Comment by joecool1029 | Hacker News Reader

Comment by joecool1029 | Hacker News Reader

Parent Full thread

> no encryption key hosting arrangements with any government-owned third party firm

Not really needed when your IME is spying on you. Signal in such an arrangement becomes security theater. They acknowledge this is a problem on their support site but never make any attempt to educate new users to the app: https://support.signal.org/hc/en-us/articles/360055276112-In... . It is arrogant to dismiss concerns about commonly-used IME's when people rely on this app for their own protection.

This was discussed previously on HN if anyone's interested in reading about the response, or lack thereof to the criticism: https://news.ycombinator.com/item?id=25758995

>free and open source

Want to also point out that months go by without server code being published: https://www.xda-developers.com/signal-updates-public-server-...

Also, when users protested reliance on Google's store, analytics, and play services, Moxie chose to attack the forks and made us wait for years to get a direct APK without the requirements available off their site. I acknowledge that there's legitimate reasons why this was done, but all we get are excuses and silence for long periods of time when these problems crop up. It is not in the spirit of opensource/free software development to attack your own community.

> Not really needed when your IME is spying on you. Signal in such an arrangement becomes security theater.

This is not a signal issue. Literally every single app that gets user input from a keyboard suffers from this issue. Saying this is a signal issue is like saying flat tires are a ford issue.

> >free and open source > Want to also point out that months go by without server code being published:

Is there some unwritten rule that a open source project must publish code every x days to be considered open source? All of signals code has always been open source and always will be.

> Also, when users protested reliance on Google's store, analytics

Analytics? Care to show me where they ever used them? 99% sure they have never used them.

> Moxie chose to attack the forks

It takes a lot of money and man hours to maintain the servers and infrastructure for signal, why should OWS pay for other projects to use it? Signal is 100% open source, if someone thinks they can create a better replacement... They are free to take all of signals code and make their own app. But don't expect OWS to pay for the infrastructure and let them leech.

My point is that Signal is preferable to Apple Messages for privacy and security. I am not claiming that Signal is the best solution for every use case. (For instance, Matrix is superior if you do not want to be tied to a phone number.)

> Not really needed when your IME is spying on you.

Users can choose an open source keyboard on Android, such as AnySoftKeyboard or the default Android Keyboard (on AOSP installations). I don't know of any open source keyboards on the App Store for iOS, but the lack of an open source keyboard on iOS does not justify compromising encryption keys for Apple Messages users in certain regions.

Signal is not responsible for the security of the rest of the user's system, and if a user is using a keyboard that leaks information, then that also affects Apple Messages and any other app they are using, not just Signal.

> Want to also point out that months go by without server code being published

The Apple Messages server and clients are completely proprietary, so Signal is still preferable even though it had previously released server source code with a delay.

> Also, when users protested reliance on Google's store, analytics, and play services...

Apple Messages is only available as an app on iOS, iPadOS, and macOS, with no option to fork because it is closed source. FaceTime is the same, but now also has a web app with limited functionality. On Android, Signal is still preferable in this area because it is fully available, can be used without Google Play Services, and can be distributed independently of an app store.

I'm not comparing Signal to Apple Messages, I am criticizing the promotion of Signal as a superior alternative while its developers will not address a major practical security concern.

>Users can choose an open source keyboard on Android

Then they should be made immediately aware of this in using Signal on Android. The IME issue is not going to be well-known outside the tech bubble.

> Then they should be made immediately aware of this in using Signal on Android.

Does any messaging app do this on any platform? You're demanding something that, as far as I'm aware, no messaging app currently does. Signal at least published the FAQ page, which you linked earlier, even though it's not their responsibility to ensure that the user's device is free of third-party spyware.

This entire discussion is about FaceTime and Apple Messages, which is why Signal is being compared to both. And Signal is superior to these services for privacy and security.

Reply on news.ycombinator.com