Hacker News Reader

Comment by tptacek | Hacker News Reader

This is idiotic. Signal didn't take money from the NSA, they took money from the Broadcasting Board of Governors, which funded virtually all Internet privacy projects during the time period we're talking about, both American and otherwise; some of those dollars went to development, and still more went to contracting commercial pentests from firms like Matasano, the one I co-ran, and iSEC Partners.

This article says it's not rehashing DeVault's arguments, and it isn't; it's making an even dumber set of arguments.

View on HN

The NSA thing is the only thing I didn't check out, and it appears you are right, so I am dumb. -- I wrote this before Marlinspike stepped down and I never thought to check that either, so second point to you: I am idiotic.

Regardless that particular point stands even if he's not the messiah anymore, that he was heralded as a saint who bestowed on humanity the right to privacy, and that we should trust in him.

From what I can find about the entity that funded Signal from the government it seems to be a lot to do with the CIA and anti-censorship products designed to disrupt other countries... Which, actually fits with the narrative of censorship resistant messaging, at least -- so no reason to think that it betrays the stated mission of Signal

The foundation that funded them used to be called: Radio Free Asia (which on inspection seems to be considered propaganda, though seems to market itself as free media), now called OTF, if you see the list of other software they sponsor it's very much in the same category: https://en.wikipedia.org/wiki/Open_Technology_Fund

So, I recant those statements about NSA, I only know that a number of people in NSA are not using Signal, and I had heard about NSA funding from somewhere, which obviously is not true.

EDIT: It appears the link to the submission has been slightly altered to break it; it should be: https://blog.dijit.sh/i-don-t-trust-signal

Correct the article, and note what you originally said when you do so, so your readers can make their own decisions about how seriously to take your arguments.

The details you're providing about BBG, RFA, and OTF aren't relevant, and just add detail to what I said. In case you were relating them to educate me: there's no need, I have firsthand knowledge of the programs you're slandering (whether you mean to or not).

> Correct the article, and note what you originally said when you do so, so your readers can make their own decisions about how seriously to take your arguments.

I mean, the points at the bottom of the article are exactly the same. I would consider your temperement and not indulge flights of fancy that I am attacking you or your institutions.

I am speaking as a citizen, from an outside perspective, on what concerns me; because ultimately I see Signal pushed very hard and only lip service paid to any issues.

> The details you're providing about BBG, RFA, and OTF aren't relevant, and just add detail to what I said. In case you were relating them to educate me: there's no need, I have firsthand knowledge of the programs you're slandering (whether you mean to or not).

I thought it might provide some context, given that I am agreeing that the stated mission of OTF aligns somewhat and does not directly contradict the stated goals of Signal.

You ran an article titled "I don't trust Signal" with a subhed that read "Signal took NSA money". That was false, as you acknowledged. You can correct it properly or not. People can draw conclusions from your actions either way.

Sorry, where are you getting the idea that I wouldn't correct the article?

What are my "actions" that people can draw conclusions from? This sounds very emotive and slightly threatening.

I don't pretend to understand what you're arguing about right now. Personally, I think you should correct the article, but you could opt not to. It's your call either way.

OK, let me be as clear as I can be because I thought I stated this: I will, always, absolutely correct the article, and I will keep my original statements as strike-throughs.

Given that it makes no material difference to the point being made I don't know why it's being so emotionally driven;

I would correct the article even if it completely invalidated my point.

I would correct the article if you hadn't been emotional too.

It's just good to make sure that if you make a mistake that you own up to it and you ensure that misinformation does not spread.

I think (I hope) you agree with that.

Which is why I'm confused as to why you keep pressing the issue as I had already corrected the article after seeing your comment for the first time (before I even replied, in fact).

The reason you can't understand what I'm arguing about is because I'm... not arguing.

Sounds like there's not much more to talk about!

The lack of Signal’s use within the NSA is not positive evidence of its compromise. The NSA has operational constraints that don’t even remotely map onto a phone-number-identified messaging scheme.

I have to imagine using Signal with a high level clearance might itself arouse suspicion, for one thing. People inside the intelligence community really can’t expect much privacy for themselves.

> so I am dumb

To be fair, as I read it, the criticism was directed at your work and not you. We all make mistakes.

To be fair, had anyone other than tptacek used that tone on today's HN they'd be downvoted as intolerably rude.

> The NSA thing is the only thing I didn't check out

You might want to check again because your post is full of inaccuracies. From signal being on f-droid to their backend being relevant to security, you got almost everything wrong.

>a number of people in NSA are not using signal

Doesn’t necessarily mean it’s cryptographically insecure. I can imagine any NSA employee installing a typical strong-crypto software like Signal, PGP, or TOR on a personal device is a massive red flag worth investigating. If I were in that position I would not want to garner that kind of attention even if the crypto itself is fine

I think you are being too deferential here.

