3 ms·

> that this might be signal telling you it's been compromised. > IMO Signal is still the best choice out there by far. I'm a little confused. How do you decid

> that this might be signal telling you it's been compromised. > IMO Signal is still the best choice out there by far. I'm a little confused. How do you decide to excuse MobileCoin as a cry for help and then decide to ignore it?

hardwaresofton 6y ago
Just in case, what I meant by "compromised" was "by a 3 or so letter agency" -- not sure if you meant I thought morally compromised. Signal's morals don't really concern me, because their client is open source, I don't have to care what they believe -- their decision to go with phone numbers irked me for example but having it be F/OSS and well encrypted (as far as I know) was worth sacrificing the privacy (and of course if they ever get the short code system off the ground I'd make a new account immediately). To the spirit of your question though, the reason I take somewhat opposite stances is because I expect the first thing is just a tin foil hat theory, and the crypto thing is neither here nor there (I know I don't plan to buy any, but even so maybe it's good for some people). Signal being banned by a lot of oppressive regimes is some pretty good supporting evidence towards it not being compromised.
- iudqnolq 6y ago
  I thought you were saying you thought signal had been three-letter compromised and you were continuing to use it, which seemed inconsistent. Now understand you meant some tin-foil hatters think it was compromised, but you don't. That makes sense. (I also find the "it's a signal they're compromised" theory absurd).
  - hardwaresofton 6y ago
    Well someone brought it up, and I thought it was an interesting tin foil hat theory -- It could have happened, I'm not sure what to make of that. I can also probably say at this point I don't care enough to really do something about it. Personally the code being F/OSS is enough for me -- if I need to run my own instance of the server then I could, and if the many-eyes theory holds true and signal's security audit is any good, then I'm pretty happy with that. I already assumed I wasn't quite out of the reach of three letter agencies because I had to use a phone number to get started. Phones are essentially pwned by default and easily pwnable for the agencies.

hardwaresofton 6y ago

Just in case, what I meant by "compromised" was "by a 3 or so letter agency" -- not sure if you meant I thought morally compromised. Signal's morals don't really concern me, because their client is open source, I don't have to care what they believe -- their decision to go with phone numbers irked me for example but having it be F/OSS and well encrypted (as far as I know) was worth sacrificing the privacy (and of course if they ever get the short code system off the ground I'd make a new account immediately). To the spirit of your question though, the reason I take somewhat opposite stances is because I expect the first thing is just a tin foil hat theory, and the crypto thing is neither here nor there (I know I don't plan to buy any, but even so maybe it's good for some people). Signal being banned by a lot of oppressive regimes is some pretty good supporting evidence towards it not being compromised.

iudqnolq 6y ago
I thought you were saying you thought signal had been three-letter compromised and you were continuing to use it, which seemed inconsistent. Now understand you meant some tin-foil hatters think it was compromised, but you don't. That makes sense. (I also find the "it's a signal they're compromised" theory absurd).
- hardwaresofton 6y ago
  Well someone brought it up, and I thought it was an interesting tin foil hat theory -- It could have happened, I'm not sure what to make of that. I can also probably say at this point I don't care enough to really do something about it. Personally the code being F/OSS is enough for me -- if I need to run my own instance of the server then I could, and if the many-eyes theory holds true and signal's security audit is any good, then I'm pretty happy with that. I already assumed I wasn't quite out of the reach of three letter agencies because I had to use a phone number to get started. Phones are essentially pwned by default and easily pwnable for the agencies.