5 ms·

Signal: developed by a non-profit organization, free and open source, end-to-end encrypted in all regions, no encryption key hosting arrangements with any gove

Signal: developed by a non-profit organization, free and open source, end-to-end encrypted in all regions, no encryption key hosting arrangements with any government-owned third party firm

deleted 5y ago
[deleted]
glogla 5y ago
Also developed by guy who is fighting against you being able to install it without involvement with a company that makes money by invading your privacy, who also has a history of working for companies making money invading your privacy.
- Forbo 5y ago
  Signal offers an APK that does not require the use of Google services.
dheera 5y ago
Signal: requires disclosing a phone number to everyone you use it with
- noja 5y ago
  Which means the other person knows it's me, right?
  - dave5104 5y ago
    Might be troublesome if you don't want the other person to know it's you, though. But that's probably not a problem in day to day communication with family and friends.
    - rOOb85 5y ago
      > Might be troublesome if you don't want the other person to know it's you, though. You're mixing privacy and anonymity. Signal offers privacy from snooping, they have never claimed or tried to provide anonymity. Two very different use cases.
  - dheera 5y ago
    There are better ways to verify someone is who you think they are, e.g. asking them about an inside joke that you only told them in person at some point in the past, or what art you have up on the wall in your dining room. Also, you might in some cases want to share knowledge or evidence without disclosing your identity, and phone numbers miserably fail for that use case.
- JumpCrisscross 5y ago
  > Signal: requires disclosing a phone number to everyone you use it with Signal also got distracted with a cryptocurrency scheme [1]. That shot their credibility in many circles. [1] https://www.schneier.com/blog/archives/2021/04/wtf-signal-adds-cryptocurrency-support.html https://www.schneier.com/blog/archives/2021/04/wtf-signal-ad...
  - 411111111111111 5y ago
    Not exactly. They're evaluating adding micro payments to the app. These micro payments will be handled by a third party which uses a crypto currency in the exchange. The feature itself is good imo. Though I'm prolly never gonna use it because of the crypto intermediary.
  - tptacek 5y ago
    First, the "also" is misplaced. Signal's telephone number requirement is a privacy feature; it's not that Signal wants your phone number, but that using phone numbers as identifiers allows them to build a social graph --- every mainstream messaging app involves a social graph --- without keeping plaintext contact lists serverside, which is what every other mainstream messenger does. That's not a small thing; the information in those contact lists is one of the highest priority targets for any state-level adversary. I don't love the cryptocurrency stuff either. I'm not defending it. But "shot their credibility" is an overstatement.
    - JumpCrisscross 5y ago
      Fair on both points. The “also” is misplaced as most users have zero problem with Signal processing their contacts. And “shot their credibility” was hyperbole. “Severely damaged, albeit repairably” is more accurate.
joecool1029 5y ago
> no encryption key hosting arrangements with any government-owned third party firm Not really needed when your IME is spying on you. Signal in such an arrangement becomes security theater. They acknowledge this is a problem on their support site but never make any attempt to educate new users to the app: https://support.signal.org/hc/en-us/articles/360055276112-Incognito-Keyboard https://support.signal.org/hc/en-us/articles/360055276112-In... . It is arrogant to dismiss concerns about commonly-used IME's when people rely on this app for their own protection. This was discussed previously on HN if anyone's interested in reading about the response, or lack thereof to the criticism: https://news.ycombinator.com/item?id=25758995 https://news.ycombinator.com/item?id=25758995 >free and open source Want to also point out that months go by without server code being published: https://www.xda-developers.com/signal-updates-public-server-code/ https://www.xda-developers.com/signal-updates-public-server-... Also, when users protested reliance on Google's store, analytics, and play services, Moxie chose to attack the forks and made us wait for years to get a direct APK without the requirements available off their site. I acknowledge that there's legitimate reasons why this was done, but all we get are excuses and silence for long periods of time when these problems crop up. It is not in the spirit of opensource/free software development to attack your own community.
- commoner 5y ago
  My point is that Signal is preferable to Apple Messages for privacy and security. I am not claiming that Signal is the best solution for every use case. (For instance, Matrix is superior if you do not want to be tied to a phone number.) > Not really needed when your IME is spying on you. Users can choose an open source keyboard on Android, such as AnySoftKeyboard or the default Android Keyboard (on AOSP installations). I don't know of any open source keyboards on the App Store for iOS, but the lack of an open source keyboard on iOS does not justify compromising encryption keys for Apple Messages users in certain regions. Signal is not responsible for the security of the rest of the user's system, and if a user is using a keyboard that leaks information, then that also affects Apple Messages and any other app they are using, not just Signal. > Want to also point out that months go by without server code being published The Apple Messages server and clients are completely proprietary, so Signal is still preferable even though it had previously released server source code with a delay. > Also, when users protested reliance on Google's store, analytics, and play services... Apple Messages is only available as an app on iOS, iPadOS, and macOS, with no option to fork because it is closed source. FaceTime is the same, but now also has a web app with limited functionality. On Android, Signal is still preferable in this area because it is fully available, can be used without Google Play Services, and can be distributed independently of an app store.

