5 ms·

Signal seems to be a lone island in its dedication to user privacy. Is this naive or an accurate evaluation? Have they done anything recently to signal that the

by usui 5y ago

Signal seems to be a lone island in its dedication to user privacy. Is this naive or an accurate evaluation? Have they done anything recently to signal that these may falter? What is going to suggest they won't resort to rent-seeking or monetizing in the future?

mach1ne 5y ago
Very recently they added their first closed-source component to their code, supposedly a spam filter. This sort of went by HN. I can't help but think that the timing with all these requests is rather coincidental.
- Klonoar 5y ago
  It didn't "sort of go by HN", it was on the front page for a bit and had some 97 comments. https://news.ycombinator.com/item?id=29072031 https://news.ycombinator.com/item?id=29072031
- approxim8ion 5y ago
  My understanding is that this component was added to their server code. If their clients are still verifyiably encrypting the content and limiting the metadata for your messages, it should not be much of an issue.
  - robryk 5y ago
    Every time you send a message with Signal, you inform the server which user the message is for. Thus, the server can remember (sending IP, target phone number) pairs and, for similar reasons, (phone number, IP of the user when retrieving messages) pairs. We rely on the server to discard this information; if not discarded, it reveals the social graph and the phone number<->IPs used mapping.
    - sam_lowry_ 5y ago
      And since Snowden we know that meta-information is as important as information. So Signal being E2E encrypted goes only halfway towards ensuring the privacy of our communications.
    - approxim8ion 5y ago
      I'm aware of this, but it's not like it's a new concern with this piece of code. This has always been the case.
  - BelenusMordred 5y ago
    Don't really understand the cries for their server code to be constantly updated or even open sourced, you can't ever verify that's what they are running anyway. Maybe there's some sort of cryptographic attestation out there which could fulfil such purposes but quite sure it's not that practical.
    - robryk 5y ago
      That's true and it's one reason I'm not too comfortable with Signal's access to metadata (even though they are the best nonfederated communicator in that regard). There are a few reasons why I would prefer them to provide source code that they claim is running in the service due to the metadata issue: a) if it's actually running there, people can find simple bugs in it that could allow that metadata to be stored or revealed by accident, b) if it's not actually running there, but something very close is (i.e. that code with small amount of patches), then the advantage above still applies and if those patches come to light, they can be easily evaluated for intent and effect, c) if they're running something completely different (which would be very weird), it'd be noticeable and it would be an obvious lie once exposed.
- 0xy 5y ago
  Their server code was closed source for over a year with no explanation, turns out it was to add a shitcoin called "MobileCoin" that Signal's founder has a financial interest in. Ever since that, I don't think you should consider Signal's server "open source" at all. They've shown they'll conceal, diverge and cover up for their own enrichment. What will they do when they're threatened? Cave.
  - onphonenow 5y ago
    No kidding such a bad look
  - nix23 5y ago
    https://github.com/signalapp/Signal-Server https://github.com/signalapp/Signal-Server >Last commit 7 Days ago >AGPL-3.0 License That's the present
    - 0xy 5y ago
      How does this disprove what I said? I said it WAS closed source. It's also not complete anymore, so I think it's still safe to call it closed source. If there's a single piece of closed source code running on the servers, it ceases to be open source.
      - nix23 5y ago
        >If there's a single piece of closed source code running on the servers, it ceases to be open source. Yeah no that's not the definition of opensource, if my opensource mailserver has a closed source spam-scanner, my mail server is still opensource - the spam-scanner
        0xy 5y ago
        And when the spam scanner looks like: phone_home_to_nsa(metadata, ip_address, sender, recipient); Are you still comfortable with this 'open source' project?
ComodoHacker 5y ago
There are many smaller islands like Threema, Tox and others. Signal is not a lone one, even if we look away from the continent named Apple.
- usui 5y ago
  I can't agree with this one. I enjoy Apple products and consider them to be of high quality, but they should not be the star example for user privacy. iCloud backups are turned on by default, which means they have access to the private key, and they considered adding a client-side detection system for "child pornography". From the standpoint of E2EE, enough is enough with the "gray area" in privacy systems. Either you don't fiddle/introspect with the content that goes through your communication medium, or you do.
  - ComodoHacker 5y ago
    >they should not be the star example for user privacy They are not perfect, but I can't see anyone who does better overall. >iCloud backups are turned on by default I believe it is good default, as 90%+ of their users (would) care more about accidental data loss than privacy. When that changes, Apple will change the default. >client-side detection system for "child pornography" Yes, that's a very controversial move. But they made it client-side because it's more private than server-side.
    - foerbert 5y ago
