5 ms·

I use Signal because I think it protects my SMS messages It depends. I think calling them simply SMS messages instead of being more precise is misleading beca

I use Signal because I think it protects my SMS messages It depends. I think calling them simply SMS messages instead of being more precise is misleading because: Text messages sent through your mobile SMS/MMS plan are insecure and need your phone to be connected to your mobile network. and Signal Desktop does not send or receive SMS/MMS messages. Only Signal messages will be sent or received. The desktop app is an independent client that works whether or not your mobile device is present or online. We also want to encourage users to move away from insecure legacy protocols. https://support.signal.org/hc/en-us/articles/360007321171-Can-I-send-SMS-MMS-with-Signal- https://support.signal.org/hc/en-us/articles/360007321171-Ca... I find it very confusing.

motohagiography 6y ago
It has other features, but the main point of using Signal is to send encrypted messages to people using the PSTN directory service (e.g. phone numbers). You are still in that sandbox. The secondary feature it it ostensibly encrypts messages at rest on your device so they cannot be decrypted and read by other apps. (Assuming that's true.) If you want a more secure messenger, use Wickr, Riot/Matrix/whatever it's called now, or protonmail or something similar, as these don't depend on the phone directory for identity and so they resist some traffic analysis and contact tracing as well. The threat model is both the business model and use case for security products, so talking about the features or implementations outside the context of the threat model is going to just add uncertainty, imo.
- frabbit 6y ago
  Sure. Agreed. I was responding to your statement that you can send encrypted SMS messages using that handy PSTN directory access provided by Signal. You can't. I think this is a common misconception.
  - motohagiography 6y ago
    Open loop criticisms are why I often can't stand other security and crypto people. To be clear, if someone is a Signal user, you use their phone number for directory discovery and initializing identity, then Signal messages themselves are encrypted and transported via Signal servers using WebRTC as a transport protocol? I think without a sequence diagram, most discussion of security protocols is pointless.
    - frabbit 6y ago
      Signal does not send encrypted SMS messages. Period. It can send encrypted messages but they are not SMS. I think that without using the same words that other "security professionals" (which I would not class myself as) use most discussion becomes absolutely pointless.

motohagiography 6y ago

It has other features, but the main point of using Signal is to send encrypted messages to people using the PSTN directory service (e.g. phone numbers). You are still in that sandbox. The secondary feature it it ostensibly encrypts messages at rest on your device so they cannot be decrypted and read by other apps. (Assuming that's true.) If you want a more secure messenger, use Wickr, Riot/Matrix/whatever it's called now, or protonmail or something similar, as these don't depend on the phone directory for identity and so they resist some traffic analysis and contact tracing as well. The threat model is both the business model and use case for security products, so talking about the features or implementations outside the context of the threat model is going to just add uncertainty, imo.

frabbit 6y ago
Sure. Agreed. I was responding to your statement that you can send encrypted SMS messages using that handy PSTN directory access provided by Signal. You can't. I think this is a common misconception.
- motohagiography 6y ago
  Open loop criticisms are why I often can't stand other security and crypto people. To be clear, if someone is a Signal user, you use their phone number for directory discovery and initializing identity, then Signal messages themselves are encrypted and transported via Signal servers using WebRTC as a transport protocol? I think without a sequence diagram, most discussion of security protocols is pointless.
  - frabbit 6y ago
    Signal does not send encrypted SMS messages. Period. It can send encrypted messages but they are not SMS. I think that without using the same words that other "security professionals" (which I would not class myself as) use most discussion becomes absolutely pointless.