3 ms·

Can the downvoters please respond to the post with the reasons why they are downvoting?

• nullc 6y ago
  I assume it's a defensible question of priorities. In spite of the many issues to complain about signal it's still a lot better than what $random_person would likely use otherwise. Do we do the most good for the world by under-representing signal's weaknesses and overstating its security in order to maximize the people using it over choices that are worse and cheerlead its development, or do we do the most good by trying to be frank and being critical of its limitations (at least some of which are pretty nitpicky), potentially at the expense of the discussion causing people to continue using clearly worse alternatives? Personally I answer this conflict like this: Outside of a techy venue I don't go into any details about signal's limitations-- I tell people they should use it, but don't assume it keeps them private from governments, google, or other powerful parties.
• akvadrako 6y ago
  You claim that MitM attacks are possible because keys can change without being notified. Can you provide more details on that? I’ve been using signal for years and often get key change notices.
  • nullc 6y ago
    You only get a low visibility notice ( https://signal.org/blog/images/safety-numbers-advisory.png https://signal.org/blog/images/safety-numbers-advisory.png ) which the counterparty can immediately scroll off. And even there, if I send a message to you and on receipt the software finds that your key has changed, my client sends it again to the new key. Which means that even if I was savvy enough to catch the message, it's tool late and potentially a critical secret has already been disclosed to a MITM by the time I see it.