9 ms·
Signal, a fast, secure and simple messenger endorsed by Snowden
- qnsi 8y agoAmazing. Endorsed by Snowden makes me trust this so much „Snowden didn’t just steal information about “domestic spying” operations. The truth is Snowden apparently stole many more files related to what most in the intelligence community and beyond see as legitimate, overseas spy operations — including anti-terror operations and those targeted against the U.S. by our enemies. He reportedly focused his theft on the most sensitive “Level 3” data that includes lists of sources and methods in China, Russia and Iran. This is the type of information that “could invalidate America’s entire intelligence enterprise if it were placed in the hands of an adversary,” Esptein writes. He suggests Snowden would have known Booz-Allen Hamilton in Hawaii (his last contractor position) was one of the few contractor facilities that had the authority to hold “Level 3” data and former co-workers believe he took the lesser paying gig”
- 0x262d 8y agoembarrassing level of police bootlicking in this post my friend
- noir_lord 8y agoHe did take potentially damaging information but he was very careful to hand it over to responsible journalists who then filtered out what was relevant. Given his circumstances at the time he did the best he could in balancing peoples right to know against legitimate stuff I think.
- throwaway189310 8y agoAnd also hand it over to China and Russia, of course.
- lern_too_spel 8y agoYou mean the "responsible journalists" of the PRC? https://www.scmp.com/news/hong-kong/article/1266777/exclusive-snowden-safe-hong-kong-more-us-cyberspying-details-revealed https://www.scmp.com/news/hong-kong/article/1266777/exclusiv...
- throwaway189310 8y agoSeriously. Snowden worship makes me sick. If Trump actually had any influence with Russia, I wish he’d use it to get Snowden extradited. I want to see him on this list with Hanssen et al.: https://en.wikipedia.org/wiki/ADX_Florence#Double_agents https://en.wikipedia.org/wiki/ADX_Florence#Double_agents
- brianpgordon 8y agoSnowden successfully evaded notice and basically "got away with it" to the extent that he tried. Whether or not you think he was justified has no bearing on his obvious opsec competence.
- pmoriarty 8y agoWhy would you trust anything a spy agency tells you?
- isnetea 8y agoDespite the unnecessary tone, nothing stated seems likely to be false. It seems likely that adversaries would have adjusted their methods based on Snowden’s disclosures. Which parts seem unlikely?
- nabla9 8y agoThe data Snowden took relative to his access level does not support your theory. The most amazing thing about Snowden case was his access to information. Normally NSA employees have a combination of clearances: TS (top secret) and then SI (signals intelligence), TK (talent keyhole), and Gamma (with subcompartments). But then they gave some IT staff like Snowden special "root access like" clearance called PRIVAC (Privileged Access) where people had access to all data collected. Snowden had open list of live feeds from all active operations, drone feeds and other information regardless of classification all over the world. PRIVAC didn't have two man rule, restricted access to contractors or compartmentalization until Snowden came out and Senate hearings happened. NSA clearly prioritized cost and data collecting over security. If there was actual spy in the same position as Snowden, or if Snowden really had the intention to spill everything to harm the US, the damage done would be catastrophic.
- lern_too_spel 8y ago> The data Snowden took relative to his access level does not support your theory. How do you know that? The only people who know what Snowden took are Snowden, the journalists, the NSA, and the foreign intelligence agencies who took the data from the journalists. Nobody thinks Snowden had the intention to damage the US. He was just so stupid that he did it accidentally.
- Dylan16807 8y ago"It's impossible to know what he took, therefore your claim about what he took is baseless. MY claim about what he took, however:"
- lern_too_spel 7y agoWe know at the very least that he took lists of Chinese targets and when they were compromised and gave them to the SCMP, who reported in broad terms about the content of the lists. We know he gave a list of war zone and drug trafficking targets to Greenwald because he reported them. We know he gave a list of Western European political targets to Greenwald because he reported them as well. We have no idea what Russian target lists he took.
- neilv 8y agoI think the endorsements should acknowledge that one can't necessarily trust the rest of the smartphone software and hardware.
- matt4077 8y agoI don’t know if this level of cynicism is helpful. If taken to its logical conclusion, one would just give up on electronic communication. That comes with some costs, either economically, or in being exposed to other safety risks associated with offline communication, or being less effective in whatever one wants to achieve with that communication. Or, people will conclude that everything is compromised anyway, and therefore not take the reasonable steps because “why bother?” I also don’t think the idea that all hardware is compromised should just be accepted as fact. There is more that speaks against that thesis than in its favor, including the high market value of iOS exploits and the length Apple and the FBI went to in their fight over that shooter’s iPhone. Apple especially has taken some steps that seem to deserve some credit. After all, if we refuse to see the differences in their approach to others’, they (and everyone else) will just learn from it not to even try making privacy part of the value proposition.
