Why I won't recommend Signal anymore

https://sandervenema.ch/2016/11/why-i-wont-recommend-signal-anymore/

by maglavaitss • 10 years ago

328 333 10 years ago

sandervenema.ch

kingad• 10 years ago

What are your views about VoIP with ZRTP?

mtmail• 10 years ago

That's unrelated (off-topic) to Signal and what the blog post discusses, isn't it?

fragmede• 10 years ago

Though it wasn't explicitly mentioned in the blog post, Signal does support encrypted voice calls, so GP post isn't entirely off topic.

fegu• 10 years ago

Nobody actually exchanges the initial words to avoid mitm. Hence, zrtp is actually no that secure in practice.

draw_down• 10 years ago

The big question now... is what post-Signal tool we want to use. I don’t know the answer to that question yet

Oh.

wtbob6• 10 years ago

I am also very unhappy with the direction Signal has gone, but there's currently no alternative. I'd be interested in contributing to work attempting to replicate it, though.

gst• 10 years ago

Why isn't there an alternative? Signal uses the Axolotl protocol for encryption. There are already several XMPP clients that support the OMEMO protocol which is based on Axolotl (https://conversations.im/omemo/). And for Matrix (a modern alternative to XMPP) there's Olm which is also based on Axolotl.

SamWhited14• 10 years ago

At the risk of derailing this slightly, I wouldn't call Matrix a "modern alternative" to XMPP. The use cases are almost entirely different; Matrix isn't really suitable for realtime applications like XMPP is (because Matrix is all pull-based, so you have to query the server constantly to try and get messages in a reasonable time; this also means keeping the phone radio in active, high-battery-drain mode [pretty sure that's the technical term]).

Disclaimer: I do a lot of work on XMPP related things and rather like the protocol, so maybe I'm biased. I'm sure there are things for which Matrix is a better fit that I wouldn't use XMPP for too though.

tptacek18• 10 years ago

You mean the Signal Protocol. That's its name. Axolotl was a name for a major component of Signal Protocol. Moxie and Trevor Perrin designed the protocol for Signal, and it's under active development. They own the protocol, its direction, and its documentation.

Other projects can adopt parts of the Signal Protocol, and doing that is certainly better than just making stuff up. But Signal owns the protocol, because the experts who own the protocol are attached to Signal.

zanny• 10 years ago

I have some friends in an encrypted riot room right now. The olm could use a real good audit, but otherwise it is working right now. Federation is working, bridges are working, voice and video are working, it has Android and iOS clients. The only problem is the encryption doesn't apply to the voice / video or shared files yet, but they have made huge progress this last year from basically nothing so far.

heavenlyhash5• 10 years ago

+1. I'm super happy with the Matrix / Riot ("riot" is the client) crypto work over the last year.

It's such a relief to have a modern chat system that's FOSS, federates, and offers a liiiiitle more advanced UX than irc...

Arathorn13• 10 years ago

the Olm audit is done; we're hoping to publish it week of Nov 14 (alongside iOS & Android support).

Encrypted attachments was PRed this week: https://github.com/matrix-org/matrix-react-sdk/pull/533 (for the web; mobile will follow shortly)

SamWhited14• 10 years ago

I highly recommend Conversations (disclaimer: I've worked on it in the past, although I'm not a project "member" per say): https://conversations.im/

It's open source, uses a federated, open protocol, and can do multiple types of encryption including OTR and OMEMO (an XMPP wire format that uses the Axolotl ratched devised for signal). It does not do VoIP, so it would just be for chat (although there is a large bounty on Jingle-based voip support open). It has also had a public security audit, and is designed to be white labeled so you can tweak a few variables in the source and build your own hardended version or encrypted-only version, etc.

joecool10297• 10 years ago

Conversations is great, but there's nothing comparable on iOS except Chatsecure which isn't yet beta quality. Then you need to pair it with a server that actually has all the recent XEP's installed (for push is XEP357, usually missing), see: https://gultsch.de/compliance_ranked.html

My current 'solution' is to use ZNC connected to Bitlbee (supporting OTR). On Bitlbee I use the jabber.fr service. ZNC has a push script for Mutter (great iOS IRC client) that I modified to redact my notification content from Apple's push service. I connect to the ZNC with TLS, so in theory everything should be ok.

NOT USER FRIENDLY but allows me to keep all my chats in one client and not tied to some shitty walled garden. Everyone less savvy I just tell them to use Signal.

heavenlyhash5• 10 years ago

That compliance table is the thing really killing XMPP for practical modern usage.

I tried to write an XMPP client about a year ago and found out about that compatibility table the hard way. It's rough -- I had no idea what I was getting into.

Turns out that XMPP, before expansions, has no standard definition of what message IDs are. Which means "good luck, have fun!" is pretty much the best anyone can hope for on synchronizing messages when you have multiple devices or when the network flakes on you. Which in turn means XMPP is basically unusable on multiple devices. If you're lucky, everything supports all the same extensions, and it'll probably work most of the time; but if any piece of software you use is missing one extension, your day is toast. (And even then, frankly, the "carbons" API is wrong-headed and not very capable of recovering from network failures. In no uncertain terms: It's time to move on.)

I wrote about this more previously on HN: https://news.ycombinator.com/item?id=9772968

Veratyr4• 10 years ago

I tried Conversations but I couldn't for the life of me get message history to work. There's just so much stuff you have to do when it comes to XMPP to get things working. Perhaps if I used someone else's server it wouldn't be a problem but I'd prefer not to do that.

joecool10297• 10 years ago

See my comment below. You need a server with the XEP support for it. (XEP-313 I believe)

SamWhited14• 10 years ago

I agree that it's a bit hard to get setup if you're dead set on running your own server, but that will be the case with anything (although Prosody and Ejabberd et al could have better defaults for the majority of people who probably just want to throw up a server and be done). The nice thing about XMPP is that if you don't want to run your own server, you're spoiled for choice. The network is significantly bigger than any of the other protocols I know of [citation needed].

giancarlostoro5• 10 years ago

Curious for next time I evaluate XMPP is there a list of servers recommended by the Conversations team that people could install themselves? My issue with XMPP is that on the same system I have at DigitalOcean where I could run: an IRC server, a Web Server, and a Mumble Server and extra goodies all together in one box, I couldn't effectively run a XMPP server that would stay up (it would crash). I would of kept at XMPP had I found a decent memory efficient server that didn't merely crash.

SamWhited14• 10 years ago

I'm a big fan of Prosody (prosody.im); even the nightlies (what I run) are remarkably stable, and the memory footprint is tiny (they have some metrics somewhere if you ask in the chat; I can't find them right away).

darklajid9• 10 years ago

THE xmpp server I'd recommend is prosody[1]. Lua based, quite active, very friendly community and easy to set up/configure.

1: http://prosody.im

majewsky8• 10 years ago

I have a virtual server (1 CPU + 1 GiB RAM) running nginx, murmur and Prosody. free(1) reports 80 MiB used memory, thereof 10 MiB for Prosody. (I just have one active account, though: myself.)

So unless you're planning on hosting hundreds or thousands of users, you should be fine IMO.

petre3• 10 years ago

I use ejabberd for a client. Prosody is also nice.

hannob2• 10 years ago

I think Conversations is probably getting a lot right, but you also mention its biggest flaw:

do multiple types of encryption including OTR and OMEMO

Oh and it can also do something else: no encryption at all. That's the problem with XMPP: The user is faced with three different encryption modes, none of them is the default.

There shouldn't be multiple types of optional encryption. There should be one that works and is enabled by default.

majewsky8• 10 years ago

The practical problem is that a lot of power-users have strong opinions about which e2e scheme to use in which case. That may include "none". [1] If you enforce a single e2e scheme (no matter which), you will lose a lot of potential power-users, who would double as multipliers to spread your app.

I don't say that Conversations (and the XMPP community at large) couldn't do better, though. For example, there could be a standardized, automated, transparent process for determining which e2e schemes are supported by the clients involved in the conversation.

