7 ms·

I refuse to use or recommend Signal due to blatantly bad design choices that put people that need privacy most at risk like security researchers, journalists, a

by lrvick 4y ago

I refuse to use or recommend Signal due to blatantly bad design choices that put people that need privacy most at risk like security researchers, journalists, abortion seekers, or dissidents. If you learn a contact phone number then you can buy their location history. Requiring phone numbers and requiring you share them with everyone you contact is brain dead. This alone is bad enough to abandon Signal but then consider they have centralized control of client binaries, and metadata protection anchored on centralized SGX they can trivially access. This negligent design makes them vulnerable to coercion or even court orders if any judge realizes they actually -can- decrypt messages and dump metadata. Matrix supports Signal crypto but in a federated network with no PII requirements like Signal. Also no lock-in or central control of apps.

Thorentis 4y ago
> abortion seekers Uhhh, not sure what koolaid you've swallowed, but including them in that list is almost laughable.
- HideousKojima 4y ago
  I wonder how the people putting "abortion seekers" on such lists would feel if I included "self-defense rights advocates" for people 3d printing guns or smuggling them in from abroad on similar lists.
  - lrvick 4y ago
    I would have no problem seeing that included on such lists either. I have friends who hunt and I myself enjoy shooting on a range once in a while. I also know single parents that live alone in sketchy areas that are well trained and level headed enough to trust with firearms for home self defense. There are almost always reasonable uses of many services and tools we tend to have knee-jerk-ban reactions to as a society.
  - Volundr 4y ago
    I'd wonder if it's for self defense why you didn't buy your firearm legally, since, you know, it's legal to do so. I haven't done a deep dive, but as far as I can tell in most cases it's legal to 3d print too, though admittedly that's something that there are some semi-serious efforts to change. In other words I'd suspect the classification of "self defense advocate" to be a self serving branding effort since there are legal ways to accomplish the same, but I wouldn't doubt the need of this person for a secure messaging platform.
    - HideousKojima 4y ago
      >I'd wonder if it's for self defense why you didn't buy your firearm legally, since, you know, it's legal to do so. Outside of the United States, that's usually not the case. Even if countries do allow private gun ownership, the restrictions on how to obtain them (and what they can legally be used for, what kinds are available, etc.) are exceptionally onerous. And even within the United States, there are individual states that have attempted to severely curtail private firearm ownership. Were it not for certain Supreme Court decisions, handgun ownership would be outright illegal in the District of Columbia and likely in several other states.
      - Volundr 4y ago
        > Outside of the United States, that's usually not the case. A good and fair point. I'd fallen into the trap of being too US centric on HN. > Were it not for certain Supreme Court decisions, handgun ownership would be outright illegal in the District of Columbia and likely in several other states. Sure, were it not for the Supreme Court. But as there remains plenty of ways to legally obtain guns in the US, I'm still going to doubt that you've resorted to gun smuggling for "self defense"
      - sofixa 4y ago
        > Even if countries do allow private gun ownership, the restrictions on how to obtain them (and what they can legally be used for, what kinds are available, etc.) are exceptionally onerous Citation needed. I, and probably the majority of the citizens of those countries do not consider the standard test/psych eval/background check/random checks in the future to make sure you're following the rules to be "exceptionally onerous". And i think most non-Americans would agree that adding some friction to a fringe case (owning a personal firearm for protection or fun is not something most people do, even in the US) is worth it if it nearly eliminates blatant misuses of firearms - either making suicides easier and more terminal, enabling easier revenge murders, or making your average school/public place shooting easier. What would you consider a just middle ground between "onerous requirements" and "everyone can buy any weapon without any requirements but paying for it"?
- Volundr 4y ago
  How do you figure? Several states had abortion laws that were never repealed and others have trigger laws on the books that have gone into effect or will shortly, so yes you can be prosecuted for abortion now. Hence the need for privacy.
