3 ms·
> Neither was signal taking your contact list and uploading a copy along with your name and photo and storing that data forever in the cloud. It seems incomple
by bentley 4y ago
> Neither was signal taking your contact list and uploading a copy along with your name and photo and storing that data forever in the cloud.
It seems incomplete to not mention that that data is end‐to‐end encrypted, and that name and photo are optional.
- autoexec 4y agoIn which case it would also be incomplete not to mention that that same data is stored insecurely and protected by an easy to brute force PIN. ( see https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu...)
- bentley 4y agoYes, “though contacts are encrypted, users are not prevented from using a weak PIN” would have been a better way to word this criticism from the start, rather than implying that they are stored completely unencrypted.
- autoexec 4y ago“though contacts are encrypted, users are not prevented from using a weak PIN” ignores that Signal encouraged users to set a weak pin (for many people the word "PIN" means a 4 digit number) and that the data is stored using SGX which has already proved to be vulnerable. In my view the fact that they have been lying in their privacy policy is a much bigger problem for a company we're supposed to trust.