[1] For example, I skip e2e when talking to my several XMPP bots. They run on the same host as the XMPP server, so e2e won't reduce my attack surface when I already have TLS enforced along the way, but make the bot implementation considerably more complex.

upofadown2• 10 years ago

In practice you always get TLS. That's really all you need if you trust the server.

Something fairly significant has happened in the world of XMPP recently. You can get real certificates for XMPP servers under your control from letsencrypt. That means that things now work transparently between clients and servers and between servers. As a result, organizations that do things that some governments might not approve of can do transparent encryption simply by setting up a server or servers in places that such governments can not physically get at.

vidyesh• 10 years ago

I never understood properly where Conversations app fit in. Is it a Jabber client to aggregate all the IM clients/accounts or is it also a independent highly secured instant messaging app on its own too?

jhasse10• 10 years ago

A very good Jabber/XMPP client for Android. It's GPL and doesn't require Google services.

reacharavindh2• 10 years ago

This. I didn't know much of the insides of Signal. But, When WhatsApp decide to go in bed with FB to share my contacts and usage, one of the alternatives I explored was Signal. Threw it out the moment it asked for ownership of my contacts (no way to opt out). I for one am not going to trust a guy's pinky promise to be good with my contacts and meta-data.

If I'm going to give up the convenience of reaching anybody by WhatsApp, it is going to be at least worth it in the sense of privacy.

Still hoping for a GNU project that garners enough interest to be technically strong, and used universally. One can dream.

Joeboy• 10 years ago

I doubt you'd want to use it if it didn't use your contacts, though. Not many people are prepared to deal with a whole separate set of contact ids for the sake of a small amount of arguable extra privacy.

tdkl2• 10 years ago

What's wrong with having options ?

reacharavindh2• 10 years ago

Discoverability is complicated issue.

If I want someone I don't know yet to reach me, I expect them to Google search my phone number/email to make initial contact.

For those I already established initial contacts with, I'd like an account on a service that knows practically nothing about me other than my username(like coolkid654) and lets me send messages to others(coolkid655).

Given the state of data leaks[data snooping by the Gov or anyone else], and spam, it wouldn't be a terrible idea for someone to have a username that they reveal to only the people they trust(are worth). More like a Blackberry key. If packaged well, and made to look 'cool', it could even catch on and everybody would create one(or many).

resonanttoe2• 10 years ago

Sure, most won't right. But clearly in this thread some people are willing to do that and I'm not convinced that there is a large burden/cost to signal to allow this.

The problem for me is that my contact list of Signal users is quite small (1 or 2 people) and everyone else isn't using it. I don't see the reason to allow Signal access to that list of people "Just in case" they decide to. It's incredibly unlikely bordering on near impossible.

This isn't the golden bullet of reasons that it should be this way, but the fact that in design Signal has made the choice to force access to contacts to me, says one of two things.

1. We haven't thought about cases outside of our own experience and expressly reject those as being outside of the market we're interested in. "You're not the user we're looking for."

2. There is value/commoditisation in that contact list that signal is interested in and this is the price to play in their system.

The problem is that either of these two options run pretty counter to the idea of secure privacy focused messaging client designed to be seperate from the user.

People's value of privacy is nuanced enough that making broad scoped decisions like this can run afoul of their expectations. Considering that Signal is aiming itself at the privacy conscious (Over-conscious in a lot of instances I'm sure), it's very weird that they would forgo this obvious affordance of information.

wtbob6• 10 years ago

It's entirely possible for Signal to work with contacts and yet not transmit address books to OWS. I sketched out a protocol for doing so awhile back: https://news.ycombinator.com/item?id=11289223

So people could use their address books securely if they wanted — if OWS would allow them.

codedokode4• 10 years ago

There could be two separate versions, one for paranoid users, one for those who don't care. The number of permissions Signal app requires is scary. It gets almost full control over your phone including reading SMS messages.

hkt• 10 years ago

Ring looks promising, re GNU projects.

I've personally reached the conclusion that software isn't enough for this, though: it is people who choose to flog your data and it is money that buys it (think FB and WhatsApp). In my view a collectively owned version of something like Signal would offer protection from what is termed corporate surveillance by allowing people with skin in the game to directly influence decisions on things like privacy policies and development roadmaps. I've sketched this in a bit more detail here: https://news.ycombinator.com/item?id=12881917

clumsysmurf• 10 years ago

Unfortunately, Google has made it (almost) impossible to wake up the phone via some external event without using its proprietary GCM. Even though GCM is not part of AOSP, it has unique status on the platform that can't easily be replicated (without recompiling the kernel, etc like the article mentions).

Before the days of doze mode & other battery optimizations, you could just listen & block on a socket, then let the phone go to sleep. Incoming 3G packets would wake up the phone, you grab a wakelock, then start doing things. From what I remember, at least a while ago Facebook Messenger did this using MQTT. But this is not possible any more.

chimeracoder• 10 years ago

Before the days of doze mode & other battery optimizations, you could just listen & block on a socket, then let the phone go to sleep. Incoming 3G packets would wake up the phone, you grab a wakelock, then start doing things. From what I remember, at least a while ago Facebook Messenger did this using MQTT. But this is not possible any more.

It's not a coincidence that the Facebook app was known for being an absolute battery killer. Go to any android forum post about battery life from a year or more ago and you'll see that the first suggestion is always "have you tried removing Facebook?"

ditn• 10 years ago

That's still the case now, just for different reasons.

Mathnerd3142• 10 years ago

Kind of tangential, but GCM is deprecated and you're supposed to use Firebase Cloud Messaging now: https://firebase.google.com/docs/cloud-messaging/

It's still just a JAR (no native components), so AFAICT there's no technical reason someone else couldn't do a similar thing with their own servers.

kuschku5• 10 years ago

It's just a JAR (no native components)

I’ve reversed it, and rebuilt an alternative

The jar you include actually opens just an IPC channel to the Google Play Services framework, which runs with system permissions, and handles the actual stuff.

You can’t implement your own FCM without having root access on EVERY Android phone out there.

lima• 10 years ago

It works quite well for me with the Conversations Jabber client with no discernible battery usage impact.

Did something change in recent Android versions?

Edit: Apparently Nougat's Doze is the issue. Conversations bug report, you can apparently put it on a whitelist:

https://github.com/siacs/Conversations/issues/1624

ucy• 10 years ago

That's very easy to manage. Every random 15-60 minutes a gcm/firebase message containing an encrypted payload with "you got this mail/no mail for you sir". So google cant get your frequency of use.

caf• 10 years ago

It's my impression that most people use Signal as an SMS app replacement, and in that environment people would not find a random 15-60 minute delay until their phone tells them about an incoming message to be tenable. I certainly wouldn't.

bitmapbrother4• 10 years ago

Unfortunately, Google has made it (almost) impossible to wake up the phone via some external event without using its proprietary GCM

No, fortunately Google has made it impossible for apps to abuse waking up the phone.

Drdrdrq3• 10 years ago

No. Apps can abuse waking up the phone all they want (and as much as user lets them), as long as they do it via Google's servers. What they can't do is bypass GCM/FCM. Nothing to do with UX.

qwertyuiop92417• 10 years ago

There are several projects moving toward this. Matrix is probably the most well-known project, but its crypto isn't actually operational yet, AFAIK.

Tox works now, but for all their talk of trying to be user-friendly, asking users to exchange long alphanumeric sequences inherently isn't.

Psyc, maybe?

SamWhited14• 10 years ago

Matrix's protocol design is terrible for realtime messaging though (I'm sure there are other uses for which it's more adept); it's effectively a giant, inefficient, JSON datastore that syncs data everywhere. It's also pull based so it consumes battery like crazy. If that's what you need, fine, but for realtime messaging I'd argue that it's really unacceptable.

qwertyuiop92417• 10 years ago

Okay. Tox, anybody?

Arathorn13• 10 years ago

As per elsewhere on this thread, this isn't entirely fair. Matrix uses HTTP+JSON as its lowest common denominator, but the whole idea is for people to use WS+CBOR or capnproto or whatever whenever they need efficiency.

In terms of "syncing data everywhere" being 'terrible for realtime messaging'... i'm not sure that holds water ;)

nickik3• 10 years ago

Matrix actually has e2e crypto working right now. Its in beta but you can active it in the room settings.

qwertyuiop92417• 10 years ago

Really? Finally. Thank god.

