Hacker News Reader

Comment by g_sch | Hacker News Reader

Some version of this post seems to circulate every few months or so. This one is more direct in its accusations of Moxie acting in bad faith. I think this is disingenuous. Moxie has been very clear[0] about the tradeoffs that Signal has made and the reasons for them. It's fine to be dissatisfied with those choices. It's another thing entirely to accuse Moxie of dissimulating.

Personally, I'd like to see Signal replace WhatsApp. That's why I support the path Signal took, and why I also have a distaste for the author's snarky dismissals of features like GIF search.

[0] https://signal.org/blog/the-ecosystem-is-moving/

View on HN

But in the linked post he does not explain, why he does not maintain a F-Droid repository for people who do not trust google, nor why the original Signal Client does not connect to Signal Forks, even if they use everything the same. Security reasons? Ordinary smartphones are full of rootkits anyways, so someone using a forked Signal version probably is better of anyway, as he knows a bit more what he is doing.

So the base argument holds in my opinion: Moxies main focus is Moxie in control. And not making Signal the best and securely possible.

So I also use Signal, but as soon as Matrix gets stable, I am gone

> Moxie forbids you from distributing branded builds of the Signal app ...

Having multiple branded builds to choose from would be a terrible thing and would easily allow fake apps to gain traction.

> ... and if you rebrand he forbids you from using the official Open Whisper servers.

This seems pretty fair to me. Not only could you abuse their resources, it would greatly hinder their ability to make changes and respond to protocol-level security threats. They aren't in the API business, controlling their ecosystem allows them to make forward progress without concern for 3rd parties that they have no control over. And still there is the issue of 3rd parties abusing their server resources.

The F-Droid argument is the strongest and most evident among all. I don't trust Google, I don't trust Play.

The main point is, Moxie could take the wind out of the sails of literally all arguments in this page by publishing Signal on F-Droid but he just won't.

This alone is enough for me to lose trust in Signal.

They've already made the APK available directly on their website for over a year now.[0][1] It works just fine (albeit a little heavy on battery usage) without the Google Play Store or Google Play Services. What more do you really want?

[0]https://signal.org/android/apk/ [1]https://whispersystems.discoursehosting.net/t/how-to-get-sig...

>What more do you really want?

For it to be on F-Droid. I think that much was clear.

You can get Signal from the developers, Play Store or Apple App Store. No where else is genuine, all possibly backdoored. Why dilute that message for the 0.01% of users who would use F-Droid?

The article is clear: download from the Signal site is not secure.

Based upon what? The download is served via HTTPS, and offers a checksum also secured via HTTPS. Are we entertaining security models in which PKC is considered "not secure"?

Or are we just going by the author's ignorant or disingenuous (depending on how you interpret his words) statements?

Checksummed but not signed.

SSL provides integrity guarantees.

Only a bit of transport level integrity. But it doesn't make your average hosting provider into a high assurance one or its servers, OSes, software stacks, etc. Quite known problem since the cryptocurrency era.

Which is maybe why Moxie is encouraging people to rely on Google Play Store.

If you are so concerned about state-level actors that play store is untenable to you, signal and android on commodity hardware are probably not the solutions you want anyways.

And f-droid somehow is immune to this?

Maybe Moxie doesnt see it as his problem to address concerns of non-contributing critics.

Are there any identified, non-state-level actor threats here, or is this just an ideological rant against proprietary software? If state-level actors are your concern, using android means you have already lost.

It seems pretty odd to me to distrust someone because they aren't using the platform that you'd like them to use. Aren't there other issues with f-droid? You have to root your device to run it, allow third party code. Those are all security concerns too.

It was posted elsewhere but here's Moxie's take: https://github.com/signalapp/Signal-Android/issues/127#issue...

You don't need root to run F-Droid, just enable 'Untrusted Applications' in Settings, which I think is what you meant by third party code. The core reason I prefer F-Droid is that apps on it are not bundled with Play Store APIs and thus you can run on Android devices that don't have GApps installed.

> You have to root your device to run it

wtf. I have been using F-Droid for many years, and this has not been the case. as far as I know, this has never been the case, as Android has always had functions for third party app stores. in fact, even today, F-Droid recommends not using root for installs, since then you don't get the screen showing permissions.

