Hacker News Reader

Comment by autoexec | Hacker News Reader

I dumped signal less over the data collection they've started doing and more for the fact that they've been less than transparent about it. Nearly a year ago their forums were filled with objections, security concerns, and questions and for months they went ignored. When they finally made setting a pin optional they were equally unclear that it would just set a random one for you and that this didn't prevent your data from being uploaded to the cloud.

I took it as a sign that they were telling us not to trust them as clearly as they were allowed. For secure communications I'm using Jami now and I've been very impressed. For SMS/MMS in general I'm still looking. I've tried a few alternatives and frankly I'm not really happy with any of them.

View on HN

They’re trying to unwind Signal from phone numbers. Also who uses SMS anymore?:)

The phone number is not even the worst part really. Signal's privacy policy says they don't collect and store sensitive info, but how is a list of everyone you've been in contact with not sensitive?

Sadly I've had very little luck getting my family to move to Signal and less luck getting them to use Jami. The bulk of my communications are unsecured SMS/MMS. It's such a basic function that I'm surprised open source solutions aren't better. Whatever they've become Signal had a pretty great interface.

it’s hard for me to read something like this and believe you aren’t being deliberately misleading. All this stuff is only stored in an encrypted form that signal never has the keys for.

The fact that's encrypted doesn't matter. There are a number of potential issues with collecting it in the first place. You can see some of the security concerns which were brought up on their forums here: https://community.signalusers.org/t/proper-secure-value-secu...

As far as I know, they encrypt the data in sgx enclaves which are notoriously leaky.

They've been trying since 2014. Somehow it never seems to happen.

That's because (secure) messaging using phone numbers as identifiers is literally the core feature of the product. Signal was marketed from day one as a drop in SMS replacement. Initially it even used SMS as the transport for encrypted messages. It was even originally called "TextSecure". This is why I have always found the attacks on it using phone numbers to be amusing.

Reply on news.ycombinator.com