Hacker News Reader

Comment by nxzero | Hacker News Reader

How does giving away a known end point make a system more secure?

To me, it's the opposite, and makes Signal less secure.

A big problem with some E2E messaging systems is that your conversations aren't synced across devices. By routing messages through your phone, the way WhatsApp does in their desktop app, you can have the same conversation synced across both devices. (EDIT: additionally a server in between could sync the various client conversations as it seems Signal is doing).

Otherwise you end up with a situation, such as with Telegram secret chats, where encrypted chats are initiated on your phone<>friend, then you switch to your desktop and create a second secret chat channel with the same friend. You could then potentially miss messages that are still going to your phones secret channel - as your friend won't be able to know which secret chat is mobile/desktop or the "right" one to use at that moment. You'd have to close the existing secret chat on your phone when switching machines, which we often forgot to do in practice.

Signal Desktop messages aren't routed through your mobile device, so it's the best of both worlds. Once you've installed Signal Desktop, you can use it when your mobile device is turned off, and vice versa.

(@Moxie) Are there docs on how & why phone numbers are used, and what if any risks/threats/weaknesses are known to exist?

I'd love to see Keybase support for contact management and addressing, perhaps by hooking into OpenKeychain that's already got it integrated (OpenKeychain has an API)

Don't hold your breath - moxie isn't the biggest fan of GPG.

http://www.thoughtcrime.org/blog/gpg-and-me/

You should update your knowlage of keybase. They are more then just a GPG public directory. They try to have multi device end to end encryption capability distributed by a smart system of public key infrastruture. This gives them the basis to have multi client archtecture for messanging and file sharing. It is very cool because it allows you to revoke individual devices and thus also 'solves' the GPG problem of having one 'holy' key.

See:

- https://keybase.io/blog/keybase-new-key-model

- https://saltpack.org/

From the keybase developers: https://saltpack.org/

So does the Desktop client have its own set of keys? Do you encrypt every message for each device registered? Can I somehow revoke a device when I lose my phone/laptop?

Are you considering something like the Keybase Device registry? It would be fantastic if I could somehow add my phone number to keybase and integrate with Keybase. It would be a total hit, Keybase providing filesharing while Signal adds the messenging part, all backed up by a clever PKI that works for the online world.

I saw the desktop client mentioning something about generating keys after scanning the QR code. Afaik it works similarly to group chat[0], but instead of clients with their own keys belonging to different accounts they belong to the same one.

Open Settings > Linked devices and tap an a device to unlink on Android. Seems there's no way to revoke (yet) in the Chrome app.

[0]: https://whispersystems.org/blog/private-groups/

I see. Thats pretty cool. Its better then whatsapp web client.

Ah, I assumed it was similar to WhatsApp. Even better.

The messages are being synced automatically between chrome client <> mobile clients, which is the key feature.

Fantastic work Moxie, thank you. My best to you and the team. Let us know how we can help contribute to the project (code/$/etc).

Not Moxie, but the desktop beta announcement[0] carried a link to a donations and grants page[1] and a link to their Github org[2] for anyone to verify their code and implementation, but not any request for or details about code submissions.

[0]: https://www.whispersystems.org/blog/signal-desktop/

[1]: https://freedom.press/bundle/encryption-tools-journalists

[2]: https://github.com/WhisperSystems

Reply on news.ycombinator.com