Free, Worldwide, Encrypted Phone Calls for iPhone

by david_shaw • 12 years ago

410 161 12 years ago

david_shaw• 12 years ago

Many people are already familiar with Moxie Marlinspike's WhisperSystems because of their Android apps: RedPhone for encrypted calls, and TextSecure for SMS messages.

The release of Signal is a pretty big deal for iOS users; previously, we had to consider a paid option like Silent Circle, or a larger corporate option like FaceTime Audio (which isn't really the same).

Although I haven't actually used the app yet (it's registering now), the screenshots appear to be a fairly direct port of RedPhone to iOS.

Edit: Yep! And it looks like Signal users can make secure calls to contacts with RedPhone installed, too. Very nice.

sarciszewski• 12 years ago

Definitely a huge win for Apple consumers. :)

stevengg• 12 years ago

Moxie also made a sailing documentary that is good called hold fast http://vimeo.com/15351476

frandroid• 12 years ago

OMG I knew the name sounded familiar. This doc is SO GOOD.

eggbrain4• 12 years ago

It's great that we have more privacy options for phone calls, texts, etc. But we still need a great "Privacy" phone, right?

There's been attempts to do so recently (Blackphone, PrivacyPhone), but both have suffered from the same fault: a binary blob for the baseband, something that renders all your privacy moot. I've heard the best recommendation is a tablet + USB LTE dongle, to put some space between the two processors ("firewalling" the baseband processor a bit).

Is there a better way than this? Has anyone kinda walked through all the steps neccesary to have a private/"secure" phone?

That being said, congratulations to Whisper Systems -- their work on things like TextSecure and Redphone have been awesome. I hope one day they do a Kickstarter for a whole secure mobile operating system.

sp3322• 12 years ago

It doesn't render all your privacy moot. It's limited to snooping on what you send over the radio, which is the same as what your cell carrier would have access to even with a secure baseband. (Edit: unless the baseband hacks into the software running on the other side of the radio and exfiltrates data right from your SD card... hm...)

What I would like to see is a way to verify that you're connected to a legitimate cell tower and not an eavesdropper.

eggbrain4• 12 years ago

Not necessarily - some processors (Snapdragon, for example) implement the baseband right into the core processor -- it will have more access than just the radios. I'm pretty sure the baseband also has access to the memory as well, right?

toomuchtodo• 12 years ago

What I would like to see is a way to verify that you're connected to a legitimate cell tower and not an eavesdropper.

Is there a way for cell tower's to "sign" their announcements cryptographically with LTE?

pinkyand2• 12 years ago

In many/most phones, the radio can access the ram of the device(DMA). the reason is efficient transfer of data, but with that comes the possibility of the radio reading everything inside the ram, including encrytion keys.

therealmarv2• 12 years ago

you are mixing things up. Privacy and Opensource. For a true open source project look at http://www.replicant.us/ And regarding privacy: Use SIM cards which do not require an ID and which you can throw away ;) but this is only the first step.

eggbrain4• 12 years ago

Privacy and Open Source can be the same thing -- the idea being that if we know how something was built, we can make sure there aren't any backdoors / "hidden" features that we don't know about. Most if not all of the open source operating systems still include a binary baseband blob, although work is progressing on a few (the best one I saw only worked on really, really old phones).

One of the main criticisms of the Blackphone was that A) PrivacyOS (I think it was called) was seemingly black box (no pun intended) -- they said they would open up the code soon, but we haven't seen anything yet B) It still would use a binary baseband. The illusion of security is sometimes worse than no security, and open source code helps with removing those barriers (Although it doesn't neccesarily -- just look at OpenSSL).

rsync• 12 years ago

"I've heard the best recommendation is a tablet + USB LTE dongle, to put some space between the two processors "

This is an interesting, and tempting, direction to go in ... my understanding is that this is problematic, however.

You see, in addition to all of the (radio stuff) that the baseband processor handles, it turns out that they also handle a lot of voice quality functions, such as noise cancel, echo cancel, interference, etc. - all things that we take for granted on all phones.

