6 ms·

Signal’s claim to fame here is that they were subpoenaed in 2016 and could only supply account creation and last connection times: > The American Civil Liberti

Signal’s claim to fame here is that they were subpoenaed in 2016 and could only supply account creation and last connection times: > The American Civil Liberties Union announced Tuesday that Open Whisper Systems (OWS), the company behind popular encrypted messaging app Signal, was subpoenaed earlier this year by a federal grand jury in the Eastern District of Virginia to hand over a slew of information—"subscriber name, addresses, telephone numbers, email addresses, method of payment"—on two of its users. > ... “The only information responsive to the subpoena held by OWS is the time of account creation and the date of the last connection to Signal servers,” Kaufman continued, also pointing out that the company did in fact hand over this data. https://arstechnica.com/tech-policy/2016/10/fbi-demands-signal-user-data-but-theres-not-much-to-hand-over/ https://arstechnica.com/tech-policy/2016/10/fbi-demands-sign...

argggg 6y ago
This, more than anything, is why I trust them and recommend them to others.
deleted 6y ago
[deleted]
Kuraj 6y ago
Is it possible that they could in fact produce this data but were prevented from publicly saying so due to a gag order? I'm asking specifically because I remember Private Internet Access, a VPN provider, also being tested in court in the past [1], and because of this I've chosen to trust them despite them falling under Five Eyes jurisdiction. [1] https://torrentfreak.com/private-internet-access-no-logging-claims-proven-true-again-in-court-180606/ https://torrentfreak.com/private-internet-access-no-logging-...
- sithadmin 6y ago
  PIA used to be my go-to, but I immediately ceased using PIA after the 2019 acquisition by Kape Technologies, which has a rather foul track record.
  - dave_sullivan 6y ago
    What did you switch to?
    - ndiscussion 6y ago
      not the GP but I switched from PIA to Mullvad
    - geraltofrivia 6y ago
      I’ve been using Mullvad since the past few years and I’ve no complaints. The fact that the recent Mozilla VPN is based on Mullvad makes me more confident in my decision.
      - dorchadas 6y ago
        I switched from PIA to Mullvad too for that reason and have absolutely no complaints. Wish I had done them first!
      - godelmachine 6y ago
        Did you consider NordVPN? I like the fact that I get to login from anywhere in the world. My default choice is Sweden since they have the most lax copyright laws in the world, so subpoenaing any Swedish server gonna be tough. They also offered me unavoidable discount.
        godelski 6y ago
        > I like the fact that I get to login from anywhere in the world. This is a fairly common practice and my understanding is that every major and most minor VPN services offer this.
        godelmachine 6y ago
        I never knew. Is it available on PIA and Mullvad?
- chimeracoder 6y ago
  > Is it possible that they could in fact produce this data but were prevented from publicly saying so due to a gag order? Unlikely. Signal and the ACLU were the ones who filed suit to allow them to disclose the terms of the warrant the first place. It would be an incredibly expensive and risky move for them to do so if they knew that the judge could force them to reveal that they've been turning over more detailed user data in secret. Not to mention that it would have amounted to perjury.
- cmroanirgo 6y ago
  Signal has blogged all the answers to these questions. https://signal.org/bigbrother/eastern-virginia-grand-jury/ https://signal.org/bigbrother/eastern-virginia-grand-jury/ In short, the ACLU helped them to lift the gag order, and the blog itself shows the legal documents. The documents show exactly the data returned (Account creation and last access in Unix millis). Only the phone numbers are still redacted.
- godelmachine 6y ago
  That’s one point in favor of PIA. I chose NordVPN coz we can access from any server in the world and they have offered me good discount
  - gruez 6y ago
    >I chose NordVPN coz we can access from any server in the world and they have offered me good discount That describes literally most of the VPN service offerings out there.
  - dewey 6y ago
    Are you aware of the controversies around NordVPN? https://en.wikipedia.org/wiki/NordVPN#Security_issues_and_controversies https://en.wikipedia.org/wiki/NordVPN#Security_issues_and_co...
    - godelmachine 6y ago
      Thanks for highlighting this. I also read somewhere their CEO did something comprising to churn in more profits. Maybe I will think about buying Mullvad subscription.
- michaelmrose 6y ago
  They were bought by an adware tech company last year AFTER the events of the article you linked. I would suggest mullvad as a good alternative. I've had better speed and as good ease of use.
jwr 6y ago
