4 ms·

Or Signal could be the most well orchestrated honey pot. The server code is already partially closed source. What I don't understand is how a small organization

Or Signal could be the most well orchestrated honey pot. The server code is already partially closed source. What I don't understand is how a small organization like that cannot be convinced or compelled by a very powerful government intelligence agency. I will stick with decentralized protocols I can host myself.

espe 3y ago
this. also, they have a payment feature that opens them up further on grounds of regulatory scrutiny.
nunobrito 3y ago
People here will massively downvote your comment. The truth is that you are 100% correct in suspecting about that messenger. Since a long time that is known how Signal was initially sponsored by Radio Free Asia, which in turn is fueled by the CIA. For some reason western pages are disappearing on this topic, but after some search there are still some: https://greatgameindia.com/how-cia-created-signal-messenger-app/ https://greatgameindia.com/how-cia-created-signal-messenger-... Then comes the development of the algorithm itself. Moxei invited more crypto experts to write the algorithm while surfing in Hawaii. Quite strange of a chouse and zero details how those trips were sponsored but would know by "coincidence" what else is headquartered in Hawaii? NSA. Last but not least comes WhatsApp. With a billion users decides almost overnight to switch to the algorithm developed by this relatively unknown and smallish group called Signal. I'm not even observing how mainstream media is invariably supporting Signal with positive news while Telegram is negatively pictured. All these "signals" (that is an intelligence term btw), plus the fact of closed source code should be enough to raise eyebrows. But nope, you will see a sea of pedantic answers and downvoting whenever pointing the facts. Don't worry, you are not alone.
- zmgsabst 3y ago
  NSA has an office in Hawaii, but is headquartered in Maryland.
- stavros 3y ago
  Does the actual cryptography has anything suspicious-looking? I generally share your suspicion of the origins of Signal, but wouldn't the cryptography itself also look fairly odd if it were designed to be weak?
  - jrockway 3y ago
    They don't have to weaken the crypto. If you go "on the list", they just send you new code that starts using weak/no encryption. If you aren't on the list, then you'll never see this. The problem with Signal (and anything like Signal) is not the server code, but the client code distributed through app stores. We have had email encryption for decades without ever having to trust any email servers.
    - thecrash 3y ago
      Is your claim that this is currently happening? If so, why has nobody detected it? Since such code would have to be distributed to user devices, it would be detectable. Also, did you know that Signal is distributed through multiple channels? The iOS App Store, Google Play, F-Droid, as well as directly through Signal's website. Given this, how could they target an individual with tampered binaries in a way that they couldn't notice? Seems pretty hard to me.
      - xorcist 3y ago
        Pegasus was much, much more intrusive than a targeted payload from the Play Store and it took years before that was discovered. Note that Signal is specifically not allowed to be distributed outside of their own apk download and Google/Apple. They have made that repeatedly clear and will take measures against such distribution. Security is not a scalar. It is probably better for the mass audience but worse if your adversaries includes Google employees. Take note of your threat model. From what we know of three letter agencies, they probably won't bother. They prefer spyware-like control of the end device. That way they don't need to target the encryption of individual apps, it is far more effective to collect communications after it is decrypted and read by the target.
      - 3y ago
- TacticalCoder 3y ago
  > ... how mainstream media is invariably supporting Signal with positive news while Telegram is negatively pictured. But people are voting... Telegram had 700 million users at the beginning of 2023. I think the reason Telegram is constantly negatively pictured has nothing to do with Signal: it is because it is an actual threat to WhatsApp's dominance. Regarding the supposed benefits of Signal: this thing is collecting metadata left and right. And metadata are much more important than the content of the messages themselves. I simply don't trust Signal. I don't trust Telegram either but at least Telegram doesn't pretend and, well, Telegram is actually used by my family and friends.
  - nunobrito 3y ago
    My thoughts exactly. At least there is no pretending around Telegram. The only guarantee we have is the difficulty for western authorities to intercept communications from western citizens there.
drexlspivey 3y ago
If the client code is available and sound it shouldn’t matter what the server does, they still can’t read your messages
- kornhole 3y ago
  Metadata is always created. This is often more valuable to the monitors than actual content in messages.

