4 ms·

Signal is just as insecure because they can push any code they want to anyone they want to spy on.

tablespoon 5y ago
> Signal is just as insecure because they can push any code they want to anyone they want to spy on. What now? That's not "just as insecure", since Telegram can also "push any code they want to anyone they want to spy on," but they don't need to because your data is already plaintext on their servers. Signal not being perfectly secure does not make it "just as insecure."
- DarylZero 5y ago
  I mean, if you were at all serious about security you'd just not use it. So it's just as insecure.
  - Barrin92 5y ago
    This is a bizarre take. What's considered "serious security" depends on the needs of the person and the kind of info they're transmitting. To tell people that there is no advantage to use Signal instead of much less secure alternatives because your Area 51 security requirements aren't met is actively harmful and bad advice.
    - DarylZero 5y ago
      LOL, "Area 51." Whether Signal or Telegram, you rely completely on trust in the central third party for security. The choice of whether to use Signal or Telegram should depend on which of these organizations you trust the most (their leadership, their internal employees, and their security from external infiltration), NOT based on what technology they use in the client & server. But you simply shouldn't use either because real security is all about not having to trust anyone like that.
      - Barrin92 5y ago
        you don't need to rely completely on trust in third parties because both produce reproducible open source clients (at least on android, not sure about apple) and if someone hands you at least a client that you can verify doesn't send out non-encrypted data you have some legitimate safety compared to a service that doesn't do that at all. And that's why technology matters, because security is not binary. Very concrete example, someone uses Facebook Messenger, the police get the hands on their phone, arrest them for some chat content. Signal cannot do that, and you can verify they cannot. That's a real use case that people in particular in countries with oppressive governments run into at this very moment.
      - DarylZero 5y ago
        > you don't need to rely completely on trust in third parties because both produce reproducible open source clients (at least on android, not sure about apple) and if someone hands you at least a client that you can verify doesn't send out non-encrypted data you have some legitimate safety compared to a service that doesn't do that at all. This is technically correct but not in a way that matters. Signal pushes everyone to depend on Google to distribute the software. Through this system, it isn't even just Signal, but also Google and anyone who breaks into Google that can inject a compromised client. You don't know that the client on the other side isn't getting its Signal app through Google. More importantly -- even if you DO know the client on the other side -- the WHOLE POINT of Signal is this massive network effect where you don't need to coordinate with the other side. If we're talking about the much smaller network-within-a-network of users who installed Signal from a non-Google source -- it's no longer compelling. Why bother with it? Less error-prone to get both sides to set something else up.
  - tablespoon 5y ago
    > I mean, if you were at all serious about security you'd just not use it. So it's just as insecure. That doesn't make any sense at all. Being "serious about security" doesn't mean letting the perfect be the enemy of the good (which is what you're doing).
    - DarylZero 5y ago
      It's not good though. It has these flaws I just described. You can avoid those flaws simply by using other software.
      - ViViDboarder 5y ago
        Such as? What other software has verifiable client builds and a server that stores as little information as Signal?
rPlayer6554 5y ago
They have reproducible builds on Android if you are that paranoid.
- DarylZero 5y ago
  That doesn't help because the other end can be compromised.
  - Anunayj 5y ago
    well nothing you can do can stop the other person from leaking your conversations.
    - DarylZero 5y ago
      That's a different issue. We're talking about software not "opsec." When the military issues secure communications devices, it makes damn sure that BOTH SIDES have a secure device.
  - ViViDboarder 5y ago
    If they verify their end, it does. What software would not be vulnerable to what you’re describing?
    - DarylZero 5y ago
      It's not about the software, it's about the distribution of the software. Signal distributes through Google as man-in-the-middle. So if you trust Google, you're OK. But if you're using Signal because you don't trust Google, it doesn't make sense. In case you don't trust Google I really suggest OpenSSH or WireGuard, to establish a secure tunnel; and then run IRC, Jabber, SIP, or mumble (as needed) over the tunnel.