Reports from 2007/2008 had already indicated significant interference and government spying between agencies and with private corporations. Also, at that time it was widely believed but not yet confirmed Dual_EC_DRBG was backdoored via NIST/NSA collaboration.

Many folks equate any US government money with NSA money, and did so especially around this time, which is likely why you made this mistake. Taking any US-backed government money, even at the time Signal took it, was and should be suspect.

IIRC Signal continued to take money even after Snowden. So it is a fair point and not at all idiotic, and the over-reaction after you agreed to correct the article is suspect.

I do think Signal needed that money to survive, and it probably was put to good use, but I would have acted differently and more transparently about how my use of that money was communicated to the public.

That's not what they said. They didn't write "Signal, like every other privacy app at the time, took US-backed Broadcast Board of Governors money". They wrote "Signal took NSA money", which is inflammatory and, of course, obviously false. You can't rescue that claim with jazz hands.

I don't think you're doing this person any favors by keeping this debate alive.

I cant see any evidence that Broadcast Board of Governers has funded anything like: Telegram, Briar, any of the third party clients for XMPP or IRC or any of the major privacy mail services like tutanota.

So I think it’s at least a mild mischaracterisation that they funded everything.

in fact the only other major popular software they seem to fund is Tor (also from US govt) and noscript.[0]

“How could you possibly get the three letter agency wrong, your argument is entirely invalid” is a bit of a strawman dude, I admitted the mistake and corrected immediately — but you make it sound as if it matters at all which three letter agency it was.

No, it wasn't the one that is charged with spying on everyone, it was the one linked to disrupting everyone. Much better, but not materially different. I am not finding evidence to suggest what you claim either.

[0]: https://www.usagm.gov/wp-content/media/2017/01/OIF-Factsheet...

You are very poorly informed. You were a Google search away from a sprawling list of projects OTF funds, but instead found a 2017 PDF of "current projects" that listed a tiny percentage of them, and concluded you'd found dispositive evidence for your argument.

It's fine not to be super well informed about this stuff. Why would you be? Most subjects that come up on HN, I'm very poorly informed about, too. But it's not fine to be so noisily poorly informed that you spread misinformation, which is literally what you've done here. I've done that, too! But I believe I apologized when that happened, rather than doubling down. I hope I did! Dealing with this thread has made me super self conscious about that, which is I guess a good thing. Your blog post was so bad I experienced personal growth.

You could have asked people before you posted this story; you could have done any kind of research at all, and improved it. But you didn't: instead, you ran a piece that claimed the NSA funded Signal, and that Signal relies on server security, and that advocates of Signal are part of disingenuous conspiracy.

(You and I are the ~only people reading this flagged, buried thread now, so we can leave it here if you like).

I’m personally not a fan of requiring phone numbers or disallowing third party clients. I’m not really sure how I could characterize those concerns as being “dumb” even if they didn’t particularly bother me.

Let people make their own third party tools/readers and then let these arguments rot

The ball is on Signal's control, but they are clearly not caring to improve further, just stagnate so long as they have got control of it

There are valid reasons to prefer other apps, but this is not really one of them; it is the Signal idiosyncrasy that has most clearly been vindicated, by what happened to Matrix, which has the opposite model and has suffered for it and will continue to.

In the unlikely event that a set of vulnerabilities as devastating as those from the Nebuchadnezzar paper were found in Signal, Signal controls the whole platform end-to-end, and can simply publish software updates to fix them. Matrix has to do a coordinated multivendor update of their entire protocol.

Right, but what prevents them from doing a similar whole-platform "update" to totally screw up privacy/security? The point of software freedom is the freedom to run variations on the software that's reasonably easy to do, because you have the source. If it's supposedly "you can connect to any Signal server you want, as long as it's our Signal server" and "you can use any Signal client you want as long as it's our signal client", there's not much freedom left there.

Ask them! They're in the middle of one right now. The answer is simple: they don't control all the software, but rather have to convince other vendors to make changes.

(I like Matrix and will always sound like I'm dunking on them because of the implications of Nebuchadnezzar, and, before that, of opt-in E2EE; they're doing mostly the best they can with a tough hand to play.)

It's more like:

- If you use our client you can use our servers - If you don't use our client, you can't use our servers, but you can use any other server

It's like, technically it's sometimes[1] OSS, but they don't care about actually being FOSS in practice. If I can't fork the software, add or remove a feature and keep using the software's other features, it hasn't hit the bare minimum to be called FOSS, IMO.

1 - Most old versions of Signal are OSS, but frequently updates are only shared after a long delay - in some cases over a year out of date, if my memory serves me.

Reply on news.ycombinator.com