- neilv 8y agoJournalists and dissidents are being encouraged to use this software, on platforms we know to be insecure.
- dontbenebby 8y ago>Journalists and dissidents are being encouraged to use this software, on platforms we know to be insecure. What specific platforms, and what are their insecurities?
- dontbenebby 8y ago> I think the endorsements should acknowledge that one can't necessarily trust the rest of the smartphone software and hardware. Welp, guess I should just send my messages in the clear then rather than make them work for them
- brianpgordon 8y agoKind of weird posting the app as a submission like this, given that it's pretty well-known and HN search turns up hundreds of discussions about it. This is kind of like posting a link to slack.com.
- sheerun 8y agoIt became more useful and stable since last discussed
- alexnewman 8y agoInteresting say more
- Cactus2018 8y agoEncrypted backup and restore works now. Including media.
- metildaa 8y agoFor how long though? Signal Android has repeatedly broken its backup functionality with no warning, it seems the Signal team is not testing this feature regularly. iOS users are still out of luck on message backup too :c
- mbesto 8y agoSo then it should refer to a press release, release announcement, github commit, or whatever. Just linking to the site and saying "Snowden supports it!" isn't really useful.
- 0x38B 8y agoYes, on Android at least the photo selection is better now, you can mark up photos and in general it's on par with other messengers. In the past year or so it's definitely filled out, feature-wise. Audio message UI has been improved.
- 8y ago
- isnetea 8y agoHow long until one or more of USA/China/Russia has a device to crack such e2e encryption? Secret quantum computer, perhaps?
- debatem1 8y agoAnything that forces adversaries to have novel (let alone sci-fi) technology instead of a warrant is a huge win. Let's not let the perfect be the enemy of the good.
- krastanov 8y agoIt would be incredibly surprising for such a device to be created in secret. Moreover, there are versions of public key encryption that can not be broken by a quantum computer.
- isnetea 8y agoMakes sense. There would probably need to be a kind of intellectual hoarding and misdirection amongst leading academics in quantum computing research. Yet one would have to assume such research does take place in private by governments. Does signal use the quantum-proof variety of encryption?
- cyphar 8y agoThe problem is that the largest QCs that we know of in the public are so ridiculously weak that I find it incredibly improbable that any government is anywhere close to having large enough QCs to break anything. The largest QCs are on the order of tens of qubits, but in order to run Shor's algorithm (to break RSA, or the discrete-log equivalent to break Diffie-Hellman) you need hundreds or thousands of stable qubits -- and the current generation of qubits are unstable. You can make stable qubits out of unstable ones by using error correction, but that requires you to have ~1000 unstable qubits to make one stable qubit. So there's at least 5-6 orders of magnitude separating the current state-of-the-art and when classic public-key crypto will be broken. > Does signal use the quantum-proof variety of encryption? No, there is currently no trusted post-quantum encryption (though the real issue is finding a replacement for public-key crypto because that seems to be the weakest link where quantum computers appear to have the most power). It's being worked on but is a very new field. In addition most post-quantum systems require keys that are kilobytes or even gigabytes in size (elliptic curve keys are tens of bytes). djb (a very well-known cryptographer) and his colleagues give quite a few talks about this[1]. Funnily enough it appears that elliptic curves (which are harder for classic computers to break, and can be easier for classic computers to compute safely) are actually easier for QCs to break because the key sizes are so much smaller (meaning that fewer qubits are required). [1]: https://www.youtube.com/watch?v=ZCmnQR3_qWg https://www.youtube.com/watch?v=ZCmnQR3_qWg
- jtl999 8y agoI wish they had a competent desktop client with feature parity to mobile and not just an Electron "app". I could write more critique regarding the forced contact discovery, the use of phone numbers as identifiers, but at lest the underlying security of the app is good.
- josteink 8y agoWhen I used Android, Signal doubled as a regular SMS app. That meant you would only use Signal, and the recipient would receive the message via Signal if he too was a user. Basically it worked like iMessage on iOS, but was 100% OSS. Which from what I can tell, is a thing people here on HN (not to mention /r/Android) are asking for all the time. Using Signal on iOS though indeed feels weirder because you always need to “discover” who has what IM-service, and then start the corresponding app. That’s a flaw of iOS though, and not Signal, and all non-iMessage services suffers for that.
- jeltz 8y agoThis was the main reason I never started using Signal. When I tried it some years ago it wanted virtually all permissions on my phone and wanted to replace my SMS client. I also did not like that they wanted my phone number. The SMS replacement should be an optional feature, and they do not need any phone number unless I want to use that feature.
