7 ms·
Interview with Signal President Meredith Whittaker
- TimSchumann 2y agohttps://archive.md/AlcdN https://archive.md/AlcdN
- sprash 2y ago[flagged]
- twoWhlsGud 2y agoI think that for folks living in the West, Putin and his gang of cyber criminals is much bigger day to day threat than the NSA. So the fact that Durov is still alive (a couple days in a French prison is the least he has to worry about) makes Signal look like a much better bet than Telegram.
- slackfan 2y ago[flagged]
- sprash 2y agoThe mostly unelected EU regime really loves censorship. Nobody ever claimed that Putin is in any way better. That doesn't mean that the EU isn't complete shit. And if you want to focus on the EU market like Whittaker claims in the interview it only works if you are completely compromised. Also looking at her history I don't think you could find a more glow in the dark person than her.
- hedgedoops2 2y agoDoesn't matter. As long as the code is open source and e2ee, Signal staff could be official NSA employees, it wouldn't matter (in the short term - in the long term, you would see these things to change, of course.) I'd change my mind on Signal if you can demonstrate an attack that assumes an evil signal operator, or evil signal servers. Signal know they just need to keep themselves open to the possibility of this kind of demonstration. Then any mistrust, combined with the fact that there is no exploit at the next CCC or defcon, becomes evidence that it's secure. More mistrust -> More attempts to prove its insecure + no demonstration of insecurity -> better argument that its secure. It's a negative feedback loop. It's also honest - you could actually break it. Did I miss how you can break it? Link to the demo. Signal the program doesn't trust signal the organization, as it should be. That's the core idea. It's what lets them not get fucked by the government. They cooperate fully and ensure they have nothing to tell (privacy by design. data minimization. self blinding). And by having a lot of users they make themselves impossible to ban and thereby protect the whole concept. Whittaker is very smart politically. The software isnt perfect, sure. It's polished and reliable and secure. Make a better one... it is fine. Also, are you reading what she's saying? This is not what compromise looks like. Here is how compromise looks like: When you see them starting to talk about protecting people by establishing police control to fight the bogeyman. When they start talking about the threats here, threats there, enemies here, enemies there... When they say, because of big tech, we need things like DSA (enforcement regimes, access for police) [1]. Whittakter says because of big tech, we need a lot of open source projects backed by nonprofit organizations that dont advertise, dont surveill, and have no incentive to start doing it... and that build stuff that has no backdoors and makes no affordances for state or anyone else in power to compromise it. [1] and then plugins like E-Evidence, and finally rules like in England that prohibit privacy by design... which would prohibit: Signal... but which the english are not enforcing because of protests by: Signal.
- pessimizer 2y ago[flagged]
- newZWhoDis 2y ago[flagged]
- saagarjha 2y agoAlas being stolen from biweekly is a fact of life independent of which country you live in.
- mardifoufs 2y agoWhataboutism. And Woah what a great standard! Better than an actual dictatorial regime! Who could wish for more
- 7bit 2y agoOh, the ignorance ..!
- kome 2y ago[flagged]
- egberts1 2y agoJust as long as you understand that the messages remain verifiably solidly-encrypted within Signal servers, both in-transit (network) and at-rest (storage). As to about the end-devices that uses Signal-client, that is about as strong as you and your OS lets you.
- miroljub 2y ago[flagged]
- btreecat 2y agoAbusive requests, API overload, noncompliant clients to name a few.
- ath3nd 2y ago> Do they have something to hide? That's very misguided of you to say and pure speculation. It's as useful for a discussion as me saying "Durov is Russian-born, and has resisted proper e2e encryption defaults, so the Kremlin incentivized him to do it, so they can spy on people". You see how this works? There is actually a clear official statement from Signal why they don't permit open-source clients to use their servers. https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ What in their statement suggests that they are "hiding something"? If you can find something wrong with their protocol, source, or suspect that somehow the communication is compromised when it reaches their servers, please go ahead and disclose it, but thinly veiled: "do they have something to hide" is just speculation. Also relevant for context: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
- hiatus 2y agoThat blog post is 8 years old and predates things like mastodon. Nothing has changed in these intervening 8 years?
- asymmetric 2y agoI really wish someone would ask them about MobileCoin, for once.
- egberts1 2y agoI don't think that this MobileCoin is her cup of tea, it is more like Marlin Moxiespike's.
- bilal4hmed 2y agoyes, it looks like MobileCoin left with Moxie
- lupire 2y agoThis illustrates the lasting power of bad decisions. I wrote off Signal when I heard about MobileCoin, and didn't look at Signal again, and didn't known MobileCoin left.
- asymmetric 2y agoIt didn't (leave), see sibling comment.