I have been told that VOIP apps running on non-mobile-phone "handsets" (like you're suggesting) are somewhat difficult to use for plain old voice, because they lack all of these functions which are difficult to replicate (and are wrapped up in a lot of patents and trade secrets, etc.)

I have no first-hand experience, however.

josh2600• 12 years ago

A couple thoughts:

1) A LTE dongle still has a binary blob.

2) An example of the kinds of things one has to deal with: many 8 numbers will drop calls that don't provide a supervised signal to the public switched telephone network.

Many phone apps simply neglect to implement call supervision, which causes weird failures when interfacing with some pbx systems.

See here for some more detail: http://www.voip-info.org/wiki/index.php?page_id=3209

pjc50• 12 years ago

The open source PJSIP (which I do have first hand experience of) has echo cancel and some noise cancellation. It's not cutting edge but it works fine in practice. You might not get quite the quality of Skype but better than plain old landline telephone service.

nardi6• 12 years ago

Um. Isn't encrypted calling on iPhones already provided by FaceTime Audio?

therealmarv2• 12 years ago

I'm sure there is no real end-to-end encryption. And you can only do that between iPhone/Mac users.

nardi6• 12 years ago

I'm sure there is no real end-to-end encryption.

"The audio/video contents of FaceTime calls are protected by end-to-end encryption, so no one but the sender and receiver can access them. Apple cannot decrypt the data."

https://ssl.apple.com/iphone/business/docs/iOS_Security_Feb1...

And you can only do that between iPhone/Mac users.

Ah yeah, I thought Signal was only for iPhone, based on the title. Should have read the first paragraph more closely.

spellboots2• 12 years ago

Yes, but it is not secure

nardi6• 12 years ago

"The audio/video contents of FaceTime calls are protected by end-to-end encryption, so no one but the sender and receiver can access them. Apple cannot decrypt the data." [1]

[1] https://ssl.apple.com/iphone/business/docs/iOS_Security_Feb1...

sp3322• 12 years ago

They claim to use SIP to establish an SRTP connection with AES-256. But I don't know any way to verify that the data is being encrypted well or sent only to the intended recipient. https://ssl.apple.com/iphone/business/docs/iOS_Security_Feb1...

nardi6• 12 years ago

But I don't know any way to verify that the data is being encrypted well or sent only to the intended recipient.

Couldn't you say the same thing about Signal? Both parties claim to use end-to-end encryption.

e1ven• 12 years ago

There is value in being able to call people who do not have iOS devices. This is more similar to SilentCircle, but without a monthly fee.

bdesimone2• 12 years ago

Yes. And you should probably assume that their claims of end-to-end encryption are about as solid as they were for iMessage.

http://blog.cryptographyengineering.com/2013/06/can-apple-re...

http://arstechnica.com/security/2013/06/can-apple-read-your-...

http://www.zdnet.com/apples-imessage-encryption-claims-refut...

nardi6• 12 years ago

Didn't Apple debunk that debunking themselves in February, when they released the iOS Security doc? [1]

According to Apple, each device's private key is generated locally and never leaves the device, making it impossible to MITM your messages.

From page 20: "For each key pair, the private keys are saved in the device’s keychain and the public keys are sent to Apple’s directory service (IDS), where they are associated with the user’s phone number or email address, along with the device’s APNs address."

[1] http://images.apple.com/iphone/business/docs/iOS_Security_Fe...

chmars• 12 years ago

Why is Signal (the app) free? What's the business model?

higherpurpose6• 12 years ago

Open source. Donations.

https://pressfreedomfoundation.org/bundle/encryption-tools-j...

eps2• 12 years ago

Donations is not a business model.

Nursie3• 12 years ago

There isn't a business model. Not everything has to have a business model.

The only business model I would even remotely associate with this is, on an individual developer level, the reputation and future work opportunities you would get from having your name associated with this stuff.

felix2• 12 years ago

Curious why this is different than RedPhone - same company, same product(?), diff't platform - why not keep app branding?

higherpurpose6• 12 years ago

Signal is better branding.

jmathai• 12 years ago

Signal is a much more neutral brand than RedPhone. RedPhone sounds either like an adult network or spying app.