espe 3y ago

this. also, they have a payment feature that opens them up further on grounds of regulatory scrutiny.

nunobrito 3y ago

People here will massively downvote your comment. The truth is that you are 100% correct in suspecting about that messenger. Since a long time that is known how Signal was initially sponsored by Radio Free Asia, which in turn is fueled by the CIA. For some reason western pages are disappearing on this topic, but after some search there are still some: https://greatgameindia.com/how-cia-created-signal-messenger-app/ https://greatgameindia.com/how-cia-created-signal-messenger-... Then comes the development of the algorithm itself. Moxei invited more crypto experts to write the algorithm while surfing in Hawaii. Quite strange of a chouse and zero details how those trips were sponsored but would know by "coincidence" what else is headquartered in Hawaii? NSA. Last but not least comes WhatsApp. With a billion users decides almost overnight to switch to the algorithm developed by this relatively unknown and smallish group called Signal. I'm not even observing how mainstream media is invariably supporting Signal with positive news while Telegram is negatively pictured. All these "signals" (that is an intelligence term btw), plus the fact of closed source code should be enough to raise eyebrows. But nope, you will see a sea of pedantic answers and downvoting whenever pointing the facts. Don't worry, you are not alone.

zmgsabst 3y ago
NSA has an office in Hawaii, but is headquartered in Maryland.
stavros 3y ago
Does the actual cryptography has anything suspicious-looking? I generally share your suspicion of the origins of Signal, but wouldn't the cryptography itself also look fairly odd if it were designed to be weak?
- jrockway 3y ago
  They don't have to weaken the crypto. If you go "on the list", they just send you new code that starts using weak/no encryption. If you aren't on the list, then you'll never see this. The problem with Signal (and anything like Signal) is not the server code, but the client code distributed through app stores. We have had email encryption for decades without ever having to trust any email servers.
  - thecrash 3y ago
    Is your claim that this is currently happening? If so, why has nobody detected it? Since such code would have to be distributed to user devices, it would be detectable. Also, did you know that Signal is distributed through multiple channels? The iOS App Store, Google Play, F-Droid, as well as directly through Signal's website. Given this, how could they target an individual with tampered binaries in a way that they couldn't notice? Seems pretty hard to me.
    - xorcist 3y ago
      Pegasus was much, much more intrusive than a targeted payload from the Play Store and it took years before that was discovered. Note that Signal is specifically not allowed to be distributed outside of their own apk download and Google/Apple. They have made that repeatedly clear and will take measures against such distribution. Security is not a scalar. It is probably better for the mass audience but worse if your adversaries includes Google employees. Take note of your threat model. From what we know of three letter agencies, they probably won't bother. They prefer spyware-like control of the end device. That way they don't need to target the encryption of individual apps, it is far more effective to collect communications after it is decrypted and read by the target.
    - 3y ago
TacticalCoder 3y ago
> ... how mainstream media is invariably supporting Signal with positive news while Telegram is negatively pictured. But people are voting... Telegram had 700 million users at the beginning of 2023. I think the reason Telegram is constantly negatively pictured has nothing to do with Signal: it is because it is an actual threat to WhatsApp's dominance. Regarding the supposed benefits of Signal: this thing is collecting metadata left and right. And metadata are much more important than the content of the messages themselves. I simply don't trust Signal. I don't trust Telegram either but at least Telegram doesn't pretend and, well, Telegram is actually used by my family and friends.
- nunobrito 3y ago
  My thoughts exactly. At least there is no pretending around Telegram. The only guarantee we have is the difficulty for western authorities to intercept communications from western citizens there.

drexlspivey 3y ago

If the client code is available and sound it shouldn’t matter what the server does, they still can’t read your messages

kornhole 3y ago
Metadata is always created. This is often more valuable to the monitors than actual content in messages.