Hacker News Reader

Comment by jagermo | Hacker News Reader

A little harsh, isn't it? They have several good arguments for ditching SMS, as explained here: https://whispersystems.org/blog/goodbye-encrypted-sms/

Especially this one:

SMS and MMS are a security disaster. They leak all possible metadata 100% of the time to thousands of cellular carriers worldwide. It's common to think of SMS/MMS as being "offline" or "peer to peer," but the truth is that SMS/MMS messages are still processed by servers--the servers are just controlled by the telcos. We don't want the state-run telcos in Saudi, Iran, Bahrain, Belarus, China, Egypt, Cuba, USA, etc... to have direct access to the metadata of TextSecure users in those countries or anywhere else.

View on HN

Yet, Signal leaks the exact same metadata, if one serves an NSL to OWS.

In a way, Moxie's argument (don't tie things to phone numbers, don't use a centralized system for message transport) is exactly why Signal itself is so problematic.

I do hope you see the differences between those scenarios, though? OWS doesn't have a presence in Egypt. If Egypt tried to serve them with some legal document requiring OWS to provide such metadata, they'd be laughed at.

Telcos, on the other hand, are usually based in the country in which they do business (and often have separate businesses in each country, e.g. Vodafone). As we've seen many times, it's pretty easy to get them to cooperate (voluntarily or by law). Much easier to get all the metadata you need that way.

Whisper systems did get a subpoena: "the only information we can produce in response to a request like this is the date and time a user registered with Signal and the last date of a user's connectivity to the Signal service."

https://whispersystems.org/bigbrother/eastern-virginia-grand...

Retroactively, yes. But the NSA could just require them to log all messages they relay between any two users – and they’d get the same metadata as from TextSecure.

NSLs are not magic [0]. They are a legal tool that can be used to extract certain types of information (such as subscriber information and maybe a little bit of transactional information) that a service provider already has stored on their servers. However, they cannot be used to force a service provider to start collecting data or build a backdoor.

[0] https://www.youtube.com/watch?v=YN_qVqgRlx4&t=20m16s

Sure, of course they cannot. And PRISM has never existed either.

I'm not going to rely on the US government adhering to its own laws when they've shown they won't do exactly that.

Instead, cryptography is supposed to prevent OWS from even being able to implement a backdoor.

Not such a problem if there is no real name attached to the phone

Just because the government doesn't know your name doesn't mean they can't hurt you.

Reply on news.ycombinator.com