Arathorn13• 10 years ago

E2E Crypto is very nearly operational. It's live (in beta) on the web on https://riot.im/app, and meanwhile the iOS & Android implementation PRs have (almost) landed on the develop branches of matrix-ios-sdk and matrix-android-sdk respectively. Our crypto audit is complete, and we're hoping to unveil it to the world in the next week or two.

qwertyuiop92417• 10 years ago

Good to hear it!

empath75• 10 years ago

Any service that owns valuable user data is going to get compromised eventually, whether they do it themselves, or are the victims of an attack. I feel like the only way to not get swept up in the surveillance state is to never put your data on one of these services at all.

raverbashing• 10 years ago

- Lack of federation

Use a federated secure protocol. Oh wait, there are none. Because if a problem appears you just can't fix it without breaking all federated clients. And then they will whine.

- Dependency on Google Cloud Messaging

Fair enough

- Your contact list is not private

Fair enough

- The RedPhone server is not open-source

While it would be nice that it was Open sourced I can understand them not releasing it (might be for IP issues)

tl,dr: "Signal does not work the way I wanted"

SamWhited14• 10 years ago

Use a federated secure protocol. Oh wait, there are none. Because if a problem appears you just can't fix it without breaking all federated clients. And then they will whine.

That's why you have to design your protocol with backwards compatibility and versioning in mind, ala XMPP. I'm not going to pretend its perfect, but it works pretty well 90% of the time. It does mean clients have to implement versioning and feature negotiation and not just blindly assume everything else supports all the features they do; convincing client authors to do this is the tricky part.

nickik3• 10 years ago

There are really two federated protocols, xmpp and matrix. Matrix is pretty young but looks good, they just added e2e encryption.

Check out the Riot client, web, android and ios. The apps are even native.

Plus, you don't have to show your phone nr.

qwertyuiop92417• 10 years ago

Umm... Tox?

exo7625• 10 years ago

Tox on mobile? Have you actually tried to use it? It drains your battery like crazy.

walterbell• 10 years ago

Wire (http://wire.com) has worked well on iOS for encrypted text/files/audio/video. Open-source client, no contact sharing neeeded. No phone number needed, you can register with email by using a desktop browser at http://app.wire.com, then logging into the mobile app. Group chat for text only. Timed/ephemeral messages for 1:1 text/files. Feature matrix, https://wire.com/privacy/. Could use more documentation (e.g. on retention of encrypted data) but a lot of questions are answered on Twitter or Github issues.

tdkl2• 10 years ago

Don't know whether it needs GCM on Android.

The .apk on the site uses websocket, no GCM required.

Siimteller2• 10 years ago

Timed coming to groups in couple of weeks.

Documentation is also getting a refresh in 2 weeks.

heavenlyhash5• 10 years ago

EDIT: this isn't a response to most of the article, but specifically to the "Moving Forward" section, asking about alternative tools.

Come to the matrix!

https://matrix.org/

It's free -- all FOSS, including the entirety of the server -- and yes, all of it: proof by existence: several of my friends run their own.

It federates. I regularly join channels hosted on several different servers, and exchange messages without issue.

It's on every platform. I use it on the desktop, my android (cyanogen, without gapps, none the less!), and my ipad, every day.

It even has voice and video calling built in, using webRTC. This feature has been a little rough while it was in development, but I used it last week in a 1-on-1 call and had an effortless experience. The audio and video quality was on par with Google Hangouts.

Crypto is hard, but it's coming. The Matrix developers have huge respect for the axolotl ratchet design used in Signal. They've worked on making another implementation (in C, for easier linking in various languages, ostensibly) here: https://matrix.org/git/olm/

The deployment of that code to give full End-to-End encryption is a work in progress, but the beta is roughly functional. It includes everything you'd expect: communication works by default, but in an encrypted room, messages are flagged yellow if you haven't explicitly verified the sender's key. There's a key per device; it doesn't leave the device; and as soon as you verify that device/key, messages from it are green, and you're E2E secure.

Disclaimer: I have no direct association -- I became a Matrix convert after trying to write some XMPP client code about a year ago. I'm just really enthusiastic about recommending it because the tech is solid, the sync is good, it solves a problem, and the team hasn't stopped either: they been firing on all cylinders constantly since I started using Matrix.

I love Signal for their dedication to getting encryption right and the security of their users. But yes, I also share a lot of the concerns listed in this article. Most of all, I honestly believe federation is an imperative. So, while acknowledging Signal's history of outstanding security work... Hey, let's celebrate there's more than one game in town working on alternatives.

Veratyr4• 10 years ago

I'm also a Matrix convert. Tried getting Conversations + Prosody running for me and my wife but just couldn't get it to work properly. XMPP has so many XEPs (like MAM - XEP-0313) that you need to get things working nicely and there are very few clients (Conversations only afaik) that actually support them. We also found that Conversations just wouldn't send/receive messages sometimes and that when there was no connection, it'd pretend everything was fine and dandy but not actually send.

Switched to Matrix and setting up my own homeserver took about half an hour, comes with everything I need (history, "Carbons", notifications, attachments, voice/video) built in. Plus it's federated and has support for bridges so I can interact with pretty much anything else through it if I like.

qwertyuiop92417• 10 years ago

I heard from another thread that Matrix is bad a realtime messaging, and quite slow at it. Is this true?

heavenlyhash5• 10 years ago

Not even remotely.

It's quite good at realtime, and especially reliable realtime. Compared with protocols like XMPP, Matrix scores way higher on reliability because it has message IDs and message ordering baked into the protocol, so it can actually converge on a correct state after network flakes. (I consider this a pretty big deal because silent message drops were a pretty regular issue for me in XMPP, and we all know about netsplits in IRC. I've simply never had silent message loss in Matrix because the protocol is simply better.)

SapphireSun3• 10 years ago

Essentially this guy is saying, Signal is secure, it's mostly easy to use (with the exception of multiple phone numbers), and the only alternative he mentioned is a half broken clone. Is he seriously going to stop recommending it to people whose lives depend on secure communications because of some abstruse ideological point? In any case, Moxie's position is a reasonable one even though there are some arguments for federation.

While my current phone doesn't support Signal, once I get a new one I will continue to use it.

You might opine that allowing Signal clones would allow me to use the app, but they would almost certainly be maintained by people who aren't really crypto experts, and so it's better to operate as though I am broadcasting in cleartext than to pretend that I'm not and get burned.

kuschku5• 10 years ago

The biggest argument is that there is little of a difference between Signal and Telegram or Signal and WhatsApp for the user if they are forced to use the official servers, and those servers get to store their entire social graph.

SapphireSun3• 10 years ago

Here's what Moxie said about this issue: https://whispersystems.org/blog/contact-discovery/

throwaway10141610• 10 years ago

That's a terrible argument. What about all the other end-to-end encryption services that have more users and don't require you to give up anonymity?

lucb1e5• 10 years ago

and the only alternative he mentioned is a half broken clone.

Sorry but you've got that backwards. He doesn't propose using that, he mentions OpenWhisperSystems banned them from using the service. It's criticism towards Signal, not a product recommendation.

my current phone doesn't support Signal

I think it's Signal not supporting your phone, not the other way around. The manufacturer probably didn't make a conscious choice to not support Signal, but depending on what the issue is exactly, Signal probably did.

haffenloher8• 10 years ago

OpenWhisperSystems banned them from using the service

Nobody has been banned from anything. People have been politely asked not to distribute 3rd-party builds of Signal using their name and their servers, and that's it.

SapphireSun3• 10 years ago

I think you are mistaking my choice of words for a lack of understanding, but I do understand. The author makes no recommendation _outside_ of Signal related products.

codemac• 10 years ago

Signal is to get people from SMS and iMessage -> Signal. This means that cross platform communication becomes secure in transit.

Once Signal and others have really wiped out all the insecure messaging people are doing, then we can start with the identity problem with phone numbers. GCM, Contacts, etc are all related to this "phone number as identity" problem.

