Hacker News Reader

Comment by usui | Hacker News Reader

Signal seems to be a lone island in its dedication to user privacy. Is this naive or an accurate evaluation? Have they done anything recently to signal that these may falter? What is going to suggest they won't resort to rent-seeking or monetizing in the future?

View on HN

Very recently they added their first closed-source component to their code, supposedly a spam filter. This sort of went by HN. I can't help but think that the timing with all these requests is rather coincidental.

It didn't "sort of go by HN", it was on the front page for a bit and had some 97 comments.

https://news.ycombinator.com/item?id=29072031

Their server code was closed source for over a year with no explanation, turns out it was to add a shitcoin called "MobileCoin" that Signal's founder has a financial interest in.

Ever since that, I don't think you should consider Signal's server "open source" at all. They've shown they'll conceal, diverge and cover up for their own enrichment. What will they do when they're threatened? Cave.

https://github.com/signalapp/Signal-Server

>Last commit 7 Days ago

>AGPL-3.0 License

That's the present

How does this disprove what I said? I said it WAS closed source. It's also not complete anymore, so I think it's still safe to call it closed source.

If there's a single piece of closed source code running on the servers, it ceases to be open source.

>If there's a single piece of closed source code running on the servers, it ceases to be open source.

Yeah no that's not the definition of opensource, if my opensource mailserver has a closed source spam-scanner, my mail server is still opensource - the spam-scanner

And when the spam scanner looks like:

phone_home_to_nsa(metadata, ip_address, sender, recipient);

Are you still comfortable with this 'open source' project?

No kidding such a bad look

My understanding is that this component was added to their server code. If their clients are still verifyiably encrypting the content and limiting the metadata for your messages, it should not be much of an issue.

Don't really understand the cries for their server code to be constantly updated or even open sourced, you can't ever verify that's what they are running anyway.

Maybe there's some sort of cryptographic attestation out there which could fulfil such purposes but quite sure it's not that practical.

That's true and it's one reason I'm not too comfortable with Signal's access to metadata (even though they are the best nonfederated communicator in that regard).

There are a few reasons why I would prefer them to provide source code that they claim is running in the service due to the metadata issue:

a) if it's actually running there, people can find simple bugs in it that could allow that metadata to be stored or revealed by accident,

b) if it's not actually running there, but something very close is (i.e. that code with small amount of patches), then the advantage above still applies and if those patches come to light, they can be easily evaluated for intent and effect,

c) if they're running something completely different (which would be very weird), it'd be noticeable and it would be an obvious lie once exposed.

Every time you send a message with Signal, you inform the server which user the message is for. Thus, the server can remember (sending IP, target phone number) pairs and, for similar reasons, (phone number, IP of the user when retrieving messages) pairs. We rely on the server to discard this information; if not discarded, it reveals the social graph and the phone number<->IPs used mapping.

And since Snowden we know that meta-information is as important as information. So Signal being E2E encrypted goes only halfway towards ensuring the privacy of our communications.

I'm aware of this, but it's not like it's a new concern with this piece of code. This has always been the case.

Matrix looks the most promising to me. I believe the people behind it are principled (just like I think the people behind Signal are), but the Matrix protocol doesn't require heros. There's no single point of technical or legal failure.

> the Matrix protocol doesn't require heros

Do you have some examples of the sort of "heroism" you think is involved here?

What I mean is that Signal as a messaging service depends completely on Signal as an organisation and on the few individuals running that organisation. Everything hinges on them.

It's pretty clear that governments around the world (including many western countries) have decided that online services must take full responsibility for everything their users say and do on the platform. Regulation is coming hard and fast. It's not subtle and some of it will inevitably be inconsistent with E2EE.

Anyone running a popular service of this sort is going to be under huge pressure - political pressure, expensive legal pressure and presumably the sort of pressure exerted by police and intelligence services that the rest of us are fortunate not to know very much about.

Signal's structure, the tight link between the org, the people and the centralised operations focuses all the pressure on this small group of people. They are going to be an absolute lightning rod as soon as WhatsApp has given up.

I don't want to be in their shoes. I fear they will have to make very difficult decisions pretty soon. I find it puzzling that they're making themselves the target of further powerful opponents by adding cryptocurrencies to the mix.

I think Matrix has the better structure for what's coming. It distributes the pressure. It's not either on or off. It's not just some specific app that can be banned.

Politicians are under pressure to "do something" about services like Facebook, Instagram, Twitter, TikTok, Youtube, Reddit ... services which publish what some of their users do and say, and enjoy broad immunity from lawsuits despite choosing what is communicated and by who. None of which applies to Signal.