- lostcolony 4y ago
  Why is it laughable? https://www.npr.org/2022/08/12/1117092169/nebraska-cops-used-facebook-messages-to-investigate-an-alleged-illegal-abortion https://www.npr.org/2022/08/12/1117092169/nebraska-cops-used...
  - WaitWaitWha 4y ago
    I agree none of this is laughable. Irrelevant of your position, please read the entire article that you referenced for facts (pre-RvW overturn, pregnancy at 23~28 (?) weeks, took Pregnot, buried in back yard, Nebraska law was at that time 20 weeks). The Vice article seems to have quite a lot more facts and references. https://www.vice.com/en/article/n7zevd/this-is-the-data-facebook-gave-police-to-prosecute-a-teenager-for-abortion https://www.vice.com/en/article/n7zevd/this-is-the-data-face...
    - lostcolony 4y ago
      I did read it. The point is that the mother is being charged with aiding her daughter to have an abortion due to evidence collected from chats they thought were secure, but which were still susceptible to a warrant. Now, there are other charges. And the time the abortion happened it occurred while the 20 week ban wasn't being enforced, because the state knew it wouldn't hold up under Roe (and is only illegal and chargeable now, with the court having overturned Roe). So, yes, it's super interesting. But the point is that police are charging someone for aiding an abortion due to texts the sender thought were secure. That's the entire relevancy. Anything else about this particular incident isn't germane.
  - HideousKojima 4y ago
andrepd 4y ago
I agree that Signal does have several questionable design decisions, but that's not one of them. You can get a sim, register with it, and take it back out. There, no location. Or even better, you can simply get a voip number. Bottom-line, despite Signal's issues it is still the #1 IM app that I recommend to "normal people" seeking to have private conversations. No, it's not perfect, yes, it's a massive improvement over facebook/instagram/whatsapp/telegram/etc.
- lrvick 4y ago
  You can not buy a sim without KYC in almost all countries. Also most users will not realize these consequences and will just assume the defaults on Signal protect them with their every day phone number and SIM. Also facebook/instagram/whatsapp/telegram/etc are not trying to advertise themselves for the high risk use cases Signal is actively promoted for. I obviously do not recommend anyone use those either, regardless. Matrix is all I suggest for most people.
  - pseudo0 4y ago
    > You can not buy a sim without KYC in almost all countries. I'd be curious to see stats on this. At least in the US, it is very easy to buy a SIM and sign up for a pre-paid plan with zero KYC.
    - lrvick 4y ago
      The US is actually the only exception I am aware of world wide which gives us a distorted view of this problem.
      - pseudo0 4y ago
        Unless things have changed in the last few years, there are apparently countries in Europe that don't require registration: https://www.reddit.com/r/europe/comments/9ziqfi/european_countries_requiring_registration_of/ https://www.reddit.com/r/europe/comments/9ziqfi/european_cou... And that's a quite high regulation part of the world, I'd be surprised if South American or African countries were stricter.
nobody9999 4y ago
>I refuse to use or recommend Signal due to blatantly bad design choices that put people that need privacy most at risk like security researchers, journalists, abortion seekers, or dissidents. I understand your concerns, and if I was a security researcher, journalist, abortion seeker or dissident, I wouldn't use Signal either. But, like the vast majority of us, I am not any of those things. As such, for my (and most others) use case, Signal is great. For those at risk from highly motivated and/or state-level actors, Signal isn't nearly enough. Nor, unless you build and run your own servers and clients (and never screw up your OpSec), is Matrix. Signal isn't perfect. However, for most people, it's good enough. Don't make perfect the enemy of the good. Because perfect doesn't exist.
- lrvick 4y ago
  Those of us that do not need high privacy today might need it tomorrow, or maybe someone we frequently communicate with. We also have a responsibility to favor tools and practices that make those that really need privacy not stand out. Element or other Matrix clients are easy to use and lack the serious flaws I outlined for Signal.
  - nobody9999 4y ago
