Hacker News Reader

Comment by stiray | Hacker News Reader

It is as simple as: I dont care. Signal requires a personally identifiable information while the keys can be extracted using rubber-hose cryptoanalysis ( https://imgs.xkcd.com/comics/security.png ) once you know ---> WHO <--- to beat. This is not secure. Sorry.

I understand the whole concept behind it. I understand why they want a phone number. BUT. This is not secure (oh, really, my phone number is hashed, how long do i need to brute force a few numbers in range of 0-9, a few seconds on my laptop, maybe?)

On the other side, I can use a simple email/irc/counterstrike chat to be MORE secure. Why? As it doesnt require any PII from me.

So why bother? Yes, sure, I can use it as a nice chat interface, I can use it as another way beside ~20 chat applications I need to use to contact people I know ( https://imgs.xkcd.com/comics/chat_systems.png ). But dont sell me security. With requiring PII they broke it.

View on HN

A big mistake you make is to think that someone would be powerful enough to find you personally on Signal, but would fail to find you on an insecure chat in a video game.

If you are not interesting for the NSA, giving your phone number to Signal is fine. If you are... run. The counterstrike chat won't hide you.

I'll have my 70 year old parents on another continent install counterstrike so we can text each other. Thanks for the suggestion.

Your 70 year old parents don't care about security of communication. Whatever http(without 's') chat is quite enough for them. They were talking on analog, unencrypted line for whole their life. Why should they care now? PRISM anyone ( https://en.wikipedia.org/wiki/PRISM )?

That is also not true either. My 80 year old mother uses Signal because she talks property management and money related issues to people. She does not trust WhatsApp because it is owned by Facebook (Which is weird because she uses Facebook all the time). For her, knowing that cell phone company employees can grab text messages is enough for her to switch to something that is secure.

So this is the crux of the disagreement. You believe that you either need maximum possible security or none at all, so when you need to be secure, it doesn’t matter if you have to use an inconvenient solution, because it’s that important. Whereas in reality there are a ton of less severe threat models that can be countered with more user-friendly methods of communication. Advertising companies, ISPs, local cops, etc won’t be able to read your Signal messages or find out who you’ve been talking to, and that can be important to many people. NSA or equivalent probably can, if they’re interested in you already, but that’s a concern for far less.

Are you suggesting that people who aren't devoted to the cause of secure communication are not allowed to derive any benefits from secure communication?

Reply on news.ycombinator.com