5 ms·

Doing so comes at a cost to privacy — by signal having a hosting server, even if the contents are E2EE, retrieving and storing these contents creates a metadata

Doing so comes at a cost to privacy — by signal having a hosting server, even if the contents are E2EE, retrieving and storing these contents creates a metadata trail. I actually go over these drawbacks and tradeoffs in a recent blog post: https://cassieheart.substack.com/p/notes-on-e2ee https://cassieheart.substack.com/p/notes-on-e2ee

anigbrowl 4y ago
Who said anything about a hosting server? Why isn't there a simple option to export a conversation to local storage, encrypted or unencrypted, along with a warning that 'your conversation is now leaving the secure Signal zone.'
- cassonmars 4y ago
  For starters, signal retains a conversation for the length of time you grant. That can be indefinite. The way it is retained is in a local storage database. It is intentionally guarded against export (although this is somewhat unavoidable with backup features on phones), so as to avoid companies like Cellebrite making it easy for LE to overstep their bounds and pull the message database when they take your phone. If you want some kind of export interface, your best option is a screenshot — signal does not take any action that threatens the mutual security between parties as explicitly agreed.
  - anigbrowl 4y ago
    I don't want to be handcuffed for my own security, thanks. An export facility has little bearing on the integrity of my communications since a counterparty could simply have their phone taken over if they forgot to set a PIN or gave the PIN up to law enforcement. A warning that the exported data can no longer be considered secure (just like when I save a file or photo) is sufficient. Meanwhile if my counterparty and I have communications in Signal that we want to preserve at scale, it's impossible to do so. A simple example would be that I have years' worth of conversations with my wife that I can't easily back up any where. We could export every picture and video by hand and screenshot or copy the text of every message, but that would be extremely time-consuming and tedious. That's the basic problem. The data is already only semi-secure in that it's subject to exfiltration without consent. It's just inconvenient. And where parties do consent, it's very inconvenient because it's many many hours of work; in the end, it's just more security theater.
- chopin 4y ago
  It's not only your conversation but the one of others too. I like that it's hard to move it elsewhere.
  - daedalus_j 4y ago
    If you don't trust the other end then disappearing messages should be used, simple. This is one of the problems with Signal having a bit of confusion about what exactly it's use-case is. There are plenty of cases where locking down the ability to save/view/export messages are valuable, and Signal provides tools to be able to do that. Making that the mandatory case though means that it's harder to adopt as a general-purpose communication platform. The need to decide if the goal is still to get as many people off of SMS/facebook-messenger as possible, or if the goal is to provide extreme security to dissidents and protestors, or if they're going to spend the effort to be able to do both effectively and let you choose which conversations or messages get which level of protection.
  - anigbrowl 4y ago
    But I could just screenshot all of it, and you'd never know. There's a setting to prevent screenshots, but no way to tell if other persons have it enabled or when their setting change. It's like when Signal asks you to put in your PIN, but it's the same PIN you use to unlock your phone. There's a different Signal PIN, but that functions as a check for when you install Signal on a new device. Your regular PIN is just a repeat of your phone PIN, and thus adds exactly zero security.

anigbrowl 4y ago

Who said anything about a hosting server? Why isn't there a simple option to export a conversation to local storage, encrypted or unencrypted, along with a warning that 'your conversation is now leaving the secure Signal zone.'

cassonmars 4y ago
For starters, signal retains a conversation for the length of time you grant. That can be indefinite. The way it is retained is in a local storage database. It is intentionally guarded against export (although this is somewhat unavoidable with backup features on phones), so as to avoid companies like Cellebrite making it easy for LE to overstep their bounds and pull the message database when they take your phone. If you want some kind of export interface, your best option is a screenshot — signal does not take any action that threatens the mutual security between parties as explicitly agreed.
- anigbrowl 4y ago
  I don't want to be handcuffed for my own security, thanks. An export facility has little bearing on the integrity of my communications since a counterparty could simply have their phone taken over if they forgot to set a PIN or gave the PIN up to law enforcement. A warning that the exported data can no longer be considered secure (just like when I save a file or photo) is sufficient. Meanwhile if my counterparty and I have communications in Signal that we want to preserve at scale, it's impossible to do so. A simple example would be that I have years' worth of conversations with my wife that I can't easily back up any where. We could export every picture and video by hand and screenshot or copy the text of every message, but that would be extremely time-consuming and tedious. That's the basic problem. The data is already only semi-secure in that it's subject to exfiltration without consent. It's just inconvenient. And where parties do consent, it's very inconvenient because it's many many hours of work; in the end, it's just more security theater.
chopin 4y ago
It's not only your conversation but the one of others too. I like that it's hard to move it elsewhere.
- daedalus_j 4y ago
  If you don't trust the other end then disappearing messages should be used, simple. This is one of the problems with Signal having a bit of confusion about what exactly it's use-case is. There are plenty of cases where locking down the ability to save/view/export messages are valuable, and Signal provides tools to be able to do that. Making that the mandatory case though means that it's harder to adopt as a general-purpose communication platform. The need to decide if the goal is still to get as many people off of SMS/facebook-messenger as possible, or if the goal is to provide extreme security to dissidents and protestors, or if they're going to spend the effort to be able to do both effectively and let you choose which conversations or messages get which level of protection.
- anigbrowl 4y ago
  But I could just screenshot all of it, and you'd never know. There's a setting to prevent screenshots, but no way to tell if other persons have it enabled or when their setting change. It's like when Signal asks you to put in your PIN, but it's the same PIN you use to unlock your phone. There's a different Signal PIN, but that functions as a check for when you install Signal on a new device. Your regular PIN is just a repeat of your phone PIN, and thus adds exactly zero security.