At one of the Shuttleworth Foundation gatherings (where all Shuttleworth fellows meet bi-annually) I remember having a conversation about the branding of RedPhone and everyone unanimously agreed that it would hinder wider spread adoption of the software.

I'm not sure what all the factors in re-branding were but I remember Moxie agreeing with the sentiment at the time.

felix2• 12 years ago

Makes sense - do you know if they will be re-branding RedPhone on Android? Just curious.

clarkm• 12 years ago

Is anyone else having trouble registering the app? I'm not receiving a SMS validation code.

carbocation3• 12 years ago

I also am not receiving the SMS validation code. I'll update when I get (or don't get) the promised phone call (which comes ~4m after they think they sent the SMS). I suspect they're just overloaded by the HN spike.

Edit: The app called, offered me a code which was rejected, and refuses to Re-call me because "rate limit exceeded."

halon4• 12 years ago

You will have the opportunity to request another call in about 15 minutes

13throwaway• 12 years ago

Great job guys! I'm a big fan of what whisper systems is doing. Why is this not called redphone though? Does it have different features?

Edit: Looks like the article says it is part of a plan to merge redphone and textsecure.

higherpurpose6• 12 years ago

Rebranding, plus they want to combine RedPhone and TextSecure into a single app: Signal. Since they're just now starting on iOS, no point naming it RedPhone now, just to rename it to Signal 3 months from now.

frequentflyeru• 12 years ago

Next round of Edward Snowden leaks: "NSA created and funded 'open whisper systems' as a way to get people to think their calls were encrypted when in reality calls went straight to the NSA..."

dm28• 12 years ago

Their encryption/transfer method has been public for a while and the app is opensource. From what I've read (I'm not technically savvy enough and don't have enough time to actually study it) it shouldn't be possible for them to read your message even if they wanted to. Please someone correct me if I'm wrong.

Tor was created by the US

lasermike026• 12 years ago

Open Whisper Systems is fund by the Shuttleworth Foundation.

https://www.shuttleworthfoundation.org/about-us/team/

acqq3• 12 years ago

Moxie is a fellow of the Foundation:

https://www.shuttleworthfoundation.org/fellowship/fellows/cu...

But it appears he personally only "helps" Open Whisper Systems:

http://www.thoughtcrime.org/blog/we-should-all-have-somethin...

"I help work on Open Source security and privacy apps at Open Whisper Systems"

On more accurate side, see also 2013 report of Open Technology Fund which granted 445K USD directly to the Open Whisper Systems in 2013.

acqq3• 12 years ago

Not NSA directly but apparently US. Government did fund Open Whisper Systems:

"US. Government Funded Your Favorite ‘NSA-Proof’ Apps"

http://revolution-news.com/us-government-funds-favorite-nsa-...

"Radio Free Asia funds many software projects through its Open Technology Fund." (...) "The Open Technology Fund listed Open Whisper Systems as accepting $455,000 in 2013."

acqq3• 12 years ago

If anybody questions the article, it's still documented directly on the fund's site:

Open technology fund 2013 report:

https://www.opentechfund.org/sites/default/files/attachments...

"Open Whisper Systems $455,000"

https://www.opentechfund.org/about

"the Open Technology Fund (OTF) was created in early 2012 from U.S. Government (USG) funds and sustained by annual grants from the Broadcasting Board of Governors (BBG) as a program of Radio Free Asia (RFA)"

eliteraspberrie2• 12 years ago

It would be nice if the server software were open source as well.

Call routing information, like all metadata, can only be protected legally not cryptographically. So it's not something I trust to people outside Canada, no matter how much esteem I have for them.

wyager2• 12 years ago

Call routing information, like all metadata, can only be protected legally not cryptographically.

In this system. You could, for example, route calls over Tor (with crippling latency). There is no theoretical reason you can't make a fully anonymous audio comms system.

eliteraspberrie2• 12 years ago

There is no such thing as low latency anonymity.

happyscrappy• 12 years ago

You realize that Canada is part of the evil five eyes.

clojsure2• 12 years ago

"Call routing information, like all metadata, can only be protected legally not cryptographically."

