Hacker News Reader

Comment by jcq3 | Hacker News Reader

Quite convincing... How Signal is perceived from cryptoexperts?

Too positive. From a cryptographical perspective the protocol is solid.

The problem is that if you are actually using signal to transmit sensitive (as in worth a lot of money,peoples lives, state secrets) information you are making a huge mistake.

Sure no one is going to break your communication on the network. But what they are going to do is use a zero day, get into your phone and extract the signal message db and listen in on your mic and keyboard.

Signal has been promoted all over the place but no one mentions this fact, and when someone does it is dismissed.

There are better solutions out there but they cost money.

That is a risk with everything, it is turtles all the way down. There are not 'better solutions' available for the general public out there and anyone who claims otherwise is selling snake oil. What Signal (and similar efforts like Riot/Matrix/etc) offer is the ability to drastically raise the cost of targeting an individual and eliminate almost all risks from bulk dragnet operations. If you, specifically you, are they target of a major government then they are going to get you and there is nothing you can do about it other that to stop using electronic communication, but if you are not already a target then Signal provides a level of security and privacy that had previously been unavailable or difficult to use.

Signal and to a much greater degree WhatsApp is used all over the place where it has no business being. A large number of politicians use these apps for communication all over the world for information that is actually classified.

The reason it is in all these places because it is free, easy to use and supposedly secure. That the information contained can be exfiltrated would be news to them. All they know is that security proffessionals recommend Signal so that is what they use.

Just use Signal has been a mantra in tech circles for a long time. This obvious fact I am bringing up is always obvious yet no one mentions it.

No one mentions it because this 'fact' is both self-evident and is in no way specific to Signal or any other piece of software. If I can own the platform then there is NOTHING you can do to stop me from owning all of the information you put into that platform. It has nothing to do with any specific tool you use on the platform and any attempt to tie this fact to a specific tool or program is an indicator of an attempt to muddy the waters (most likely so you can try to sell some 'solution' that does not actually solve the problem.) In almost all cases these so-called solutions end up being so inconvenient and painful to use that people actively route around them using mechanisms that are even less secure than the original tool that is being 'fixed' -- there is a reason no one uses Qubes and why everyone tries to avoid a SCIF if possible...

It it is self evident to people who understand security. It is far from self evident to everyone else. To many who actually need security and are given the mantra to just use signal.

Yeah and corporate espionage is still a thing.

Reply on news.ycombinator.com