You do realize that this "LDAP-like server" you're describing does not store the phone number, right?

feanaro 8y ago

> You know, they can see the metadata. When's the last time we had problems with metadata? The POTS network? Yep. Yes, metadata is a problem, particularly with calls. However, Signal recently added the sealed sender (https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/) feature which makes the server blind to who the sender of a message is. > And you're indeed right the client has reproducible builds. But the server side certainly doesn't. That's true, but the server side is much less important when it comes to cryptographic assurances. Signal is definitely not a panacea, but by many counts it's better than anything else that currently exists and has any semblance to something a typical user can use.

Forbo 8y ago
For what it's worth, they don't retain any of that metadata. This has been tested in court: > We’ve designed the Signal service to minimize the data we retain about Signal users, so the only information we can produce in response to a request like this is the date and time a user registered with Signal and the last date of a user’s connectivity to the Signal service. https://signal.org/bigbrother/eastern-virginia-grand-jury/ https://signal.org/bigbrother/eastern-virginia-grand-jury/ This was even before sealed sender, so if anything my confidence in the Signal Foundation has only increased.

ReptileMan 8y ago

Threema is ok. No number. But paid.

bronco21016 8y ago

Everytime Signal is brought up someone just has to chime in saying ‘we must abandanon Signal at all costs because metadata’. The metadata limitation is well known and if metadata interception is a problem for your threat model there are steps to obscure your identity or you should use a different tool. For the 99% of other cases where I just don’t want anyone snooping on my conversation with friends and family but don’t care that people know I’m obviously conversing with my friends and family Signal is great. Let’s not throw Signal out just because the metadata is still there.

StudentStuff 8y ago
Briar is good if metadata is a prime concern, but even Matrix, XMPP and email have very similar metadata problems to Signal, plus contact discovery problems as you can't casually gather that your friend or relative is on the platform (phone numbers mostly solve this).
e12e 8y ago
If metadata is good enough to drone strike weddings, it's probably good enough to throw you in a concentration camp too. And since data never dies, it might be enough to throw your grand kids in concentration camps. Now, protecting everyone's meta data is hard (probably impossible), and I don't mean to be defeatist - but "it's just metadata" doesn't sit well in a post Snowden world. We know all large intelligence agencies hoover up this stuff. And we also know that agencies are made up of people, and some people abuse their access.
- bronco21016 8y ago
  I certainly don’t mean to discount the importance of metadata. I specifically mentioned ensuring Signal fits your threat model. To suggest that metadata of communication over Signal between my spouse and I will be used against my grand kids one day is a bit absurd though. Of course there’s tons of metadata connecting my spouse and I. It would be more suspicious if there wasn’t.
  - e12e 8y ago

jwr 8y ago

You do realize that this "LDAP-like server" you're describing does not store the phone number, right?