8 ms·

I was vouching for Signal for all my friends for years, supported them with donations, and was really rooting for them. However, I regrettably can't trust in mo

by 3np 6y ago

I was vouching for Signal for all my friends for years, supported them with donations, and was really rooting for them. However, I regrettably can't trust in moxie having the best intentions with Signal anymore. Lost count of the number of times this has been recycled on HN so I'm not taking the time to formulate this extremely well but: * For the longest time, requires phone number as identifier. When asked to remove this restriction, the reply is "so we can bootstrap off the phone's native contact application". But Android and iOS contacts have natively supported e-mail addresses on contacts since forever? And those could be optional? Every time the conversation has gone this far with anyone involved in Signal, silence/ghosting. * The whole PIN requirement debacle - where further amounts of metadata would be uploaded to Signal's servers (encrypted of course, with the PIN as passphrase of the key). Suddenly the app wouldn't start and users were locked out of all their Signal conversations (even reading them) without setting a PIN, no way to circumvent it. We were told this would be a strict requirement to be able to solve the above. After a lot of backlash they rolled it back after a week or so? * Hostility towards alternative implementations. * There's an open issue on GH for verified builds. Since 2015. Signal may be good today. What about tomorrow? I think the only durable and realistic solution (because let's face it, pure P2P for the mainstream is not the latter) is federation. Anyone feeling similarly should check out matrix.org. It may not be ready for the masses yet. But if we consider how we communicate in 5, 10, 20 years from now, it becomes obvious that we can't rely on a single actor as provider, regardless of how good they are today. The only way we get there is with people like the ones frequenting HN getting involved by using it, contributing, filing bugs, hosting home servers and using the clients.

