10 ms·

> By using end-to-end encryption, user messages are stored only on their devices, not on Signal’s servers or anywhere else. How do we know with certainty that

> By using end-to-end encryption, user messages are stored only on their devices, not on Signal’s servers or anywhere else. How do we know with certainty that the messages are not stored anywhere else? Don't they go through servers to get to the end user?

EGreg 4y ago
Since you aren’t installing something that can be checked against an audited open source build, you always have to TRUST the publisher of the software. You just take their word for it. They could always phone home any kind of data using steganography! I replied to Moxie’s opposition to decentralized open source software, with arguments like this.
- jrm4 4y ago
  I'm 100% in agreement that we should see the source, but it seems to me there could be a "black boxy" way to check for this? As in set up e.g. an emulator and sniff all traffic in and out?
- palata 4y ago
  There is always trust involved. The question is: what's your threat model? You can compile Signal yourself, but maybe you don't trust your OS, or your hardware, or your cleaning lady, or your wife. Signal cannot do anything if your phone got compromised by Pegasus, but they never claimed they could. That's exactly equivalent with decentralised software.
tialaramex 4y ago
Because this is end-to-end encryption, what's transmitted is only arguably "the message", we can't - and there is every reason to think never will be able to - decrypt it without the symmetric key and only the sender and recipient have the key. So from an information theoretic point of view, arguably no, the message was never stored anywhere else, even though Signal is indeed a store-and-retrieve arrangement. The encrypted message was stored briefly by Signal, but only its sender and intended recipient could decrypt it. The keys are ephemeral, so if you have exactly bit-for-bit copies of encrypted Signal messages I sent when I was arranging to play Red Dead Redemption 2 with friends, nobody knows how to decrypt those. I can't decrypt them, the people who received them can't decrypt it, even though we saw them at the time, and even though you have the encrypted messages and even if you have our phones, the keys are gone so that's that.
- scifibestfi 4y ago
  That's good, but I don't see how that means we know they aren't being stored. The NSA or another entity could be collecting them in bulk just in case the encryption is broken in 30 years.
  - cvwright 4y ago
    What’s your alternative? Sneakernet? Anything that goes over a network could be stored.
    - scifibestfi 4y ago
      The article says they are not stored. That's what I'm questioning. "user messages are stored only on their devices, not on Signal’s servers or anywhere else."
      - kingaillas 4y ago
        I think it is fair to interpret that as: Signal is not storing messages on their servers, also Signal is not storing them on someone else's servers. Whether or not a 3rd party, outside Signal's knowledge and/or control, is storing messages is entirely out of their control.
      - tialaramex 4y ago
        Sure, like I said, it's a information theoretic argument. Imagine if Signal used a One Time Pad instead of AES, this might make it easier to see what's going on if you have some idea about the One Time Pad. Suppose I promise you that qMsVOrgWDZTo0Fet9xLhIQ is the base 64 encoded, 16 byte encrypted message I just sent, but I used OTP. Do you in some sense "have" a copy of my message ? No. That is completely useless without the key, it could have literally been any message, without the key there's no difference.
        scifibestfi 4y ago
        Thanks for the explanation! That helps.
kklisura 4y ago
Signal received subpoena to produce all data they have on a user and they provided just two data-points: last connection date and account creation date [1][2]. So I'm pretty sure they do not store anything else. [1] https://signal.org/bigbrother/central-california-grand-jury/ https://signal.org/bigbrother/central-california-grand-jury/ [2] https://signal.org/bigbrother/eastern-virginia-grand-jury/ https://signal.org/bigbrother/eastern-virginia-grand-jury/
- deleted 4y ago
  [deleted]
- coldtea 4y ago
  And how to we know they don't collect other data but don't advertise it? If they have a special deal with government, the court wouldn't even know about those, or might be instructed not to ask them and not disclose anything.
  - kklisura 4y ago
    Valid question, which I don't have the answer for, but since Signal is open-source [1][2] it's open to lot of analysis. Since we haven't heard anything damaging so far, I'm guessing it's _secure enough_. [1] https://github.com/signalapp/Signal-iOS https://github.com/signalapp/Signal-iOS [2] https://github.com/signalapp/Signal-Android https://github.com/signalapp/Signal-Android
    - coldtea 4y ago
      Another question then: can we verify (even if we have to jailbreak and check the binary) that the encrypted app delivered on iOS (and I presume Android) is built from the exact same source code? E.g. could we build it ourselves in, say, Xcode, and compare a hash of the resulting app binary with the installed one?
      - eitland 4y ago
        With Telegram you can. They provide instructions. (At least used to do.) Not sure about Signal.
permo-w 4y ago
is this not exactly the point of end to end encryption?

