3 ms·

Well, to link with recent news, do you think talking with the late Alexey Navalni over Signal would protect you from russian police? They'd still be able to see

Well, to link with recent news, do you think talking with the late Alexey Navalni over Signal would protect you from russian police? They'd still be able to see that you talked to him. And then what's the point of the super duper encryption?

ivlad 3y ago
In Signal, probably no. Signal has this sealed sender functionality hiding significant amount of metadata from passive observer and active examination post-communication: https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/ What Russian police would be able to see, that in a given time period of certificate rotation at most X people communicated to Navalny.
wolverine876 3y ago
> They'd still be able to see that you talked to him. Signal has no access to metadata, including participants in a conversation. All they know is the date of account creation and the date of the last connection. However, if they got access to Navalni's phone, then they of course can see everything Navalni can.
- nottorp 3y ago
  > However, if they got access to Navalni's phone, then they of course can see everything Navalni can. Aha :) Do you people also want the relevant xkcd? The one about the wrench...
Summershard 3y ago
Signal does not know who you correspond with. The only information they keep is the account creation timestamp, and the date that the account last connected to the Signal service. You may have confused this information with WhatsApp which indeed keeps a lot of metadata on each user.
- fsflover 3y ago
  https://news.ycombinator.com/item?id=39414322 https://news.ycombinator.com/item?id=39414322
  - Summershard 3y ago
    Well, TIL. That does not refute my comment, though. Signal still does not know who you chat with. It's the cloud provider who might log the IP address of the sender. Identifying the person based on that information alone would be non-trivial if not simply impossible.
    - fsflover 3y ago
      > Signal still does not know who you chat with. It's the cloud provider To me, it's much worse. A non-profit doesn't have my data but Amazon (and NSA) does. With Amazon's scale, it must be trivial to identify everyone. See also: https://news.ycombinator.com/threads?id=autoexec&next=39445791#39445866 https://news.ycombinator.com/threads?id=autoexec&next=394457...
- xorcist 3y ago
  Signal absolutely knows who you correspond with. How could they otherwise route your chat messages? They promise to throw this information away, which is nice but not possible to verify. They also employ a roundabout way of encrypting this data, but as they rightly point out in their article that describes the scheme, encrypting or hashing phone numbers is not safe from a malicious attacker. The space of all possible phone numbers is so small that it could be brute forced in the blink of an eye. You place all your trust in Signal (and Google/Apple) when you use them. That may be better than the alternatives, but it's still something we should be honest about. That said, keep in mind that Signal and Google/Apple can also trivially backdoor your software, so unless you take specific precautions against that, the details of their middleman protection isn't terribly important.
  - Summershard 3y ago
    I guess you are right. It's trust-based. For an actual obfuscation Signal would need to implement something like onion routing, right? I think Session does it.
borski 3y ago
That is not true. That is now how Signal works. Unsure why the downvotes, but I assume it’s from this misunderstanding of the Signal protocol.

ivlad 3y ago

In Signal, probably no. Signal has this sealed sender functionality hiding significant amount of metadata from passive observer and active examination post-communication: https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/ What Russian police would be able to see, that in a given time period of certificate rotation at most X people communicated to Navalny.

wolverine876 3y ago

> They'd still be able to see that you talked to him. Signal has no access to metadata, including participants in a conversation. All they know is the date of account creation and the date of the last connection. However, if they got access to Navalni's phone, then they of course can see everything Navalni can.

nottorp 3y ago
> However, if they got access to Navalni's phone, then they of course can see everything Navalni can. Aha :) Do you people also want the relevant xkcd? The one about the wrench...

Summershard 3y ago

Signal does not know who you correspond with. The only information they keep is the account creation timestamp, and the date that the account last connected to the Signal service. You may have confused this information with WhatsApp which indeed keeps a lot of metadata on each user.

fsflover 3y ago
https://news.ycombinator.com/item?id=39414322 https://news.ycombinator.com/item?id=39414322
- Summershard 3y ago
  Well, TIL. That does not refute my comment, though. Signal still does not know who you chat with. It's the cloud provider who might log the IP address of the sender. Identifying the person based on that information alone would be non-trivial if not simply impossible.
  - fsflover 3y ago
    > Signal still does not know who you chat with. It's the cloud provider To me, it's much worse. A non-profit doesn't have my data but Amazon (and NSA) does. With Amazon's scale, it must be trivial to identify everyone. See also: https://news.ycombinator.com/threads?id=autoexec&next=39445791#39445866 https://news.ycombinator.com/threads?id=autoexec&next=394457...
xorcist 3y ago
Signal absolutely knows who you correspond with. How could they otherwise route your chat messages? They promise to throw this information away, which is nice but not possible to verify. They also employ a roundabout way of encrypting this data, but as they rightly point out in their article that describes the scheme, encrypting or hashing phone numbers is not safe from a malicious attacker. The space of all possible phone numbers is so small that it could be brute forced in the blink of an eye. You place all your trust in Signal (and Google/Apple) when you use them. That may be better than the alternatives, but it's still something we should be honest about. That said, keep in mind that Signal and Google/Apple can also trivially backdoor your software, so unless you take specific precautions against that, the details of their middleman protection isn't terribly important.
- Summershard 3y ago
  I guess you are right. It's trust-based. For an actual obfuscation Signal would need to implement something like onion routing, right? I think Session does it.

borski 3y ago

That is not true. That is now how Signal works. Unsure why the downvotes, but I assume it’s from this misunderstanding of the Signal protocol.