Your theory is that, seeing this, US politicians will decide priority #1 is to re-write the US constitution in order to go after a completely different service? Sure, they can't find a bare majority of votes for cheap, easy fixes that are broadly popular, but repeatedly getting super-majorities for the lengthy and expensive process of tearing down the fundamental principles of the country to go after an outfit few voters have even heard of it will be easy? I don't buy it.

One of the most awful things about the "better structure" of Matrix is that if you make any use of this "better structure" you eliminate Don't Stand Out which is an essential characteristic of Signal. Yet, to enable that "better structure" to even exist Matrix already makes you give up some of the privacy you have on Signal anyway. So you're losing some privacy to have the option of giving up even more privacy.

Several of the sub-threads in this discussion mention metadata. Don't Stand Out is crucial because of metadata. The Secret Police can raid all sixteen users of "Jim's Black Pill Matrix Server" and if two of them are innocent bystanders too bad, all fourteen members of the Conspiracy To Do A Naughty Thing are known to use Jim's server, and so they Stand Out and were caught. In contrast, using Signal the Conspiracy To Do A Naughty Thing are disguised by the presence of Sarah's Hen Night Planning DO NOT TELL SARAH, Smith Family Group, and LOL Funny Cats!!!! among many more. Signal doesn't know, or care about any of these groups.

I don't think it's realistic to assume that there will be a very large number of tiny Matrix servers that stand out. It's far more likely that there will be a couple of big ones and some midsize ones that most people use. Each of them can obviously become a target, but they will be in various different jurisdictions and it's easy to create new ones linked to all the rest of them.

If you think that E2EE is not under heavy political fire then please read what our governments are demanding from tech companies. This is not limited to companies that are "choosing what is communicated and by who". On the contrary, governments are demanding that companies monitor what is communicated and by who:

International statement: End-to-end encryption and public safety

https://www.gov.uk/government/publications/international-sta...

That "International Statement" basically says "We wish facts weren't true". But, like, too bad they are. Notice that it doesn't say they acknowledge the reality and so, fuck it, they'll just violate Human Rights and "materially weaken or limit security systems", instead they say well, surely we can avoid that and yet still get the same outcome. Nope. That's not how facts work.

Writing long letters deploring the rules might work if you're up against the resident's association, local town council, or even a court of law, but Mother Nature couldn't give a shit what you think about her rules.

There are many smaller islands like Threema, Tox and others. Signal is not a lone one, even if we look away from the continent named Apple.

I can't agree with this one. I enjoy Apple products and consider them to be of high quality, but they should not be the star example for user privacy. iCloud backups are turned on by default, which means they have access to the private key, and they considered adding a client-side detection system for "child pornography". From the standpoint of E2EE, enough is enough with the "gray area" in privacy systems. Either you don't fiddle/introspect with the content that goes through your communication medium, or you do.

>they should not be the star example for user privacy

They are not perfect, but I can't see anyone who does better overall.

>iCloud backups are turned on by default

I believe it is good default, as 90%+ of their users (would) care more about accidental data loss than privacy. When that changes, Apple will change the default.

>client-side detection system for "child pornography"

Yes, that's a very controversial move. But they made it client-side because it's more private than server-side.

> I believe it is good default, as 90%+ of their users (would) care more about accidental data loss than privacy.

I think you're right about the numbers, but I don't understand why that justifies the default. Why even have a default? Why not just ask users what they want? It's not a hard question, and it even has the benefit of helping inform users about the feature.

> Yes, that's a very controversial move. But they made it client-side because it's more private than server-side.

So? Either it respects privacy or it doesn't in this kind of discussion. Lauding them for violating your privacy but not as much as they could otherwise is like lauding a mugger for only taking half of the cash in your wallet. Yeah it could have been worse, but that doesn't change the nature of their actions.

Last time I tried them, they still required phone number? If it is still the case, they did compromise on the users privacy.

This is a usability stance. Removing the ability to use phone numbers would have made it harder for users to adopt Signal, and I find it to be a reasonable trade-off. At least right now, the only thing prying eyes can do is know that you use Signal due to the login SMS, or hijack your SMS. We all know about some terrible security practices that phone providers have been doing with phone number swapping by unauthorized parties, but if we can pick non-awful phone providers which at least have password-protected SIM locks on the account, it shouldn't be as viable.

> Removing the ability to use phone numbers

I've never seen anyone ask for Signal to remove the ability to use phone numbers. People ask Signal to add the ability to use something other than a phone number, as well.

As I've heard it, it's motivated by security rather than usability: If two people use Signal to communicate with each other, then they should use the Signal protocol rather than SMS, without having to go through any extra steps.

There are different ways to achieve that, all of which have drawbacks. They chose one.

Signal has demonstrated to me that they don't give a shit about privacy, but they care a lot about security. I'll take it, but I wouldn't confuse the two.

There is more, like very promising https://cwtch.im/

Reply on news.ycombinator.com