- jtl999 8y agoI registered my Signal account with a burner number not linked to any SIM card, and thus I didn't use it as my SMS app. Don't know if it's default behavior when you register it with the phone number attached to your SIM or not. I agree the permissions (especially the forced contact discovery) is problematic.
- reacharavindh 8y agoI thought of doing the same until I realized that it's a silly workaround. If I ever need to restore my account or forget password or change device, I'd need the same burner phone... it's a burner anymore now is it? And then I gave up because of the forced contact discovery... it's a pity. I wish there was a popular chat service that worked more like Blackberry. Central network but just pseudonymns instead of the phone number.
- rcchyssser 8y agoRussia loves Snowden.
- adev_ 8y agoSignal, or what any chat system should be : E2E encryption, user friendly, Open Source, Vendor neutral. What else ?
- JshWright 8y agoWhat it's missing: federation, a stable/open protocol
- _emacsomancer_ 8y agoHas the experience improved much recently? I switched a couple of years ago to using Wire, since it seemed like a smoother experience (important for trying to convert people).
- eugeniub 8y agoI think the experience has improved a lot recently, and it's grown much more popular than Wire, so you may find your friends already on Signal rather than needing to convert them. For comparison, Wire for iOS has 204 ratings (3.9 stars) in the App Store, while Signal for iOS has 190,000 ratings (4.7 stars).
- _emacsomancer_ 8y agoHmm... perhaps I'll try Signal again. It looks like they've add videos calls since I seriously used them too.
- Cactus2018 8y ago.
- _emacsomancer_ 8y agoThat's rather disturbing!
- kethinov 8y agoSignal isn't federated. Use Matrix instead.
- pugworthy 8y agoFor those like me who aren’t used to the term federated... “Federated architecture (FA) is a pattern in enterprise architecture that allows interoperability and information sharing between semi-autonomous de-centrally organized lines of business (LOBs), information technology systems and applications.“ —Wikipedia
- cbHXBY1D 8y agoFor those who want to know why it's not federated: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/
- Whatitat90 8y agoFor those who want to know why it still should be federated: https://gultsch.de/objection.html https://gultsch.de/objection.html
- Hamuko 8y agoThese people really need to come up with better Googleable names.
- BlackRing 8y agoriot/matrix is substantially worse in usability than Signal. In addition, if you wanted something federated with decent crypto, an xmpp server with something as basic as TLS and OTR on the server and clients would be far more usable than matrix.
- agorabinary 8y agoSignal lags pretty hard on ubuntu 16.04, reason why I switched to Telegram despite the latter's inferior privacy
- arianvanp 8y agoTelegram is a native Qt app written in C++. It's very smooth because of it
- reneberlin 8y agoOutside of the tech-bubble we are all in, security-blablabla sounds good - but ordinary people just prefer any sorts of like WhateverAppMyFamilyUses. We're stuck with alternatives, that the crowd doesn't prefer.
- INTPenis 8y agoActually I find Signal to be among the easiest apps to use for secure communication. My 68 year old mother uses it. 50 year old brother uses it. Co-workers who aren't techies use it. Now matrix on the other hand seems like the next step for us nerds, so far less available than Signal.
- solarkraft 8y agoTelegram has gotten decent adoption because it makes a good compromise of security and convenience.
- theyinwhy 8y agoLike, not encrypting by default?
- solarkraft 8y agoYes. It allows you to easily have your content synchronized between devices.
- theyinwhy 7y agoWell, my comment was not serious. By not encrypting by default they actually put your data at risk. Syncing and encryption is not exclusive and could be done in its simplest form by sharing the private key or working with subkeys. Not encrypting by default is the worst option, imho.
- areoform 8y agoI wish I could keep recommending Signal to my friends. For an app as famous as theirs, the applications and tooling don’t feel mature at all. Their MacOS desktop app insists on updating multiple times a day. Indeed, every time I have it open, it starts bugging me for updates. I can’t have conversations anymore because the app insists on restarting signal. These hourly demands for updates has caused me to ignore them entirely - devaluing the core value add in the process. Was the latest 5pm update a security update that I desperately need? Well, I don’t know and at this point no longer care because I’d like to use the app to talk to people instead. The app also doesn’t work if you have multiple phones or a tablet. I can have signal either on my iPad or my phone. Not both. Why? I don’t know. But Signal insists that it is more secure. It’s a problem with these security focused applications. They often sacrifice usability on the altar of best case security; making applications that are hard to use for anyone but the most ardent of folks. I want to love this app, but their bad UX makes it really really hard.