> allow third party code

that's called running apps.

tl;dr nice FUD.

'allow third party code' means code which is not signed. Once you tick that any unsigned code can run, not only the app you downloaded. Makes exploitation significantly easier. It would be better if Android forced you to explicitly select which code could run, but too hard for most users.

Then you "untick" it until the next time you need to install something.

This is what I do on lineageOS. I don't regularly install new apps.

Side rant: This marketer-driven "install an app for everything" is a threat to the open internet and privacy. Usually the only reason is to extract more personal info.

Already, young people barely use a web browser. That appears to be the future. Now get off my lawn or I'll start talking about the war.

You might do it, but thousands wouldn't.

Android could undoubtedly be stronger in this regard, and in permission control, firewall, ad blocking etc, but it's not going to happen.

Apps wouldn't be so bad if they were actually sandboxed properly, but yeah, they suck.

I was interested in Copperhead OS as an alternative, but it seems to have fallen into a greed induced mess.

You just shot your own argument against his point in the foot. Thousands of people doesn't even make up a percentage point of the users of Android. Most people on Android use Google Play because it's sufficient against the threats that they need to it be sufficient against. Most people are okay with the risk/reward ratios that come with using commercial software because they then don't have to think about it. Signal provides a nearly turnkey level of protection above and beyond standard messaging in an easy enough format for most people to use.

IDK what you're going on about. What is your argument?

I am arguing Play store is fine, and side loading is bad policy.

I argued that for every person who will take the time to micromanage permissions, thousands wouldn't.

So what are you talking about?

We're about to see what happens with APK side loading at scale... Fortnite is bypassing Play store. I predict massive pwnage.

https://twitter.com/APKMirror/status/1027580291374702592?s=1...

Android explicitly forbids running unsigned APKs, it is not possible to do.

> that's called running apps.

And you accuse me of making things up? "Allow third party code" is not called "running apps"

> You have to root your device to run it, allow third party code.

Most likely one of those, yes. Though on Android 8+ you can only give that allow-install from unknown soures permission to F-Droid.

Also both Copperhead and Fairphone Open ship with the F-Droid priviledged extension by default allowing you to kee that setting entirely disabled.

> It seems pretty odd to me to distrust someone because they ...

... are using a platform "you" don't trust.

Really? That's not really odd.

At least, it's not odd, if that usage and what it entails is the denominating part of the persona in this question.

Whats odd is calling a application "not secure" because it uses the platform's software distribution channel.

Here's a thought. If you are so concerned about the NSA that you think Google's cloud is a problem, why are you running the OS developed by Google?

The open-source base OS is fine, the closed-source services layer and cloud platform are not.

Sounds like you're confident you (or the FOSS community collective) can spot cleverly hidden backdoors.

I'm not, and I find that position naieve. For the overwhelming majority of people who are not a cross between Bruce Schneier and Linus Torvalds, a threat model that tries to protect against the NSA and GRU and MSS pretty much requires avoiding anything with a network connection. If you have a smartphone, you should probably just use its default application store.

The application uses google play, which almost every other android application in the world uses by default. And somehow that makes them untrustworthy?

This seems more like "I disagree with Moxie," not "I don't trust Moxie," unless there's some allegation that Moxie is in cahoots with Google.

I can trust people that I think made incorrect technical decisions, because I can see that they made a decision for technical reasons and have different priorities and reasoned soundly.

What I don't understand is why he's not doing that in spite of the fact that he could still keep control over Signal easily. One minor modification of the app and a forced upgrade would do the trick and render the F-Droid copies useless. The competition has been forcing users to upgrade in this way for a couple of years now. So I don't understand what he's afraid of.

Nah, people will just accuse him of publishing different binaries, or find something else to be upset about. You can't win against concern trolling by giving in to their demands. They just manufacture new demands, and all you do is waste your own resources. Haters are gonna hate, so you're better off ignoring them and focussing on your own vision.

Are you going to pay for him to do that?

The Signal Foundation has 50 million dollars.

And who is paying for Signal to be on Google Play?

google, facebook, whats app, microsoft. Basically the companies that pay for signal end to end encryption in their chat apps.