I think this discussion should also mention that Signal is a non-profit organization, dedicated to enabling secure and private communications. Yes, it's not strong proof, but it should be taken into account when comparing the goals and motivations of organizations developing various other communicators. The organization behind your communicator app could be in the business of gathering data about you and selling it in various forms (Facebook, Google), in the business of selling hardware and add-on software services (Apple), or in the non-business of trying to provide you with private communications.
- grier 6y ago
  > a non-profit organization > should be taken into account when comparing the goals and motivations of organizations developing various other communicators. Business or funding models can change for both for- and non-profit organizations. Especially as people move to options that are believed to have better user-privacy, the idea that they do not sell/monetize collected user data today does not indicate what they will do tomorrow. Unless users have strong evidence that companies are not collecting and/or monetizing this information (which as the OP pointed out, there is for Signal as found in a subpoena), the "billboard" approach towards promising user privacy via marketing and PR is a shallow one at best for non-profits as well as for-profit companies.
  - spicybright 6y ago
    Whenever I see an ad flaunting privacy guarantees, I ask myself "How would a honey pot for gathering user's information be advertised?" Exactly the same way. That said, at the end of the day you have to trust SOMEONE if you want to use digital communications. And there's certainly a difference between facebook and GPG email encryption. It's just a matter of balancing convenience and privacy for your personal use case.
- TrueDuality 6y ago
  I prefer to look at the history of who founded and continues to run the Signal Foundation... Moxie Marlinspike. Moxie has a long history of improving security in all kinds of tech and fighting for privacy. The Signal app itself is opensource as well various pieces of the tech stack. You can audit yourself what is being sent and how their protocols work. The protocol itself has won awards due to its security and elegance. There is a lot of good things to say about Signal and you can easily find it all. They have made some annoying or less than ideal features that are opt-out instead of opt-in but they're not sacrificing privacy for them.
Mediterraneo10 6y ago
Signal may have only supplied that metadata at the time. But what I am concerned about is that if Signal is US-based, couldn’t the state demand Signal’s app signing key via a NSL, and couldn’t that signing key then be used for targeted attacks by which someone of interest gets a Signal app upgrade that is malicious (while everyone else gets the non-malicious app)? I admit to being somewhat unfamiliar with Android distribution through the Play Store, so if this is unfeasible, help me understand why.
- restingrobot 6y ago
  Technically they could get the signature key, but they can't force Signal to publish it via the store. Users would have to download an .apk file and install it directly. At that point there is no reason to have the signing key at all as the phone will recognize a sideload as a third party install. As far as I know, the government cannot compel a company to do something like update an app.
  - Mediterraneo10 6y ago
    > but they can't force Signal to publish it via the store Is there not a suspicion that Google, another US-based corporation, may have some agreement with American national security to supply malicious APKs to individual targets via the Play Store? Having Signal’s signing key would allow the state to present that custom-targeted APK as an ordinary Signal version update.
    - vel0city 6y ago
      While I'm not saying Google hasn't done something like this (I have no proof either way) there's a strong legal argument to be made that forcing a company to produce binaries is compelled speech which goes against the first amendment.
- bigiain 6y ago
  Yes. But if you specifically are targeted by organisations capable of issuing NSLs, you're completely hosed already. (And they're just as likely, if not more so, to have done that to your OS instead of just the Signal app.)
1vuio0pswjnm7 6y ago
"And Mr. Musk's endorsement of Signal last week sent publicly traded shares of Signal Advance Inc., a small medical device maker, soaring from a roughly $50 million market value to more than $3 billion. (The company has no relation to the messaging app.)" https://www.nytimes.com/2021/01/13/technology/telegram-signal-apps-big-tech.html https://www.nytimes.com/2021/01/13/technology/telegram-signa...
- k__ 6y ago
  lol Can they keep the money?
  - abrookewood 6y ago
    That's not how the share market works ...
    - InvertedRhodium 6y ago
      It is if they can sell (their shares) quick enough!

