Hacker News Reader

Comment by filleokus | Hacker News Reader

Maybe I'm overconfident in the security of an up-to-date iOS device with a complex passcode, but I would have just used Signal if I was tasked with running the IT ops of some crime syndicate.

Turn of all cloudy functions, hell maybe use some kind of enterprise MDM to enforce polices on your subordinates.

View on HN

Signal is bound to a phone number, no? I think I would go with OTR via XMPP, or whatever is a modern protocol. Or maybe Matrix is now a good alternative?

I didn’t use OTR since a long time now, so not sure if that’s still a good choice, but it’s quite versatile and easy to setup.

Edit: OTR doesn’t seem to be recommended anymore, OMEMO seems to be the modern alternative https://en.wikipedia.org/wiki/OMEMO

It is, but it's not re-validated once used. You can get a burner phone, sign up, ditch the phone.

There are no such thing as burner phones in many countries any more. You have to show ID to buy a SIM card, and a copy is made and sent on to the authorities.

Also, Signal revalidates the number when restoring from backup. If you don't have the number any more, you can't revalidate and have to start over with a different number.

I bet you 50 euros that I could pay a random homeless person or drug addict to go buy a basic android phone with SIM card and service at retail. The sort of people who are running drug smuggling and middle/end-retail distribution operations have access to lots of such persons.

'smurfing' methodologies are well known.

They can steal a SIM, or buy one from a country where they are available freely.

Belgium is one of these countries.

I'm not going through the hassle of buying a new phone just to create another centralized chat account. I have email (with GPG if you don't mind that,) a jabber account with OMEMO enabled clients, and SMS. Two people have bothered to ask if I want to use signal and everyone just uses SMS.

Are you a member of an organized crime syndicate?

Oh I totally agree, I think the phone-number requirement is absolutely ridiculous. Just pointing out that it's possible.

Isn’t OTR protocol Indeoendent? I remember using it even through Facebook via Pidgin.

OMEMO seems tied to XMPP.

The OMEMO killer feature is that it can deal with clients that are offline. Unfortunately it needs access to cryptographic state stored on a server to do that. So it can't be used in a generic way like OTR. In the case of OMEMO it uses a generic XMPP persistent data feature to store that state. So OMEMO causes a requirement for a particular feature enabled on the server ... which is slightly tacky in the XMPP world.

For the record this feature is a pretty core part of many things in XMPP, and is enabled on 98% of this sample of 670 servers: https://compliance.conversations.im/test/xep0163/

The ones without it are mostly special cases (e.g. gmail.com is on the list, of course).

Reply on news.ycombinator.com