Comment by nakedrobot2 | Hacker News Reader

Comment by nakedrobot2 | Hacker News Reader

Parent Full thread

I guess I'll be downvoted to hell, but.... This absolutely stinks. Signal is most likely blessed by the NSA. This is a ruse to get people comfortable with using Skype again for confidential conversations. Ever since Microsoft bought Skype and completely gutted it, it's been an open secret that they only did so to fulfill an $8B RFP by the NSA to break Skype's encryption.

https://news.ycombinator.com/item?id=8106721

https://news.ycombinator.com/item?id=4254925

edit: added sources

Your first "source" claims that Signal was funded by a part of the US government that is very much not the NSA - which is well-known and well-publicized. Your second "source" is about Skype, not Signal (and the only meaningful mention of the NSA is a rumor that they're willing to fund third parties who can effectively break the encryption, not that they're willing to fund MS to remove it, anyway).

The most effective thing the NSA could do to weaken Signal is fund people to spread FUD about it on message boards and drive people to inferior solutions. I'm not saying they're doing that, but it would be way more effective than providing funding to an open, peer-reviewed protocol and implementation.

If RFA funding means "blessed by the NSA" it will be hard to find an open source cryptography project that isn't blessed by the NSA, because RFA funds (or funded) audits of everything. Source: ran a security consultancy, was offered (and sometimes accepted) RFA funding to do crypto audits. I don't think you understand the cites you're providing.

You can't make a claim like that and not cite any sources.

You don't think, maybe, Radio Free Asia (funding from the Broadcasting Board of Governors) is providing funding to Signal so Asians (like the Chinese) have a surveillance free communication option? The US government is bigger than the NSA.

Maybe they have an 'understanding' about the implementation of the cryptography as they do with WhatsApp, meaning the program doesn't notify you when your opposite's keys change, leaving unscrupulous users (most) susceptible to MitM attacks, which could be used by law enforcement or three-letter-agencies. Plus, Skype probably still makes extensive use of meta-data, Signal allege that they don't, but we can't really assess what's actually running on their servers, despite the use of the AGPL.

Why would you want to assess what's actually running on their servers? Even if you know the code on it, you have no guarantee it's not running inside a hypervisor that logs the contents of memory, or something.

In terms of cryptographic robustness, it's good for an app like Signal to have a closed-source server, because it forces you to not trust the server.

(This is of course separate from whether it's good for the Signal server to be free software for inherent free-software morality reasons.)

True, but it seems like wishful thinking for Internet users to reasonably assess the dangers of trusting the 'Cloud' with private data.

Still, I think the most important breaches of privacy are not necessarily in decoding the messages themselves, but rather everything from location data to contact lists including time and number of communications these apps have access to by default.

Maybe it’s beside the point, but to be clear, Signal Server source is available here: https://github.com/WhisperSystems/Signal-Server

Signal takes metadata protection very seriously: https://signal.org/bigbrother/

You know what else absolutely stinks? Skype in general. I cannot fathom why something so simple as remembering conversation history is beyond their engineers.

But... Skype does remember conversation history?

Hm, I seem to also have issues with Skype history. I can't find a way in the new UI to go back more than ~6 months of conversation history.

I lost an semi-important document that was shared with me over skype because of that.

> I can't find a way in the new UI to go back more than ~6 months of conversation history.

First, you'll want to make sure Skype is set to keep message history forever: Skype -> Privacy -> Keep history for... -> Forever

Then, you can right-click on a contact -> View Old Messages -> 1 Year, etc.

This is assuming you're using Skype, and not Skype for Business; they are not the same: https://en.wikipedia.org/wiki/Skype_for_Business

Not the version I use for work. If you close the conversation, the history is gone, unless you fancy digging it up in Outlook, which of course you don't, because the way it is stored there is terrible.

There's about 50% chance Outlook failed to store it too. Skype for business is really failing at the basics.

Just a guess, but you may be using Skype for Business, which is a completely different product with just a similarity in name.

Correct:

https://en.wikipedia.org/wiki/Skype_for_Business

Teams is much better than SfB, and I think if your org pays for SfB it also has access to Teams.

That's a setting. Your IT team may have chosen it.

2/4 of the links in your sources don't work.

I don't see any evidence that the OTF is a front for the NSA, or that you think somebody with the capability to make that in a year would sell their soul for $455,000.

The OTF is specifically a (non-secret) front for Radio Free Asia, whose mission is to work in other countries against their NSA equivalents. The best thing the OTF can do is to fund actually honestly secure crypto, because if there's a hidden weakness the NSA can use, there's too much of a risk that one of the countries Radio Free Asia is trying to work against is going to find it.

(Yes, technically, a keyed "backdoor" would work and allow the NSA alone to hold the corresponding private key, but also Signal's client code is public so there isn't really a place to put one of those without anyone noticing.)

whose mission is to work in other countries against their NSA equivalents.

That's not really a sensible way to describe either their officially stated or inferred mission.

Maybe s/against their NSA equivalents/against government oppression/ would be more accurate - partly because that's what their mission actually is, partly because in theory the NSA isn't an agent of government oppression in the US. (But that's what the worry about NSA funding Signal is about.)

Reply on news.ycombinator.com