      > I believe it is good default, as 90%+ of their users (would) care more about accidental data loss than privacy. I think you're right about the numbers, but I don't understand why that justifies the default. Why even have a default? Why not just ask users what they want? It's not a hard question, and it even has the benefit of helping inform users about the feature. > Yes, that's a very controversial move. But they made it client-side because it's more private than server-side. So? Either it respects privacy or it doesn't in this kind of discussion. Lauding them for violating your privacy but not as much as they could otherwise is like lauding a mugger for only taking half of the cash in your wallet. Yeah it could have been worse, but that doesn't change the nature of their actions.
hippich 5y ago
Last time I tried them, they still required phone number? If it is still the case, they did compromise on the users privacy.
- usui 5y ago
  This is a usability stance. Removing the ability to use phone numbers would have made it harder for users to adopt Signal, and I find it to be a reasonable trade-off. At least right now, the only thing prying eyes can do is know that you use Signal due to the login SMS, or hijack your SMS. We all know about some terrible security practices that phone providers have been doing with phone number swapping by unauthorized parties, but if we can pick non-awful phone providers which at least have password-protected SIM locks on the account, it shouldn't be as viable.
  - JoshTriplett 5y ago
    > Removing the ability to use phone numbers I've never seen anyone ask for Signal to remove the ability to use phone numbers. People ask Signal to add the ability to use something other than a phone number, as well.
  - Arnt 5y ago
    As I've heard it, it's motivated by security rather than usability: If two people use Signal to communicate with each other, then they should use the Signal protocol rather than SMS, without having to go through any extra steps. There are different ways to achieve that, all of which have drawbacks. They chose one.
New_California 5y ago
There is more, like very promising https://cwtch.im/ https://cwtch.im/
fauigerzigerk 5y ago
Matrix looks the most promising to me. I believe the people behind it are principled (just like I think the people behind Signal are), but the Matrix protocol doesn't require heros. There's no single point of technical or legal failure.
- tialaramex 5y ago
  > the Matrix protocol doesn't require heros Do you have some examples of the sort of "heroism" you think is involved here?
  - fauigerzigerk 5y ago
    What I mean is that Signal as a messaging service depends completely on Signal as an organisation and on the few individuals running that organisation. Everything hinges on them. It's pretty clear that governments around the world (including many western countries) have decided that online services must take full responsibility for everything their users say and do on the platform. Regulation is coming hard and fast. It's not subtle and some of it will inevitably be inconsistent with E2EE. Anyone running a popular service of this sort is going to be under huge pressure - political pressure, expensive legal pressure and presumably the sort of pressure exerted by police and intelligence services that the rest of us are fortunate not to know very much about. Signal's structure, the tight link between the org, the people and the centralised operations focuses all the pressure on this small group of people. They are going to be an absolute lightning rod as soon as WhatsApp has given up. I don't want to be in their shoes. I fear they will have to make very difficult decisions pretty soon. I find it puzzling that they're making themselves the target of further powerful opponents by adding cryptocurrencies to the mix. I think Matrix has the better structure for what's coming. It distributes the pressure. It's not either on or off. It's not just some specific app that can be banned.
    - tialaramex 5y ago
      Politicians are under pressure to "do something" about services like Facebook, Instagram, Twitter, TikTok, Youtube, Reddit ... services which publish what some of their users do and say, and enjoy broad immunity from lawsuits despite choosing what is communicated and by who. None of which applies to Signal. Your theory is that, seeing this, US politicians will decide priority #1 is to re-write the US constitution in order to go after a completely different service? Sure, they can't find a bare majority of votes for cheap, easy fixes that are broadly popular, but repeatedly getting super-majorities for the lengthy and expensive process of tearing down the fundamental principles of the country to go after an outfit few voters have even heard of it will be easy? I don't buy it. One of the most awful things about the "better structure" of Matrix is that if you make any use of this "better structure" you eliminate Don't Stand Out which is an essential characteristic of Signal. Yet, to enable that "better structure" to even exist Matrix already makes you give up some of the privacy you have on Signal anyway. So you're losing some privacy to have the option of giving up even more privacy. Several of the sub-threads in this discussion mention metadata. Don't Stand Out is crucial because of metadata. The Secret Police can raid all sixteen users of "Jim's Black Pill Matrix Server" and if two of them are innocent bystanders too bad, all fourteen members of the Conspiracy To Do A Naughty Thing are known to use Jim's server, and so they Stand Out and were caught. In contrast, using Signal the Conspiracy To Do A Naughty Thing are disguised by the presence of Sarah's Hen Night Planning DO NOT TELL SARAH, Smith Family Group, and LOL Funny Cats!!!! among many more. Signal doesn't know, or care about any of these groups.
boondaburrah 5y ago
Signal has demonstrated to me that they don't give a shit about privacy, but they care a lot about security. I'll take it, but I wouldn't confuse the two.

by usui 5y ago

mach1ne 5y ago

Very recently they added their first closed-source component to their code, supposedly a spam filter. This sort of went by HN. I can't help but think that the timing with all these requests is rather coincidental.

