Security isn't TRUE/FALSE. Signal is more secure than other products like Telegram. There are a lot of things it could add to increase its security. But it's pretty damn good and that it doesn't do things that would make it better doesn't change the fact that it's damn good.
> All it seems like you're trying to do is distract from these glaring issues.
I take issue with listing "automatic software updates without user consent" as a list item in criticisms about Signal because "automatic software updates without user interaction" are a damn good idea for the threat models that take most computer crime into account. Even the paranoid (I don't use this term lightly) models can be mitigated by a well implemented secure update infrastructure.
What would you rather have?
- Activists being pwned by 1day vulnerabilities
- The patch being applied automatically as soon as it's available
This is a criticism of words you said, not some attempt to distract from "these glaring issues".
WordPress, which powers 26% of websites on the Internet, doesn't even cryptographically sign its updates. If you pwn their update server, you've got a backdoor into millions of websites. The Mirai botnet? Child's play in comparison.
That's a glaring issue.
> If OWS was legitimately interested in security and anonymity, they wouldn't be including proprietary components and shutting down other open source projects that take matters into their own hands.
So says your ideology.
If OWS wasn't legitimately interested in security and anonymity, why would they publish their protocols as open specifications that anyone can use to develop their own protocols and apps?
Go on, take their papers and build an app that doesn't do all the things you disagree with.
Fork their project (It's GPL; you can fork it!), remove all Signal trademarks and branding, and release your own GPL app that doesn't rely on proprietary components. Make your app/protocol federated. If you do these things, there's literally nothing OWS can do to "shut down" your project.
Don't bother worrying about integrating with Signal users or using Signal servers. Do a better job and convince people to use your fork instead.
This comment is a mixture of falsehoods ("sending messages over Google servers") and out-of-bounds attacks on the integrity of HN users ('moxie did not build a "honey pot").
Thankfully: you cannot comment like this on HN. If you want to criticize Signal, you can do that, but you can't do it this way.
To say "OWS shut down this fork" is a rather drastic distortion of the truth. The project was simply not entitled to running on OWS servers, or of re-using the Signal trademark, both of which are perfectly understandable.
And if you look at the repo that you linked, this is called out right at the top of the README:
In the same thread, Marlinspike said that he would be willing to consider "a clean, well written, and well tested" pull request that would add WebSocket support to the Android version of Signal. This would effectively eliminate Signal's dependency on GCM and thus allow the official Signal app to function on custom Android ROMs that do not include Google Play Services. There is now a bounty on making this pull request, and the person/team making the pull request would also receive whatever the BitHub payout would be at the time.
...
To be clear, Signal relying on GCM is only an issue for people who use a custom Android ROM without Google Play Services. For the vast majority of people who do have Google Play on their phone, this issue is completely irrelevant. Signal is designed so that GCM is only used for a wakeup event and never sees any of the encrypted Signal messages.
Moxie has explained this over and over again, and comments like this continue to pretend that he hasn't, while re-raising the falsehood that Google sees Signal messages. This is tendentious trolling, not good-faith conversation and debate. Which is why your last comment was flagged off the site.
You're mischaracterizing my claims. GCM allows Google to extract metadata about who you are messaging and when you are messaging them. They then have the capability to reconstruct your social network graph and select you for further targeting via silent updates if needed.
Assuming you are in fact the other newly created account with the random-looking username above, then you explicitly stated that Signal "forces you to send messages over Google servers".
This is straightforwardly false: the user does not send anything over Google servers in the course of using Signal. Signal sends an empty push notification over GCM to users who have received a message; while technically true, to, in a discussion of a messaging platform, refer to empty push notifications as sending "messages over Google servers" is prone to misinterpretation as false statements that the "messages" going over Google servers contain any information about the messages being sent over the messaging platform.
Additionally, the use of GCM only allows Google to extract metadata about when a user receives messages; GCM messages aren't necessary to notify you when you've sent a message, so I'm not sure how you propose that Google can infer when a user sends a message and who that user is messaging. Could you elaborate on this?
And why do you suppose that they're unable to record the wake events? They don't need metadata from Signal: they can make their own, which is precisely what I've been trying to say this entire time. That's enough for them to reconstruct your social graph.
Signal is seemingly built around providing the image of anonymity and security, but has glaring design flaws which negate these.
I'm sorry, I seem to have given the impression that I doubt your ability to play six-degrees-of-Google-breaking-Signal. I do not doubt that. You've ably demonstrated your ability.
