5 ms·

Tories switch to messaging app Signal after WhatsApp leaks

27 points by utopian3 7y ago

deogeo 7y ago
How does "option to make messages automatically disappear after a set period of time" and "open source" fit together?
- noman-land 7y ago
  This is a confusing question. The two seem to have nothing to do with each other. Open source means the source code is available to read. Disappearing messages means you can delete things from your device and ask the other side to delete them as well.
  - closeparen 7y ago
    A user who is in control of their client software can just comment out the self destruct part.
    - noman-land 7y ago
      Exactly. Or they could just take a screenshot or a slew of other things. One of the reasons Signal use deniable encryption is because if a message that supposedly comes from you is sitting in someone else's chat, they have no way of proving that you sent it vs them putting it there.
    - geofft 7y ago
      Not necessarily - Signal can show a warning icon to people they're having conversations with / only enable the feature if everyone in the group is on an official client. Nothing about it being open source prevents this, and conversely, making Signal closed source wouldn't prevent people exfiltrating content via jailbroken phones etc. (Or via screenshots, as others have mentioned.)
      - deleted 7y ago
        [deleted]
      - deogeo 7y ago
        A modified client could simply claim to be official.
        geofft 7y ago
        Do the mobile platforms give you a way to authenticate an app as the official app of a certain ID? I thought they did but now that I think harder I'm not actually sure how to implement it. If they do, it's "just" that plus jailbreak detection.
    - 0-_-0 7y ago
      A user who is in control of their phone can just take a photo of the screen, even if the software is closed source.
- ryukafalz 7y ago
  You’re requesting that the other side delete the message after a set period of time. The client on the other side could save the message instead, but realistically it probably won’t. This depends on you trusting the other conversation party - but it would in any case, as there are so many ways to save a message that’s on your device. Even if you assume the most draconian, user-hostile device imaginable, all it takes is a camera pointed at the screen to defeat. It’s just not worth it.
- adrianmonk 7y ago
  The Signal site has a reasonable answer for this. From https://support.signal.org/hc/en-us/articles/360007320771-Set-and-manage-disappearing-messages https://support.signal.org/hc/en-us/articles/360007320771-Se... : > This is not for situations where your contact is your adversary — after all, if someone who receives a disappearing message really wants a record of it, they can always use another camera to take a photo of the screen before the message disappears. In other words, the way they describe it, use cases for disappearing messages would be limited to ones where you trust your conversation partner(s). Basically it is a cooperative data retention feature.
n4r9 7y ago
> Killock said: ... "I guess Priti Patel must be quite confused and alarmed as her party votes with its feet for secure messaging platforms, while she’s campaigning to stop them from protecting these very same users." I'm sure Killock's tongue was firmly in his cheek when he said this, but of course Patel is unlikely to experience either emotion. A lot of the UK political establishment have an attitude of "one rule for us, another for the hoi polloi". Patel is certainly not an exception.

27 points by utopian3 7y ago

deogeo 7y ago

How does "option to make messages automatically disappear after a set period of time" and "open source" fit together?

noman-land 7y ago
This is a confusing question. The two seem to have nothing to do with each other. Open source means the source code is available to read. Disappearing messages means you can delete things from your device and ask the other side to delete them as well.
- closeparen 7y ago
  A user who is in control of their client software can just comment out the self destruct part.
  - noman-land 7y ago
    Exactly. Or they could just take a screenshot or a slew of other things. One of the reasons Signal use deniable encryption is because if a message that supposedly comes from you is sitting in someone else's chat, they have no way of proving that you sent it vs them putting it there.
  - geofft 7y ago
    Not necessarily - Signal can show a warning icon to people they're having conversations with / only enable the feature if everyone in the group is on an official client. Nothing about it being open source prevents this, and conversely, making Signal closed source wouldn't prevent people exfiltrating content via jailbroken phones etc. (Or via screenshots, as others have mentioned.)
    - deleted 7y ago
      [deleted]
    - deogeo 7y ago
      A modified client could simply claim to be official.
      - geofft 7y ago
        Do the mobile platforms give you a way to authenticate an app as the official app of a certain ID? I thought they did but now that I think harder I'm not actually sure how to implement it. If they do, it's "just" that plus jailbreak detection.
  - 0-_-0 7y ago
    A user who is in control of their phone can just take a photo of the screen, even if the software is closed source.
ryukafalz 7y ago
You’re requesting that the other side delete the message after a set period of time. The client on the other side could save the message instead, but realistically it probably won’t. This depends on you trusting the other conversation party - but it would in any case, as there are so many ways to save a message that’s on your device. Even if you assume the most draconian, user-hostile device imaginable, all it takes is a camera pointed at the screen to defeat. It’s just not worth it.
adrianmonk 7y ago
The Signal site has a reasonable answer for this. From https://support.signal.org/hc/en-us/articles/360007320771-Set-and-manage-disappearing-messages https://support.signal.org/hc/en-us/articles/360007320771-Se... : > This is not for situations where your contact is your adversary — after all, if someone who receives a disappearing message really wants a record of it, they can always use another camera to take a photo of the screen before the message disappears. In other words, the way they describe it, use cases for disappearing messages would be limited to ones where you trust your conversation partner(s). Basically it is a cooperative data retention feature.

n4r9 7y ago

> Killock said: ... "I guess Priti Patel must be quite confused and alarmed as her party votes with its feet for secure messaging platforms, while she’s campaigning to stop them from protecting these very same users." I'm sure Killock's tongue was firmly in his cheek when he said this, but of course Patel is unlikely to experience either emotion. A lot of the UK political establishment have an attitude of "one rule for us, another for the hoi polloi". Patel is certainly not an exception.