Hacker News Reader

Comment by O__________O | Hacker News Reader

I have nothing against Signal, Moxie, etc — but it attracts high-value targets. As such, Signal is an extremely high-value target.

>> Signal knows nothing about who you are.

This is based on trust, not systematic proofs, Signal knows this, yet never tells its users. For example, Signal uses Intel’s Software Guard Extensions (SGX) - which is know to have multiple attacks, any of which Signal might be forced to run using national security letter. They have also had multiple data breaches, which I am guessing average user is not aware of. Moxie is still on the board, and he personally refused multiple times to remove the requirement for a phone number. Lastly, Signals three board members have all been the leader of Signal in last year and I have been unable to find their most recent 990 non-profit disclosure.

View on HN

> any of which Signal might be forced to run using national security letter.

NSLs can demand information but cannot compel action. The govt cannot use an NSL to force you into military service, for example, or force you to hack someone else’s computer (which is essentially what you are suggesting).

Regardless if they were “compeled” - nation security letter related activities have included actions.

For example, this included a room and split:

- https://wikipedia.org/wiki/33_Thomas_Street

My understanding is that vendors that execute national security letters offer system integration technology to be locally installed to ingest the related data.

Signal has the data, it just requires them collecting it — hence my statement that Signal’s security is based on trust, not physics, math, etc.

Those actions were not the result of a national security letter. NSLs can only require the production of existing records. They cannot require the release of the content of communications nor the collection of records which don't already exist. They must also specify the time period the records request covers which can only include up to the date the NSL was received.

As I said, they’re related. That is All Writs Act is a United States federal statute, codified at 28 U.S.C. § 1651, which authorizes the United States federal courts to issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law. A writ is a form of written command in the name of a court or other legal authority to act, or abstain from acting, in some way.

Also my understanding that the National Security Letters vendors can simply reissue them automatically to maintain persistent data feeds. Disclosing actions taken via All Writs Act to enable national security letters would likely be a disclosure of them similar to warrant canary.

NSLs don't involve data feeds. The All Writs Act involves a judicial review and issuing of a judicial subpoena. A judicial subpoena may well involve ongoing data collection. NSLs are administrative subpoenas which aren't reviewed by the judiciary before being issued and limited in scope because of that. Actions taken "via All Writs Act" are not to enable NSLs.

This is correct but the All Writs Act can compel third parties to help in a criminal investigation, like a phone company being asked to help wiretap a phone. Signal by design at the most would have only contacts that you shared and IP address/access log. Apple was able to argue that they shouldn’t be forced to push an update to unlock the phone of that terrorist in California so there are limits to it but they are not entirely clear.

Idea that Apple would not add backdoors privately regardless of what actions they take publicly is a stretch give Apple has obviously been more than happy to tailor their systems to China’s demands. Core difference between China and US is that US is fine on government spying on it as long as it’s done in secrecy.

> Signal is rapid on its way to a billion users

The last number I could find is 40 million in 2021

You’re correct; removed that from comment, not sure where I got that from, but was unable to find anything quickly that would be anywhere near billion.

Signal does marketing by omission: "Intel’s SGX protects against introspection", "we depend on donations from our community", etc.

Would it be possible for you to expand on Signal not being dependent on donations?

They also received a very large amount of funding from some successful tech founders, Brian Acton and Pavel Durov

My understanding was that the funds from Brian Acton were a loan to be repaid, though might be wrong. I was unable to quickly locate any information relate to Pavel Durov having any financial relationship with Signal.

"we depend on donations from our community" + a $105 million 0% interest loan (until 2068)¹.

¹ https://en.wikipedia.org/wiki/Brian_Acton#Signal

Are you suggesting Signal should not repay their debts or the best time to do that is not as soon as possible? If not, regardless of if there’s no interest, that loan should be repaid as soon as possible in my opinion. In my opinion, 990s are public, that loan was publicly acknowledged, and see no issue with a non-profit raising donations or repaying their debts.

All that said, if it was up to me, Signal would have their 990s on their site, annual publicly shared audits, etc. - which to my knowledge they do not.

> Are you suggesting Signal should not repay their debts or the best time to do that is not as soon as possible?

Cutting through the tug-at-the-heartstrings sales pitch: Signal does not currently "depend on donations", nor will they for at least 45 more years.

It is reasonable to expect the entire truth when asked for money, instead of getting Wikipedia'd.

That's not how NSLs work.

Reply on news.ycombinator.com