> Signal is just as insecure because they can push any code they want to anyone they want to spy on. What now? That's not "just as insecure", since Telegram can also "push any code they want to anyone they want to spy on," but they don't need to because your data is already plaintext on their servers. Signal not being perfectly secure does not make it "just as insecure."

DarylZero 5y ago
I mean, if you were at all serious about security you'd just not use it. So it's just as insecure.
- Barrin92 5y ago
  This is a bizarre take. What's considered "serious security" depends on the needs of the person and the kind of info they're transmitting. To tell people that there is no advantage to use Signal instead of much less secure alternatives because your Area 51 security requirements aren't met is actively harmful and bad advice.
  - DarylZero 5y ago
    LOL, "Area 51." Whether Signal or Telegram, you rely completely on trust in the central third party for security. The choice of whether to use Signal or Telegram should depend on which of these organizations you trust the most (their leadership, their internal employees, and their security from external infiltration), NOT based on what technology they use in the client & server. But you simply shouldn't use either because real security is all about not having to trust anyone like that.
    - Barrin92 5y ago
      you don't need to rely completely on trust in third parties because both produce reproducible open source clients (at least on android, not sure about apple) and if someone hands you at least a client that you can verify doesn't send out non-encrypted data you have some legitimate safety compared to a service that doesn't do that at all. And that's why technology matters, because security is not binary. Very concrete example, someone uses Facebook Messenger, the police get the hands on their phone, arrest them for some chat content. Signal cannot do that, and you can verify they cannot. That's a real use case that people in particular in countries with oppressive governments run into at this very moment.
    - DarylZero 5y ago
      > you don't need to rely completely on trust in third parties because both produce reproducible open source clients (at least on android, not sure about apple) and if someone hands you at least a client that you can verify doesn't send out non-encrypted data you have some legitimate safety compared to a service that doesn't do that at all. This is technically correct but not in a way that matters. Signal pushes everyone to depend on Google to distribute the software. Through this system, it isn't even just Signal, but also Google and anyone who breaks into Google that can inject a compromised client. You don't know that the client on the other side isn't getting its Signal app through Google. More importantly -- even if you DO know the client on the other side -- the WHOLE POINT of Signal is this massive network effect where you don't need to coordinate with the other side. If we're talking about the much smaller network-within-a-network of users who installed Signal from a non-Google source -- it's no longer compelling. Why bother with it? Less error-prone to get both sides to set something else up.
- tablespoon 5y ago
  > I mean, if you were at all serious about security you'd just not use it. So it's just as insecure. That doesn't make any sense at all. Being "serious about security" doesn't mean letting the perfect be the enemy of the good (which is what you're doing).
  - DarylZero 5y ago
    It's not good though. It has these flaws I just described. You can avoid those flaws simply by using other software.
    - ViViDboarder 5y ago
      Such as? What other software has verifiable client builds and a server that stores as little information as Signal?

rPlayer6554 5y ago

They have reproducible builds on Android if you are that paranoid.

DarylZero 5y ago
That doesn't help because the other end can be compromised.
- Anunayj 5y ago
  well nothing you can do can stop the other person from leaking your conversations.
  - DarylZero 5y ago
    That's a different issue. We're talking about software not "opsec." When the military issues secure communications devices, it makes damn sure that BOTH SIDES have a secure device.
- ViViDboarder 5y ago
  If they verify their end, it does. What software would not be vulnerable to what you’re describing?
  - DarylZero 5y ago
    It's not about the software, it's about the distribution of the software. Signal distributes through Google as man-in-the-middle. So if you trust Google, you're OK. But if you're using Signal because you don't trust Google, it doesn't make sense. In case you don't trust Google I really suggest OpenSSH or WireGuard, to establish a secure tunnel; and then run IRC, Jabber, SIP, or mumble (as needed) over the tunnel.