Hacker News Reader

Comment by rolisz | Hacker News Reader

But then who is Signal for? Yes, it has E2EE encryption, but who cares about that other than us orangey types?

And Signal makes plenty of user hostile moves: making backups is not supported. If your Android phone dies, you can kiss your previous conversations goodbye. That's working as intended according to the team.

If I receive a large number of photos via Signal, i have to long tap each of them and save them individually (several taps to do that).

So really, who is Signal for then? It's not for anonymity fans. It's not for people who care about long term discussions.

View on HN

> But then who is Signal for? Yes, it has E2EE encryption, but who cares about that other than us orangey types?

Although I think people like us (?) were some of the original proponents of Signal, and it could never have spread without us, I believe Signal's intention is more about capturing the wider market while simultaneously changing that market to be more privacy-aware. I think that they believe they can make private, encrypted messaging to be a household idea, and I hope they're right.

>But then who is Signal for? Yes, it has E2EE encryption, but who cares about that other than us orangey types?

Me.

> If I receive a large number of photos via Signal, i have to long tap each of them and save them individually (several taps to do that).

No, you don't. You can select them all and export to Photos app (at least on Android, I have not tried on my iPhone).

> So really, who is Signal for then? It's not for anonymity fans. It's not for people who care about long term discussions.

My SO and I foster. New case, new numbers for everything. When I'm at the pediatrician and I can't remember an insurance number or a birth date, my SO can text it to me and after I say I have it, they can delete the message.

Signal is great. I love it. Warts and all.

> Yes, it has E2EE encryption, but who cares about that other than us orangey types?

Signal is vulnerable to MITM attack. Our government has no problems with reading of my messages in Signal. I forced either to accept new certificate and be OK with wiretaping, or to lost communication channel with a friend.

Which MITM attack has a government used to read your Signal messages? I've heard people allude to government breaks of Signal for years, but always without evidence. Surely some Signal messages have been recovered from devices in the government's possession, but that's not a protocol problem. Are you saying a government has successfully spoofed safety number change messages from your contacts?

I believe they're saying that if the government (or another party) can read your received SMS messages, then your Signal account isn't secure. It could be taken over by anyone who can receive the SMS verification code. Your contacts would be notified that you'd changed your keys, and your own device would be locked out. So it's not the most quiet attack. But people replace their phones and forget account details so it may pass unnoticed by some of your contacts, particularly if you have no other channel to reach your contacts.

The number of countries where the government would do that to your SMS but won't also just arrest you arbitrarily and seize your device and/or beat/threaten you, seems small. But I imagine there are some people in some places, who feel physically and/or legally secure from arbitrary government action against their devices proper, but not with their cellular service.

> So it's not the most quiet attack. But people replace their phones and forget account details so it may pass unnoticed by some of your contacts, particularly if you have no other channel to reach your contacts.

So in other words, such attacks aren't viable for dragnet surveillance and must be targeted. But if you have reason to believe that you'll be targeted by the government for surveillance, you'd be on the lookout for signs like "your safety number has changed"?

You can also make it so that your PIN is required to register your number on a new device.

So it's not vulnerable. You choose to accept the new certificate.

I have two options: 1) accept new certificate and be OK with MITM, 2) use another messenger.

I use Signal to be able to communicate with those members of my family who don't have iPhones. It's a compromise between my privacy expectations and their usability expectations.

For me and my converted familie. It is the same as WA but not FB. Well, except for that everybody just leaves that message for a PIN code verification open all the time and never do anything with it.

All media, select all, save by the way. You don't need to tap the individual photos.

Reply on news.ycombinator.com