A counter example of this is seen through ImperialViolet's pond(https://pond.imperialviolet.org/). Using pond, neither metadata nor content are leaked, as both are transmitted over tor every set interval.

rdl2• 12 years ago

Why is the App Store application search process so horrible? I agree, "Signal" and "Whisper" are bad things to have to search for, but there's basically no way to enter a simple memorable text string in the store and get the right app.

I ended up using a browser on the phone to go to the HN article to go to the right app store link.

I can't believe this hasn't been solved.

wmeredith• 12 years ago

Apple has kind of always sucked at search. It's a shame, considering the quality of the rest of their ecosystem.

ableal• 12 years ago

Word. The other day I typed the correct name of an app into the Apple web search box, no hits. Try Google, first hit straight to the app store.

Last month I posted the John Dvorak piece where he suggests Apple should buy themselves some search - http://www.pcmag.com/article2/0,2817,2458892,00.asp ; it features an amusing pic proposing DuckDuckGo http://www9.pcmag.com/media/images/429429-apple-isearch-mock...

thefreeman• 12 years ago

Perhaps the idea is to encourage browsing? Like how stores like Target and Walmart move things around all the time with the goal of forcing you to explore the store.

Regardless I agree trying to find apps through any of the built in app stores is a nightmare, ios, android, and windows alike.

graeme• 12 years ago

Perhaps the idea is to encourage browsing? Like how stores like Target and Walmart move things around all the time with the goal of forcing you to explore the store.

It's a different situation though. In a physical store, you won't leave the store on a whim. In the app store, you can easily exit if distracted by a text, twitter, etc.

rdl2• 12 years ago

It seems worth giving iOS apps "distinctive" names just to win the type-in traffic, if it doesn't work better; or at least having a weird company name with a boring product name so people can at least search on product.

Maybe kids these days do EVERYTHING on mobile, including web browsing to find new apps; my problem is I browse on one platform without iTunes, but want the app on my iPhone.

dm28• 12 years ago

It might not be in there yet. The app was released about an hour ago.

n6mac417172• 12 years ago

https://itunes.apple.com/app/id874139669

Got to it on the company website, but on a desktop browser (can't find it using my phone browser). So I emailed the URL to myself to click on it in my phone mail client :-)

mox1• 12 years ago

It's really horrible on the iOS store, less so on Google play.

I am like ranked 100+ on a certain low volume, extremely specific keyword that has approximately 20 actual apps related to that keyword in the store. This keyword is in my apps name. The other 80 are just random games and apps that happen to be more popular and Apple has somehow correlated to my keyword.

It's a free app and I don't advertise. It sucks that people looking for my solution specifically will never even find it. I'm amazed it ever gets downloaded to be honest...

On Google play, they at least take the name of the app vs. search term into account pretty heavily. So if I name an app "Widget Doodad" I will be ranked amongst all of the other apps related to Widget, before non widget related apps show up.

StavrosK4• 12 years ago

I wanted to donate $5 to BitHub using Bitcoin, but Coinbase's overlay doesn't allow you to change the amount (typing a new amount in does nothing). Does anyone know of a way around this?

Moxie, if you see this, can you publish some static address we can send funds to as well?

thecoffman2• 12 years ago

I used it to successfully donate $5 without issue. Changing the dollar amount seemed to work for me.

StavrosK4• 12 years ago

Hmm, thanks. It must have been some ad blocker issue, I'll try an incognito window.

mahyarm• 12 years ago

Next step, no phone number required for accounts!

jtfairbank• 12 years ago

Congrats Jake and the WhisperSystems crew! :D Can't wait to see you in a few weeks bud.

dm28• 12 years ago

I wish they had text messaging. I've been waiting so long for this and it lacks the major feature we need! Hopefully it'll come soon.

The reason why this is important these days is that law enforcement now has more access (because the technology is cheaper) to fake cell towers http://en.wikipedia.org/wiki/Stingray_phone_tracker

Many states are denying FOIA requests regarding this spying but there are several news stories from this year of data obtained from these fake "towers" being used in court. They can be put in vans or just be near people or be used at any large gathering of people.

I used an Android phone with RedPhone and this Signal app with iOS and it works perfectly. Very well done! Need encrypted text messaging ASAP!