    I'd point out that for most people (I suppose that could change, and I wouldn't be upset if such changes resulted in better privacy), messaging is often phone-based and includes folks who use secure methods like Signal and Matrix as well as those who use iMessage and OEM SMS clients. When it comes to that sort of messaging ("I'm running a few minutes late and will meet you inside the restaurant," or similar) I don't (and won't) separate those out. I just use Signal for all such messages. Which makes for inconvenience when (especially iPhone users) install Signal and still use iMessage. I'd add that if I have something to discuss that I don't want recorded (don't forget that it's not just your device that puts you at risk, anyone who's received such messages do so as well), I'll use encrypted voice calls (with the assumption -- valid or not -- that the other participant(s) aren't recording that conversation) with Signal or Matrix. In both my personal and professional life, I've always made sure to only put in writing that which I wouldn't care if it was shared with the world. Which is no different than it's ever been. I'm not sure why anyone thinks this is a new thing or that somehow "technology" obviates the need for good OpSec. It never did and still doesn't.
dcow 4y ago
How does signal allow you to learn someone's phone number from message history? As far as I understand the only thing one can learn by inspecting signal's protocol is that: 1. generally, a certain phone number uses signal (1) happens once, upon registration of your phone number. You don't see history of which phone numbers are communicating, do you? In other words, you don't need Signal to buy someone's location history. You just need their phone number and Signal doesn't particularly provide that to you. Per my understanding, Signal provides subpoena/nation-state resistant level security and is in fact used by many people with high security needs.
- lrvick 4y ago
  Sadly the protections you mention are only true if we ignore the last decade of security research and dragnet surveillance activity. Metadata protection in Signal has major asterisks they do not like to talk about which could be activated covertly by warrant, threats, or money. 1. Google, Apple, or Signal could, compile a malicious Signal binary that generates weak keys and deliver it to specific users, or all users, via app stores. 2. Signal sysadmins or third party datacenter techs could use any of a pile of SGX exploits to dump all their centralized metadata in plain text. 3. Signal aggregates all IP metadata to one place making it easy for their cloud providers and ISPs to work out who is talking to who. 4. Carriers see SMS activations and know who uses Signal. They also know all of the cellular data IPs. An entity that buys this along with data from other ISPs would quickly learn the identities of most conversation participants and their current locations. Enrich that with data widely sold from drivers license office and you also get race, home address, etc, etc. Centralized PII requiring services that claim to be promoting security and privacy should be met with extreme scrutiny.
  - dcow 4y ago
    Okay... (1) is abstractly possible for any software and always has been. Signal cannot directly send my phone a bespoke binary... I got it through the app store. If that was allowed it would be Apple or Googles breach of the model, not Signal. (2) there were SGX vulnerabilities, yes, but they've been patched and Signal is no longer vulnerable (in the one instance where they were), no? (3) citation please, these are IP logs for conversations? (4) this is not Signal's problem to solve. If you buy into what Signal offers, you're saying it's okay that my carrier knows that I registered with Signal because that's all they know. Being able to inspect IP headers for traffic on the internet is possible regardless of the software you're using. If you don't trust the internet with your communications then you need to take them off the internet... I don't know what else to say. Further, typically companies can't be compelled to do something like (1) because it represents an undue burden on operation of their business. This is why Apple refused to give the FBI a bespoke build of iOS that bypassed the pin code. Not to mention the loss of business when people find out that a breach of trust had happened. Also I thought Signal had reproducible builds in every instance possible. Idk, it sounds like you really shouldn't use any software you didn't write yourself and hardware you didn't build yourself and network where you don't trust every single node if your threat model involves IP logs and hardware tampering and targeted malicious software... that is hardly practical by any stretch of the imagination.
ptsneves 4y ago
Aren’t the apps reproducible? Meaning, if the open source part does not match the binaries the it could be a canary for compromise. Mind you, the last time I looked there are not alternate implementations of the signal protocol and even the usage of libsignald was frustrating due to continuous backwards compatibility breakage. I would love for a proper libpurple implementation.