Signal: developed by a non-profit organization, free and open source, end-to-end encrypted in all regions, no encryption key hosting arrangements with any government-owned third party firm

deleted 5y ago

[deleted]

glogla 5y ago

Also developed by guy who is fighting against you being able to install it without involvement with a company that makes money by invading your privacy, who also has a history of working for companies making money invading your privacy.

Forbo 5y ago
Signal offers an APK that does not require the use of Google services.

dheera 5y ago

Signal: requires disclosing a phone number to everyone you use it with

noja 5y ago
Which means the other person knows it's me, right?
- dave5104 5y ago
  Might be troublesome if you don't want the other person to know it's you, though. But that's probably not a problem in day to day communication with family and friends.
  - rOOb85 5y ago
    > Might be troublesome if you don't want the other person to know it's you, though. You're mixing privacy and anonymity. Signal offers privacy from snooping, they have never claimed or tried to provide anonymity. Two very different use cases.
- dheera 5y ago
  There are better ways to verify someone is who you think they are, e.g. asking them about an inside joke that you only told them in person at some point in the past, or what art you have up on the wall in your dining room. Also, you might in some cases want to share knowledge or evidence without disclosing your identity, and phone numbers miserably fail for that use case.
JumpCrisscross 5y ago
> Signal: requires disclosing a phone number to everyone you use it with Signal also got distracted with a cryptocurrency scheme [1]. That shot their credibility in many circles. [1] https://www.schneier.com/blog/archives/2021/04/wtf-signal-adds-cryptocurrency-support.html https://www.schneier.com/blog/archives/2021/04/wtf-signal-ad...
- 411111111111111 5y ago
  Not exactly. They're evaluating adding micro payments to the app. These micro payments will be handled by a third party which uses a crypto currency in the exchange. The feature itself is good imo. Though I'm prolly never gonna use it because of the crypto intermediary.
- tptacek 5y ago
  First, the "also" is misplaced. Signal's telephone number requirement is a privacy feature; it's not that Signal wants your phone number, but that using phone numbers as identifiers allows them to build a social graph --- every mainstream messaging app involves a social graph --- without keeping plaintext contact lists serverside, which is what every other mainstream messenger does. That's not a small thing; the information in those contact lists is one of the highest priority targets for any state-level adversary. I don't love the cryptocurrency stuff either. I'm not defending it. But "shot their credibility" is an overstatement.
  - JumpCrisscross 5y ago
    Fair on both points. The “also” is misplaced as most users have zero problem with Signal processing their contacts. And “shot their credibility” was hyperbole. “Severely damaged, albeit repairably” is more accurate.

joecool1029 5y ago

> no encryption key hosting arrangements with any government-owned third party firm Not really needed when your IME is spying on you. Signal in such an arrangement becomes security theater. They acknowledge this is a problem on their support site but never make any attempt to educate new users to the app: https://support.signal.org/hc/en-us/articles/360055276112-Incognito-Keyboard https://support.signal.org/hc/en-us/articles/360055276112-In... . It is arrogant to dismiss concerns about commonly-used IME's when people rely on this app for their own protection. This was discussed previously on HN if anyone's interested in reading about the response, or lack thereof to the criticism: https://news.ycombinator.com/item?id=25758995 https://news.ycombinator.com/item?id=25758995 >free and open source Want to also point out that months go by without server code being published: https://www.xda-developers.com/signal-updates-public-server-code/ https://www.xda-developers.com/signal-updates-public-server-... Also, when users protested reliance on Google's store, analytics, and play services, Moxie chose to attack the forks and made us wait for years to get a direct APK without the requirements available off their site. I acknowledge that there's legitimate reasons why this was done, but all we get are excuses and silence for long periods of time when these problems crop up. It is not in the spirit of opensource/free software development to attack your own community.

commoner 5y ago
My point is that Signal is preferable to Apple Messages for privacy and security. I am not claiming that Signal is the best solution for every use case. (For instance, Matrix is superior if you do not want to be tied to a phone number.) > Not really needed when your IME is spying on you. Users can choose an open source keyboard on Android, such as AnySoftKeyboard or the default Android Keyboard (on AOSP installations). I don't know of any open source keyboards on the App Store for iOS, but the lack of an open source keyboard on iOS does not justify compromising encryption keys for Apple Messages users in certain regions. Signal is not responsible for the security of the rest of the user's system, and if a user is using a keyboard that leaks information, then that also affects Apple Messages and any other app they are using, not just Signal. > Want to also point out that months go by without server code being published The Apple Messages server and clients are completely proprietary, so Signal is still preferable even though it had previously released server source code with a delay. > Also, when users protested reliance on Google's store, analytics, and play services... Apple Messages is only available as an app on iOS, iPadOS, and macOS, with no option to fork because it is closed source. FaceTime is the same, but now also has a web app with limited functionality. On Android, Signal is still preferable in this area because it is fully available, can be used without Google Play Services, and can be distributed independently of an app store.