They are also saying TextSecure and RedPhone will be merged into Signal. That'll be great!

I will gladly donate to this company if they will increase the speed of development.

Question: If my phone has a limited amount of minutes and I have RedPhone or Signal and I call someones phone who doesn't have one of these programs, does that use my minutes or does it only use Data (or WiFi)?

gioi2• 12 years ago

    Later this summer, Signal for iPhone will be expanded to support text communication compatible with TextSecure for Android.

You'll have to wait to wait a little. I'd bet it will be worth.

tedunangst• 12 years ago

Can a Stingray intercept iMessages?

dm28• 12 years ago

I'm not sure, I doubt it, but that doesn't mean there aren't other ways to intercept them.

iOS still sends normal text messages to any device that isn't iOS. I use an Android device for the most part and almost everyone I know uses iOS, which means that even if I'm using TextSecure the message will be delivered as a normal text message, which certainly can be intercepted and stored by Stingray and similar devices.

pinkyand2• 12 years ago

IMessages are supposed to be encrypted, so no.

Titanous• 12 years ago

No, the messages are encrypted device-to-device with Apple providing a key directory service. Apple must be complicit to read messages without physical or backdoor access to the device.

http://blog.quarkslab.com/imessage-privacy.html

halon4• 12 years ago

It uses only data

FredericJ• 12 years ago

Hey, I'm the co-lead developer of Signal. We're looking for help with translations, help us out to bring Signal to as many people as possible: https://www.transifex.com/projects/p/signal-ios/ We also pay per commit if you want to help on Open Whisper Systems projects: http://bithub.whispersystems.org/

dm28• 12 years ago

These seem like incredibly generous payments for such small commits...

https://github.com/WhisperSystems/whispersystems.org/commit/...

I was going to donate today, but it seems like the donations are being wasted. I work hard for my money and if my donations go towards a trivial (and arguably unnecessary) 2 line CSS change that would really piss me off.

Can we donate only to certain apps? I want to see TextSecure for iOS out as soon as possible, I couldn't care less about CSS changes on your website or escaping some readme file.

heavenlyhash• 12 years ago

It seems reasonable to me. Good documentation is a critical part of a project's success. It's hard and valuable work.

And think of it in terms of replacement cost. What would it take for all of these changes to be made by core developers instaed? Every moment we have the core developers working on the crypto while a supportive community takes part in documentation -- at a rate far, far lower per hour rate than I imagine the core developers would value their time if they were contractors -- is a net win, in my figuring.

halon4• 12 years ago

I am also one of the core devs. Actually, none of the Bithub donations go close to being a working wage for any programmer actively working on the repository. We either get paid by grants or are volunteer. Asking us to micromanage Bithub grants for one or two off contributors would only be more work. We went with a "worse is better" strategy with the goal of encouraging people to regularly commit in however they feel comfortable. It's an experiment that we've been pleased with and if you would rather donate to a dev individually just look at who the top contributors are and reach out. We appreciate any support from PRs to Bitcoin to press.

EGreg• 12 years ago

How do I set up a similar system with BitHub rewards for commits? I would like to put $100 towards it and see whether it would be worthwhile to continue.

aeontech• 12 years ago

If you approve russian translation request, I'll be happy to help

StavrosK4• 12 years ago

I'd also be happy to give Greek a stab.

synergies• 12 years ago

I can help with Russian as well.

atmosx• 12 years ago

I can help with the Greek translation along with StavrosK. Created my account at Transifex today, but have to get some sleep now. Will get in contact tomorrow, if you can create a GR version/repo.

rahimnathwani• 12 years ago

How do I translate the app to Simplified Chinese? I visited the link, but Chinese wasn't in the list of languages I could choose to translate. I added a 'request' for it to the list. Will I be notified when the request is approved and I can start translating strings?

zz12• 12 years ago

Does anyone know what the userbase of Redphone is? Is it the same as Textsecure (around 10 milions)?

hruan2• 12 years ago

"Signal uses your existing number, doesn’t require a password, and leverages privacy-preserving contact discovery to immediately display which of your contacts are reachable with Signal."

