3 ms·
> that’s all Signal turned over because that’s all Signal itself had access to. As Signal’s website puts it, “It’s impossible to turn over data that we never ha
by autoexec 3y ago
> that’s all Signal turned over because that’s all Signal itself had access to. As Signal’s website puts it, “It’s impossible to turn over data that we never had access to in the first place.”
Note that this is no longer the case and signal stores a lot of data in the cloud now (name, phone number, photo, and your contacts)
> It says the username values are hashed, so they can't actually see them.
Even if I didn't already believe that Signal was compromised this wouldn't inspire much confidence. When they're keeping your phone number in the cloud forever (along with your contacts) not having a username doesn't mean a whole lot. Phone numbers are trivial to match up to a name/address/credit card/billing address/location.
- collinmcnulty 3y agoAs addressed in the article, all the information is stored encrypted. Signal cannot see your photo, name, etc in any practical sense. The only thing signal know is that this phone number uses signal … that’s not a lot.
- autoexec 3y agoIt's encrypted with an easy to brute force pin and stored using SGX https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... Even if we forgive them for keeping/using phone numbers, all of the other data collection is entirely unnecessary and it's also exactly the kind of data the feds have been asking them to hand over.
- wolverine876 3y agoIIRC it works something like this: You can use a password of whatever complexity you like. Signal adds a PIN to enhance the password's complexity, just in case a user might choose an insecure one.
- autoexec 3y agoThey did change it to accept longer passwords while still calling it a PIN which most people associate with a 4 digit number and allowing short PINs. While it's good to increase the complexity on their end, the justification for all of this is so that users can restore their settings on a new device. That means that in the worst case the data is more secure on the server, but someone acting as if they are restoring their settings will only have to enter the weak password to get the data.
- bigiain 3y ago> signal stores a lot of data in the cloud now (name, phone number, photo, and your contacts) Do you have any links talking about that? It's contrary to what I believe, but I'm not so confident in those beliefs that I'm not intensely curious about that claim.
- autoexec 3y agoYou can find more info here: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... I don't blame you for not knowing about it. They were extremely unclear about it at the time it was implemented, and to this day they've refused to update their privacy policy the very first sentence of which is a lie. Make of that what you will.
- bigiain 3y agoThanks. I'll do some reading.