4 ms·

The NSA thing is the only thing I didn't check out, and it appears you are right, so I am dumb. -- I wrote this before Marlinspike stepped down and I never thou

by dijit 3y ago

The NSA thing is the only thing I didn't check out, and it appears you are right, so I am dumb. -- I wrote this before Marlinspike stepped down and I never thought to check that either, so second point to you: I am idiotic. Regardless that particular point stands even if he's not the messiah anymore, that he was heralded as a saint who bestowed on humanity the right to privacy, and that we should trust in him. From what I can find about the entity that funded Signal from the government it seems to be a lot to do with the CIA and anti-censorship products designed to disrupt other countries... Which, actually fits with the narrative of censorship resistant messaging, at least -- so no reason to think that it betrays the stated mission of Signal The foundation that funded them used to be called: Radio Free Asia (which on inspection seems to be considered propaganda, though seems to market itself as free media), now called OTF, if you see the list of other software they sponsor it's very much in the same category: https://en.wikipedia.org/wiki/Open_Technology_Fund https://en.wikipedia.org/wiki/Open_Technology_Fund So, I recant those statements about NSA, I only know that a number of people in NSA are not using Signal, and I had heard about NSA funding from somewhere, which obviously is not true. EDIT: It appears the link to the submission has been slightly altered to break it; it should be: https://blog.dijit.sh/i-don-t-trust-signal https://blog.dijit.sh/i-don-t-trust-signal

