4 ms·

> I do wish Signal would be more transparent though. You mean like updating their privacy policy to explain that they are keeping sensitive user data in the cl

> I do wish Signal would be more transparent though. You mean like updating their privacy policy to explain that they are keeping sensitive user data in the cloud? They refuse. There are people in this very discussion who are (or were at least) unaware that Signal is collecting and permanently storing user data on their servers. Signal's communication on what they're collecting and how has been a total joke. I cannot consider them trustworthy and at this point I suspect that refusing to update their privacy policy is a giant dead canary intended to warn users away from their product.

sneak 4y ago
Please stop spreading objectively inaccurate FUD in the thread.
- autoexec 4y ago
  What part of what I said was inaccurate?
  - godelski 4y ago
    What user data is being stored in the cloud? Can they decrypt it?
    - autoexec 4y ago
      The information they collect includes your name, your photo, your phone number, and a list of all the people you've been in contact with using Signal. They encrypt it using a pin which they ask you to set or one they generate for you. They (and anyone else) can decrypt that data by brute forcing what is often just a 4 digit number.
      - godelski 4y ago
        Can you show me this? I'd guess it would have to be in the server code, so where is it? I don't see any real information about this on their site. Their website suggests that this information is stored locally https://support.signal.org/hc/en-us/articles/360007459591-Signal-Profiles-and-Message-Requests https://support.signal.org/hc/en-us/articles/360007459591-Si...
        autoexec 4y ago
        I know. I really wish they had a simple page that explains everything. They've gone to great lengths to be confusing about what they're collecting and how. There were several complaints about misleading communication when this change rolled out Examples: https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057/231 https://community.signalusers.org/t/dont-want-pin-dont-want-... https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/fyjy7a5/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin... They've never updated their privacy policy to cover their new data collection practices even after requests (see https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 https://community.signalusers.org/t/can-signal-please-update...) The scheme they came up with to store user data in the cloud was described here: https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/ The code is here: https://github.com/signalapp/SecureValueRecovery https://github.com/signalapp/SecureValueRecovery This site does a pretty good job of explaining why this isn't a good design: https://palant.info/2020/06/16/does-signals-secure-value-recovery-really-work/ https://palant.info/2020/06/16/does-signals-secure-value-rec... Lots of discussion here: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... and also https://community.signalusers.org/t/sgx-cacheout-sgaxe-attack-signals-cloud-storage-and-contact-discovery-vulnerable/14892 https://community.signalusers.org/t/sgx-cacheout-sgaxe-attac... Even more details here: https://community.signalusers.org/t/wiki-faq-signal-pin-svr-kbs-storage-service-cloud/15690?u=u32i64 https://community.signalusers.org/t/wiki-faq-signal-pin-svr-... The major change was that pins were mandatory initially but the UX was so bad they had to give people a way to opt out of setting a pin. There is no opting out of having your profile/contacts data collected and stored in the cloud though.
        sneak 4y ago
        Link to the lines of code on the server that store the data in the way you describe or stop slinging mud. You linked to a repository that uses Intel SGX which is used in this instance specifically to address your false claim that the e2e encryption used is easily bruteforced. It also doesn't store any lists of who you contact; this claim is false. You've already been asked once for code references for your inaccurate claims, it's time for PoC or GTFO.

sneak 4y ago

Please stop spreading objectively inaccurate FUD in the thread.

autoexec 4y ago
What part of what I said was inaccurate?
- godelski 4y ago
  What user data is being stored in the cloud? Can they decrypt it?
  - autoexec 4y ago
    The information they collect includes your name, your photo, your phone number, and a list of all the people you've been in contact with using Signal. They encrypt it using a pin which they ask you to set or one they generate for you. They (and anyone else) can decrypt that data by brute forcing what is often just a 4 digit number.
    - godelski 4y ago
      Can you show me this? I'd guess it would have to be in the server code, so where is it? I don't see any real information about this on their site. Their website suggests that this information is stored locally https://support.signal.org/hc/en-us/articles/360007459591-Signal-Profiles-and-Message-Requests https://support.signal.org/hc/en-us/articles/360007459591-Si...
      - autoexec 4y ago
        I know. I really wish they had a simple page that explains everything. They've gone to great lengths to be confusing about what they're collecting and how. There were several complaints about misleading communication when this change rolled out Examples: https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057/231 https://community.signalusers.org/t/dont-want-pin-dont-want-... https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/fyjy7a5/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin... They've never updated their privacy policy to cover their new data collection practices even after requests (see https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 https://community.signalusers.org/t/can-signal-please-update...) The scheme they came up with to store user data in the cloud was described here: https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/ The code is here: https://github.com/signalapp/SecureValueRecovery https://github.com/signalapp/SecureValueRecovery This site does a pretty good job of explaining why this isn't a good design: https://palant.info/2020/06/16/does-signals-secure-value-recovery-really-work/ https://palant.info/2020/06/16/does-signals-secure-value-rec... Lots of discussion here: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... and also https://community.signalusers.org/t/sgx-cacheout-sgaxe-attack-signals-cloud-storage-and-contact-discovery-vulnerable/14892 https://community.signalusers.org/t/sgx-cacheout-sgaxe-attac... Even more details here: https://community.signalusers.org/t/wiki-faq-signal-pin-svr-kbs-storage-service-cloud/15690?u=u32i64 https://community.signalusers.org/t/wiki-faq-signal-pin-svr-... The major change was that pins were mandatory initially but the UX was so bad they had to give people a way to opt out of setting a pin. There is no opting out of having your profile/contacts data collected and stored in the cloud though.
        sneak 4y ago
        Link to the lines of code on the server that store the data in the way you describe or stop slinging mud. You linked to a repository that uses Intel SGX which is used in this instance specifically to address your false claim that the e2e encryption used is easily bruteforced. It also doesn't store any lists of who you contact; this claim is false. You've already been asked once for code references for your inaccurate claims, it's time for PoC or GTFO.