RCS is an unfortunate grab in this space, and we need to move fast before RCS is the default, and we're back to insecure messaging.

Email addresses are the best form of "federated identification" but are wildly insecure for communication. Here's to hoping we can get some better ones.

EugeneOZ• 10 years ago

Any messenger, tied to phone number, is not safe. possible attacks are: 1) create copy of sim-card; 2) force mobile operator to intercept password-code, sent to your number, and "restore" password this way. It may sound ridiculous for you, but in Russia it's reality (both vectors), it's real cases from life. And when user really need safe messenger, all of them are too careless to implement really safe way of messaging. And if you think these vectors are not possible in your country - be sure, we were thinking the same way.

trimbo• 10 years ago

This is why there is a fingerprint ("Safety Numbers" in Signal), and a warning on every message when that fingerprint changes.

codedokode4• 10 years ago

Warning still does not fully prevent the attack. The attacker can still access the account and obtain the data stored at a server (like contact list if it is stored there).

lawnchair_larry3• 10 years ago

Which everyone, including myself, clicks through.

nickik3• 10 years ago

I have started to read about matrix a lot.

- It now supports e2e encryption.

- It has a nice web and mobile client, called riot.im

- I has many other client options

- You don't need to show any phone numbers.

- Federated, you can host your own server

secfirstmd2• 10 years ago

I've trained hundreds of human rights defenders and journalists over the last 10 years and I will continue to recommend Signal. For too long the community has placed perfect security over usability - there are slightly more secure ways to communicate than Signal but they are far too disruptive to peoples work flows to actually be implemented.

tptacek18• 10 years ago

The author of this post believes that by making a stand over Signal policies he doesn't like (the superficial GCM dep, the OWS-only server policy, the contact list discovery system), something more like LibreSignal will grow to take Signal's place.

The author is wrong. LibreSignal won't replace Signal. Something like Telegram will: an "open source" messaging system with inferior cryptography, "opt-in" end-to-end messaging, a long-term dependency on the telephone system for authentication, and a far "cuddlier" personality with its users and, more importantly, with people from the app development community (like the author). Telegram will continue to gain adoption, because sexy beats sound in every end-user match up. Signal is the closest thing sound cryptography has to a palatable solution for end users.

Iran has already compromised Telegram users, because it systemically trades security off for user adoption. They'll get more of them, and people will hang from cranes as a result.

It's not wrong to criticize Signal. Signal does things I don't love, too! But we should be clear-eyed about the market.

venomsnake• 10 years ago

Just a question - is Telegram secret chat after you verify keys still with inferior cryptography? And why?

joecool10297• 10 years ago

https://news.ycombinator.com/item?id=10713064

sandervenema14• 10 years ago

Hi, author here. I don't think LibreSignal or indeed Signal will ever be the dominant mobile messenger out there. There's simply a lot of inertia to fight against. It's the same reason why it's hard to convince e.g. Facebook friends to move to a different social network, why Google+ failed, etc. Whenever the social aspect gets involved, companies can very easily create lock-in by being early, and then the social aspect will prevent the majority of people from considering changing, because 'it works'.

I never said that LibreSignal will replace Signal, and frankly, LibreSignal itself is not the solution either. But maybe LibreSignal will be the catalyst to a better solution.

We all want to prevent people hanging from cranes, but crypto alone does not equal privacy, does not keep you safe, especially not in those countries, where rubber hose cryptanalysis (https://xkcd.com/538/) is much more common. In those dangerous situations/countries, good operational security practices are better to avoid detection/suspicion than using any 'magic' crypto messaging app.

joecool10297• 10 years ago

We all want to prevent people hanging from cranes, but crypto alone does not equal privacy, does not keep you safe, especially not in those countries, where rubber hose cryptanalysis (https://xkcd.com/538/) is much more common. In those dangerous situations/countries, good operational security practices are better to avoid detection/suspicion than using any 'magic' crypto messaging app.

Then just put a TL;DR at the end of your article and say 'use iMessage/Facetime, it's probably good enough for operating in an unstable region' If it worked for Erdogan it will work for you!

EDIT: (While I intend to come off as cocky, I'm serious:

https://www.apple.com/business/docs/iOS_Security_Guide.pdf page 41

http://www.independent.co.uk/news/world/europe/turkey-coup-e...

)

tptacek18• 10 years ago

You don't understand what I'm saying. I agree that crypto alone doesn't equal privacy --- it's table stakes. Clearly: it does not follow from that observation that crypto doesn't matter. If you cannot at least be cryptographically secure, the rest of what you do doesn't matter.

We now have two examples --- CryptoCat and Telegram --- of "secure messaging" systems being used by governments as a way of hunting down activists. Why do we need more? Can't the question be settled now?

As gently as I can, I'm going to push a little further. I poked around your site a little to get a sense of where you're coming from. Your post today opens up like this:

One of the things I do is cryptography and infosec training for investigative journalists who have a need to keep either their sources and communications confidential so they can more safely do their work in the public interest.

Can I ask what your qualifications are in training journalists in keeping their communications secure? Investigative journalists working in hostile regimes, even in smaller countries, are facing adversaries that are better funded than almost any other imaginable threat. Cryptography is incredibly hard. Elsewhere on the thread, you said "I'm not a cryptographer". Neither am I! I've spent the better part of 10 years getting decent at breaking cryptosystems for clients, and I still refuse to do privacy implementation work, because I'm simply not up to the challenge. Are you sure you are?

kardos• 10 years ago

The author of the post is making the point that Signal's tradeoffs/policies are eroding support from the privacy-conscious end of the user spectrum. Crypto-soundness is excellent but when you staple an infoleak to it (contact list) it's much less compelling. So you can start to make the case to an end user that sharing all your info with Whatsapp or Telegram is a Bad Thing, and here let's install this Signal thing that's much better, except hold on what's this permission list that it requires?

I see Signal as having positioned itself as a compromise that makes nobody happy.

throwaway10141610• 10 years ago

What about all the other alternatives like Wire and Wickr? Wickr went through crypto reviews. Wire is open source.

They don't require using phone numbers so it's not really annoying to sign up without giving away anonymity.

tptacek18• 10 years ago

Serious question: what does "went through crypto reviews" even mean? One of these messaging systems is designed and implemented by experts; the others, not, but they've gotten 1-2 person/weeks of attention by (one hopes) a crypto experts.

jhasse10• 10 years ago

a long-term dependency on the telephone system for authentication

You can protect your Telegram account with a password (it's opt-in). Iran couldn't have compromised it then.

zabuni• 10 years ago

"Also, there’s the issue of integrity. Google is still cooperating with the NSA and other intelligence agencies. PRISM is also still a thing. I’m pretty sure that Google could serve a specially modified update or version of Signal to specific targets for surveillance, and they would be none the wiser that they installed malware on their phones."

Isn't part of the reason that Moxie went with the Google Store is that he gets to sign the god damned binaries, making it impossible for Google to modify the app.

antocv2• 10 years ago

Google has root on your phone. That is enough for them to replace any signatures, steal keys, replace apps without you knowing etc.

majewsky8• 10 years ago

This. If Google controlling your phone via a remote backdoor is part of your threat model, you better start shopping for a different operating system anyway. That's not an issue with any particular Android app, it's an issue with Android.

sandervenema14• 10 years ago

Hi, author here. Yes, my point with that sentence was that the average (non-technical) user (to which Signal is marketed btw), is not going to check signatures. Google has root on the phone, the user is using their app store to install the Signal app that comes up in the store, and basically Google has full control over this, and the user would be none the wiser.

Of course, us more technical inclined people could then check the signature, or compare the apk with one built from the official sources, to see the difference and complain about it.

But between those things is a time frame where this is possible.

zigzigzag5• 10 years ago

Does it, actually?

I was under the impression that the Play Store doesn't run as root and the package manager API (controlled by the phone manufacturer) is what checks signatures. Can the Play Store override the signature checks on upgrade and if so, what codepaths is it using?

zigzigzag5• 10 years ago

Like a lot of crypto-puritanism it is rather mixed up. He says he recommended Signal because it was easy to use (more consumer friendly I guess) and secure, then says he wouldn't have gone in the direction of making it easier to use and criticises the things that make it user friendly, like using phone numbers instead of usernames.

