3 ms·

> broadcasting images to your contact list isn't exactly what I think of when I think "private messaging". Neither was signal taking your contact list and uplo

> broadcasting images to your contact list isn't exactly what I think of when I think "private messaging". Neither was signal taking your contact list and uploading a copy along with your name and photo and storing that data forever in the cloud. Neither was refusing to update their privacy policy to reflect their new data collection practices. A company that promotes itself to whistleblowers and human rights activists and then lies to them about what data they collect and keep is highly unethical. None of this inspires confidence in Signal as a private/secure messaging service. I've moved away from it. I wish them luck as a social media platform.

bentley 4y ago
> Neither was signal taking your contact list and uploading a copy along with your name and photo and storing that data forever in the cloud. It seems incomplete to not mention that that data is end‐to‐end encrypted, and that name and photo are optional.
- autoexec 4y ago
  In which case it would also be incomplete not to mention that that same data is stored insecurely and protected by an easy to brute force PIN. ( see https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu...)
  - bentley 4y ago
    Yes, “though contacts are encrypted, users are not prevented from using a weak PIN” would have been a better way to word this criticism from the start, rather than implying that they are stored completely unencrypted.
    - autoexec 4y ago
      “though contacts are encrypted, users are not prevented from using a weak PIN” ignores that Signal encouraged users to set a weak pin (for many people the word "PIN" means a 4 digit number) and that the data is stored using SGX which has already proved to be vulnerable. In my view the fact that they have been lying in their privacy policy is a much bigger problem for a company we're supposed to trust.

bentley 4y ago

> Neither was signal taking your contact list and uploading a copy along with your name and photo and storing that data forever in the cloud. It seems incomplete to not mention that that data is end‐to‐end encrypted, and that name and photo are optional.

autoexec 4y ago
In which case it would also be incomplete not to mention that that same data is stored insecurely and protected by an easy to brute force PIN. ( see https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu...)
- bentley 4y ago
  Yes, “though contacts are encrypted, users are not prevented from using a weak PIN” would have been a better way to word this criticism from the start, rather than implying that they are stored completely unencrypted.
  - autoexec 4y ago
    “though contacts are encrypted, users are not prevented from using a weak PIN” ignores that Signal encouraged users to set a weak pin (for many people the word "PIN" means a 4 digit number) and that the data is stored using SGX which has already proved to be vulnerable. In my view the fact that they have been lying in their privacy policy is a much bigger problem for a company we're supposed to trust.