- Aqua 8y agoI couldn't agree more with this, the constant requests to restart drive me nuts. It wouldn't have been so bad if it happened once a day, but 2-3 times make the usage as annoying as it can get.
- metildaa 8y agoWhat platform are you encountering this on? I have yet to see this behaviour, though Signal Desktop will throw away all its data if the checksum on the database fails (eg: dying SSD/hard drive). Take a peek at my other comment perhaps, signal-weechat & pyre.chat might be of use
- izacus 8y agoNow try backing up your conversations and group memberships - I've rarely seen so convoluted and user hostile process which practically ensures people will lose their chat histories and just switch to FB Messenger in disgust. I do admit the rest of the experience has improved, although the ban from binding more a single device to an account is still preventing me from using it more.
- dqybh 8y ago"endorsed by criminals" is now marketing blurb :')
- kemonocode 8y agoSignal's hostility towards third-party contributions and staunch refusal in federation makes it hard to recommend. Not to mention for an app that touts itself as both being secure and being easy to use, it has a rather crappy UX.
- klyrs 8y agoAlso, why is it on Google Play Store but not FDroid? Tryin' to protect my privacy, here.
- cyphar 8y agoBecause Moxie doesn't want it to be[1]. It should be noted though than you can download just the APK from their website[2] and it supports auto-updating. [1]: https://github.com/signalapp/Signal-Android/issues/127 https://github.com/signalapp/Signal-Android/issues/127 [2]: https://signal.org/android/apk/ https://signal.org/android/apk/
- alexnewman 8y agoThe pin on signal is not secure at all. easy to brutefoce bypass on existing signal users
- nichos 7y agoThis won't get the history of the conversation though. And if doing this on a new device, the security number will change, and others will be notified.
- seancork 8y agoI find Signal on Android handy since it can be used for sms as well.
- philips 8y agoI want to love Signal but is so hard to love at times: 1. The Signal backup restore process is ridiculous and kludgey. It took me quite some time to figure out how /Internal works on Android 9 devices using the files app for example. [1] 2. If your phone fails without a backup the only way to rejoin groups is having people post a message to each group. I wish there was a middle ground between full backup and dump my keys/group list.[2] 3. The Linux app will, at random, take minutes to load because it is loading 100s of messages. But, this happens even if I was running the app 5 minutes before. Watching the logs I see sqlite insertions happening no faster than 10 a second. The old web based Signal client worked great. I would love to have that brought back. On my wishlist, which I haven't posted anywhere publicly, includes: 1. Clicking a contact circle _should not_ show me the Android contact, it should show me a list of actions I can take in Signal instead: call, message, video call 2. Video conferences are often used with families. Please create a full screen video call mode that is friendly for parents with kids. This means that I can let my kid touch the screen and not immediately drop a call or switch apps. A full screen mode with optional pin or swipe pattern to exit would make me love the app forever. Also, for context, my experience comes from converting dozens of family members off of Whatsapp to Signal over the course of 6 weeks earlier this year. For the most part it has been fine but these sharp edges have caused me pain trying to support my family members. Whatapp lost my trust with the announcement of Fb messenger integration and the unencrypted backup to Google Drive. I am hopeful that Signal will improve overtime. However, the web client deprecation and my recent experience with the backup/restore process has me concerned. [1] https://support.signal.org/hc/en-us/articles/360007059752#android_restore https://support.signal.org/hc/en-us/articles/360007059752#an... [2] https://support.signal.org/hc/en-us/articles/360007062012-New-Number-or-New-Phone https://support.signal.org/hc/en-us/articles/360007062012-Ne...
- senectus1 7y agothis this this this this. I like and push signal every chance i can get but yeah, the UI/UX is horrible at times. Also wtf should we pay attention to snowden's opinion. the guy is no "security guru". His name is only relevent because he uses it... so what?
- dcsommer 8y agoHow do people think about the relative trajectories of Signal and Keybase? It seems like Keybase wins in terms of features, but Signal has a much bigger network and is therefore perceived as more of a known entity, security wise?
- netwanderer3 8y agoOnce my phone is rebooted or ran out of battery, Signal would stop notifying me of any new messages unless I manually launch the app, sometimes I even had to tap on each individual conversation to check for new messages. I agree with some posters here that its UX badly needs a redesign too.
- premek 8y agoI had to do this https://support.signal.org/hc/en-us/articles/360007318711-Troubleshooting-Notifications https://support.signal.org/hc/en-us/articles/360007318711-Tr...
- regnerba 8y agoI currently use Wire. Their apps are solid, not perfect thats for sure but good enough, but most importantly I am not required to use my phone number to register an account.