He says he thinks the protocol is secure, then says he doesn't want it to use GCM because it routes messages via Google who he doesn't trust (fixing that is the point of the encryption) and then talks about an attack that'd apply to any app regardless of whether it used GCM or not.

He finishes with a call to action: "We as a community need to come up with a viable solution and alternative to Signal that is easy to use and that does in fact respect people’s choices ... this tool should not have dependencies on corporate infrastructure"

But like a lot of armchair moralising, he isn't willing to debate the hard choices that go into building successful software. He says it should "respect people's choices" as if Signal is built by people who are disrespectful, he says it should not have dependencies on "corporate infrastructure" as if volunteer run datacenters actually exist, and then says his motivation is avoided paywalls, ignoring that both Signal and WhatsApp are free.

It reads like a collection of talking points rather than a coherent argument.

Signal is unusual because it combines cutting edge cryptography with consumer friendliness and is actually successful. It's pragmatic, not ideological. Crypto-warriors have a long history of producing secure software that nobody uses and then blaming the general public for not getting it; this sort of blog post is just a continuation of this decades long trend.

api3• 10 years ago

People need to get the fact that all traffic across the Internet traverses lots of people's systems. There is no difference between it relaying off Google vs Verizon, AT&T, Amazon, OVH, or dozens of other carriers and cloud providers.

Like you say that is the point of end to end crypto.

throwaway10141610• 10 years ago

There is a difference, because these people in the middle don't have your contacts and don't have root on your phone.

tptacek18• 10 years ago

I agree overwhelmingly with what you wrote, except that I want to point out that this isn't "crypto-puritanism". It's just hipsterism. The author isn't a cryptographer, and if you asked a panel of 10 cryptographic engineers what messaging system they'd recommend, 9 of them would say "Signal".

The 10th wants you to use something else because they're working on an attack for that "something else", and want their paper to be splashier when it's released. :)

When reading critiques of messaging software, keep in mind that messaging is a fucking midnight back-alley knife fight of a market. For whatever reason --- I think because (a) basic chat software is pretty easy to write, with a near- hello- world payoff similar to, say, blog software for Ruby on Rails and (b) because there have been multi-billion-dollar acquisitions of messaging tools --- there are a lot of different messaging products. Messaging is a network-effect market, so all the different vendors are fighting for users.

I don't think Signal has sockpuppets (it's just not their style), but I know several other "secure" messaging applications do.

zigzigzag5• 10 years ago

Good points. Perhaps crypto-hipsterism, then: crypterism.

mst• 10 years ago

Plus the complaint about giphy seems to completely miss the point that the more 'random messaging users' Signal attracts the better from a POV of deniability/etc.

RubyPinch• 10 years ago

are you part of that knife fight? calling the article writer a hipster in this comment, and what seems to amount to "It's not wrong to criticize Signal. but don't because telegram is worse and more likely to win" in your other comment (since they arn't asking for libresignal to take over, just for a decent alternative to exist which currently probably does not)

It seems a really strong and a bit aggressive of an attitude to have against a person's opinions

moxie2• 10 years ago

I think these types of posts are also the inevitable result of people overestimating our organizational capacity based on whatever limited success Signal and Signal Protocol have had. It could be that the author imagines me sitting in a glass skyscraper all day, drinking out of champagne flutes, watching over an enormous engineering team as they add support for animated GIF search as an explicit fuck you to people with serious needs.

I invite those who have opinions about Signal to start by getting involved in the project. To my knowledge the author of this blog post has never submitted a PR, issue, or discussion post to any of our repositories or forums. Many of these points are things that we would like to address, and we could use the help. The day to day reality of developing apps like these is a lot of work.

To provide some color on a few of these:

Dependency on Google Cloud Messaging

To clarify this for casual readers, no data at all is transmitted over GCM. GCM is only used as a push event to tell the Signal Android client to wake up and connect to the Signal server to retrieve messages from the queue if the app isn't in the foreground.

This is pretty fundamentally just how Android works. However, people who want to use Google's OS without any Google services flash custom ROMs onto their devices that are missing this dependency.

I have said many times that I have no problem with supporting these custom ROMs. But I would like someone from that community to submit the PR: "I would consider a clean, well written, and well tested PR for websocket-only support in Signal. I expect it to have high battery consumption and an unreliable user experience, but would be fine with it if it comes with a warning and only runs in the absence of play services."

Nobody has done it.

Your contact list is not private

First, on Android 6+ you can just disable the contacts permission and everything works (although you obviously won't see your contact names).

However, we also spend a lot of time thinking about this class of problems, as well as metadata in general. Right now things are playing out alright for one specific class of attack:

https://whispersystems.org/bigbrother/eastern-virginia-grand...

We'd obviously like to do even better. The nice thing about having a centralized service is that we can eventually take steps in this direction. People seem to equate federation with meta-data hiding for reasons I've never totally understood, but I think serious metadata protection is going to require new protocols and new techniques, so we're much more likely to see major progress in centralized rather than distributed environments (in the same way that Signal Protocol is now on over two billion devices, but we're unlikely to ever see even basic large scale email end to end encryption).

Lack of federation

I've tried to write about why I don't feel like this is going to be a part of our future here: https://whispersystems.org/blog/the-ecosystem-is-moving/

However, I would love it if someone proved me wrong. The Signal clients and server already support federation, so there shouldn't be any technical hurdles stopping the people who are really into federation from using our software to start their own federated network that demonstrates the viability of their ideas.

If anyone needs help doing that, let me know. I'd be happy to help.

lawnchair_larry3• 10 years ago

Hipsterism? That's horseshit. TFA is completely reasonable. At least 3 of these issues have prevented my privacy conscious friends from using it.

Especially the phone number thing. Phone numbers are quite sensitive. In some cases, the USG uses phone numbers alone for targeting drone strikes. They're enough to pull your credit report.

matt_kantor• 10 years ago

I don't think Signal has sockpuppets (it's just not their style), but I know several other "secure" messaging applications do.

Could you provide details/sources? This seems like a good opportunity for some public shaming.

antocv2• 10 years ago

There is a coherent argument which you just refuse to see.

Signal was marketed as anti mass surveillance secure messaging system. It is but a mere user friendly email+gpg alternative. It actively avoid anti-mass surveillance methods and does the opposite - encourages centralization and collection of user statistics.

Even Telegram is better, as people arent fooled by what it is.

A better alternative is Ring.cx or Tox.im with for example Antox client.

tptacek18• 10 years ago

I don't think you can reasonably post a top-level comment on a thread suggesting that Signal is a "honey pot", and then reply to a different comment on the same thread saying its author "refuses to see a coherent argument".

https://news.ycombinator.com/item?id=12881018

zigzigzag5• 10 years ago

How does it actively avoid anti-mass surveillance methods? There are no metadata obfuscation mechanisms that work at scale against all adversaries. Using GCM is without a doubt a big win for privacy because adversaries that have backbone taps (like your friendly local intelligence agency) just see SSL to google.com which tells them nothing of any use, not even that you use Signal. A big encrypted packet from google.com might be a Signal message or it might be an email or a Play Store update or whatever.

People always overlook the fact that the world is full of adversaries and 99% of them can't get access to Google's datacenters. Those adversaries matter too. Look at Turkey!

darklajid9• 10 years ago

I'm not a cryptographer. I .. am reasonably sure that no one would take me for a hipster.

But two issues - or call it 'differences in opinion' - in that article are relevant for me: The inability to use the service without a mobile number and federation.

I understand the rationale behind the former ("It's easier"), but I don't understand why it is mandatory. I could've been 1283783127356128531312 on Signal and optionally add my phone number to that identity for others to find me (and optionally let Signal use my contacts to search for someone). That could even be the default, opt-out during registration. But right now, I'm basically using my phone number, which I really hate to do.

Federation is probably hard to get right, and looking at Eric Lippert's "Every feature idea starts with -100 points" rationale I guess it is understandable that this isn't a thing. But I don't want to join another silo, even if it's the best of the crop so far.

