4 ms·

I'm more interested in the tin foil hat theory (that I saw mentioned on HN) that this might be signal telling you it's been compromised. The crypto stuff isn't

I'm more interested in the tin foil hat theory (that I saw mentioned on HN) that this might be signal telling you it's been compromised. The crypto stuff isn't great, but just... dont' touch it if you don't like it. It's unfortunate that it's there, but this is the trade-off for everyone not running their own Matrix homeservers. IMO Signal is still the best choice out there by far.

qqii 6y ago
I hate that theory for a number of reasons. It avoids so much evidence of Signals past controversial changes, Moxie's past interviews about MobileCoin and his current tweets or the amount of work done to create MobileCoin. Even a quick look into it creates many holes that can only be filled with speculation.
- hardwaresofton 6y ago
  Yeah I really have no idea what's going on but I can say for sure that I didn't think of the possibility of it being a canary of some sort until I read that, so it was eye opening to me. I was (and still am) definitely under-informed on Moxie's past interviews about the coin and the other stuff -- I just looked around and it was discussed on HN in 2017[0] (!!). I honestly mostly steer clear of Moxie and the other stuff related to Signal -- I personally was really annoyed with the phone number thing, but I can make peace with the fact that Signal is concerned with privacy, mass appeal, and then maybe some anonymity. I am getting a ton of value for absolutely free. In the end, the code is open source, and that is the difference that puts it above the other choices with mass appeal. For me it was basically Signal or Telegram -- there are some other F/OSS options, but they just don't have the mass appeal for me to use with friends. [0]: https://news.ycombinator.com/item?id=15935583 https://news.ycombinator.com/item?id=15935583
iudqnolq 6y ago
> that this might be signal telling you it's been compromised. > IMO Signal is still the best choice out there by far. I'm a little confused. How do you decide to excuse MobileCoin as a cry for help and then decide to ignore it?
- hardwaresofton 6y ago
  Just in case, what I meant by "compromised" was "by a 3 or so letter agency" -- not sure if you meant I thought morally compromised. Signal's morals don't really concern me, because their client is open source, I don't have to care what they believe -- their decision to go with phone numbers irked me for example but having it be F/OSS and well encrypted (as far as I know) was worth sacrificing the privacy (and of course if they ever get the short code system off the ground I'd make a new account immediately). To the spirit of your question though, the reason I take somewhat opposite stances is because I expect the first thing is just a tin foil hat theory, and the crypto thing is neither here nor there (I know I don't plan to buy any, but even so maybe it's good for some people). Signal being banned by a lot of oppressive regimes is some pretty good supporting evidence towards it not being compromised.
  - iudqnolq 6y ago
    I thought you were saying you thought signal had been three-letter compromised and you were continuing to use it, which seemed inconsistent. Now understand you meant some tin-foil hatters think it was compromised, but you don't. That makes sense. (I also find the "it's a signal they're compromised" theory absurd).
    - hardwaresofton 6y ago
      Well someone brought it up, and I thought it was an interesting tin foil hat theory -- It could have happened, I'm not sure what to make of that. I can also probably say at this point I don't care enough to really do something about it. Personally the code being F/OSS is enough for me -- if I need to run my own instance of the server then I could, and if the many-eyes theory holds true and signal's security audit is any good, then I'm pretty happy with that. I already assumed I wasn't quite out of the reach of three letter agencies because I had to use a phone number to get started. Phones are essentially pwned by default and easily pwnable for the agencies.

qqii 6y ago

I hate that theory for a number of reasons. It avoids so much evidence of Signals past controversial changes, Moxie's past interviews about MobileCoin and his current tweets or the amount of work done to create MobileCoin. Even a quick look into it creates many holes that can only be filled with speculation.

hardwaresofton 6y ago
Yeah I really have no idea what's going on but I can say for sure that I didn't think of the possibility of it being a canary of some sort until I read that, so it was eye opening to me. I was (and still am) definitely under-informed on Moxie's past interviews about the coin and the other stuff -- I just looked around and it was discussed on HN in 2017[0] (!!). I honestly mostly steer clear of Moxie and the other stuff related to Signal -- I personally was really annoyed with the phone number thing, but I can make peace with the fact that Signal is concerned with privacy, mass appeal, and then maybe some anonymity. I am getting a ton of value for absolutely free. In the end, the code is open source, and that is the difference that puts it above the other choices with mass appeal. For me it was basically Signal or Telegram -- there are some other F/OSS options, but they just don't have the mass appeal for me to use with friends. [0]: https://news.ycombinator.com/item?id=15935583 https://news.ycombinator.com/item?id=15935583

iudqnolq 6y ago

> that this might be signal telling you it's been compromised. > IMO Signal is still the best choice out there by far. I'm a little confused. How do you decide to excuse MobileCoin as a cry for help and then decide to ignore it?

hardwaresofton 6y ago
Just in case, what I meant by "compromised" was "by a 3 or so letter agency" -- not sure if you meant I thought morally compromised. Signal's morals don't really concern me, because their client is open source, I don't have to care what they believe -- their decision to go with phone numbers irked me for example but having it be F/OSS and well encrypted (as far as I know) was worth sacrificing the privacy (and of course if they ever get the short code system off the ground I'd make a new account immediately). To the spirit of your question though, the reason I take somewhat opposite stances is because I expect the first thing is just a tin foil hat theory, and the crypto thing is neither here nor there (I know I don't plan to buy any, but even so maybe it's good for some people). Signal being banned by a lot of oppressive regimes is some pretty good supporting evidence towards it not being compromised.
- iudqnolq 6y ago
  I thought you were saying you thought signal had been three-letter compromised and you were continuing to use it, which seemed inconsistent. Now understand you meant some tin-foil hatters think it was compromised, but you don't. That makes sense. (I also find the "it's a signal they're compromised" theory absurd).
  - hardwaresofton 6y ago
    Well someone brought it up, and I thought it was an interesting tin foil hat theory -- It could have happened, I'm not sure what to make of that. I can also probably say at this point I don't care enough to really do something about it. Personally the code being F/OSS is enough for me -- if I need to run my own instance of the server then I could, and if the many-eyes theory holds true and signal's security audit is any good, then I'm pretty happy with that. I already assumed I wasn't quite out of the reach of three letter agencies because I had to use a phone number to get started. Phones are essentially pwned by default and easily pwnable for the agencies.