How does contact discovery work? What happens when run on a device without a (valid) SIM?

acdha2• 12 years ago

They've blogged a bit about this challenge in the past:

https://whispersystems.org/blog/contact-discovery/

hruan2• 12 years ago

Ah, thanks!

acdha2• 12 years ago

It looks like it uses bloom filters for the phone number:

isCntactRegisteredWithWhisper calls isPhoneNumberRegisteredWithWhisper:

https://github.com/WhisperSystems/Signal-iOS/blob/19ff47e278...

The implementation is simply checking a bloom filter:

https://github.com/WhisperSystems/Signal-iOS/blob/19ff47e278...

… and the filter is periodically downloaded from their servers:

https://github.com/WhisperSystems/Signal-iOS/blob/19ff47e278...

which ultimately ends up at:

https://master.whispersystems.org:31337/users/directory

guelo• 12 years ago

These guys are doing amazing high-quality work. I'm really amazed that they can pull it off with volunteers and donations. There are very few examples of polished front-end apps in the open source world.

autodidakto• 12 years ago

Please authenticate with something that's not a phone number! I guess that's the simplest for most people (look at WhatsApp), but the reason why I use things like Signal is because I despise cell carriers. I'd like to use this on a (cheaper) non-cellular device (for myself and family members).

The Holy Grail of Secure Communications: Group Encrypted Text, Voice, and Video. Right now, Skype gives you the unholy grail, but you get all three (+group). I wish Open Whisper Systems luck.

dublinben2• 12 years ago

To my knowledge, Jitsi fulfills your Holy Grail of Secure Communications requirements. It certainly much more trustworthy than Skype.

joeyspn• 12 years ago

+1, and also uses zrtp

jitl• 12 years ago

Needs to be quality on mobile too.

zeeed2• 12 years ago

nice. it requires a 3rd party FB, Google, AIM, ICQ, ippi, iptel or MSN account but it says they optionally use OTR.

Not 100% secure IMHO but close. Why do they have to rely on a 3rd party for authentication? This still gives (at least, if you manually enable OTR encryption) the connection data to the service providers.

imaginenore2• 12 years ago

You missed the main holy grail requirement: open source.

Nothing closed source can be trusted.

bellerocky• 12 years ago

Complete transparency from end to end would require more than just open source. You'd have to be able to build and run the software itself, which on an iPhone costs $99 a year to do and poses significant technical challenges. To go further you'd have to transparency at the hardware level as well. Your own device, built by you, with software you compiled yourself. Maybe then you'd achieve the level of security that you're aiming for, assuming you are competent enough to evaluate the software and hardware you are using.

nobbyclark• 12 years ago

How do you know that the app published on the App Store is the same one you have the source code for? Can't I can just give you some source code then release something else entirely?

ozmbie• 12 years ago

Why is it so hard to find cross-platform, encrypted group chat? Surely there's a market for it.

chatmasta• 12 years ago

The market exists, but it's in its infancy. The Snowden revelations blew a hole wide open in the privacy market, and that's why you're starting to see more and more privacy companies opening. I suspect it won't be long before one of them (whisper?) offers a cross platform, encrypted group chat like you speak of. But these things take a while to build.

dscrd• 12 years ago

These guys have been trying for as long as I think http://silcnet.org/

I would assume that the problems are more difficult compared to simple P2P.

zeeed2• 12 years ago

if mobile/tablet-only is OK, try wickr (wickr.com).

It works fairly well for me. They have a $100.000 bounty for someone who manages to break their code/get communication contents and they're sponsored by the EFF.

The downsides are that it's closed-source and that there's no desktop client (yet).

Nursie3• 12 years ago

The announcement here says that Signal will support text messaging compatible with TextSecure later in the summer.

I've been using TextSecure on android for some time, group chat is part of it.

subbz• 12 years ago

I agree with that but to bring encryption close to end-users you will have to use something that's simple and everybody has. Said that, I'm aware of the disadvantages - they should provide an alternative to the phone number too.

supernova87a• 12 years ago

Maybe a stupid question, but is the app sending this encrypted voice over the cellular channel, or is it making a data connection independent of the phone?