argggg 6y ago

This, more than anything, is why I trust them and recommend them to others.

deleted 6y ago

[deleted]

Kuraj 6y ago

Is it possible that they could in fact produce this data but were prevented from publicly saying so due to a gag order? I'm asking specifically because I remember Private Internet Access, a VPN provider, also being tested in court in the past [1], and because of this I've chosen to trust them despite them falling under Five Eyes jurisdiction. [1] https://torrentfreak.com/private-internet-access-no-logging-claims-proven-true-again-in-court-180606/ https://torrentfreak.com/private-internet-access-no-logging-...

sithadmin 6y ago
PIA used to be my go-to, but I immediately ceased using PIA after the 2019 acquisition by Kape Technologies, which has a rather foul track record.
- dave_sullivan 6y ago
  What did you switch to?
  - ndiscussion 6y ago
    not the GP but I switched from PIA to Mullvad
  - geraltofrivia 6y ago
    I’ve been using Mullvad since the past few years and I’ve no complaints. The fact that the recent Mozilla VPN is based on Mullvad makes me more confident in my decision.
    - dorchadas 6y ago
      I switched from PIA to Mullvad too for that reason and have absolutely no complaints. Wish I had done them first!
    - godelmachine 6y ago
      Did you consider NordVPN? I like the fact that I get to login from anywhere in the world. My default choice is Sweden since they have the most lax copyright laws in the world, so subpoenaing any Swedish server gonna be tough. They also offered me unavoidable discount.
      - godelski 6y ago
        > I like the fact that I get to login from anywhere in the world. This is a fairly common practice and my understanding is that every major and most minor VPN services offer this.
        godelmachine 6y ago
        I never knew. Is it available on PIA and Mullvad?
chimeracoder 6y ago
> Is it possible that they could in fact produce this data but were prevented from publicly saying so due to a gag order? Unlikely. Signal and the ACLU were the ones who filed suit to allow them to disclose the terms of the warrant the first place. It would be an incredibly expensive and risky move for them to do so if they knew that the judge could force them to reveal that they've been turning over more detailed user data in secret. Not to mention that it would have amounted to perjury.
cmroanirgo 6y ago
Signal has blogged all the answers to these questions. https://signal.org/bigbrother/eastern-virginia-grand-jury/ https://signal.org/bigbrother/eastern-virginia-grand-jury/ In short, the ACLU helped them to lift the gag order, and the blog itself shows the legal documents. The documents show exactly the data returned (Account creation and last access in Unix millis). Only the phone numbers are still redacted.
godelmachine 6y ago
That’s one point in favor of PIA. I chose NordVPN coz we can access from any server in the world and they have offered me good discount
- gruez 6y ago
  >I chose NordVPN coz we can access from any server in the world and they have offered me good discount That describes literally most of the VPN service offerings out there.
- dewey 6y ago
  Are you aware of the controversies around NordVPN? https://en.wikipedia.org/wiki/NordVPN#Security_issues_and_controversies https://en.wikipedia.org/wiki/NordVPN#Security_issues_and_co...
  - godelmachine 6y ago
    Thanks for highlighting this. I also read somewhere their CEO did something comprising to churn in more profits. Maybe I will think about buying Mullvad subscription.
michaelmrose 6y ago
They were bought by an adware tech company last year AFTER the events of the article you linked. I would suggest mullvad as a good alternative. I've had better speed and as good ease of use.

