4 ms·

>it has nothing to do with spam or anything What experience do you have to have gained this confident knowledge?

by callalex 3y ago

verisimi 3y ago
Would they be able to resist a secret court order?
- stavros 3y ago
  An order to what? Hand over a random phone number?
  - anigbrowl 3y ago
    As if you can't get a whole lot of information on most people with just their phone number. The number of people whose Signal ID is built off a burner phone ad no longer traceable back to them is miniscule.
    - growse 3y ago
      > As if you can't get a whole lot of information on most people with just their phone number. The number of people whose Signal ID is built off a burner phone ad no longer traceable back to them is miniscule. Yes, but what are you going to do with this information? All you know is how long they've been a signal user and when they last connected.
      - heavyset_go 3y ago
        You correlate that with the chat logs you've secured from a phone that's been confiscated or subpoenaed. The metadata itself is just as valuable as the content of the messages. If you want to prove that criminal A was in correspondence with criminal B, that's how you do it. As per this comment, they store much more than just the last connection time[1]. [1] https://news.ycombinator.com/item?id=39445791 https://news.ycombinator.com/item?id=39445791
        growse 3y ago
        If you got the physical device and the data on it (unencrypted), then what do you need the server for?
        anigbrowl 3y ago
        You're not thinking this through. You might have someone else's device with access to their signal chats, but need to confirm the identity of someone they're talking to. You might have been able to ID a person but only have had temporary access to the message data (eg undercover agents who sneak or are granted a look at someone else's Signal messages). You might have a Signal conversation with someone you suspect of crime, and want to establish correlation with their use of signal (by most-recently-accessed timestamps) and some other activity.
- toomuchtodo 3y ago
  No tech professional is going to resist people with legalized force showing up at their door.
  - tamimio 3y ago
    That’s why you design a system that doesn’t require such info in the first place, if you don’t have it, nothing to hand over.
    - xboxnolifes 3y ago
      That doesn't explain why it has nothing to do with spam. If you know how to build an anonymous communication platform, that is convenient to use, and is also spam resistant/proof, you have the miracle platform idea.
    - insane_dreamer 3y ago
      that already exists; IRC for one. But not particularly user-friendly for everyone (requires presence).
    - Vinnl 3y ago
      That's why Signal only stores your phone number (and when you last connected) - they know nothing about your real identity, so they can't link it back to you.
    - heavyset_go 3y ago
      And then when you're faced with potential criminal suits and/or the security state coming after you for "national security" reasons, you implement the tracking the government wants so you don't potentially go to trial and/or prison.
  - miohtama 3y ago
    In Sweden they have some spine to do this https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subjec...
- Sanzig 3y ago
  Signal publishes their responses to court orders already: https://signal.org/bigbrother/ https://signal.org/bigbrother/. Obviously doesn't include warrants they may have received where a gag order is in place, but you can see from the responses they do publish that they only store phone number, initial registration date, and last connection date.
  - _zoltan_ 3y ago
    this seems to have stopped in 2021?
  - autoexec 3y ago
    They love to brag about the times when they were asked to hand over data and they had to tell the feds that they couldn't because that kind of data was never collected or stored in their systems in the first place. They still love to brag about it, but it's no longer true. They now collect and permanently store in the cloud exactly the kind of data that the police and feds were asking them to provide. Your name, your phone number, your username, your profile picture, and most importantly a list of everyone you have contacted with signal. This is in direct opposition to the very first line of their privacy policy which lies when it states "Signal is designed to never collect or store any sensitive information." and they've refused for years now to correct that lie and update their policy to detail all the new data collection they're doing.
    - roughly 3y ago
      Do you have details on this? Given that usernames just came out, I don’t expect they’re storing many of them, but I’m interested in specifically a source for “a list of everyone you have contacted with signal”
      - autoexec 3y ago
        This has been true for many years now. At the time it caused a major uproar among the userbase (myself included) whose concerns were almost entirely ignored. Their misleading communication at the time caused a lot of confusion, but if you didn't know that Signal was collecting this data that should tell you everything you need to know about how trustworthy they are. Here's some reading from the time of the change: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 https://community.signalusers.org/t/dont-want-pin-dont-want-... https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin... https://www.vice.com/en/article/pkyzek/signal-new-pin-feature-worries-cybersecurity-experts https://www.vice.com/en/article/pkyzek/signal-new-pin-featur... Note that the "solution" of disabling pins mentioned at the end of that last article was later shown to not prevent the collection and storage of user data. It was just giving users a false sense of security. To this day there is no way to opt out of the data collection. My personal feeling is that Signal is compromised and the fact that the very first sentence of their privacy policy is a lie and they refuse to update it to detail their new data collection is a big fat dead canary warning people to find a new solution for secured communication. Other very questionable Signal moves that make me wonder if it wasn't an effort to drive people away from the platform as loudly as they were allowed to include the killing off of one of the most popular features (the ability to get both secured messages and insecure SMS/MMS in the same app) and the introduction of weird crypto shit nobody was asking for.
- autoexec 3y ago
  At this point that's entirely unclear. Because they're keeping your data in the cloud my guess is that the US government can easily access that data and any other government can get anyone's data as long as they can guess the person's PIN. You can find a discussion on the problems with their security here: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu...
  - egberts1 3y ago
    Required reading: https://eprint.iacr.org/2016/1013.pdf https://eprint.iacr.org/2016/1013.pdf
    - fsflover 3y ago
      The parent is right: https://news.ycombinator.com/item?id=39414322 https://news.ycombinator.com/item?id=39414322
    - autoexec 3y ago
      That was before they started collecting and storing sensitive data in the cloud. See https://sgaxe.com/files/SGAxe.pdf https://sgaxe.com/files/SGAxe.pdf for an attack that leaked Signal contacts.