For users like me, Signal, WhatsApp and yes, Telegram are basically the same thing, come with the same set of limitations and I feel that it is worth pointing them out from time to time. Just as the article did (I'm not agreeing with everything in there btw.)

People jump in to defend Signal whenever this comes up, but maybe that isn't necessary. Signal is a great project and most criticism I've seen here so far is not 'Signal sucks', it is usually more a long the line of 'Signal is not for me' and I have a hard time understanding why that is debatable or why this shouldn't be a valid position.

sandervenema14• 10 years ago

Agree. I'm not a cryptographer and never claimed to be either. -- and I think it would be difficult to mistake me for a hipster. For one, I don't have that snazzy majestic beard.. Anyway, on to the point. :)

Yes, the phone number thing is a policy decision by the Signal people. As I write in my article, it's maybe marginally easier to get connected using phone numbers, but I may want to communicate via Signal with someone I don't want to give my phone number to. Handing out personal phone numbers on the willy nilly is not something I'm comfortable with. There's no reason why we couldn't have some other identifier, possibly easy to remember to connect us to via Signal. So this was a policy decision by the Signal people.

Federation is indeed hard to get right, but I think with proper versioning, and various teams keeping their software up-to-date and close to the reference paper/the Signal protocol, I see no reason why it cannot be overcome. For XMPP/Jabber it also works quite well.

b2600• 10 years ago

I agree about the user name vs phone number. Federation issue was addressed here[1] for what it's worth.

[1] https://whispersystems.org/blog/the-ecosystem-is-moving/

tptacek18• 10 years ago

Signal and Telegram are not the same thing. Telegram has, according to Reuters, been actively compromised by people working for oppressive regimes (Iran, in particular).

If you're just using a secure messenger on general principles, it doesn't matter much which one you use. Probably WhatsApp is your best choice.

But if you actually need secure messaging, you should be using the safest secure messenger. Since we don't know who's reading these recommendations and what they're doing with them, we should employ the precautionary principle, and be clear with people that systems like Telegram, while probably fine for keeping messages out of the hands of jealous ex-partners, are simply not up to the task of protecting messages from serious, well-funded adversaries.

Mz4• 10 years ago

You are not a cryptographer and not a hipster and apparently never had your life on the line in a way that made it imperative that your communications not be associated with your phone number.

Whether you are a journalist or an abused individual hiding from the ex spouse/parents/whomever that abused you, if your life and/or the lives of other people are on the line, this detail (and perhaps others, as I am not super technically literate) is a serious deal breaker.

It has nothing whatsoever to do with some kind of vague, hand-wavy preference, like preferring red phones over blue ones because you like the color red. It has to do with "If I use this, will I or others end up dead, maimed, in jail for a lot of years or otherwise basically have one's life utterly ruined?" Like that movie scene where they blow up everything "because you made a phone call" (Enemy of the State, IIRC).

petre3• 10 years ago

Wire can use e-mails or phone nunbers for IDs, so you can use the same ID on multiple devices. But the mobile UI is worse than Signal's and it's also it's not federated. The source for the clients is on Github. It does have desktop apps for Windiws and Mac and a web app that works in most modern browsers. It's in many ways better than Skype. You don't have to link it to your phone in order to send messages - just use an e-mail account. It's also run by a Swiss company, so the servers might just be outside of the US.

aisofteng• 10 years ago

I disagree with your criticisms entirely and I think you are conflating things.

First, ease of use: the distinction you miss is ease of use from a UX point of view. Managing your own security is hard for the vast majority of people. It is an advantage that there is ease of use with respect to the security aspects - no command line commands to generate keys, for example - and ease of use from a UX point of view is completely different. Making a decision to to ease the UX can indeed negatively affect privacy elements, and there is no contradiction there.

Which brings me to the second point, which is that there is no contradiction in the discussion of security. The service could be using insecure protocols or algorithms, but the author says it isn't - from the point of view of cryptography, those choices are said to be sound. On the other hand, having your communication routed through a PRISM partner is a different concern. There is no contradiction in saying that the part of security under their control is sound, but that the part routed through Google may not be.

Cryptography is complex and rigorous. What you call puratinism is actually rigor with respect to sound practices. The points the article makes are, in fact, coherent; where you call puratinism and hipsterism on the article, I call cynicism and likely uninformed reasoning on your comment.

xenobioticants• 10 years ago

Signal is unusual because it combines cutting edge cryptography with consumer friendliness and is actually successful.

You do realize that since last year WhatsApp actually uses the Signal protocol?

sctblol2• 10 years ago

Hmm... he mentions the Giphy thing at the beginning of the article, then never again.

The Giphy mention seemed really dangerous to me. Now I don't use Signal but I imagine it's 1) optional and 2) requests are proxified/anonimised through an intermediary (the Signal servers in this case). And why is this dangerous? Because this "don't build cool stuff on this serious app" is what makes people not use the app. It's creating boring, dull apps what stops them from becoming mainstream successes. If we are trying to make the public using secure apps because we believe in privacy, we have to make them appealing.

This is similar to the case of how nobody uses PGP because how horribly bad it is, UX-wise.

That said the rest of points he brings up are good. I just didn't like the Giphy mention, especially taking into account he didn't say anything else about it, he just brought it up.

sandervenema14• 10 years ago

Hi there! The Giphy thing is what set me off writing the blog post in the first place. Maybe I should've expanded a bit more on that in the article. As far as I can tell, the idea is that requests to the Giphy API gets proxied through Signal.

I don't see anything in moxie's blog post about whether this is optional. If it isn't and it's sending everything you type to the Giphy API then we have a whole new problem.

In the blogpost by moxie, there's the example of typing "Im excited", which then gets sent in multiple API requests to giphy (basically one of 'I', one of 'Im', one for 'Im+' etc.). Now, if this is an action you don't do explicitly (like pressing a button or something, to search for gifs), then it would basically send everything you type in order to continually search for gifs and then offer suggestions? It's not clear from the blogpost. I hope at least that this is not what moxie had in mind.

sctblol2• 10 years ago

It's not clear to me, but I assumed that that only happened if you tapped on a "search for gifs" button, which is something that can happen accidentally, but... that's unlikely.

giancarlostoro5• 10 years ago

Giphy only occurs when you click on a button to add an attachment, and you have to click on Giphy, THEN you search for GIFs.

haffenloher8• 10 years ago

I promise that nobody is going to force you to use the GIF search. For a demo on how this feature works, check out the short video embedded into the blog post. [1]

I second the parent poster's question: "why is this dangerous?"

[1] https://whispersystems.org/blog/images/giphy.webm

joecool10297• 10 years ago

Can't wait for moxie to jump into the commentary. :)

Lack of federation

Moxie's pissy because he trusted the kangbangers at Cyanogenmod to to keep in sync with his development. They didn't. Someone will need to volunteer to run their own server that's kept updated, then buy Moxie a Snickers and hope he stops being moody.

Dependency on Google Cloud Messaging

Fun fact: The iOS client doesn't use GCM, it uses Pushkit. GCM was chosen for Android because what else is as robust and doesn't eat battery? Moxie's voiced support of Websockets if someone implements it correctly and he can merge it as a fallback option when Play Services are missing. If you can't code and want it, contribute to the bounty on it:

https://github.com/LibreSignal/LibreSignal/issues/37

https://github.com/LibreSignal/LibreSignal/issues/43

Your contact list is not private

https://whispersystems.org/blog/contact-discovery/

TL;DR, it's a tradeoff because nobody has a better idea that works at scale and is usable. Redphone used to have a good way of blindly doing contact discovery but it would require too much data for their current userbase.

secfirstmd2• 10 years ago

Layoff the personalised attacks on the psychology of someone who has helped increase the security of hundreds of millions of people for free, on basically a shoestring. Making pro/against arguments about Signal is fine but Moxie is genuinely a nice person (as are the rest of the former and current OWS team), so let's keep the argument civil.

joecool10297• 10 years ago

I actually insulted the Cyanogenmod team and I think it's funny you missed that.

I don't have an issue with Moxie except that he's been pissy over this and a few other issues. I don't think anyone is going to argue that he isn't. Why not check the first link to the Libresignal thread and read his comments on the topic?