lrvick 6y ago
These are all exact reasons I have never used Signal. Additionally I find concerning the choice to bet the farm on SGX which has been repeatedly broken with repeated opportunities to extract the keys, at which point cracking small numeric pins is trivial. Moxie simply promised they always patch right away and never take the keys when they have such opportunities to do so. I do believe him, today, but I don't believe he is above being threatened or coerced tomorrow or that he won't get replaced by someone that cooperates better with state powers as happened with VK and countless others. I also took issue with Signal having central network metadata chokepoints his DCs or ISP could do timing heuristics on even if he does not. I tried to engage with Moxie about these issues but he dismissed each as things we will mostly have to accept because he feels it is not possible to create and rapidly improve a privacy focused communication tool for the masses that isn't produced and controlled by a single large company. Moxie is brilliant, and his contributions to cryptography and bringing education on privacy and end to end encryption to millions can't be overstated. The problem is Moxie and Signal are struggling to engineer best efforts under an assumption they treat like a law of nature: No end to end end encrypted messaging platform can succeed without complete centralization. I operate under a different assumption: No centralized platform will ever escape censorship and control by the government it operates under. Moxie has said before he is happy to be proven wrong. I hope as Matrix and others continue to prove him wrong with his own cryptography research that he comes around and rejoins the fight for a decentralized internet with irrevocable privacy.
- tptacek 6y ago
  You can't coherently be alarmed by Signal's use of SGX while at the same time endorsing systems that use no cryptography whatsoever to protect the metadata Signal uses SGX for.
  - saagarjha 6y ago
    I’m not sure that that’s the only conclusion you can draw. Some systems choose to not handle that metadata, which often makes them a worse service but they make that choice by looking at the landscape and choosing to not use SGX. The other plausible argument is that Signal uses SGX, which is better than nothing, but in selling it as more secure than it is they do more harm than good.
    - JshWright 6y ago
      Some people choose not to turn their servers on at all. It makes for a worse server, but it's very secure. Security is always about tradeoffs and compromises. A system that is very, very good, but not perfect and widely used is far preferable to a system that is perfect but used by no one.
      - saagarjha 6y ago
        Right, but in this case the choice is "should I be able to discover contacts" and some people just don't desire that feature enough.
        cwyers 6y ago
        Who, though? Matrix has contact discovery, doesn't it?
        Reelin 6y ago
        If and only if you opt in to it. It's difficult to understate how important that is.
schoolornot 6y ago
I have some concerns around the Signal foundation: The initial $50M in funding was a loan, not a donation, from Brian Acton to the new nonprofit Signal Technology Foundation. By the end of 2018, the loan had increased to $105,000,400, which is due to be repaid on February 28, 2068. The loan is unsecured and at 0% interest.[5] The Foundation is completely controlled by Brian Acton, who is the sole "member" of the nonprofit, with the right to appoint or remove every member of the Board of Directors. The Board consists of Acton and Marlinspike. Acton is also the President.[5]
- sk2020 6y ago
  Is there a reason to suspect Brian Acton’s motives? I’m always skeptical of celebrity-hackers, but I don’t know why I should be worried about Acton in particular.
  - walrus01 6y ago
    I sincerely hope that he is like a younger version of Mitch Kapor, who used his money to launch the EFF. https://en.wikipedia.org/wiki/Mitch_Kapor https://en.wikipedia.org/wiki/Mitch_Kapor I would be very disappointed if I found out that Acton had any hidden motivations behind his philanthropic support.
- codethief 6y ago
  I think you intended to link the sources but you didn't. Could you still provide them please? I'd be very interested in where those numbers come from.
  - joecool1029 6y ago
    Here's the foundation's Form 990 from 2018: https://projects.propublica.org/nonprofits/display_990/824506840/12_2019_prefixes_82-86%2F824506840_201812_990_2019121216951146 https://projects.propublica.org/nonprofits/display_990/82450...
    - codethief 6y ago
bawolff 6y ago
There is a reason why signal is relatively mainstream succesful (by crypto product standards) and PGP wasn't. Its because its willing to make tradeoffs in the name of usability (while still emphasizing security). A secure messenger product nobody uses helps nobody's security.
- nullc 6y ago
  Many of the security design flaws in signal have had little to no direct impact on usability. For example, for years we asked for a simple mechanism which could be used to view a users key and mark it as identified, to prevent MITM -- even one buried in a menu for advanced users (who could at least act as canaries against widespread interception). Not only was the request turned down but usually responded to with vigorous personal attacks against the requesters. Subsequently once a fingerprint validation method was added it was gratuitously bound to be pair-wise, making it largely unusuable -- e.g. post a pgp signed signal fingerprint that any of your contacts could use to transfer trust from an existing key. Requests for a non-pairwise version, even as just some advanced thing that grandma never sees ... again, hostility. The constant logic-bombed auto-expiring software that make signal effectively open-source-in-name-only. etc. I think signal is fine as an insecure messanger: Unencrypted communications protocols should have no place in on the internet today. But to advance it as a security tool almost certainly puts people's lives and freedom at risk. Common usage of signal has zero security against MITM: users aren't effectively notified that the contacts keys have changed-- and given how often users lose/wipe phones perhaps that's really the best that can be done for normy friendly software. If that's how it is, that's how it is. Some resistance against passive monitoring is still a critical upgrade. But don't call it secure: if you do people will do and say things using it that they wouldn't otherwise.
  - hackerfromthefu 6y ago
    Can the downvoters please respond to the post with the reasons why they are downvoting?
    - nullc 6y ago
cwkoss 6y ago
I've also heard that Signal on android leaks message text because of google's keyboard auto-prediction feature. They should implement their own keyboard or find a way to disable text prediction - and educate their users.
- lrvick 6y ago
  In general I would not expect much privacy from a stock Android device on any chat tool considering they shamelessly ship lots of third party blobs carriers demand be included, some of which like OMA-DM toolkits have sweeping permissions on your device. On Apple this is less true, but it is also a centralized black box that grants you no freedom, and apps can be banned at any time with little recourse. You could use something other than Android like PostmarketOS or Librem5 however odds are Signal won't create clients for those platforms considering Moxie has stated publicly he prefers distribution through proprietary channels in order to collect usage stats. Moxie has also stated he will actively fight any third party clients that try to join his network, so we won't likely see many of those attempted for alternative platforms either.
  - joecool1029 6y ago
    > some of which like OMA-DM toolkits have sweeping permissions on your device. Fortunately this seems to be going away. For those not aware as to what you're talking about, this is the proprietary 'rootkit' providers like Sprint had to use to activate CDMA modems on their carriers on many of their devices that did not come with a CSIM. As it's doing a lot with the phone's modem, it needs tons of permissions on the device. Verizon Wireless and Google Fi also had similar apk's that were required to provision phones and update PRL (prority roaming list) information. In the US all modern devices on Verizon are CDMA-less and new Sprint customers are usually activated on T-Mobile network (with fallback to GSM/WCDMA not CDMA).
- jfim 6y ago
  On Android, Signal sets the flag on the text entry box that disables IME personalization, the same way that the text entry box works in Chrome's incognito mode. Whether or not Google respects it is not clear, but it does show a little incognito mode icon on the keyboard.

