5 ms·
I think the author is suggesting Signal may have a back door. There is a philosophy that you should not trust any crypto software unless it is open source andhe
by gweinberg 2y ago
I think the author is suggesting Signal may have a back door. There is a philosophy that you should not trust any crypto software unless it is open source andheavily vetted and you compile your copy yourself.
- sterlind 2y agoHe didn't really suggest a backdoor. None of his writing touched on the technical aspects of Signal, or Moxie Marlinspike (which is weird - it's like talking about Apple's history without mentioning Steve Jobs.) He doesn't discuss any scenarios by which Signal messages could be censored; I'm honestly not sure he's even used Signal. Also, Signal's client is open-source. You can verify its security claims. It's been independently audited. I think the builds are deterministic, or at least verifiable. The server is closed-source, but the client does not trust the server. And even contact discovery etc. uses SGX enclaves and other mechanisms to keep metadata from being visible. It's what makes the accusation so risible - Signal's security and privacy are verifiably state of the art.
- greyface- 2y agoI agree that Moxie's mysterious exit (and the associated Mobilecoin shenanigans) and Signal's continued insistence on trusting Intel SGX (which is indeed state of the art, but it's not clear that it's actually secure against a determined adversary) are more salient than the political character of the current board chair. It's a shame the article didn't mention them at all.