(EDIT: I get the downvotes on this comment, but like Moxie, I too am seriously annoyed that Cyanogenmod dropped the ball so bad with them. Moxie would need to get over it if there's a new solution in the future and HE ALREADY VOICED HIS OPINION THAT FEDERATION IS UNLIKELY. If that's not being pissy, I don't know what else is. I used to run Libresignal on BB10 and now I can't because of this policy of being anti-federation and no work moving forward on websockets fallback. He'll likely say no to approving the fallback on Replicant/Sailfish/BB10 because he doesn't get version reporting through analytics and is concerned about disturbances of the signal server.)

1024core• 10 years ago

Another issue, and a plus for using usernames, is that you may want to use Signal with people you don’t necessarily want to give your phone number to.

So, how do you know that the Edward.Snowden@signal you're communicating with is the same Ed Snowden that we all know about, and not some TLA stooge?

resonanttoe2• 10 years ago

You're missing the point. Neither Phone number of Email address/username solve the problem you're proposing. But an email address/username is a lot more transient than a phone number.

I can change emails/usernames very easily and with little effort, and while burner numbers and applications that help that exist, changing phone numbers is not as easy and thus a significant percentage of users are unlikely to do it regularly. So you have a pseudo real ID that to the end user FEELS like it isn't you, but is a very strong (no pun intended) signal that it is to anyone looking in.

The phone number grants no you special verification of identity over an email address that doesn't involve an external verification mechanism (i.e, talking to the identity in person.)

Sylos• 10 years ago

By making user-names unique...?

latkin• 10 years ago

this tool should not have dependencies on corporate infrastructure like Google’s (basically any partner in PRISM)

Free yourself from the bonds of corporate infrastructure by installing this tool on your Google Android or Apple iPhone device (Microsoft Windows desktop version coming soon).

joesmo2• 10 years ago

"Otherwise, we’ll be in danger of ending up in an neo-90s Internet, with walled gardens and pay walls all over the place. You already see this trend happening in journalism."

The internet will never be less walled, more free, and more federated than it was in the 90's. With such a poor understanding of the internet and its history, even if he did make a compelling argument (he doesn't), it'd be hard to take seriously.

qwertyuiop92417• 10 years ago

You're forgetting about AOL and Compuserve. The Internet itself was federated. Networking really wasn't.

joesmo2• 10 years ago

I forgot them on purpose because he's talking about the Internet, not networking, not BBSs (which AOL and Compuserve were just big versions of). AOL and Compuserve eventually made themselves just another part of the Internet, but before that, they were really irrelevant in relation to the Internet's federation. In fact, other than AOL being an ISP and a gateway to the Internet for many, the actual AOL service was completely irrelevant once Internet connections came along.

Canada2• 10 years ago

Nothing is stopping anyone from running their own servers, changing the username scheme, and implementing the voice signaling. Moxie doesn't complain about such usage. But that's more work than simply complaining and telling OWS what they should do.

As far as usernames go, that would require the signaling key to be remembered by the user. That doesn't work well in practice. As far as contact sync goes, has anyone submitted a patch for the android client to add an advanced option to disable that? On IOS access to the address book is user controlled at runtime. destinations will be validated by the server at compose time. Regarding federation, let's see some code. It's ridiculous to demand the small team that is OWS solve every single problem.

JupiterMoon• 10 years ago

Regarding federation, let's see some code. It's ridiculous to demand the small team that is OWS solve every single problem.

Moxie has explicitly rejected federation. Anyone writing such code is wasting their time it won't get accepted.

Canada2• 10 years ago

Yep. You can run your own federation though. And maybe if it's really awesome he'll change his mind.

joecool10297• 10 years ago

Redphone component.

I don't know why it's closed source. It's been suggested elsewhere in this thread that it was potentially IP issues they kept it closed for. Is it possible loose US CALEA law interpretation influences the reasoning? Or a gag?

I honestly don't know why they chose to do that but I wanted to comment in to see if a lawyer or someone from the project could hint at the reasoning.

theGimp• 10 years ago

https://github.com/WhisperSystems/Signal-Android/tree/master...

codethief3• 10 years ago

This is the client component. The blog post and your parent were referring to the server component.

lisper• 10 years ago

I'm working on a completely open secure communications suite based on TweetNaCl. Proof-of-concept prototype is here:

https://github.com/Spark-Innovations/SC4

Working on a better UI at the moment. Could really use help, especially beta testers.

HashThis• 10 years ago

How does Signal compare to Telegram? Would you recommend Telegram as better or worse then Signal.

encryptawaa• 10 years ago

On Signal, every message uses end-to-end encryption. Signal's servers can't see the messages you are sending, only you and the recipient can read them. Signal's encryption protocol is carefully scrutinized and follows best-practices.

Telegram sends messages in plain-text by default. Telegram servers have access to all plain-text messages that you send.

Telegram's private chats use end-to-end encryption. But they use an encryption protocol that they invented themselves that doesn't follow best-practices. Encryption experts have been critical of Telegram's encryption protocol since it was released. So your private messages might not be so private, either.

If you are doing something sensitive and want to stay out of prison, use Signal.

majewsky8• 10 years ago

Actually, always use Signal unless you have contacts on Telegram that refuse to migrate. Consider all communication via Telegram to be on public record.

jhasse10• 10 years ago

Telegram sends messages in plain-text by default.

This sounds like everyone has access to those messages. Better: Telegram sends messages client-server encrypted by default and since you can't run your own Telegram servers, this is a problem.

richardwhiuk• 10 years ago

If you aren't going to recommend anything else then sit down and shut up frankly. The world is made of compromises and saying I don't like your choices is pointless if it's effectively impossible to choose differently.

ttam• 10 years ago

funny enough, I was going to try out Signal today but stopped right after seeing the permissions they request: https://pbs.twimg.com/media/CwhFsLzXcAIDcMH.jpg:large

codethief3• 10 years ago

Well, everything is there for a good reason. (Though it escapes me right now why it needs permission to access the calendar.) How are you going to call someone over Signal if Signal can't use the microphone? If in doubt you can always check the source code – it's open source for exactly that reason.

cbsmith• 10 years ago

There's a fundamental assumption here: that there is a better way. I'm not saying there isn't, but there's a pretty good existence proof that Signal is the best combination of security & simplicity we can put together.

I would agree with this statement from the article: "there should be a tool that is fully free software (as defined by the GNU GPL), that respects users' freedoms to freely inspect, use, modify the software and distributed modified copies of the software. Also, this tool should not have dependencies on corporate infrastructure like Google’s (basically any partner in PRISM), that allows these parties to control the correct working of the software."

There are such tools. None of them are as easy to use as Signal. So for now, I recommend Signal. I can't, in good conscience, recommend anything else... and given the author doesn't speak to what they recommend, I'm curious about what their recommendation would be.

RustyRussell• 10 years ago

For me I won't recommend it because of the horrible lack of options when you replace your phone (let alone lose it). No encrypted migrate. No backup options. Unencrypted loses content (images).

Plus there's no way to search old messages.

majewsky8• 10 years ago

I guess these are all features. For example, how are you going to do a backup that restores when you lose the phone (and thus the private key)? In practice, you would encrypt the backup with a passphrase, and the user would choose "123".

Signal aims to be the most usable secure messenger, not the most usable messenger that also happens to be secure.

codewiz2• 10 years ago

  "Also, there’s the issue of integrity. Google is still
  cooperating with the NSA and other intelligence agencies.
  PRISM is also still a thing."

What's this based on? Google immediately denied any association with the NSA and PRISM:

https://googleblog.blogspot.com/2013/06/what.html

Google’s chief legal officer claimed that collection was being done without Google's consent:

http://www.irishtimes.com/news/technology/google-outraged-at...

Evidence leaked by Edward Snowden also points in the direction of illegal infiltration of Google's private network without Google's consent:

https://www.washingtonpost.com/world/national-security/nsa-i...

sandervenema14• 10 years ago

On this: https://wikileaks.org/Op-ed-Google-and-the-NSA-Who-s.html

there are links on that page that point out multiple e-mails from the STRATFOR leaks and other files that point to Google being deeply embedded with the U.S. security apparatus.

