Hacker News Reader

E2E encryption and perfect forward secrecy doesn't matter if the protocol is leaking copious amounts of metadata about who you're talking to and when.

View on HN

That's what OPSEC is for. A bit hard in enemey territory but def less noisy than using w/e else they were currently using.

The Signal server doesn't even know who the sender of a message is, just the recipient.

Even just traffic analysis makes any kind of communication potentially leaky. Encryption matters, but it doesn't protect against everything. Even the lack of communication leaks information.

What data is known exactly? Phone number? IP?

Just the IP, IIRC, but it doesn't know who you are. There are more details on their blog in one of the latest blog posts.

https://signal.org/bigbrother/

You can see exactly what Signal is able to provide to a legal request. Time of last connection related to a phone number

This is one of the coolest exchanges I’ve seen between a company and the government. Class act.

Reply on news.ycombinator.com