tptacek 3y ago
Correct the article, and note what you originally said when you do so, so your readers can make their own decisions about how seriously to take your arguments. The details you're providing about BBG, RFA, and OTF aren't relevant, and just add detail to what I said. In case you were relating them to educate me: there's no need, I have firsthand knowledge of the programs you're slandering (whether you mean to or not).
- dijit 3y ago
  > Correct the article, and note what you originally said when you do so, so your readers can make their own decisions about how seriously to take your arguments. I mean, the points at the bottom of the article are exactly the same. I would consider your temperement and not indulge flights of fancy that I am attacking you or your institutions. I am speaking as a citizen, from an outside perspective, on what concerns me; because ultimately I see Signal pushed very hard and only lip service paid to any issues. > The details you're providing about BBG, RFA, and OTF aren't relevant, and just add detail to what I said. In case you were relating them to educate me: there's no need, I have firsthand knowledge of the programs you're slandering (whether you mean to or not). I thought it might provide some context, given that I am agreeing that the stated mission of OTF aligns somewhat and does not directly contradict the stated goals of Signal.
  - tptacek 3y ago
    You ran an article titled "I don't trust Signal" with a subhed that read "Signal took NSA money". That was false, as you acknowledged. You can correct it properly or not. People can draw conclusions from your actions either way.
    - dijit 3y ago
      Sorry, where are you getting the idea that I wouldn't correct the article? What are my "actions" that people can draw conclusions from? This sounds very emotive and slightly threatening.
      - tptacek 3y ago
        I don't pretend to understand what you're arguing about right now. Personally, I think you should correct the article, but you could opt not to. It's your call either way.
        dijit 3y ago
        OK, let me be as clear as I can be because I thought I stated this: I will, always, absolutely correct the article, and I will keep my original statements as strike-throughs. Given that it makes no material difference to the point being made I don't know why it's being so emotionally driven; I would correct the article even if it completely invalidated my point. I would correct the article if you hadn't been emotional too. It's just good to make sure that if you make a mistake that you own up to it and you ensure that misinformation does not spread. I think (I hope) you agree with that. Which is why I'm confused as to why you keep pressing the issue as I had already corrected the article after seeing your comment for the first time (before I even replied, in fact). The reason you can't understand what I'm arguing about is because I'm... not arguing.
        tptacek 3y ago
        Sounds like there's not much more to talk about!
woodruffw 3y ago
The lack of Signal’s use within the NSA is not positive evidence of its compromise. The NSA has operational constraints that don’t even remotely map onto a phone-number-identified messaging scheme.
jolux 3y ago
I have to imagine using Signal with a high level clearance might itself arouse suspicion, for one thing. People inside the intelligence community really can’t expect much privacy for themselves.
yawz 3y ago
> so I am dumb To be fair, as I read it, the criticism was directed at your work and not you. We all make mistakes.
- lmm 3y ago
  To be fair, had anyone other than tptacek used that tone on today's HN they'd be downvoted as intolerably rude.
guraf 3y ago
> The NSA thing is the only thing I didn't check out You might want to check again because your post is full of inaccuracies. From signal being on f-droid to their backend being relevant to security, you got almost everything wrong.
opportune 3y ago
>a number of people in NSA are not using signal Doesn’t necessarily mean it’s cryptographically insecure. I can imagine any NSA employee installing a typical strong-crypto software like Signal, PGP, or TOR on a personal device is a massive red flag worth investigating. If I were in that position I would not want to garner that kind of attention even if the crypto itself is fine
rcarback 3y ago
I think you are being too deferential here. Reports from 2007/2008 had already indicated significant interference and government spying between agencies and with private corporations. Also, at that time it was widely believed but not yet confirmed Dual_EC_DRBG was backdoored via NIST/NSA collaboration. Many folks equate any US government money with NSA money, and did so especially around this time, which is likely why you made this mistake. Taking any US-backed government money, even at the time Signal took it, was and should be suspect. IIRC Signal continued to take money even after Snowden. So it is a fair point and not at all idiotic, and the over-reaction after you agreed to correct the article is suspect. I do think Signal needed that money to survive, and it probably was put to good use, but I would have acted differently and more transparently about how my use of that money was communicated to the public.
- tptacek 3y ago
  That's not what they said. They didn't write "Signal, like every other privacy app at the time, took US-backed Broadcast Board of Governors money". They wrote "Signal took NSA money", which is inflammatory and, of course, obviously false. You can't rescue that claim with jazz hands. I don't think you're doing this person any favors by keeping this debate alive.
  - dijit 3y ago
    I cant see any evidence that Broadcast Board of Governers has funded anything like: Telegram, Briar, any of the third party clients for XMPP or IRC or any of the major privacy mail services like tutanota. So I think it’s at least a mild mischaracterisation that they funded everything. in fact the only other major popular software they seem to fund is Tor (also from US govt) and noscript.[0] “How could you possibly get the three letter agency wrong, your argument is entirely invalid” is a bit of a strawman dude, I admitted the mistake and corrected immediately — but you make it sound as if it matters at all which three letter agency it was. No, it wasn't the one that is charged with spying on everyone, it was the one linked to disrupting everyone. Much better, but not materially different. I am not finding evidence to suggest what you claim either. [0]: https://www.usagm.gov/wp-content/media/2017/01/OIF-Factsheet_Jan-2017.pdf https://www.usagm.gov/wp-content/media/2017/01/OIF-Factsheet...

by dijit 3y ago

tptacek 3y ago

Correct the article, and note what you originally said when you do so, so your readers can make their own decisions about how seriously to take your arguments. The details you're providing about BBG, RFA, and OTF aren't relevant, and just add detail to what I said. In case you were relating them to educate me: there's no need, I have firsthand knowledge of the programs you're slandering (whether you mean to or not).

