Hacker News Reader

Comment by binaryapparatus | Hacker News Reader

It seems that if you really want proper secure channel you need to write one yourself. Anything out there is subject to being compromised.

Is there open source alternative for Signal?

View on HN

Matrix is decentralized, proper open source, modern, has audited end-to-end encryption and all that. Be aware that if you install the Riot app from the Play Store, it uses GCM (which means that client is technically vulnerable to the same attack as described in the article), but if you install it from F-Droid it does not.

One strength of Matrix over Signal is indeed that you are free to choose or develop your own client to use with it. You can also host your own server for the decentralized Matrix network, but that point is kind of orthogonal and not related to this specific issue.

You don't have to look far. The actual Signal client source is licensed under GPLv3.

Edit: And server code under AGPLv3.

well LibreSignal was shut down because Moxie didn't like them using WhisperSystem's servers. I guess the libre community could figure out how to setup and fund an alternative server, but since Signal's server code isn't federated, then I don't believe there would be a straightforward way to send messages between the two systems.

https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

Obviously they can run an alternative server, and if their version is sufficiently more attractive people will switch their client.

They could 'solve' all these usability problems, fix the use of google interfaces the tin foil hat brigade detest, and deploy it on a non-existent non-proprietary secure phone platform. Oh and make it federated but keep it immune from spam. Yeah, seems like that is a bit hard.

Moxie and Whisper Systems is clearly against decentralization and federation, based on that blog post they wrote. This means it's unlikely that Signal is ever going to have any support for federation.

> This means it's unlikely that Signal is ever going to have any support for federation.

Signal had support for federation. Their server was federated with Cyanogen's for a while[0]. That being the disaster it was is why that blog post happened and no one seems to be forthcoming with solutions to the problems they had.

[0] https://whispersystems.org/blog/cyanogen-integration/

> but since Signal's server code isn't federated

The Signal server code has supported federation since the first commit in the git history. Whisper Systems' instance of the server doesn't federate with any other server anymore but there is nothing stopping the LibreSignal crowd from standing up their own network of federation-enabled servers.

also on F-Droid you can find "Silence" which is a fork of "Signal" but only for SMS texts.

True, but you still need to be aware of who your potential adversary is. If it is someone with access to SMS network texts logs, these encrypted texts will light up like a Christmas tree for someone looking for something unusual.

The threat model is that google and cell phone networks are untrusted adversaries. So your same concern can be said about Signal messages going through Google servers under the surveillance of the NSA. Either way the adversary sees a bunch of suspicious encrypted messages, but can't read them. But if the user has proprietary google code installed on their phone (i.e. Google Play Services), then the backdoor which this blog is warning about is the fact that now your phone software is/could be potentially compromised.

It depends on who you are hiding from. In some freer countries, encrypted texts at most get you flagged on some kind of list. In others you may get enhanced interrogation.

from the article: XMPP

Or use Signal on iOS? (This is a genuine question)

This would arguably be more secure. Depends who you trust least I guess, Apple or Google + OEMs. I think Apple has a lot to lose if they were to produce a backdoored firmware. Some android handset contract manufacturer or OEM? Not so much.

Reply on news.ycombinator.com