4 ms·
Agreed. If their data is safe, the rest of us are safe, too. I'll keep using Signal.
by hereme888 3y ago
Agreed. If their data is safe, the rest of us are safe, too.
I'll keep using Signal.
- 1oooqooq 3y agoproblem with signal is that server is an unknown. still a million times better than most alternatives. maybe matrix today can compete. but that's it.
- fragmede 3y agoyou can verify safety number out of band to assert that signal's server isn't mitm-ing you
- gaganyaan 3y agoYou can't actually assert that. You have to hope that they or someone else hasn't found an SGX weakness: https://www.vice.com/en/article/pkyzek/signal-new-pin-feature-worries-cybersecurity-experts https://www.vice.com/en/article/pkyzek/signal-new-pin-featur...
- fragmede 3y agoThat article doesn't contradict that. Signal's new feature is to store users' address book on their servers. That's not great in the case of an SGX break, but that's not the same thing as Signal mitm-ing messages.
- 1oooqooq 3y agothe lack of awareness in this thread... the pin/number-as-id is just the cherry on top. we know nothing about signal infra or why the server code is closed. for all i know mox have the root password on a post it and it's MitM from day one. also they boast about things being easy to verify on client but the default client doesn't and they are very against custom clients... which is very schizophrenic
- fragmede 3y agoThe client code is available though, and that's what's needed to verify that it's not MitM'd. If there's something you'd like to make me and others aware of, I'm all ears. Otherwise you're just casting baseless aspersions.
- dns_snek 3y agoYou're also relying on the client not lying to you, and Signal is openly hostile against 3rd party clients of any kind.