by 3np 6y ago

lrvick 6y ago

These are all exact reasons I have never used Signal. Additionally I find concerning the choice to bet the farm on SGX which has been repeatedly broken with repeated opportunities to extract the keys, at which point cracking small numeric pins is trivial. Moxie simply promised they always patch right away and never take the keys when they have such opportunities to do so. I do believe him, today, but I don't believe he is above being threatened or coerced tomorrow or that he won't get replaced by someone that cooperates better with state powers as happened with VK and countless others. I also took issue with Signal having central network metadata chokepoints his DCs or ISP could do timing heuristics on even if he does not. I tried to engage with Moxie about these issues but he dismissed each as things we will mostly have to accept because he feels it is not possible to create and rapidly improve a privacy focused communication tool for the masses that isn't produced and controlled by a single large company. Moxie is brilliant, and his contributions to cryptography and bringing education on privacy and end to end encryption to millions can't be overstated. The problem is Moxie and Signal are struggling to engineer best efforts under an assumption they treat like a law of nature: No end to end end encrypted messaging platform can succeed without complete centralization. I operate under a different assumption: No centralized platform will ever escape censorship and control by the government it operates under. Moxie has said before he is happy to be proven wrong. I hope as Matrix and others continue to prove him wrong with his own cryptography research that he comes around and rejoins the fight for a decentralized internet with irrevocable privacy.

tptacek 6y ago
You can't coherently be alarmed by Signal's use of SGX while at the same time endorsing systems that use no cryptography whatsoever to protect the metadata Signal uses SGX for.
- saagarjha 6y ago
  I’m not sure that that’s the only conclusion you can draw. Some systems choose to not handle that metadata, which often makes them a worse service but they make that choice by looking at the landscape and choosing to not use SGX. The other plausible argument is that Signal uses SGX, which is better than nothing, but in selling it as more secure than it is they do more harm than good.
  - JshWright 6y ago
    Some people choose not to turn their servers on at all. It makes for a worse server, but it's very secure. Security is always about tradeoffs and compromises. A system that is very, very good, but not perfect and widely used is far preferable to a system that is perfect but used by no one.
    - saagarjha 6y ago
      Right, but in this case the choice is "should I be able to discover contacts" and some people just don't desire that feature enough.
      - cwyers 6y ago
        Who, though? Matrix has contact discovery, doesn't it?
        Reelin 6y ago
        If and only if you opt in to it. It's difficult to understate how important that is.

schoolornot 6y ago

I have some concerns around the Signal foundation: The initial $50M in funding was a loan, not a donation, from Brian Acton to the new nonprofit Signal Technology Foundation. By the end of 2018, the loan had increased to $105,000,400, which is due to be repaid on February 28, 2068. The loan is unsecured and at 0% interest.[5] The Foundation is completely controlled by Brian Acton, who is the sole "member" of the nonprofit, with the right to appoint or remove every member of the Board of Directors. The Board consists of Acton and Marlinspike. Acton is also the President.[5]