Also: https://www.theguardian.com/world/2013/aug/23/nsa-prism-cost...

sandervenema14• 10 years ago

And Google became a PRISM partner in 2009, as the slides here from the Snowden collection prove: https://search.edwardsnowden.com/docs/PRISMUS-984XNOverview2...

lawnchair_larry3• 10 years ago

Slight correction. Google is a willing* PRISM partner, but they don't use the name PRISM, and PRISM isn't quite what was originally described.

The leaks related to exploitation of Google traffic refer to programs unrelated to PRISM.

*Willing in the sense that they have to respond to FISA orders and NSLs, and they have agreed to do it according to a certain protocol.

piotrjurkiewicz2• 10 years ago

Add a lack of real desktop to this.

piotrjurkiewicz2• 10 years ago

*real desktop client

droopybuns2• 10 years ago

Animated GIFS were the straw that broke the camels back?

Let's throw the best available solution under the bus.

This post will be my go to example of the myopia of some members of the security community. We have very few examples of well executed, consumer friendly privacy soloutions. Signal is the best for all possible scenarios: Open source, user friendly, buy in from a major Internet service.

I like wickr, but it falls short due to the closed source nature of the project.

Consumer friendly, usable security needs to be the number one priority for security advocates. We need to stop burning down houses because they are short a door or are the wrong color. The foundation is the hard part. Wait till there is a real alternative that can be used by people who are not c.s. majors before you argue that people should stop using the best available solution.

I appreciate the authors perspective and I agree with some of their points. Then they fuck it up by demonstrating purist jackassery. Worth a read as a useful persuasion antipattern.

youdontknowtho• 10 years ago

If they are only using GCM as a queue (and the messages are themselves encrypted) I don't understand what the problem is.

They could use anyone for that functionality. Even if the messages are given to an "adversary" what can they really get from that? Your phone app contacted the signal servers. That's really it.

haffenloher8• 10 years ago

They're not even using it as a queue, they're queueing and delivering the messages themselves. GCM messages are empty and are only used to wake up your device.

angry_octet3• 10 years ago

If wishes were fishes we'd all live by the sea.

haffenloher8• 10 years ago

From the post:

"The Google Cloud Messaging service basically handles message handling from/to the user’s devices to the Signal servers. The GCM service then handles all the aspects of queueing all messages and delivery from/to users."

This is not true. Messages are delivered via Signal's own servers only. GCM messages are empty; their only purpose is to wake up your device. [1]

"The phone component of Signal is called RedPhone. The server component of this is unfortunately not open source [...] this is also probably the reason why secure encrypted phone calls don’t work in e.g. LibreSignal"

No. The reason for that is that the signaling for RedPhone calls is currently still done via GCM and not via Signal's own message transport.

Regarding microg: I've never heard of the need to re-compile kernels for that. I think most people use it with Xposed (admittedly, a giant hack, but it works).

[1] https://whispersystems.org/blog/goodbye-encrypted-sms/

sandervenema14• 10 years ago

Hmm. You seem to be right. Article corrected there to reflect that Signal is using empty GCM messages. I must have still had the old situation of TextSecure in my head when I wrote that. Nice to know re the reason Redphone doesn't work, thanks for that insight!

tptacek18• 10 years ago

(had suggested the author add an endnote; they did)

bitmapbrother4• 10 years ago

I’m pretty sure that Google could serve a specially modified update or version of Signal to specific targets for surveillance, and they would be none the wiser that they installed malware on their phones.

I'm not sure he understands how app signing works and why it would be impossible for Google to forge a developer's signature. He also seems to have a problem with GCM and Google in general. Perhaps he should look into writing his own secure chat application.

throwaway10141610• 10 years ago

Why would they have to forge it? They can simply install a version that isn't signed on your system via an update.

Then later replace it with a signed version once they have the data they wanted. You would never know what happened.

em3rgent0rdr• 10 years ago

I didn't have to recompile my kernel to use microg...instead I used FakeGApps with Xposed framework. instructions: https://github.com/thermatk/FakeGApps

chrismartin• 10 years ago

Signal may not transmit any payload via Google Cloud Messaging, but Signal's requirement to run Google Play Services compromises the user's privacy in ways that have nothing to do with Signal. If you run Play Services then you have a device which provides your communications metadata, whereabouts, and device usage habits to Google.

I don't trust Google with this information and don't want to carry such a device, but a handful of friends and family use Signal, so I must choose between easy/secure communication with them, and reducing my exposure to corporate surveillance.

Signal may be "pragmatic" among the current choices (just like the project's decision to use GCM is pragmatic), but OpenWhisperSystems absolutely deserves criticism for:

1. Tying secure communication to running what amounts to Google's spyware on your device

2. Offering no alternative for privacy-conscious users

3. Showing hostility to those trying to introduce such an alternative to the project

I think those dismissing these concerns as "crypto-puritanism" will be on the wrong side of history.

haffenloher8• 10 years ago

3. Showing hostility to those trying to introduce such an alternative to the project

Quite the contrary, they're actively asking people to contribute code for an alternative push mechanism [1][2]:

"I would consider a clean, well written, and well tested PR for websocket-only support in Signal. I expect it to have high battery consumption and an unreliable user experience, but would be fine with it if it comes with a warning and only runs in the absence of play services."

[1] https://github.com/LibreSignal/LibreSignal/issues/37#issueco... [2] https://news.ycombinator.com/item?id=12883410

fiatjaf• 10 years ago

The Signal app is stupid. It doesn't work intuitively as WhatsApp. It's incomprehensible that you need a phone number, it's incomprehensible that you can't compile it yourself.

lonelyw0lf• 10 years ago

The truth which a lot of Moxie fans don't want to admit is he thinks there is nobody better to be entrusted with this project. I don't think this was ever meant to be a community project -- he just opened some parts so he could pretend it is. Also he is a limelight hogging security diva who always wants to be in the news and have people talk about him. If he allowed others to contribute and be recognised, he worries they might overshadow him.

gyey2• 10 years ago

I haven't actually worked with GCM so please forgive me if this doesn't make any sense. I suggest that, instead of routing all messages through GCM, what if Signal could send a "wake up" message via GCM, and then let the app pull the encrypted messages directly out of Signal's servers? A wake up message would only be sent by the server if the message could not be received by the client via normal means (implying that the device is asleep).

An optional user preference could allow some dummy wake up messages to be sent at random moments during the day, to support plausible deniability, at the cost of slightly worse battery life performance. This would all happen silently and the user would only notice a message notification when the app successfully fetches a new incoming message.

haffenloher8• 10 years ago

I suggest that, instead of routing all messages through GCM, what if Signal could send a "wake up" message via GCM, and then let the app pull the encrypted messages directly out of Signal's servers?

Yep, that's exactly how Signal has been doing it for >1.5 years now.

gyey2• 10 years ago

ahh. I just thought otherwise from some of the other comments here. Makes sense. Thank you.

rstuart4133• 10 years ago

I know the redphone is library is just a binary blob in the github repository:

    https://github.com/WhisperSystems/Signal-Android/tree/master/libs/armeabi

But I always thought that .so was just a compiled version of this C++ source, which in the same github repository:

    https://github.com/WhisperSystems/Signal-Android/tree/master/jni/redphone

I haven't compiled it myself so I can't be 100% sure, but the C++ entry points matches the API the Java code is using. I presume it's written in C++ for speed. There isn't much to the C++ bits. It just pumps data through an encrypted RTP connection - CPU intensive but not particularly complex.

The server code is up there too - in fact it's all up there. AFAICT, Signal is completely open source.

nopcode• 10 years ago

Why is the author asking for GPL?

Wouldn't a ISC/BSD-like license be better for the federation aspect?

argos-rho• 10 years ago

The author offers no better alternative so I think that means the article speaks for itself: there's not much to do but whine. These are problems, sure, but they're minor when you consider that Signal is the most secure and user-friendly messenger we have on the market right now. If something takes its place, then great. Otherwise, we just will continue to use what is secure and actually works.

Why I won't recommend Signal anymore

Related Stories