- egberts1 2y agoI broke off libsignal at that point. I've encountered this argument ... repeatedly. Let's explore the DIY route: If you can build your own Signal server, you too can serve you and your own circle of friends. The bar is not that high (Java and VPS). Signal clients are even easier but it remains mostly an unique build-challenge due to not so strong documentation and by the virtue of mastery of multi-platforms. Having said all that jazz, step back and ask yourself this, what am I losing by building my own Signal-protocol network? Anonymity Now, you would easily stick out like sore thumb to all the Internet overwatch, even within VPN tunnels. That's a risk for me. What am I actually gaining? Not much: a more unique hash signature of client app (it has downsides); the ability to perform a unique but slight tweak of hash/key/encryption algorithm using same Signal protocol (dangerous rabbit hole), and avoidance of XDR/NDR/IPS/IDS firewall, and the biggest one: zero spreading of hashed contact info (more on this below). ----- Alternatively, let's take the original route: your own client against "the" Signal server: Now, Signal protocol would be open to misshapen protocal usages (think "fuzzing"). Might be a good thing but certainly not at this early stage; do we have the manpower to stand guard over a protocol like ISC Bind9 team do with their DNS? The one area that is not firmed up 100% (more like 99.999%) yet is the Privacy Information Protection axiom and that is centered around the exhanges of hashed "Contact" address book. This there is largely understudied and under-whitepapered: how to exchange contact info in safe privacy order just to build your network: I keep that Signal client app option off for now and manually add my contacts. That's why I think that Signal team is moving away from telephone number. So i am now dual-tracking usage of libsignal.
- deleted 2y ago[deleted]
- bilal4hmed 2y agoEverytime I read anything from her, she solidifies herself as the leader for Signal. I cant wait to see what they unveil for the 10 yr anniversary
- popol12 2y agoMessage backup on iOS device maybe ? Or the possibility to transfer messages history between iOS and Android devices ?
- bilal4hmed 2y agoooh those would be nice
- lxgr 2y agoThe absence of message backups is arguably one of Signal’s advantages over the competition. I believe weak/no backup encryption to be the primary attack vector against otherwise well-designed e2ee messengers.
- saagarjha 2y agoMaybe they should add good backup encryption then lest people decide they don’t want to use Signal because it doesn’t have this feature and end up with weak/no backup encryption.
- lxgr 2y agoI'm pretty sure they would, if they could think of a good way. Usable, yet secure backup encryption is so far an unsolved problem, as far as I can tell. The two options, roughly speaking, are: Force users to store some high-entropy passphrase (which most users will then store somewhere not very secure), or let them pick their own passphrase (which won't be very good). This is what WhatsApp does. A third one would be to allow a short passphrase and guard that by a server-side HSM or maybe SGX, which Signal seems to be somewhat fond of; I'm glad they're not doing that.
- 2y ago
- bdominy 2y agoShe gave a talk at TechCrunch last year and kindly spoke to me briefly afterwards about how end-to-end encryption can help businesses. The problem is that without a huge benefactor, there isn’t enough consumer demand to make a sustainable business out of privacy concerns.
- musha68k 2y agoAnecdotal but in my circles I'm increasingly seeing the shooting star badge.
- ath3nd 2y agoIn my circles as well! I also converted my friends and family. What's very nice for building trust is their transparency report on how funds are spent.
- tapoxi 2y agoMy 70 year old, nontechnical Mom converted my entire extended family. We now use Signal for every family gathering, baby picture, etc. It's just a really elegant solution for cross-platform messaging, the security is a great bonus.
- monocasa 2y ago[flagged]
- thecrash 2y agoThere's a difference between an investment and a grant. What ownership share, promise of future payment, board seats, or other rights to control Signal was assigned to the Open Technology Fund by receiving that grant?
- monocasa 2y agoThere's a lot of forms of investment if your goals aren't simply 'turn this pile of money into a larger pile of money'. Signal should not have been taking money from the CIA.
- throwaway290 2y agoWhat about Tor? Or even internet in early days, I guess
- monocasa 2y agoI mean, Tor is fairly commonly thought to have always been compromised (if you can even call a US DoD project compromised in the first place).
- jonnybgood 2y agoWhy not?
- pdabbadabba 2y ago> Signal should not have been taking money from the CIA. ... > Why not? In fairness, at least one answer is obvious: because it created the appearance, for some, that the CIA was getting something out of the deal, undermining trust in the platform.
- triyambakam 2y agoI wish I could use the same account on more than one device. For my family I've subscribed to Snikket and stopped using Signal
- DanAtC 2y ago> The easiest way to get started with Snikket is to launch your own Snikket instance
- triyambakam 2y agoI pay for one which was easier for me at this time
- joombaga 2y agoI use my Signal account on more than one device. What's stopping you?
- Cupertino95014 2y agoMe, too: Android phone and Mac laptop.
- 2y ago
- AlbertCory 2y ago> I looked up your 990, and you pay yourself less than … well, you pay yourself half or a third as much as some of your engineers Big props for that (and for the interviewer for looking it up). A lot of nonprofits are glorified jobs programs for politically connected individuals. Nothing is pure-as-the-driven-snow perfect, but I use Signal.