Also, on a different point, if I were trying to eavesdrop on someone's conversation, I would probably just try to hack the microphone with a different / already loaded app...

higherpurpose6• 12 years ago

Will we eventually get video calling, too? (especially in the browser version, perhaps by using a more secure version of WebRTC?)

Also, I suggest dropping SMS support, and going "data-only" for the new Signal. Or at the very least disable all SMS/MMS stuff by default, and only leave them as opt-in options in settings. Don't even prompt users about it, because most will say yes, without really knowing what they're doing, and that the app will start eating SMS credits without realizing.

But really, you should just drop it. I mean look how successful Whatsapp is, and doesn't have any SMS support, let alone an end-to-end encrypted one.

trounce• 12 years ago

As soon as I registered, I started getting "No Caller ID" phone calls every few minutes from some unknown person speaking Chinese (which I don't speak). This is pretty annoying, to say the least.

There doesn't seem to be any way to deregister your phone number? So what now?

alt_f42• 12 years ago

When the client device is compromised (and we know that iOS is [1]), it doesn't matter how secure the link is. If I were a sophisticated attacker and wanted to listen to your conversation, I could just tap your mic and audio output.

[1] https://pentest.com/ios_backdoors_attack_points_surveillance...

alt_f42• 12 years ago

At -3, it amazes me why people on here would down vote facts. It's not like you're disagreeing with me - you're disagreeing with reality. Sometimes, the stupidity of people on here is mind-boggling.

n6mac417172• 12 years ago

I installed it on my iPhone. I'm able to discover and call friends that have RedPhone, but they can't see me. Is that a feature or a bug :P

clojsure2• 12 years ago

Hey. Could you please file a bug report at https://github.com/WhisperSystems/Signal-iOS/issues ? We'll try to work with you to fix the the issue. Thanks!

girvo• 12 years ago

Ahhhh I'm so excited for this, but it's not in the Australian store and I can't change it to US as I have an iTunes Match sub :( Any ETA on when it'll be here?

_uy6i• 12 years ago

Who is Riddle Quiet Ventures, LLC? They appear to be the "seller in the App Store"

snitko• 12 years ago

Distributing secure text/voice/video calls app through an app store of any kind is by definition not secure. Give me an .apk

__david__• 12 years ago

This seems really neat. I tried it on an iOS 8 device and it hung on the verification screen. Is anyone else seeing that?

scottlocklin• 12 years ago

"What could possibly go wrong?" I mean, besides the fact that it runs on iphones.

motyar• 12 years ago

Teligram should add this feature.

zz12• 12 years ago

Telegram should get their crypto straight, publish their server-side code and federate to OpenWhisperSystems federation.

dan_bk• 12 years ago

How can you trust a product promising privacy when it runs on a closed-source platform (that is further also known to collect data on the user and to be prone to government surveillance)?

Real privacy is only possible on platforms that are 100% open-source.

lazyjones4• 12 years ago

Nice try, but pointless and snake oil, since the iPhone is not a secure device.

Try building a secure device that users "own" first, then spend effort on building secure services on top.

nodata2• 12 years ago

Nice idea, but in the real world you need to create a service that people "use" first, then spend effort on building a secure device.

lazyjones4• 12 years ago

Noone's ever going to build a secure device if people are fed such snake oil and given the impression that they have "some" or "enough" security if they use it.

andor2• 12 years ago

Software like this is about making mass surveillance more expensive. If you have a backdoor or a remote exploit for a phone, you might still be able to wiretap somebody, but at least all data on the network is encrypted.

lazyjones4• 12 years ago

Apparently I'm fighting windmills here, but encryption does not work on compromised devices. It will be sabotaged and rendered ineffective. Google for DROPOUTJEEP, what makes you think you can keep the encryption code safe from manipulation?

tempodox• 12 years ago

Could theoretically be nice, if it would actually work.

borando• 12 years ago

It's refreshing to see the rebrand (RedPhone -> Signal) links security with functionality, rather than with something dramatic/hide-worthy.

When your tools are secure, they work for you and not the other way around.

Free, Worldwide, Encrypted Phone Calls for iPhone

Related Stories