There are, I'm sure, apps that are better, and that's never been moxie's goal. He's said it over and over that he'd rather have encryption for the masses than the perfect messaging app. It seems disingenuous to assume that he's acting in bad faith when he's clearly doing exactly what he said he wanted to do.

If you want to make the prefect, self-hosted, chat eco system, fire up that matrix server and invite your non tech friends to join. I'm sure that will work out incredibly well.

In the mean time, Moxie seems to realize that to accomplish his goal and make communication incrementally more secure for average users, he needs to go where the users are.

It's crazy to me that people still think that secure communication is a technical problem. We've had GPG for the competent for a long time. The hard problems in secure communication are about using the eco systems that are available to large groups of average users and still being secure.

Pushing an app out to F-Droid is trivial. There is literally no defense for only using Google Play and unsigned binaries on his own website.

I believe that to use the same app, he requires google play? Am i missing something? You can export the app yourself from google play and it doesn't run unless you have google play installed.

Am I missing something?

Does "the same app" refer to Signal? If so, you an run it without having Google Play installed (though it will be more battery-hungry), and download the APK yourself.

Build the code yourself

Google Play is the default.

> Are you going to pay for him to do that?

I donated some money to them a while back. How hard could it be to push the binaries out to a second app store?

I published an app on F-Droid once: it is a very light-weight process. One gives them access to the open source repo where the code is with build instructions and they then take care of pulling updates and publishing new versions.

That process can be more complicated than it seems.

I tried to publish my open-source game on F-Droid, but the build process involves building native components with a specific third-party version of the NDK toolchain, as well as shell scripts to move files around, so it never made it to the store.

"Having multiple branded builds to choose from would be a terrible thing and would easily allow fake apps to gain traction"

In this particular case, not likely. People who are into more secure communication do not randomly click on anything. They know what they are doing, or get it installed from people they trust. And if they don't - their fault. Not Signals.

And Signal can continue to work and introduce breaking changes whenever they want. They simply only support the official build of Signal. Any person using anything different, cannot complain, if things stop working. (they will anyway, sure)

And the ressouce-abuse. Can this really be a thing? I don't know in detail how the protocol works, but what can I do with the servers, I can't do with Signal anyway? Sending (encrypted) data from A to B. I can allready abuse that today, if I want.

> People who are into more secure communication do not randomly click on anything

I think you overestimate people. I told my wife to install Signal because she needed a password for something and it was way to complicated for her to remember. I know what the signal app is and could likely avoid fakes - she would not. I think it is often the case that only one party of the conversation is security minded, while the others just trust that person.

> And the ressouce-abuse. Can this really be a thing?

You know NTP, the protocol for sharing what time it is? That gets abused badly [1]. If you have an open service, there are ways it can be abused. This would without a doubt lead to DDoS-like resource abuse where lazy clients don't cache things properly and just hog server resources. There are ways to limit things like that- but they aren't always simple. Also, like I said before, Signal isn't in the API business.

[1] https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse

People who do click on the wrong "Signal" probably clicked on many other wrong things, too. Their Security is not existent anyway, even if they accidently use the official Signal build.

So because a user clicked on a wrong thing we should completely abandon them and ignore all their security and privacy needs?

Nope, but we should not limit the freedom of other users, who know what they are doing, because of some, who do not.

I heavily disagree. If we want to protect as much people as possible we will have to limit the freedom of some users to do as they want because other users will accidentally or intentionally abuse the freedoms given.

Not limiting freedom of the user because they know what they are doing at the expense of others is maximizing the protection and freedom of a small group, not society as a whole.

> People who are into more secure communication do not randomly click on anything

Even if that wasn't wrong, it would be a fatal limitation for a social app which relies on network effects. Even if you were actually super-humanly capable of not making mistakes you'd end up using the apps that everyone else you know is actually on.

" People who are into more secure communication do not randomly click on anything."

That's not the sole market of people who would try Signal, though.

He has previously explained his reasoning: https://github.com/signalapp/Signal-Android/issues/127#issue...

"why he does not maintain a F-Droid repository for people who do not trust google"

Are you paying him to do that? No? Well, there you go. It's more work, for what appears to be very little benefit.

As another person said:

> The Signal Foundation has 50 million dollars.

None of it came from the phone sysadmins. Rather, it came from a benefactor that wanted to work with Moxie and Trevor.