sk2020 6y ago
Is there a reason to suspect Brian Acton’s motives? I’m always skeptical of celebrity-hackers, but I don’t know why I should be worried about Acton in particular.
- walrus01 6y ago
  I sincerely hope that he is like a younger version of Mitch Kapor, who used his money to launch the EFF. https://en.wikipedia.org/wiki/Mitch_Kapor https://en.wikipedia.org/wiki/Mitch_Kapor I would be very disappointed if I found out that Acton had any hidden motivations behind his philanthropic support.
codethief 6y ago
I think you intended to link the sources but you didn't. Could you still provide them please? I'd be very interested in where those numbers come from.
- joecool1029 6y ago
  Here's the foundation's Form 990 from 2018: https://projects.propublica.org/nonprofits/display_990/824506840/12_2019_prefixes_82-86%2F824506840_201812_990_2019121216951146 https://projects.propublica.org/nonprofits/display_990/82450...
  - codethief 6y ago

bawolff 6y ago

There is a reason why signal is relatively mainstream succesful (by crypto product standards) and PGP wasn't. Its because its willing to make tradeoffs in the name of usability (while still emphasizing security). A secure messenger product nobody uses helps nobody's security.

nullc 6y ago
Many of the security design flaws in signal have had little to no direct impact on usability. For example, for years we asked for a simple mechanism which could be used to view a users key and mark it as identified, to prevent MITM -- even one buried in a menu for advanced users (who could at least act as canaries against widespread interception). Not only was the request turned down but usually responded to with vigorous personal attacks against the requesters. Subsequently once a fingerprint validation method was added it was gratuitously bound to be pair-wise, making it largely unusuable -- e.g. post a pgp signed signal fingerprint that any of your contacts could use to transfer trust from an existing key. Requests for a non-pairwise version, even as just some advanced thing that grandma never sees ... again, hostility. The constant logic-bombed auto-expiring software that make signal effectively open-source-in-name-only. etc. I think signal is fine as an insecure messanger: Unencrypted communications protocols should have no place in on the internet today. But to advance it as a security tool almost certainly puts people's lives and freedom at risk. Common usage of signal has zero security against MITM: users aren't effectively notified that the contacts keys have changed-- and given how often users lose/wipe phones perhaps that's really the best that can be done for normy friendly software. If that's how it is, that's how it is. Some resistance against passive monitoring is still a critical upgrade. But don't call it secure: if you do people will do and say things using it that they wouldn't otherwise.
- hackerfromthefu 6y ago
  Can the downvoters please respond to the post with the reasons why they are downvoting?
  - nullc 6y ago

cwkoss 6y ago

I've also heard that Signal on android leaks message text because of google's keyboard auto-prediction feature. They should implement their own keyboard or find a way to disable text prediction - and educate their users.

lrvick 6y ago
In general I would not expect much privacy from a stock Android device on any chat tool considering they shamelessly ship lots of third party blobs carriers demand be included, some of which like OMA-DM toolkits have sweeping permissions on your device. On Apple this is less true, but it is also a centralized black box that grants you no freedom, and apps can be banned at any time with little recourse. You could use something other than Android like PostmarketOS or Librem5 however odds are Signal won't create clients for those platforms considering Moxie has stated publicly he prefers distribution through proprietary channels in order to collect usage stats. Moxie has also stated he will actively fight any third party clients that try to join his network, so we won't likely see many of those attempted for alternative platforms either.
- joecool1029 6y ago
  > some of which like OMA-DM toolkits have sweeping permissions on your device. Fortunately this seems to be going away. For those not aware as to what you're talking about, this is the proprietary 'rootkit' providers like Sprint had to use to activate CDMA modems on their carriers on many of their devices that did not come with a CSIM. As it's doing a lot with the phone's modem, it needs tons of permissions on the device. Verizon Wireless and Google Fi also had similar apk's that were required to provision phones and update PRL (prority roaming list) information. In the US all modern devices on Verizon are CDMA-less and new Sprint customers are usually activated on T-Mobile network (with fallback to GSM/WCDMA not CDMA).
jfim 6y ago
On Android, Signal sets the flag on the text entry box that disables IME personalization, the same way that the text entry box works in Chrome's incognito mode. Whether or not Google respects it is not clear, but it does show a little incognito mode icon on the keyboard.