- tribby 8y agowhat kind of metadata does signal generate by using google cloud services (or whatever) to send push notifications?
- bilal4hmed 8y agohere you go https://www.reddit.com/r/signal/comments/ap9lin/gcm_notification/ https://www.reddit.com/r/signal/comments/ap9lin/gcm_notifica... Its amazing how paranoid some people are
- Whatitat90 8y agoThere are also these kinds of slip ups: https://news.ycombinator.com/item?id=18234849 https://news.ycombinator.com/item?id=18234849
- deleted 7y ago[deleted]
- gnuarch 8y agohttps://quicksy.im/ https://quicksy.im/ – a spin-off of the popular Jabber/XMPP client Conversations with automatic contact discovery. > Even if you are not a Quicksy user you can enter your Jabber ID into the Quicksy Directory and give Quicksy users the ability to automatically discover you based on your phone number. This lets you enjoy the privacy-friendly, federated nature of Jabber/XMPP while giving your less tech-savvy friends a low barrier entry into that world // not affiliated; saw this recently, like the idea.
- vector_spaces 8y agoFor some critique of Signal, Drew DeVault wrote this up several months ago: "I don't trust Signal" - https://drewdevault.com/2018/08/08/Signal.html https://drewdevault.com/2018/08/08/Signal.html Past discussion here on HN: https://news.ycombinator.com/item?id=17723973 https://news.ycombinator.com/item?id=17723973 Just posting for discussion. For me, the fact that Signal can only be downloaded via Google Play and not F-Droid. is a major blocker. For that reason I run a Matrix/synapse instance and that's what I use for day to day text based communication. Matrix clients have some issues and aren't as user friendly as Signal's IMHO, but they're getting better and better. That said, I don't think federation actually contributes to security. My instance is firewalled off from being discoverable by the larger Matrix community, mainly because my instance is for close friends and family. I can't really comment on what he brings up about the Signal founder -- not very familiar with him..
- socceroos 8y agoI love Signal and use it as my main communication platform, but the inherent metadata information disclosure doesn't make it the ideal secure communication platform. Right now, that title belongs to Briar in my opinion - it has a far more satisfactory security model in my opinion.
- Aelius 8y agoMy 2c I recently got signal because some friends made me. Given how old it is, I was shocked by how poor some aspects are. I liked using it as an android sms app, until I replied to one too many sms over signal because signal always defaults to signal, rather than whichever protocol the person sent you a message via. People uninstall the app, or use iOS. Signal constantly defaulting to a protocol the person on the other end isn't using was too much, so I stopped using signal as my sms app. I hate that, now that I've stopped using signal as my sms app, it wasn't storing sms in android's common sms store. Now chunks of history are missing, trapped in signal. The desktop client seems fundamentally broken, often taking 5-10 minutes to sync messages in. I hate that I can only mute conversations for 1 or 2 hours, 1 or 7 days, 1 year, or forever. I hate that I can't mute a group and still receive @s. I hate that it is tied to my phone number. I think signal offers a really bad experience. I prefer keybase, for many reasons. However when my mother and sister and grandmother needed a way to share pictures and videos (which mms would convert to garbage quality), I set them up with signal. Keybase's mobile client is, unfortunately, specifically bad at media. Signal is decent at it. Although, the keybase devs as recently as yesterday said they'll be polishing the mobile experience in the coming weeks. Maybe soon I can in good conscience not recommend signal and start pushing keybase among my family. Keybase did also recently streamlined their onboarding process to not require a password- you can just download and go. Edited for spelling errors.
- majkinetor 7y agoAll true. The worst offender is actually sync on desktop that can take anywhere between 5 to 50 minutes ! On-boarding of keybase was more complicated before, maybe its better now.
- rodmena 8y agoOh really? Endorsed by a guy who is working for Putin? cool.
- socceroos 7y agoI hear the commies endorse the use of air for breathing too. We need to find alternatives asap.
- charliebrownau 8y agoProblem with both SIGNAL and TELEGRAM is it "requires" you give your personal phone number to an overseas company
- throw2016 8y agoThose who depend on anonymity and security in any serious way should think carefully about using technology. Two whistle blowers in a row have been compromised in the last few months and are now in prison in their communication with theintercept. Don't trust anything you read online, if you need guidance try to reach out to trusted and well regarded experts in privacy and security ecosystems and do it in the real world face to face, not online. Cryptome has a decent faq on this. Signal is connected to your phone number. That's game over right there and then on any claims to security and anonymity. Things directly connected to your identity in an insecure OS as Android cannot deliver security or anonymity, and its dangerous to lull others into a false sense of security.