Doesn't matter. F-Droid is more work to support.

I would pay a share, and I'm sure others would too. Unless he has set a price and there were no takers, that argument is fallacious.

I am not willing to support Signal if they are unwilling to federate the system.

Sure, it doesn't allow them the flexibility they'd like to have to move forward but in a way it won't be their fault if federated servers aren't keeping themselves up to date when there's a major protocol change and they get temporarily splitted from the pool.

It doesn’t matter whose “fault” it is — the issue is the practical effect that will result. This is exactly his point with the SMTP and GitHub analogy from the “moving ecosystems” post. Why do you think the split would be “temporary”?

As long as “email” is a thing, as in “just send me an email”, and it’s a federated set of randomly updated servers, “email” will never have end-to-end encryption, because the first version of SMTP didn’t have it, and the user will still expect to send messages to a server running that version.

Similarly, if “Signal” is going to be a thing, as in “contact me on Signal”, the entire network effectively has to operate at the level of the least up-to-date server — otherwise it’s not one network, and the product is therefore unreliable. But there’s no way to enforce that all the federated servers update themselves in any amount of time.

Also, it's not like Moxie hasn't discussed this. At length. GP deliberately ignores Moxie's reasoned responses to exactly this issue.

Try to look at it from a user perspective, though. It's not a question of whose fault it is when something doesn't work, it simply doesn't work.

Signal is successful in large part because it provides complex functionality (secure messaging) in a package that "just works". Federation complicates that significantly.

Your „in a way“ is totally opposed to what normal users see. They will blame OWS when their Signal client that hasn‘t been updated in two years won‘t work.

Completely agree, I have had several people move from various chat apps and texting to Signal largely because of the iMessage like features. Ultimately, I am now able to have more secure discussions with largely non-technical users which is good for everyone.

It’s not surprising. The people most interested in encryption want to trust nobody. That’s the goal of strong encryption, but as Ken Thompson says it’s not possible. Between the US Government and Moxie I’d trust Moxie but I’d rather trust neither.

Agreed, though personally I find any support of animated gifs in the year 2010 and beyond to be counterproductive.

How much non-geek non-privacy-activist socialising have you done via Signal?

Without emoji and animated gifs, I suspect 70% of my Signal contacts wouldn't use it at all. It's hard enough to convince some of my friends to use it at all, "Can't I just Facebook message you?"

For me, amongst my group of friends - it seems Moxy is making all the right security/usability tradeoffs.

If you don't trust PlayStore, it seems not much of a jump to say you also shouldn't trust Android.

If you're _rightly_ that concerned (and I'll note that Snowden recommends Signal, so I wonder what it is you're up to that makes you more of a nation-state target than him), I don't have a clue what your options are - I suspect they start with "don't use the internet at all"...

>I wonder what it is you're up to that makes you more of a nation-state target than him

I don't know what it is you're talking about. The entire point of my comment was that I don't like animated gifs. They're distracting, bandwidth intensive, and could be easily replaced by a dozen better image formats.

Sorry - I hadn't intended to aim that accusation at you specifically, but at people who are "more of a nation-state target" than Snowden. Poor sentence construction on my part there...

And while I agree with you about animated gifs, I understand WhisperSystems reluctance to try and become the force that turns non-geek non-privacy-activist users (which they and I are hoping will widely adopt Signal) to find WebP or flif or whatever alternatives to giphy or where ever else they're finding their reaction gifs and topical memes and funny cat-riding-a-roomba animations from. That's how a _huge_ percentage of users want to communicate with each other. Moxy is trying to give them a secure way to communicate how they want to, not attempting to force them into new ways of communicating that have boring justifications like "bandwidth saving" or "animation format technical merit" as the only reasons why they can't have vast libraries of funny animations to send their friends... If they can't quickly reply with Ru Paul doing fingersnaps in Signal, they'll go do it on Facebook instead.

For that reason, I'm of the opinion that _not_ supporting animated gifs is significantly more counterproductive, if you're trying to become "the secure messaging mechanism the whole world will use" or if (like me) you'd like more and more personal communication to be exclusively between the participants, and not include advertising networks and data miners and sentiment analysers (and, yeah, law enforcement and government bureaucracy)...

