Seems like his problem is more with Google than Signal. There's not a single thing about Signal itself being bad in that article. Clickbait headline, imo.
Seems like his problem is more with Google than Signal. There's not a single thing about Signal itself being bad in that article.
What I get from his article it seems that his problem is a mix between Google and Moxie because of the steps that Moxie has chosen in order to "get to the masses".
What I get from his article it seems that his problem is a mix between Google and Moxie because of the steps that Moxie has chosen in order to "get to the masses".
It's not a trade off though, putting the app on F-Droid in no way affects people downloading it from Google Play. Edit: I should also add, for an app that’s already open-source and doesn’t depend...
It's not a trade off though, putting the app on F-Droid in no way affects people downloading it from Google Play.
Edit: I should also add, for an app that’s already open-source and doesn’t depend on Google Play Services like Signal, it’s not that difficult to package for and get into F-Droid.
Signal should definitely be on F-droid, but that doesn't solve every possible problem. We still don't have OpenWhisper's server software, can't confirm what metadata it logs or doesn't log, have...
Signal should definitely be on F-droid, but that doesn't solve every possible problem. We still don't have OpenWhisper's server software, can't confirm what metadata it logs or doesn't log, have no insight into what national security letters they have or haven't received, and as a centralized network, can't prevent Signal from denying service to specific users or countries. The article's argument is, in the absence of any valid good-faith reasons for making the decisions OpenWhisper has made, one has to assume bad faith.
Federated protocols don't have these problems. Several other applications use Signal's same end-to-end encryption scheme, why not use one of them?
Sure, and that's why I prefer Matrix/Riot.im over anything else. Isn't that a bit beside the point though? If someone wants to use Signal, an app that claims to be very secure, why not put the...
Sure, and that's why I prefer Matrix/Riot.im over anything else.
Isn't that a bit beside the point though? If someone wants to use Signal, an app that claims to be very secure, why not put the client on F-Droid? Sure you can't necessarily trust the server software, but if someone is going to use it anyways, you may as well increase the trust a bit with open, reproducible builds.
I mean if I were talking to the author of this article I would probably bring up Intel Management Engine and AMD Platform Security Processor. Both are black boxes running at high privilege levels...
we're not to the point like in desktops where we have enough control over them to ensure security.
I mean if I were talking to the author of this article I would probably bring up Intel Management Engine and AMD Platform Security Processor. Both are black boxes running at high privilege levels in any modern (x86) computer system.
Even with the best security out there, if I was a political dissident or otherwise had something big to hide, I really would not want to put it on any kind of computer.
I think that in this age, getting secure privacy focused apps and software to the masses is important in itself and that it makes up for not doing it the absolutely most secure way possible. Not a...
I think that in this age, getting secure privacy focused apps and software to the masses is important in itself and that it makes up for not doing it the absolutely most secure way possible. Not a lot of people care and a lot of people believe it's too much work to address these problems themselves - So showing the masses that it doesn't have to be complicated is a good thing by itself, even if it, as of today means using the most popular (albeit suboptimal) channel of distribution.
It's mostly complaints about Google, but eventually there is a good point: This echoes the problem of encrypted email. Things like Proton Mail are great, but require you to be in the network for...
It's mostly complaints about Google, but eventually there is a good point:
Truly secure systems do not require you to trust the service provider. This is the point of end-to-end encryption. But we have to trust that Moxie is running the server software he says he is. We have to trust that he isn’t writing down a list of people we’ve talked to, when, and how often. We have to trust not only that Moxie is trustworthy, but given that Open Whisper Systems is based in San Francisco we have to trust that he hasn’t received a national security letter, too (by the way, Signal doesn’t have a warrant canary). Moxie can tell us he doesn’t store these things, but he could. Truly secure systems don’t require trust.
There are a couple of ways to solve this problem, which can be used in tandem. We can stop Signal from knowing when we’re talking to each other by using peer-to-peer chats. This has some significant drawbacks, namely that both users have to be online at the same time for their messages to be delivered to each other. You can still fall back to peer-to-server-to-peer when one peer is offline, however. But this isn’t the most important of the two solutions.
The most important change is federation. Federated services are like email, in that Alice can send an email from gmail.com to Bob’s yahoo.com address. I should be able to stand up a Signal server, on my own hardware where I am in control of the logs, and communicate freely with other Signal servers, including Open Whisper’s servers. This distributes the security risks across hundreds of operators in many countries with various data extradition laws. This turns what would today be easy for the United States government to break and makes it much, much more difficult. Federation would also open the possibility for bridging the gap with several other open source secure chat platforms to all talk on the same federated network - which would spurn competition and be a great move for users of all chat platforms.