by lrvick 4y ago

Thorentis 4y ago

> abortion seekers Uhhh, not sure what koolaid you've swallowed, but including them in that list is almost laughable.

HideousKojima 4y ago
I wonder how the people putting "abortion seekers" on such lists would feel if I included "self-defense rights advocates" for people 3d printing guns or smuggling them in from abroad on similar lists.
- lrvick 4y ago
  I would have no problem seeing that included on such lists either. I have friends who hunt and I myself enjoy shooting on a range once in a while. I also know single parents that live alone in sketchy areas that are well trained and level headed enough to trust with firearms for home self defense. There are almost always reasonable uses of many services and tools we tend to have knee-jerk-ban reactions to as a society.
- Volundr 4y ago
  I'd wonder if it's for self defense why you didn't buy your firearm legally, since, you know, it's legal to do so. I haven't done a deep dive, but as far as I can tell in most cases it's legal to 3d print too, though admittedly that's something that there are some semi-serious efforts to change. In other words I'd suspect the classification of "self defense advocate" to be a self serving branding effort since there are legal ways to accomplish the same, but I wouldn't doubt the need of this person for a secure messaging platform.
  - HideousKojima 4y ago
    >I'd wonder if it's for self defense why you didn't buy your firearm legally, since, you know, it's legal to do so. Outside of the United States, that's usually not the case. Even if countries do allow private gun ownership, the restrictions on how to obtain them (and what they can legally be used for, what kinds are available, etc.) are exceptionally onerous. And even within the United States, there are individual states that have attempted to severely curtail private firearm ownership. Were it not for certain Supreme Court decisions, handgun ownership would be outright illegal in the District of Columbia and likely in several other states.
    - Volundr 4y ago
      > Outside of the United States, that's usually not the case. A good and fair point. I'd fallen into the trap of being too US centric on HN. > Were it not for certain Supreme Court decisions, handgun ownership would be outright illegal in the District of Columbia and likely in several other states. Sure, were it not for the Supreme Court. But as there remains plenty of ways to legally obtain guns in the US, I'm still going to doubt that you've resorted to gun smuggling for "self defense"
    - sofixa 4y ago
      > Even if countries do allow private gun ownership, the restrictions on how to obtain them (and what they can legally be used for, what kinds are available, etc.) are exceptionally onerous Citation needed. I, and probably the majority of the citizens of those countries do not consider the standard test/psych eval/background check/random checks in the future to make sure you're following the rules to be "exceptionally onerous". And i think most non-Americans would agree that adding some friction to a fringe case (owning a personal firearm for protection or fun is not something most people do, even in the US) is worth it if it nearly eliminates blatant misuses of firearms - either making suicides easier and more terminal, enabling easier revenge murders, or making your average school/public place shooting easier. What would you consider a just middle ground between "onerous requirements" and "everyone can buy any weapon without any requirements but paying for it"?
Volundr 4y ago
How do you figure? Several states had abortion laws that were never repealed and others have trigger laws on the books that have gone into effect or will shortly, so yes you can be prosecuted for abortion now. Hence the need for privacy.
lostcolony 4y ago
Why is it laughable? https://www.npr.org/2022/08/12/1117092169/nebraska-cops-used-facebook-messages-to-investigate-an-alleged-illegal-abortion https://www.npr.org/2022/08/12/1117092169/nebraska-cops-used...
- WaitWaitWha 4y ago
  I agree none of this is laughable. Irrelevant of your position, please read the entire article that you referenced for facts (pre-RvW overturn, pregnancy at 23~28 (?) weeks, took Pregnot, buried in back yard, Nebraska law was at that time 20 weeks). The Vice article seems to have quite a lot more facts and references. https://www.vice.com/en/article/n7zevd/this-is-the-data-facebook-gave-police-to-prosecute-a-teenager-for-abortion https://www.vice.com/en/article/n7zevd/this-is-the-data-face...
  - lostcolony 4y ago
    I did read it. The point is that the mother is being charged with aiding her daughter to have an abortion due to evidence collected from chats they thought were secure, but which were still susceptible to a warrant. Now, there are other charges. And the time the abortion happened it occurred while the 20 week ban wasn't being enforced, because the state knew it wouldn't hold up under Roe (and is only illegal and chargeable now, with the court having overturned Roe). So, yes, it's super interesting. But the point is that police are charging someone for aiding an abortion due to texts the sender thought were secure. That's the entire relevancy. Anything else about this particular incident isn't germane.
- HideousKojima 4y ago

andrepd 4y ago

I agree that Signal does have several questionable design decisions, but that's not one of them. You can get a sim, register with it, and take it back out. There, no location. Or even better, you can simply get a voip number. Bottom-line, despite Signal's issues it is still the #1 IM app that I recommend to "normal people" seeking to have private conversations. No, it's not perfect, yes, it's a massive improvement over facebook/instagram/whatsapp/telegram/etc.

lrvick 4y ago
You can not buy a sim without KYC in almost all countries. Also most users will not realize these consequences and will just assume the defaults on Signal protect them with their every day phone number and SIM. Also facebook/instagram/whatsapp/telegram/etc are not trying to advertise themselves for the high risk use cases Signal is actively promoted for. I obviously do not recommend anyone use those either, regardless. Matrix is all I suggest for most people.
- pseudo0 4y ago
  > You can not buy a sim without KYC in almost all countries. I'd be curious to see stats on this. At least in the US, it is very easy to buy a SIM and sign up for a pre-paid plan with zero KYC.
  - lrvick 4y ago
    The US is actually the only exception I am aware of world wide which gives us a distorted view of this problem.
    - pseudo0 4y ago
      Unless things have changed in the last few years, there are apparently countries in Europe that don't require registration: https://www.reddit.com/r/europe/comments/9ziqfi/european_countries_requiring_registration_of/ https://www.reddit.com/r/europe/comments/9ziqfi/european_cou... And that's a quite high regulation part of the world, I'd be surprised if South American or African countries were stricter.

nobody9999 4y ago

>I refuse to use or recommend Signal due to blatantly bad design choices that put people that need privacy most at risk like security researchers, journalists, abortion seekers, or dissidents. I understand your concerns, and if I was a security researcher, journalist, abortion seeker or dissident, I wouldn't use Signal either. But, like the vast majority of us, I am not any of those things. As such, for my (and most others) use case, Signal is great. For those at risk from highly motivated and/or state-level actors, Signal isn't nearly enough. Nor, unless you build and run your own servers and clients (and never screw up your OpSec), is Matrix. Signal isn't perfect. However, for most people, it's good enough. Don't make perfect the enemy of the good. Because perfect doesn't exist.

