5 ms·

Signal to add social features, employees worried about potential abuse

45 points by marketingtech 6y ago

edgyquant 6y ago
I’m not sure i agree with a lot of these complaints. Of course potential terrorist groups will abuse any service they can, but I don’t see that as a reason to create said service. If anything refusing to will just allow them to be outcompeted as someone else steps in to fill that niche and disrupting them. Same for the crypto concerns. Criminals and bad actors are going to use crypto to exchange money regardless so what’s the point in not adding it to your platform? I was expecting the abuse to be from state agencies, not an encryption company literally spewing the same anti-encryption rhetoric we’ve heard for years.
- Barrin92 6y ago
  > Criminals and bad actors are going to use crypto to exchange money regardless so what’s the point in not adding it to your platform? because someone else doing something that you consider wrong doesn't give you a license to do the same thing. After all criminals also dodge taxes.
babesh 6y ago
The narrative is being set to end end to end encryption. Expect more hypothetical articles like this going forward. The powers want to control the narrative. I would bet that there will be laws rolled out in the next few years.
- babesh 6y ago
  https://www.documentcloud.org/documents/6956033-Lawful-Access-to-Encrypted-Data-Act.html https://www.documentcloud.org/documents/6956033-Lawful-Acces... Lawful Access to Encrypted Data
- ac29 6y ago
  Seems that there is a compelling argument that the First Amendment precludes the government from passing laws that prohibit encrypted communications (between US citizens, the US constitution does not apply to foreigners). Not sure the extent that has been tested in court, though. Regulations on exporting encryption still exist in the US to some degree, though Bernstein v. United States was a turning point in that regard (holding that publishing encryption algorithm source code, including electronically, cannot be restricted by the Government).
marketingtech 6y ago
There's an idealogical collision course between safely offering usernames+financial transactions and maintaining an absolutist stance on encryption. Within minutes, you'll have people going by @ElonMusk and @JeffBezos running scams to millions of non tech-savvy users. Are you going to try to stop that in any way? Can you, while maintaining full encryption? I can appreciate Moxie sticking to his guns, but he'll need a better plan than "we'll deal with the problem when it comes." if he doesn't want to get deplatformed by Apple/Google or face government scrutiny.
- kfriede 6y ago
  Would an alternative be to offer auto-generated usernames that you have one-shot to generate a password for and if you lose that password you're gone? Something like opposite-dwindling-zodiac, casino-smile-widget, or creative-crumpled-dismiss? If you choose to add a phone number as a recovery (and for contact finding) that's your optional choice.
  - marketingtech 6y ago
    There absolutely are mitigations from a technical standpoint, some with privacy trade-offs and some with UI trade-offs. But the key is to have those mitigations in place before you launch a feature with potential attack vectors. Moxie's statement in that article claims they have no plans to address it.
- waheoo 6y ago
  I'd quit my job if signal got deplatformed. They're not parler.
  - sirwally 6y ago
    you should quit your job anyhow
    - waheoo 6y ago
      Hah, ok dude? the feeling is mutual.
op03 6y ago
Key phrase here is - "we are not algorithmically amplifying content" Trump (or Obama for that matter and such characters who suddenly appear out of nowhere due to their pandering to a fan club skills) cannot be propped up at light speed without algorithmic amplification. Read that again Trump and Obama are not possible without the Like Button and the algo amplification it enables. That is the main lesson from the last 15 years. And apps that don't have reward mechanisms that prop up time wasting Pandering section of the population are not going to produce the side effects Youtube, Twitter and Facebook did.
autoexec 6y ago
I dumped signal less over the data collection they've started doing and more for the fact that they've been less than transparent about it. Nearly a year ago their forums were filled with objections, security concerns, and questions and for months they went ignored. When they finally made setting a pin optional they were equally unclear that it would just set a random one for you and that this didn't prevent your data from being uploaded to the cloud. I took it as a sign that they were telling us not to trust them as clearly as they were allowed. For secure communications I'm using Jami now and I've been very impressed. For SMS/MMS in general I'm still looking. I've tried a few alternatives and frankly I'm not really happy with any of them.
- nitrogen 6y ago
  Wait, not setting a pin still enables sync??
  - autoexec 6y ago
    It still uploads your profile (name, number, photo) and contacts to their servers, just not to SVR See here for more info: https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...
    - tmp538394722 6y ago
      Edited my response to be less sarcastic. But honestly it’s hard for me to read something like this and believe you aren’t being deliberately misleading. All this stuff is only stored in an encrypted form that signal never has the keys for. And all this stuff is only applicable if you choose to set it. Yes, for Alice to see Bobs profile Alice has to download some bytes. Those bytes live somewhere. The difference is that, unlike every other app, signal spent a ton of time making this work in a way that The signal service can’t read your data, even if they wanted to.
      - autoexec 6y ago
wolverine876 6y ago
The interesting question is, how can they prevent abuse? 1. Spoofed names to perpetrated scams. 2. Groups promoting evil (however it's defined). IIRC by default ny contact must be whitelisted, which helps a bit with scams. But if people get a contact request by their bank or employer, what will they do? For the latter, Signal could incorporate messages in their app that undermines that behavior - for example, promoting tolerance, providing resources for people to report criminal activity, providing encouragement and resources for people to escape cult-like behavior, etc. I wonder how effective that would be.

