3 ms·

Somewhat tangential, I got into an argument about Signal last night. The other guy claimed that Signal was insecure because: * It's "Custodial E2EE" * Needs a

Somewhat tangential, I got into an argument about Signal last night. The other guy claimed that Signal was insecure because: * It's "Custodial E2EE" * Needs a phone number (I'm not going to bother with his complaints about the crappiness of the desktop client or convenience of the design because those are non-sequiturs to the security of the app) I asked him to define "Custodial E2EE". His words: "They have ownership of my keys, use phone number auth to access them and I cant expatriate them" I managed to suppress my xkcd-386 instinct and go to bed, but my intuition is still that he's quite wrong about that. I may or may not resume my arguement with him; I got the impression that his disagrements were rooted in a Matrix fanboyism, but I'd like to be equipped to refute such arguments in the future. I can somewhat sympathize with the phone number argument, and I think it comes from a concern about metadata leaks or opsec. I think that concern ultimately stems from a wrong threat model, but I'm not sure how to refute that. I have however, come across a number of tutorials which cover how to register a Signal account without using your phone numbers, so I feel confident I can refute the argument that signal must have your phone number, even if I can't refute the underlying wrong thinking. Regarding the "Custodial E2EE" argument, I'm not sure where to begin. Anyone have any suggestions?

jcrawfordor 6y ago
On the first point, their understanding of Signal's key management doesn't seem to be correct. The private key is held only by the client on the mobile phone, which is one of the reasons that the desktop client is rather clumsy - it is dependent on the mobile app for initial key setup. It's also just very slow compared to the mobile app. On the second point, I think they are quite correct. Yes, this depends on your use-case, but I consider the ability to have multiple and disposable identities to be somewhat critical to any messaging system calling itself suitable for security-sensitive use. Unfortunately, Signal is designed explicitly to make multiple or disposable identities impractical. Above and beyond their desire to be a drop-in replacement for SMS, a reason for this is almost certainly to reduce spam, as the need for a valid phone number makes it difficult to register accounts en masse. In general, this method to mitigating abuse means that Signal cannot practically be used anonymously, which somewhat conflicts with the popularity of Signal as a mechanism for e.g. contacting journalists. In the vein of criticizing Signal, I would also throw out that it largely abandons the problem of key distribution, effectively implementing a TOFU model that is lightly enforced at that, with "safety number changes" being pretty much normal. It is possible to verify Signal identities out-of-band but not common, and the Signal app does not really provide much tooling to make it easier. I wouldn't say that Signal is bad, it does a great job of implementing effectively the identity semantics of SMS (including the shortcomings) but with the addition of E2E encryption and TOFU. I would stop short anyone who claims Signal to be a "perfect" or "complete" solution for encrypted messaging as there are common use cases that it has actively decided not to address. I'm also, to be honest, somewhat baffled that your starting position seems to be that no criticism of Signal could possibly be valid, when attributing the other's viewpoint to fanboyism. Don't take that too seriously, it just stood out to me on reading. :)
- korethr 6y ago
  >I'm also, to be honest, somewhat baffled that your starting position seems to be that no criticism of Signal could possibly be valid, when attributing the other's viewpoint to fanboyism. Don't take that too seriously, it just stood out to me on reading. :) Touche. That wasn't my position, but re-reading what I posted, I agree that's it unnecessarily implies that position. Part of me wants to correct that, but I think I'll own my words and leave it there.

jcrawfordor 6y ago

On the first point, their understanding of Signal's key management doesn't seem to be correct. The private key is held only by the client on the mobile phone, which is one of the reasons that the desktop client is rather clumsy - it is dependent on the mobile app for initial key setup. It's also just very slow compared to the mobile app. On the second point, I think they are quite correct. Yes, this depends on your use-case, but I consider the ability to have multiple and disposable identities to be somewhat critical to any messaging system calling itself suitable for security-sensitive use. Unfortunately, Signal is designed explicitly to make multiple or disposable identities impractical. Above and beyond their desire to be a drop-in replacement for SMS, a reason for this is almost certainly to reduce spam, as the need for a valid phone number makes it difficult to register accounts en masse. In general, this method to mitigating abuse means that Signal cannot practically be used anonymously, which somewhat conflicts with the popularity of Signal as a mechanism for e.g. contacting journalists. In the vein of criticizing Signal, I would also throw out that it largely abandons the problem of key distribution, effectively implementing a TOFU model that is lightly enforced at that, with "safety number changes" being pretty much normal. It is possible to verify Signal identities out-of-band but not common, and the Signal app does not really provide much tooling to make it easier. I wouldn't say that Signal is bad, it does a great job of implementing effectively the identity semantics of SMS (including the shortcomings) but with the addition of E2E encryption and TOFU. I would stop short anyone who claims Signal to be a "perfect" or "complete" solution for encrypted messaging as there are common use cases that it has actively decided not to address. I'm also, to be honest, somewhat baffled that your starting position seems to be that no criticism of Signal could possibly be valid, when attributing the other's viewpoint to fanboyism. Don't take that too seriously, it just stood out to me on reading. :)

korethr 6y ago
>I'm also, to be honest, somewhat baffled that your starting position seems to be that no criticism of Signal could possibly be valid, when attributing the other's viewpoint to fanboyism. Don't take that too seriously, it just stood out to me on reading. :) Touche. That wasn't my position, but re-reading what I posted, I agree that's it unnecessarily implies that position. Part of me wants to correct that, but I think I'll own my words and leave it there.