lrvick 4y ago
Those of us that do not need high privacy today might need it tomorrow, or maybe someone we frequently communicate with. We also have a responsibility to favor tools and practices that make those that really need privacy not stand out. Element or other Matrix clients are easy to use and lack the serious flaws I outlined for Signal.
- nobody9999 4y ago
  I'd point out that for most people (I suppose that could change, and I wouldn't be upset if such changes resulted in better privacy), messaging is often phone-based and includes folks who use secure methods like Signal and Matrix as well as those who use iMessage and OEM SMS clients. When it comes to that sort of messaging ("I'm running a few minutes late and will meet you inside the restaurant," or similar) I don't (and won't) separate those out. I just use Signal for all such messages. Which makes for inconvenience when (especially iPhone users) install Signal and still use iMessage. I'd add that if I have something to discuss that I don't want recorded (don't forget that it's not just your device that puts you at risk, anyone who's received such messages do so as well), I'll use encrypted voice calls (with the assumption -- valid or not -- that the other participant(s) aren't recording that conversation) with Signal or Matrix. In both my personal and professional life, I've always made sure to only put in writing that which I wouldn't care if it was shared with the world. Which is no different than it's ever been. I'm not sure why anyone thinks this is a new thing or that somehow "technology" obviates the need for good OpSec. It never did and still doesn't.

dcow 4y ago

How does signal allow you to learn someone's phone number from message history? As far as I understand the only thing one can learn by inspecting signal's protocol is that: 1. generally, a certain phone number uses signal (1) happens once, upon registration of your phone number. You don't see history of which phone numbers are communicating, do you? In other words, you don't need Signal to buy someone's location history. You just need their phone number and Signal doesn't particularly provide that to you. Per my understanding, Signal provides subpoena/nation-state resistant level security and is in fact used by many people with high security needs.

lrvick 4y ago
Sadly the protections you mention are only true if we ignore the last decade of security research and dragnet surveillance activity. Metadata protection in Signal has major asterisks they do not like to talk about which could be activated covertly by warrant, threats, or money. 1. Google, Apple, or Signal could, compile a malicious Signal binary that generates weak keys and deliver it to specific users, or all users, via app stores. 2. Signal sysadmins or third party datacenter techs could use any of a pile of SGX exploits to dump all their centralized metadata in plain text. 3. Signal aggregates all IP metadata to one place making it easy for their cloud providers and ISPs to work out who is talking to who. 4. Carriers see SMS activations and know who uses Signal. They also know all of the cellular data IPs. An entity that buys this along with data from other ISPs would quickly learn the identities of most conversation participants and their current locations. Enrich that with data widely sold from drivers license office and you also get race, home address, etc, etc. Centralized PII requiring services that claim to be promoting security and privacy should be met with extreme scrutiny.
- dcow 4y ago
  Okay... (1) is abstractly possible for any software and always has been. Signal cannot directly send my phone a bespoke binary... I got it through the app store. If that was allowed it would be Apple or Googles breach of the model, not Signal. (2) there were SGX vulnerabilities, yes, but they've been patched and Signal is no longer vulnerable (in the one instance where they were), no? (3) citation please, these are IP logs for conversations? (4) this is not Signal's problem to solve. If you buy into what Signal offers, you're saying it's okay that my carrier knows that I registered with Signal because that's all they know. Being able to inspect IP headers for traffic on the internet is possible regardless of the software you're using. If you don't trust the internet with your communications then you need to take them off the internet... I don't know what else to say. Further, typically companies can't be compelled to do something like (1) because it represents an undue burden on operation of their business. This is why Apple refused to give the FBI a bespoke build of iOS that bypassed the pin code. Not to mention the loss of business when people find out that a breach of trust had happened. Also I thought Signal had reproducible builds in every instance possible. Idk, it sounds like you really shouldn't use any software you didn't write yourself and hardware you didn't build yourself and network where you don't trust every single node if your threat model involves IP logs and hardware tampering and targeted malicious software... that is hardly practical by any stretch of the imagination.

ptsneves 4y ago

Aren’t the apps reproducible? Meaning, if the open source part does not match the binaries the it could be a canary for compromise. Mind you, the last time I looked there are not alternate implementations of the signal protocol and even the usage of libsignald was frustrating due to continuous backwards compatibility breakage. I would love for a proper libpurple implementation.