4 ms·

There's some major issues with Signal right now. 1. Signal was used by Chinese dissidents and were whisked away by the CCP. The most likely proposed method was

There's some major issues with Signal right now. 1. Signal was used by Chinese dissidents and were whisked away by the CCP. The most likely proposed method was that the GBoard (google soft-keyboard) was "updated" with a poison update that uploaded everything typed. What defenses does Signal have against that? And will Signal warn against unverified GBoard updates that haven't been vetted? 2. Signal still demands your phone# to make an account. This by itself is unconscionable for an application that purports to be for security and privacy. 3. Signal still demands/pesters the user to share the whole phonebook with Signal. Anyone who does gets notifications when their phonebook shows up on Signal. And when you show up on Signal, everybody else is also told you're there as well. (Massive domestic abuse issues here)

Erlich_Bachman 6y ago
You can't call 1.) an "issue with Signal". It is not even correct description. It is an issue with any messenger app on any device or OS that installs automatic updates of anything from CCP.
UncleMeat 6y ago
> Signal was used by Chinese dissidents and were whisked away by the CCP. The most likely proposed method was that the GBoard (google soft-keyboard) was "updated" with a poison update that uploaded everything typed. What defenses does Signal have against that? And will Signal warn against unverified GBoard updates that haven't been vetted? If you can't trust your OS then you've lost already. This complaint is also fun considering the number of people who yell about banks doing things like refusing to run if nonstandard keyboards are installed. > Signal still demands your phone# to make an account. This by itself is unconscionable for an application that purports to be for security and privacy. The alternative appears to be "Signal knows which users you have communicated with", which is much worse. All sorts of interesting things can be obtained from the communication graph.
- duckfang 6y ago
  > > Signal was used by Chinese dissidents and were whisked away by the CCP. The most likely proposed method was that the GBoard (google soft-keyboard) was "updated" with a poison update that uploaded everything typed. What defenses does Signal have against that? And will Signal warn against unverified GBoard updates that haven't been vetted? > If you can't trust your OS then you've lost already. This complaint is also fun considering the number of people who yell about banks doing things like refusing to run if nonstandard keyboards are installed. There are also open source and 3rd party repos (F-Droid) that could provide properly vetted soft keyboards. And I'd also mention that Signal is not available on F-Droid or Guardian Project's repo. And Signal can also run basic checks for sanity of the system, and loudly warn if things aren't as the application expects. > > Signal still demands your phone# to make an account. This by itself is unconscionable for an application that purports to be for security and privacy. > The alternative appears to be "Signal knows which users you have communicated with", which is much worse. All sorts of interesting things can be obtained from the communication graph. All of the encrypted comms goes through their servers. They also prevent others from running federated Signal servers. That would lead that they have access to both who, where (ip address), how long (by length of encrypted data), and with whom. The same metadata was/is the basis of the NSA's spy projects. Metadata is just as important as the very content.
alwdgxzubpxnzcy 6y ago
1. That isn't an issue with Signal or something that Signal could fix. Every messaging app will have that problem. 2. That is an issue but they do have their reasons. They are working on implementing a username system that does not depend you giving them a phone number. 3. That can be solved once they implement usernames. Until then a workaround can be to use a Google Voice Number or a burner sim.
maverick74 6y ago
It will also be interesting to see the p2p Matrix version, since they also use the same encryption tech as signal (it's equally private) and won't rely on centralized server.

Erlich_Bachman 6y ago

You can't call 1.) an "issue with Signal". It is not even correct description. It is an issue with any messenger app on any device or OS that installs automatic updates of anything from CCP.

UncleMeat 6y ago

> Signal was used by Chinese dissidents and were whisked away by the CCP. The most likely proposed method was that the GBoard (google soft-keyboard) was "updated" with a poison update that uploaded everything typed. What defenses does Signal have against that? And will Signal warn against unverified GBoard updates that haven't been vetted? If you can't trust your OS then you've lost already. This complaint is also fun considering the number of people who yell about banks doing things like refusing to run if nonstandard keyboards are installed. > Signal still demands your phone# to make an account. This by itself is unconscionable for an application that purports to be for security and privacy. The alternative appears to be "Signal knows which users you have communicated with", which is much worse. All sorts of interesting things can be obtained from the communication graph.

duckfang 6y ago
> > Signal was used by Chinese dissidents and were whisked away by the CCP. The most likely proposed method was that the GBoard (google soft-keyboard) was "updated" with a poison update that uploaded everything typed. What defenses does Signal have against that? And will Signal warn against unverified GBoard updates that haven't been vetted? > If you can't trust your OS then you've lost already. This complaint is also fun considering the number of people who yell about banks doing things like refusing to run if nonstandard keyboards are installed. There are also open source and 3rd party repos (F-Droid) that could provide properly vetted soft keyboards. And I'd also mention that Signal is not available on F-Droid or Guardian Project's repo. And Signal can also run basic checks for sanity of the system, and loudly warn if things aren't as the application expects. > > Signal still demands your phone# to make an account. This by itself is unconscionable for an application that purports to be for security and privacy. > The alternative appears to be "Signal knows which users you have communicated with", which is much worse. All sorts of interesting things can be obtained from the communication graph. All of the encrypted comms goes through their servers. They also prevent others from running federated Signal servers. That would lead that they have access to both who, where (ip address), how long (by length of encrypted data), and with whom. The same metadata was/is the basis of the NSA's spy projects. Metadata is just as important as the very content.

alwdgxzubpxnzcy 6y ago

1. That isn't an issue with Signal or something that Signal could fix. Every messaging app will have that problem. 2. That is an issue but they do have their reasons. They are working on implementing a username system that does not depend you giving them a phone number. 3. That can be solved once they implement usernames. Until then a workaround can be to use a Google Voice Number or a burner sim.

maverick74 6y ago

It will also be interesting to see the p2p Matrix version, since they also use the same encryption tech as signal (it's equally private) and won't rely on centralized server.