45 points by marketingtech 6y ago

I’m not sure i agree with a lot of these complaints. Of course potential terrorist groups will abuse any service they can, but I don’t see that as a reason to create said service. If anything refusing to will just allow them to be outcompeted as someone else steps in to fill that niche and disrupting them. Same for the crypto concerns. Criminals and bad actors are going to use crypto to exchange money regardless so what’s the point in not adding it to your platform? I was expecting the abuse to be from state agencies, not an encryption company literally spewing the same anti-encryption rhetoric we’ve heard for years.

Barrin92 6y ago
> Criminals and bad actors are going to use crypto to exchange money regardless so what’s the point in not adding it to your platform? because someone else doing something that you consider wrong doesn't give you a license to do the same thing. After all criminals also dodge taxes.

babesh 6y ago

The narrative is being set to end end to end encryption. Expect more hypothetical articles like this going forward. The powers want to control the narrative. I would bet that there will be laws rolled out in the next few years.

babesh 6y ago
https://www.documentcloud.org/documents/6956033-Lawful-Access-to-Encrypted-Data-Act.html https://www.documentcloud.org/documents/6956033-Lawful-Acces... Lawful Access to Encrypted Data
ac29 6y ago
Seems that there is a compelling argument that the First Amendment precludes the government from passing laws that prohibit encrypted communications (between US citizens, the US constitution does not apply to foreigners). Not sure the extent that has been tested in court, though. Regulations on exporting encryption still exist in the US to some degree, though Bernstein v. United States was a turning point in that regard (holding that publishing encryption algorithm source code, including electronically, cannot be restricted by the Government).

marketingtech 6y ago

There's an idealogical collision course between safely offering usernames+financial transactions and maintaining an absolutist stance on encryption. Within minutes, you'll have people going by @ElonMusk and @JeffBezos running scams to millions of non tech-savvy users. Are you going to try to stop that in any way? Can you, while maintaining full encryption? I can appreciate Moxie sticking to his guns, but he'll need a better plan than "we'll deal with the problem when it comes." if he doesn't want to get deplatformed by Apple/Google or face government scrutiny.

kfriede 6y ago
Would an alternative be to offer auto-generated usernames that you have one-shot to generate a password for and if you lose that password you're gone? Something like opposite-dwindling-zodiac, casino-smile-widget, or creative-crumpled-dismiss? If you choose to add a phone number as a recovery (and for contact finding) that's your optional choice.
- marketingtech 6y ago
  There absolutely are mitigations from a technical standpoint, some with privacy trade-offs and some with UI trade-offs. But the key is to have those mitigations in place before you launch a feature with potential attack vectors. Moxie's statement in that article claims they have no plans to address it.
waheoo 6y ago
I'd quit my job if signal got deplatformed. They're not parler.
- sirwally 6y ago
  you should quit your job anyhow
  - waheoo 6y ago
    Hah, ok dude? the feeling is mutual.

op03 6y ago

Key phrase here is - "we are not algorithmically amplifying content" Trump (or Obama for that matter and such characters who suddenly appear out of nowhere due to their pandering to a fan club skills) cannot be propped up at light speed without algorithmic amplification. Read that again Trump and Obama are not possible without the Like Button and the algo amplification it enables. That is the main lesson from the last 15 years. And apps that don't have reward mechanisms that prop up time wasting Pandering section of the population are not going to produce the side effects Youtube, Twitter and Facebook did.

autoexec 6y ago

I dumped signal less over the data collection they've started doing and more for the fact that they've been less than transparent about it. Nearly a year ago their forums were filled with objections, security concerns, and questions and for months they went ignored. When they finally made setting a pin optional they were equally unclear that it would just set a random one for you and that this didn't prevent your data from being uploaded to the cloud. I took it as a sign that they were telling us not to trust them as clearly as they were allowed. For secure communications I'm using Jami now and I've been very impressed. For SMS/MMS in general I'm still looking. I've tried a few alternatives and frankly I'm not really happy with any of them.

nitrogen 6y ago
Wait, not setting a pin still enables sync??
- autoexec 6y ago
  It still uploads your profile (name, number, photo) and contacts to their servers, just not to SVR See here for more info: https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...
  - tmp538394722 6y ago
    Edited my response to be less sarcastic. But honestly it’s hard for me to read something like this and believe you aren’t being deliberately misleading. All this stuff is only stored in an encrypted form that signal never has the keys for. And all this stuff is only applicable if you choose to set it. Yes, for Alice to see Bobs profile Alice has to download some bytes. Those bytes live somewhere. The difference is that, unlike every other app, signal spent a ton of time making this work in a way that The signal service can’t read your data, even if they wanted to.
    - autoexec 6y ago

wolverine876 6y ago

The interesting question is, how can they prevent abuse? 1. Spoofed names to perpetrated scams. 2. Groups promoting evil (however it's defined). IIRC by default ny contact must be whitelisted, which helps a bit with scams. But if people get a contact request by their bank or employer, what will they do? For the latter, Signal could incorporate messages in their app that undermines that behavior - for example, promoting tolerance, providing resources for people to report criminal activity, providing encouragement and resources for people to escape cult-like behavior, etc. I wonder how effective that would be.