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- IncreasePosts 2y agoShe gets about half as much as normal engineers at the company ($200k vs $400k). I wonder what would be more productive - 6 engineers getting paid $200k or 3 getting paid $400k? You could still attract a very large talent pool for $200k/yr, especially given the mission, and doubly especially if this is remote work and not based in SF/SV.
- ApolloFortyNine 2y agoIf the 400k ones are good and won't leave, those. Anyone whose worked with a dozen or so people will know they're never equal. There's generally at least one 'guru' in the group who knows the ins, outs, and why's of everything. At big companies they'll get split up so there's only one per team, with maybe a couple roaming super team for anything truly major. But I've certainly met engineers who are worth at least 2 lower engineers.
- deleted 2y ago[deleted]
- borski 2y agoPeople love to wish this weren’t true, but it is. All engineers have great potential, but some realize it faster than others, and some never fully realize it at all. The difference is significant. Moreover, not all spectacular engineers are worth working with; there’s a lot to be said for someone’s ability to be worked with and to be a leader, in addition to just pure knowledge or capability. Being able to work on teams matters, and being able to lead them (while being respected, respectful, and educating) matters even more. The latter pieces of being a “strong engineer” are the pieces that are the hardest to learn for most engineers, because we spend so much time pretending it’s only the code that counts. Great engineers who realize and understand how to push their colleagues and themselves to grow while pushing the company forward? They are worth their weight in gold.
- declan_roberts 2y agoI had a family member working in Tibet with Christian churches, which is a very sensitive topic in China. Most all technology was outright blocked (except overtly monitored wechat). However, Signal was not blocked by the great firewall and we were able to communicate freely on it. But now I'm wondering why isn't Signal blocked? Does the CCP have a backdoor into it somehow and therefore doesn't feel threatened by it?
- colmmacc 2y agoI very much doubt that the CCP has a backdoor into Signal the app; but it is worth keeping in mind that if an actor can observe traffic, e.g. cellular traffic records or network flow logs, they may be able to correlate senders and receivers through ordinary time-stamps. Person A sends 200 bytes at time T, Person B receives 200 bytes at time T + 300ms. It doesn't take much analysis to build up a picture of a weighted network of communicators. There are "Military Grade" message and voice encryption technologies that avoid these issues by always sending a fixed amount of traffic to all parties, but that tends to be impractical for mobile apps.
- ikmckenz 2y agoWhat year was this? Signal has been blocked by the GFW for several years now. Here’s an article from 2021: https://www.nbcnews.com/tech/tech-news/encrypted-messaging-app-signal-blocked-china-rcna432 https://www.nbcnews.com/tech/tech-news/encrypted-messaging-a...
- Tmpod 2y agoSignal has a toggle for censorship resistant routing, if I'm not mistaken. I believe it works quite well in most places, including China?
- declan_roberts 2y agoPre-covid, so that checks out.
- rnhmjoj 2y agoThe easiest explanation is no significant amount of people in China are using it, there's no need to resort to conspiracies and backdoors.
- dijit 2y agoHagiographies are exhausting, and not exactly tech news in my opinion. I understand that people love signal, but I don't understand why: outside of what appears to be propaganda such as this. btw; Downvotes only make my belief stronger that unironically there are actual shills on HN. The way people are bleeding to defend it as “the one true secure messenger” is about as convincing as Epstein killing himself.
- vzaliva 2y ago"Signal is a nonprofit because a for-profit structure leads to a scenario where one of my board members goes to Davos, talks to some guy, comes back excitedly telling me we need an AI strategy for profit." So true!
- cvwright 2y agoYeah we definitely wouldn’t want them chasing fads. Like, say, crypto currencies for example. https://www.wired.com/story/signal-mobilecoin-cryptocurrency-payments/ https://www.wired.com/story/signal-mobilecoin-cryptocurrency...
- skeaker 2y agoThat at least seems to line up with their business ethos as a whole.
- staticautomatic 2y agoExcept this is totally a thing at nonprofits. If it isn’t happening to her, it’s because her board members know better.
- will-burner 2y agoSignal trying to capitalize on the Telegram bad press at the moment. Hopefully Signal does.
- Vinnl 2y agoIn terms of growth strategy, all Signal has to do is wait; bad press for the competitors arrives all the time. So it seems right that she's focused on funding more than user growth.
- indulona 2y agoI donated to Signal twice. i do not use it much actually but i long believed it is only one that can be trusted.
- gherkinnn 2y agoThe Verge's Decoder podcast interviewed her in October 2022. What a great person she is. https://www.theverge.com/23409716/signal-encryption-messaging-sms-meredith-whittaker-imessage-whatsapp-china https://www.theverge.com/23409716/signal-encryption-messagin...
- amai 2y ago„Because having 70 percent of the global market for cloud in the hands of three companies globally is simply not safe. It’s Microsoft and CrowdStrike taking down half of the critical infrastructure in the world, because CrowdStrike cut corners on QA for a fucking kernel update. Are you kidding me? That’s totally insane, if you think about it, in terms of actually stewarding these infrastructures.“ This might well be her most important statement.