This echoes the problem of encrypted email. Things like Proton Mail are great, but require you to be in the network for full functionality. Yes, you can send someone outside of Proton Mail an encrypted message, but it's really just an email link to a webpage. If Proton Mail goes down due to an attack, the users are out of luck.
Personally, I'm getting sick of all the non-interoperabile messaging applications out there. I have Signal, WhatsApp, and standard texting on my phone. I refuse to install Facebook or Facebook Messenger on my phone. Some people only use one and not the any others. And yes, there's an xkcd about that: https://xkcd.com/1810/
Messaging is so broken, it's awful. I remember when it was ICQ or AIM or IRC and nothing else, and that was bad enough - but these days I have almost as many chat apps as I have friends to chat...
Messaging is so broken, it's awful. I remember when it was ICQ or AIM or IRC and nothing else, and that was bad enough - but these days I have almost as many chat apps as I have friends to chat with. But it's OK, RCS will fix everything.
matrix is federated. you can host your own instance on your own domain and still chat with people from other domains. it also supports many different types of bridging
matrix is federated. you can host your own instance on your own domain and still chat with people from other domains. it also supports many different types of bridging
Seems like his problem is more with Google than Signal. There's not a single thing about Signal itself being bad in that article.
Clickbait headline, imo.
What I get from his article it seems that his problem is a mix between Google and Moxie because of the steps that Moxie has chosen in order to "get to the masses".
It's not a trade off though, putting the app on F-Droid in no way affects people downloading it from Google Play.
Edit: I should also add, for an app that’s already open-source and doesn’t depend on Google Play Services like Signal, it’s not that difficult to package for and get into F-Droid.
Signal should definitely be on F-droid, but that doesn't solve every possible problem. We still don't have OpenWhisper's server software, can't confirm what metadata it logs or doesn't log, have no insight into what national security letters they have or haven't received, and as a centralized network, can't prevent Signal from denying service to specific users or countries. The article's argument is, in the absence of any valid good-faith reasons for making the decisions OpenWhisper has made, one has to assume bad faith.
Federated protocols don't have these problems. Several other applications use Signal's same end-to-end encryption scheme, why not use one of them?
Sure, and that's why I prefer Matrix/Riot.im over anything else.
Isn't that a bit beside the point though? If someone wants to use Signal, an app that claims to be very secure, why not put the client on F-Droid? Sure you can't necessarily trust the server software, but if someone is going to use it anyways, you may as well increase the trust a bit with open, reproducible builds.
Isn't this their server software: https://github.com/signalapp/Signal-Server ?
I mean if I were talking to the author of this article I would probably bring up Intel Management Engine and AMD Platform Security Processor. Both are black boxes running at high privilege levels in any modern (x86) computer system.
Even with the best security out there, if I was a political dissident or otherwise had something big to hide, I really would not want to put it on any kind of computer.
I think that in this age, getting secure privacy focused apps and software to the masses is important in itself and that it makes up for not doing it the absolutely most secure way possible. Not a lot of people care and a lot of people believe it's too much work to address these problems themselves - So showing the masses that it doesn't have to be complicated is a good thing by itself, even if it, as of today means using the most popular (albeit suboptimal) channel of distribution.
It's mostly complaints about Google, but eventually there is a good point:
This echoes the problem of encrypted email. Things like Proton Mail are great, but require you to be in the network for full functionality. Yes, you can send someone outside of Proton Mail an encrypted message, but it's really just an email link to a webpage. If Proton Mail goes down due to an attack, the users are out of luck.
Personally, I'm getting sick of all the non-interoperabile messaging applications out there. I have Signal, WhatsApp, and standard texting on my phone. I refuse to install Facebook or Facebook Messenger on my phone. Some people only use one and not the any others. And yes, there's an xkcd about that: https://xkcd.com/1810/
Messaging is so broken, it's awful. I remember when it was ICQ or AIM or IRC and nothing else, and that was bad enough - but these days I have almost as many chat apps as I have friends to chat with. But it's OK, RCS will fix everything.
Between Signal and FB Messenger or WhatsApp, I choose Signal anytime. Matrix isn't an option because it's not mainstream.
What are the benefits of matrix? I use wire but I know it has some vulnerabilities.
matrix is federated. you can host your own instance on your own domain and still chat with people from other domains. it also supports many different types of bridging
I can see where he is coming from, but there's no alternative... So yeah, Signal it is for me.