dijit 3y ago
> Correct the article, and note what you originally said when you do so, so your readers can make their own decisions about how seriously to take your arguments. I mean, the points at the bottom of the article are exactly the same. I would consider your temperement and not indulge flights of fancy that I am attacking you or your institutions. I am speaking as a citizen, from an outside perspective, on what concerns me; because ultimately I see Signal pushed very hard and only lip service paid to any issues. > The details you're providing about BBG, RFA, and OTF aren't relevant, and just add detail to what I said. In case you were relating them to educate me: there's no need, I have firsthand knowledge of the programs you're slandering (whether you mean to or not). I thought it might provide some context, given that I am agreeing that the stated mission of OTF aligns somewhat and does not directly contradict the stated goals of Signal.
- tptacek 3y ago
  You ran an article titled "I don't trust Signal" with a subhed that read "Signal took NSA money". That was false, as you acknowledged. You can correct it properly or not. People can draw conclusions from your actions either way.
  - dijit 3y ago
    Sorry, where are you getting the idea that I wouldn't correct the article? What are my "actions" that people can draw conclusions from? This sounds very emotive and slightly threatening.
    - tptacek 3y ago
      I don't pretend to understand what you're arguing about right now. Personally, I think you should correct the article, but you could opt not to. It's your call either way.
      - dijit 3y ago
        OK, let me be as clear as I can be because I thought I stated this: I will, always, absolutely correct the article, and I will keep my original statements as strike-throughs. Given that it makes no material difference to the point being made I don't know why it's being so emotionally driven; I would correct the article even if it completely invalidated my point. I would correct the article if you hadn't been emotional too. It's just good to make sure that if you make a mistake that you own up to it and you ensure that misinformation does not spread. I think (I hope) you agree with that. Which is why I'm confused as to why you keep pressing the issue as I had already corrected the article after seeing your comment for the first time (before I even replied, in fact). The reason you can't understand what I'm arguing about is because I'm... not arguing.
        tptacek 3y ago
        Sounds like there's not much more to talk about!

woodruffw 3y ago

The lack of Signal’s use within the NSA is not positive evidence of its compromise. The NSA has operational constraints that don’t even remotely map onto a phone-number-identified messaging scheme.

jolux 3y ago

I have to imagine using Signal with a high level clearance might itself arouse suspicion, for one thing. People inside the intelligence community really can’t expect much privacy for themselves.

yawz 3y ago

> so I am dumb To be fair, as I read it, the criticism was directed at your work and not you. We all make mistakes.

lmm 3y ago
To be fair, had anyone other than tptacek used that tone on today's HN they'd be downvoted as intolerably rude.

guraf 3y ago

> The NSA thing is the only thing I didn't check out You might want to check again because your post is full of inaccuracies. From signal being on f-droid to their backend being relevant to security, you got almost everything wrong.

opportune 3y ago

>a number of people in NSA are not using signal Doesn’t necessarily mean it’s cryptographically insecure. I can imagine any NSA employee installing a typical strong-crypto software like Signal, PGP, or TOR on a personal device is a massive red flag worth investigating. If I were in that position I would not want to garner that kind of attention even if the crypto itself is fine

rcarback 3y ago

I think you are being too deferential here. Reports from 2007/2008 had already indicated significant interference and government spying between agencies and with private corporations. Also, at that time it was widely believed but not yet confirmed Dual_EC_DRBG was backdoored via NIST/NSA collaboration. Many folks equate any US government money with NSA money, and did so especially around this time, which is likely why you made this mistake. Taking any US-backed government money, even at the time Signal took it, was and should be suspect. IIRC Signal continued to take money even after Snowden. So it is a fair point and not at all idiotic, and the over-reaction after you agreed to correct the article is suspect. I do think Signal needed that money to survive, and it probably was put to good use, but I would have acted differently and more transparently about how my use of that money was communicated to the public.

tptacek 3y ago
That's not what they said. They didn't write "Signal, like every other privacy app at the time, took US-backed Broadcast Board of Governors money". They wrote "Signal took NSA money", which is inflammatory and, of course, obviously false. You can't rescue that claim with jazz hands. I don't think you're doing this person any favors by keeping this debate alive.
- dijit 3y ago
  I cant see any evidence that Broadcast Board of Governers has funded anything like: Telegram, Briar, any of the third party clients for XMPP or IRC or any of the major privacy mail services like tutanota. So I think it’s at least a mild mischaracterisation that they funded everything. in fact the only other major popular software they seem to fund is Tor (also from US govt) and noscript.[0] “How could you possibly get the three letter agency wrong, your argument is entirely invalid” is a bit of a strawman dude, I admitted the mistake and corrected immediately — but you make it sound as if it matters at all which three letter agency it was. No, it wasn't the one that is charged with spying on everyone, it was the one linked to disrupting everyone. Much better, but not materially different. I am not finding evidence to suggest what you claim either. [0]: https://www.usagm.gov/wp-content/media/2017/01/OIF-Factsheet_Jan-2017.pdf https://www.usagm.gov/wp-content/media/2017/01/OIF-Factsheet...