> I'd like to see Signal replace WhatsApp

And one day we realise it was indeed something nefarious, let's assume something of this sort happened in the future, and then we rue that we didn't act when people used to say something was amiss.

There is one line in the article that says it well:

> Truly secure systems don’t require trust.

edit:

I have supported Matrix and Firefox among others (both in code as an Android dev and with modest donations - stopped using Firefox after Pocket). But no, not Signal. I'd wait for federation (if at all).

I would agree with you if only Signal would not ask for so many permissions on my phone.

Can you elaborate? I just set it up on a new phone yesterday and all it asked for on mine was; contacts (makes sense) files (to send pictures, files, etc) receive and send texts (if you want it as your default texting app/validating phone number via sms) Access to camera and microphone (for calls and in app photography)

These all seem like reasonable permissions for the features available.

Is sharing your contacts mandatory in Signal? I don't use WhatsApp because I can't without sharing them.

No. That’s the primary reason I use Signal rather than WhatsApp. With Signal, you just need to give it the contacts that you want to chat with vua Signal.

no, it isn't.

It would be great if it asked for those permissions when it needed to do something - for example ask for mic permission at the point you want to make your first voice call. I see some apps going that direction and it's refreshing.

edit: Apparently, Signal does this for some things? See comment-replies.

On Android that's version dependant.

Older Android versions only had the idea of the app declaring "I need to be able to use your Camera, read your Contacts, and make $$$ phone calls" and then you pick "No" and don't get the app or you pick "OK". This more or less railroads users into pressing "OK", except for the most security conscious, who go without the app.

A few releases back Google had an unofficial feature that let you switch off features an app had, and it would get some dummy replacement, e.g. if it had Contacts access but you switched that off, it would see no Contacts at all. If it had Camera access, but that was switched off, it would always be told your Camera was busy in another app. Once word about this hidden feature got out, Google disabled it.

Recent releases (Certainly on my Nexus 5X for example which is a while back) enable an app to ask at runtime. If you said "No" the app gets a second chance to explain itself, and then if you keep saying "No" the feature is just disabled and Android stops prompting you. The app might not work after that of course. Like the disabled older feature, the Settings pages for apps let you undo previous authorizations, again this may make certain apps malfunction - a map app with no GPS is merely crippled, but a "barcode scanner" with no Camera access is junk.

However of course apps for an older phone don't prompt, the older Android can't handle it, so for them you still have to make the decision at install time.

The permissions system that android apps use is entirely dependent on which API version you target. Last I understood, if you made a new app today and purposely chose to target an old API version, you could force it to use the "all or nothing", user hostile permissions query you described

I believe Google is asking developers to support a recent API version to push updates to the Play Store.

Yeah - as of 1 Aug new apps or 1 Nov for updated apps - you need to "target" API level 26 (Android 8), but you can still set your minSdkVersion to whatever you like (we're still publishing version 16/Android 4.4 updated).

https://developer.android.com/distribute/best-practices/deve...

@mrguyorama - this means you can force the old landgrab user-hostile permissions to people running old Android versions, but you cannot force them onto users running Android 8.

It does. Signal supports runtime permissions[1] and it requests them dynamically while you are using the app (e.g. the camera permission prompt appears the first time you try to take a picture).

1: https://developer.android.com/training/permissions/requestin...

Last time I had it installed it scanned my contacts a half dozen times while I slept. I removed it in the AM.

The Contacts permission is completely optional, and contact information is never stored: https://signal.org/blog/private-contact-discovery/

This seems like smoke and mirrors to me:

  Traditionally, in Signal that process has looked like:
  
    The client calculates the truncated SHA256 hash of each phone number in the device’s address book.
    The client transmits those truncated hashes to the service.
    The service does a lookup from a set of hashed registered users.
    The service returns the intersection of registered users.

The phone number space is really not this big.

They acknowledge that in literally the next paragraph, and the entire post is about how they improved on that old state of things. How is that "smoke and mirrors"?

Right, my bad. This does look like a sensible solution

Is this solution deployed in production? The source code says "beta".

To be fair it does that to map you with the contacts who also are on Signal just like WhatsApp or Telegram does. Though you could also use Telegram just with user_names w/o phonebook permission but for signing up you need to use your actual phone number.

Reply on news.ycombinator.com