>it has nothing to do with spam or anything What experience do you have to have gained this confident knowledge?

verisimi 3y ago

Would they be able to resist a secret court order?

stavros 3y ago
An order to what? Hand over a random phone number?
- anigbrowl 3y ago
  As if you can't get a whole lot of information on most people with just their phone number. The number of people whose Signal ID is built off a burner phone ad no longer traceable back to them is miniscule.
  - growse 3y ago
    > As if you can't get a whole lot of information on most people with just their phone number. The number of people whose Signal ID is built off a burner phone ad no longer traceable back to them is miniscule. Yes, but what are you going to do with this information? All you know is how long they've been a signal user and when they last connected.
    - heavyset_go 3y ago
      You correlate that with the chat logs you've secured from a phone that's been confiscated or subpoenaed. The metadata itself is just as valuable as the content of the messages. If you want to prove that criminal A was in correspondence with criminal B, that's how you do it. As per this comment, they store much more than just the last connection time[1]. [1] https://news.ycombinator.com/item?id=39445791 https://news.ycombinator.com/item?id=39445791
      - growse 3y ago
        If you got the physical device and the data on it (unencrypted), then what do you need the server for?
        anigbrowl 3y ago
        You're not thinking this through. You might have someone else's device with access to their signal chats, but need to confirm the identity of someone they're talking to. You might have been able to ID a person but only have had temporary access to the message data (eg undercover agents who sneak or are granted a look at someone else's Signal messages). You might have a Signal conversation with someone you suspect of crime, and want to establish correlation with their use of signal (by most-recently-accessed timestamps) and some other activity.
toomuchtodo 3y ago
No tech professional is going to resist people with legalized force showing up at their door.
- tamimio 3y ago
  That’s why you design a system that doesn’t require such info in the first place, if you don’t have it, nothing to hand over.
  - xboxnolifes 3y ago
    That doesn't explain why it has nothing to do with spam. If you know how to build an anonymous communication platform, that is convenient to use, and is also spam resistant/proof, you have the miracle platform idea.
  - insane_dreamer 3y ago
    that already exists; IRC for one. But not particularly user-friendly for everyone (requires presence).
  - Vinnl 3y ago
    That's why Signal only stores your phone number (and when you last connected) - they know nothing about your real identity, so they can't link it back to you.
  - heavyset_go 3y ago
    And then when you're faced with potential criminal suits and/or the security state coming after you for "national security" reasons, you implement the tracking the government wants so you don't potentially go to trial and/or prison.
- miohtama 3y ago
  In Sweden they have some spine to do this https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subjec...
Sanzig 3y ago
Signal publishes their responses to court orders already: https://signal.org/bigbrother/ https://signal.org/bigbrother/. Obviously doesn't include warrants they may have received where a gag order is in place, but you can see from the responses they do publish that they only store phone number, initial registration date, and last connection date.
- _zoltan_ 3y ago
  this seems to have stopped in 2021?
- autoexec 3y ago
  They love to brag about the times when they were asked to hand over data and they had to tell the feds that they couldn't because that kind of data was never collected or stored in their systems in the first place. They still love to brag about it, but it's no longer true. They now collect and permanently store in the cloud exactly the kind of data that the police and feds were asking them to provide. Your name, your phone number, your username, your profile picture, and most importantly a list of everyone you have contacted with signal. This is in direct opposition to the very first line of their privacy policy which lies when it states "Signal is designed to never collect or store any sensitive information." and they've refused for years now to correct that lie and update their policy to detail all the new data collection they're doing.
  - roughly 3y ago
    Do you have details on this? Given that usernames just came out, I don’t expect they’re storing many of them, but I’m interested in specifically a source for “a list of everyone you have contacted with signal”
    - autoexec 3y ago
      This has been true for many years now. At the time it caused a major uproar among the userbase (myself included) whose concerns were almost entirely ignored. Their misleading communication at the time caused a lot of confusion, but if you didn't know that Signal was collecting this data that should tell you everything you need to know about how trustworthy they are. Here's some reading from the time of the change: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 https://community.signalusers.org/t/dont-want-pin-dont-want-... https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin... https://www.vice.com/en/article/pkyzek/signal-new-pin-feature-worries-cybersecurity-experts https://www.vice.com/en/article/pkyzek/signal-new-pin-featur... Note that the "solution" of disabling pins mentioned at the end of that last article was later shown to not prevent the collection and storage of user data. It was just giving users a false sense of security. To this day there is no way to opt out of the data collection. My personal feeling is that Signal is compromised and the fact that the very first sentence of their privacy policy is a lie and they refuse to update it to detail their new data collection is a big fat dead canary warning people to find a new solution for secured communication. Other very questionable Signal moves that make me wonder if it wasn't an effort to drive people away from the platform as loudly as they were allowed to include the killing off of one of the most popular features (the ability to get both secured messages and insecure SMS/MMS in the same app) and the introduction of weird crypto shit nobody was asking for.
autoexec 3y ago
At this point that's entirely unclear. Because they're keeping your data in the cloud my guess is that the US government can easily access that data and any other government can get anyone's data as long as they can guess the person's PIN. You can find a discussion on the problems with their security here: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu...
- egberts1 3y ago
  Required reading: https://eprint.iacr.org/2016/1013.pdf https://eprint.iacr.org/2016/1013.pdf
  - fsflover 3y ago
    The parent is right: https://news.ycombinator.com/item?id=39414322 https://news.ycombinator.com/item?id=39414322
  - autoexec 3y ago
    That was before they started collecting and storing sensitive data in the cloud. See https://sgaxe.com/files/SGAxe.pdf https://sgaxe.com/files/SGAxe.pdf for an attack that leaked Signal contacts.