Klonoar 5y ago
It didn't "sort of go by HN", it was on the front page for a bit and had some 97 comments. https://news.ycombinator.com/item?id=29072031 https://news.ycombinator.com/item?id=29072031
approxim8ion 5y ago
My understanding is that this component was added to their server code. If their clients are still verifyiably encrypting the content and limiting the metadata for your messages, it should not be much of an issue.
- robryk 5y ago
  Every time you send a message with Signal, you inform the server which user the message is for. Thus, the server can remember (sending IP, target phone number) pairs and, for similar reasons, (phone number, IP of the user when retrieving messages) pairs. We rely on the server to discard this information; if not discarded, it reveals the social graph and the phone number<->IPs used mapping.
  - sam_lowry_ 5y ago
    And since Snowden we know that meta-information is as important as information. So Signal being E2E encrypted goes only halfway towards ensuring the privacy of our communications.
  - approxim8ion 5y ago
    I'm aware of this, but it's not like it's a new concern with this piece of code. This has always been the case.
- BelenusMordred 5y ago
  Don't really understand the cries for their server code to be constantly updated or even open sourced, you can't ever verify that's what they are running anyway. Maybe there's some sort of cryptographic attestation out there which could fulfil such purposes but quite sure it's not that practical.
  - robryk 5y ago
    That's true and it's one reason I'm not too comfortable with Signal's access to metadata (even though they are the best nonfederated communicator in that regard). There are a few reasons why I would prefer them to provide source code that they claim is running in the service due to the metadata issue: a) if it's actually running there, people can find simple bugs in it that could allow that metadata to be stored or revealed by accident, b) if it's not actually running there, but something very close is (i.e. that code with small amount of patches), then the advantage above still applies and if those patches come to light, they can be easily evaluated for intent and effect, c) if they're running something completely different (which would be very weird), it'd be noticeable and it would be an obvious lie once exposed.
0xy 5y ago
Their server code was closed source for over a year with no explanation, turns out it was to add a shitcoin called "MobileCoin" that Signal's founder has a financial interest in. Ever since that, I don't think you should consider Signal's server "open source" at all. They've shown they'll conceal, diverge and cover up for their own enrichment. What will they do when they're threatened? Cave.
- onphonenow 5y ago
  No kidding such a bad look
- nix23 5y ago
  https://github.com/signalapp/Signal-Server https://github.com/signalapp/Signal-Server >Last commit 7 Days ago >AGPL-3.0 License That's the present
  - 0xy 5y ago
    How does this disprove what I said? I said it WAS closed source. It's also not complete anymore, so I think it's still safe to call it closed source. If there's a single piece of closed source code running on the servers, it ceases to be open source.
    - nix23 5y ago
      >If there's a single piece of closed source code running on the servers, it ceases to be open source. Yeah no that's not the definition of opensource, if my opensource mailserver has a closed source spam-scanner, my mail server is still opensource - the spam-scanner
      - 0xy 5y ago
        And when the spam scanner looks like: phone_home_to_nsa(metadata, ip_address, sender, recipient); Are you still comfortable with this 'open source' project?

ComodoHacker 5y ago

There are many smaller islands like Threema, Tox and others. Signal is not a lone one, even if we look away from the continent named Apple.

usui 5y ago
I can't agree with this one. I enjoy Apple products and consider them to be of high quality, but they should not be the star example for user privacy. iCloud backups are turned on by default, which means they have access to the private key, and they considered adding a client-side detection system for "child pornography". From the standpoint of E2EE, enough is enough with the "gray area" in privacy systems. Either you don't fiddle/introspect with the content that goes through your communication medium, or you do.
- ComodoHacker 5y ago
  >they should not be the star example for user privacy They are not perfect, but I can't see anyone who does better overall. >iCloud backups are turned on by default I believe it is good default, as 90%+ of their users (would) care more about accidental data loss than privacy. When that changes, Apple will change the default. >client-side detection system for "child pornography" Yes, that's a very controversial move. But they made it client-side because it's more private than server-side.
  - foerbert 5y ago
    > I believe it is good default, as 90%+ of their users (would) care more about accidental data loss than privacy. I think you're right about the numbers, but I don't understand why that justifies the default. Why even have a default? Why not just ask users what they want? It's not a hard question, and it even has the benefit of helping inform users about the feature. > Yes, that's a very controversial move. But they made it client-side because it's more private than server-side. So? Either it respects privacy or it doesn't in this kind of discussion. Lauding them for violating your privacy but not as much as they could otherwise is like lauding a mugger for only taking half of the cash in your wallet. Yeah it could have been worse, but that doesn't change the nature of their actions.