EGreg 4y ago

Since you aren’t installing something that can be checked against an audited open source build, you always have to TRUST the publisher of the software. You just take their word for it. They could always phone home any kind of data using steganography! I replied to Moxie’s opposition to decentralized open source software, with arguments like this.

jrm4 4y ago
I'm 100% in agreement that we should see the source, but it seems to me there could be a "black boxy" way to check for this? As in set up e.g. an emulator and sniff all traffic in and out?
palata 4y ago
There is always trust involved. The question is: what's your threat model? You can compile Signal yourself, but maybe you don't trust your OS, or your hardware, or your cleaning lady, or your wife. Signal cannot do anything if your phone got compromised by Pegasus, but they never claimed they could. That's exactly equivalent with decentralised software.

tialaramex 4y ago

Because this is end-to-end encryption, what's transmitted is only arguably "the message", we can't - and there is every reason to think never will be able to - decrypt it without the symmetric key and only the sender and recipient have the key. So from an information theoretic point of view, arguably no, the message was never stored anywhere else, even though Signal is indeed a store-and-retrieve arrangement. The encrypted message was stored briefly by Signal, but only its sender and intended recipient could decrypt it. The keys are ephemeral, so if you have exactly bit-for-bit copies of encrypted Signal messages I sent when I was arranging to play Red Dead Redemption 2 with friends, nobody knows how to decrypt those. I can't decrypt them, the people who received them can't decrypt it, even though we saw them at the time, and even though you have the encrypted messages and even if you have our phones, the keys are gone so that's that.

scifibestfi 4y ago
That's good, but I don't see how that means we know they aren't being stored. The NSA or another entity could be collecting them in bulk just in case the encryption is broken in 30 years.
- cvwright 4y ago
  What’s your alternative? Sneakernet? Anything that goes over a network could be stored.
  - scifibestfi 4y ago
    The article says they are not stored. That's what I'm questioning. "user messages are stored only on their devices, not on Signal’s servers or anywhere else."
    - kingaillas 4y ago
      I think it is fair to interpret that as: Signal is not storing messages on their servers, also Signal is not storing them on someone else's servers. Whether or not a 3rd party, outside Signal's knowledge and/or control, is storing messages is entirely out of their control.
    - tialaramex 4y ago
      Sure, like I said, it's a information theoretic argument. Imagine if Signal used a One Time Pad instead of AES, this might make it easier to see what's going on if you have some idea about the One Time Pad. Suppose I promise you that qMsVOrgWDZTo0Fet9xLhIQ is the base 64 encoded, 16 byte encrypted message I just sent, but I used OTP. Do you in some sense "have" a copy of my message ? No. That is completely useless without the key, it could have literally been any message, without the key there's no difference.
      - scifibestfi 4y ago
        Thanks for the explanation! That helps.

kklisura 4y ago

Signal received subpoena to produce all data they have on a user and they provided just two data-points: last connection date and account creation date [1][2]. So I'm pretty sure they do not store anything else. [1] https://signal.org/bigbrother/central-california-grand-jury/ https://signal.org/bigbrother/central-california-grand-jury/ [2] https://signal.org/bigbrother/eastern-virginia-grand-jury/ https://signal.org/bigbrother/eastern-virginia-grand-jury/

deleted 4y ago
[deleted]
coldtea 4y ago
And how to we know they don't collect other data but don't advertise it? If they have a special deal with government, the court wouldn't even know about those, or might be instructed not to ask them and not disclose anything.
- kklisura 4y ago
  Valid question, which I don't have the answer for, but since Signal is open-source [1][2] it's open to lot of analysis. Since we haven't heard anything damaging so far, I'm guessing it's _secure enough_. [1] https://github.com/signalapp/Signal-iOS https://github.com/signalapp/Signal-iOS [2] https://github.com/signalapp/Signal-Android https://github.com/signalapp/Signal-Android
  - coldtea 4y ago
    Another question then: can we verify (even if we have to jailbreak and check the binary) that the encrypted app delivered on iOS (and I presume Android) is built from the exact same source code? E.g. could we build it ourselves in, say, Xcode, and compare a hash of the resulting app binary with the installed one?
    - eitland 4y ago
      With Telegram you can. They provide instructions. (At least used to do.) Not sure about Signal.

permo-w 4y ago

is this not exactly the point of end to end encryption?