jwr 6y ago

I think this discussion should also mention that Signal is a non-profit organization, dedicated to enabling secure and private communications. Yes, it's not strong proof, but it should be taken into account when comparing the goals and motivations of organizations developing various other communicators. The organization behind your communicator app could be in the business of gathering data about you and selling it in various forms (Facebook, Google), in the business of selling hardware and add-on software services (Apple), or in the non-business of trying to provide you with private communications.

grier 6y ago
> a non-profit organization > should be taken into account when comparing the goals and motivations of organizations developing various other communicators. Business or funding models can change for both for- and non-profit organizations. Especially as people move to options that are believed to have better user-privacy, the idea that they do not sell/monetize collected user data today does not indicate what they will do tomorrow. Unless users have strong evidence that companies are not collecting and/or monetizing this information (which as the OP pointed out, there is for Signal as found in a subpoena), the "billboard" approach towards promising user privacy via marketing and PR is a shallow one at best for non-profits as well as for-profit companies.
- spicybright 6y ago
  Whenever I see an ad flaunting privacy guarantees, I ask myself "How would a honey pot for gathering user's information be advertised?" Exactly the same way. That said, at the end of the day you have to trust SOMEONE if you want to use digital communications. And there's certainly a difference between facebook and GPG email encryption. It's just a matter of balancing convenience and privacy for your personal use case.
TrueDuality 6y ago
I prefer to look at the history of who founded and continues to run the Signal Foundation... Moxie Marlinspike. Moxie has a long history of improving security in all kinds of tech and fighting for privacy. The Signal app itself is opensource as well various pieces of the tech stack. You can audit yourself what is being sent and how their protocols work. The protocol itself has won awards due to its security and elegance. There is a lot of good things to say about Signal and you can easily find it all. They have made some annoying or less than ideal features that are opt-out instead of opt-in but they're not sacrificing privacy for them.

Mediterraneo10 6y ago

Signal may have only supplied that metadata at the time. But what I am concerned about is that if Signal is US-based, couldn’t the state demand Signal’s app signing key via a NSL, and couldn’t that signing key then be used for targeted attacks by which someone of interest gets a Signal app upgrade that is malicious (while everyone else gets the non-malicious app)? I admit to being somewhat unfamiliar with Android distribution through the Play Store, so if this is unfeasible, help me understand why.

restingrobot 6y ago
Technically they could get the signature key, but they can't force Signal to publish it via the store. Users would have to download an .apk file and install it directly. At that point there is no reason to have the signing key at all as the phone will recognize a sideload as a third party install. As far as I know, the government cannot compel a company to do something like update an app.
- Mediterraneo10 6y ago
  > but they can't force Signal to publish it via the store Is there not a suspicion that Google, another US-based corporation, may have some agreement with American national security to supply malicious APKs to individual targets via the Play Store? Having Signal’s signing key would allow the state to present that custom-targeted APK as an ordinary Signal version update.
  - vel0city 6y ago
    While I'm not saying Google hasn't done something like this (I have no proof either way) there's a strong legal argument to be made that forcing a company to produce binaries is compelled speech which goes against the first amendment.
bigiain 6y ago
Yes. But if you specifically are targeted by organisations capable of issuing NSLs, you're completely hosed already. (And they're just as likely, if not more so, to have done that to your OS instead of just the Signal app.)

1vuio0pswjnm7 6y ago

"And Mr. Musk's endorsement of Signal last week sent publicly traded shares of Signal Advance Inc., a small medical device maker, soaring from a roughly $50 million market value to more than $3 billion. (The company has no relation to the messaging app.)" https://www.nytimes.com/2021/01/13/technology/telegram-signal-apps-big-tech.html https://www.nytimes.com/2021/01/13/technology/telegram-signa...

k__ 6y ago
lol Can they keep the money?
- abrookewood 6y ago
  That's not how the share market works ...
  - InvertedRhodium 6y ago
    It is if they can sell (their shares) quick enough!