hippich 5y ago

Last time I tried them, they still required phone number? If it is still the case, they did compromise on the users privacy.

usui 5y ago
This is a usability stance. Removing the ability to use phone numbers would have made it harder for users to adopt Signal, and I find it to be a reasonable trade-off. At least right now, the only thing prying eyes can do is know that you use Signal due to the login SMS, or hijack your SMS. We all know about some terrible security practices that phone providers have been doing with phone number swapping by unauthorized parties, but if we can pick non-awful phone providers which at least have password-protected SIM locks on the account, it shouldn't be as viable.
- JoshTriplett 5y ago
  > Removing the ability to use phone numbers I've never seen anyone ask for Signal to remove the ability to use phone numbers. People ask Signal to add the ability to use something other than a phone number, as well.
- Arnt 5y ago
  As I've heard it, it's motivated by security rather than usability: If two people use Signal to communicate with each other, then they should use the Signal protocol rather than SMS, without having to go through any extra steps. There are different ways to achieve that, all of which have drawbacks. They chose one.

New_California 5y ago

There is more, like very promising https://cwtch.im/ https://cwtch.im/

fauigerzigerk 5y ago

Matrix looks the most promising to me. I believe the people behind it are principled (just like I think the people behind Signal are), but the Matrix protocol doesn't require heros. There's no single point of technical or legal failure.

tialaramex 5y ago
> the Matrix protocol doesn't require heros Do you have some examples of the sort of "heroism" you think is involved here?
- fauigerzigerk 5y ago
  What I mean is that Signal as a messaging service depends completely on Signal as an organisation and on the few individuals running that organisation. Everything hinges on them. It's pretty clear that governments around the world (including many western countries) have decided that online services must take full responsibility for everything their users say and do on the platform. Regulation is coming hard and fast. It's not subtle and some of it will inevitably be inconsistent with E2EE. Anyone running a popular service of this sort is going to be under huge pressure - political pressure, expensive legal pressure and presumably the sort of pressure exerted by police and intelligence services that the rest of us are fortunate not to know very much about. Signal's structure, the tight link between the org, the people and the centralised operations focuses all the pressure on this small group of people. They are going to be an absolute lightning rod as soon as WhatsApp has given up. I don't want to be in their shoes. I fear they will have to make very difficult decisions pretty soon. I find it puzzling that they're making themselves the target of further powerful opponents by adding cryptocurrencies to the mix. I think Matrix has the better structure for what's coming. It distributes the pressure. It's not either on or off. It's not just some specific app that can be banned.
  - tialaramex 5y ago
    Politicians are under pressure to "do something" about services like Facebook, Instagram, Twitter, TikTok, Youtube, Reddit ... services which publish what some of their users do and say, and enjoy broad immunity from lawsuits despite choosing what is communicated and by who. None of which applies to Signal. Your theory is that, seeing this, US politicians will decide priority #1 is to re-write the US constitution in order to go after a completely different service? Sure, they can't find a bare majority of votes for cheap, easy fixes that are broadly popular, but repeatedly getting super-majorities for the lengthy and expensive process of tearing down the fundamental principles of the country to go after an outfit few voters have even heard of it will be easy? I don't buy it. One of the most awful things about the "better structure" of Matrix is that if you make any use of this "better structure" you eliminate Don't Stand Out which is an essential characteristic of Signal. Yet, to enable that "better structure" to even exist Matrix already makes you give up some of the privacy you have on Signal anyway. So you're losing some privacy to have the option of giving up even more privacy. Several of the sub-threads in this discussion mention metadata. Don't Stand Out is crucial because of metadata. The Secret Police can raid all sixteen users of "Jim's Black Pill Matrix Server" and if two of them are innocent bystanders too bad, all fourteen members of the Conspiracy To Do A Naughty Thing are known to use Jim's server, and so they Stand Out and were caught. In contrast, using Signal the Conspiracy To Do A Naughty Thing are disguised by the presence of Sarah's Hen Night Planning DO NOT TELL SARAH, Smith Family Group, and LOL Funny Cats!!!! among many more. Signal doesn't know, or care about any of these groups.

boondaburrah 5y ago

Signal has demonstrated to me that they don't give a shit about privacy, but they care a lot about security. I'll take it, but I wouldn't confuse the two.