Comment by dijit | Hacker News Reader

Comment by dijit | Hacker News Reader

Parent Full thread

The NSA thing is the only thing I didn't check out, and it appears you are right, so I am dumb. -- I wrote this before Marlinspike stepped down and I never thought to check that either, so second point to you: I am idiotic.

Regardless that particular point stands even if he's not the messiah anymore, that he was heralded as a saint who bestowed on humanity the right to privacy, and that we should trust in him.

From what I can find about the entity that funded Signal from the government it seems to be a lot to do with the CIA and anti-censorship products designed to disrupt other countries... Which, actually fits with the narrative of censorship resistant messaging, at least -- so no reason to think that it betrays the stated mission of Signal

The foundation that funded them used to be called: Radio Free Asia (which on inspection seems to be considered propaganda, though seems to market itself as free media), now called OTF, if you see the list of other software they sponsor it's very much in the same category: https://en.wikipedia.org/wiki/Open_Technology_Fund

So, I recant those statements about NSA, I only know that a number of people in NSA are not using Signal, and I had heard about NSA funding from somewhere, which obviously is not true.

EDIT: It appears the link to the submission has been slightly altered to break it; it should be: https://blog.dijit.sh/i-don-t-trust-signal

Correct the article, and note what you originally said when you do so, so your readers can make their own decisions about how seriously to take your arguments.

The details you're providing about BBG, RFA, and OTF aren't relevant, and just add detail to what I said. In case you were relating them to educate me: there's no need, I have firsthand knowledge of the programs you're slandering (whether you mean to or not).

> Correct the article, and note what you originally said when you do so, so your readers can make their own decisions about how seriously to take your arguments.

I mean, the points at the bottom of the article are exactly the same. I would consider your temperement and not indulge flights of fancy that I am attacking you or your institutions.

I am speaking as a citizen, from an outside perspective, on what concerns me; because ultimately I see Signal pushed very hard and only lip service paid to any issues.

> The details you're providing about BBG, RFA, and OTF aren't relevant, and just add detail to what I said. In case you were relating them to educate me: there's no need, I have firsthand knowledge of the programs you're slandering (whether you mean to or not).

I thought it might provide some context, given that I am agreeing that the stated mission of OTF aligns somewhat and does not directly contradict the stated goals of Signal.

You ran an article titled "I don't trust Signal" with a subhed that read "Signal took NSA money". That was false, as you acknowledged. You can correct it properly or not. People can draw conclusions from your actions either way.

Sorry, where are you getting the idea that I wouldn't correct the article?

What are my "actions" that people can draw conclusions from? This sounds very emotive and slightly threatening.

I don't pretend to understand what you're arguing about right now. Personally, I think you should correct the article, but you could opt not to. It's your call either way.

OK, let me be as clear as I can be because I thought I stated this: I will, always, absolutely correct the article, and I will keep my original statements as strike-throughs.

Given that it makes no material difference to the point being made I don't know why it's being so emotionally driven;

I would correct the article even if it completely invalidated my point.

I would correct the article if you hadn't been emotional too.

It's just good to make sure that if you make a mistake that you own up to it and you ensure that misinformation does not spread.

I think (I hope) you agree with that.

Which is why I'm confused as to why you keep pressing the issue as I had already corrected the article after seeing your comment for the first time (before I even replied, in fact).

The reason you can't understand what I'm arguing about is because I'm... not arguing.

Sounds like there's not much more to talk about!

The lack of Signal’s use within the NSA is not positive evidence of its compromise. The NSA has operational constraints that don’t even remotely map onto a phone-number-identified messaging scheme.

I think you are being too deferential here.

Reports from 2007/2008 had already indicated significant interference and government spying between agencies and with private corporations. Also, at that time it was widely believed but not yet confirmed Dual_EC_DRBG was backdoored via NIST/NSA collaboration.

Many folks equate any US government money with NSA money, and did so especially around this time, which is likely why you made this mistake. Taking any US-backed government money, even at the time Signal took it, was and should be suspect.

IIRC Signal continued to take money even after Snowden. So it is a fair point and not at all idiotic, and the over-reaction after you agreed to correct the article is suspect.

I do think Signal needed that money to survive, and it probably was put to good use, but I would have acted differently and more transparently about how my use of that money was communicated to the public.

That's not what they said. They didn't write "Signal, like every other privacy app at the time, took US-backed Broadcast Board of Governors money". They wrote "Signal took NSA money", which is inflammatory and, of course, obviously false. You can't rescue that claim with jazz hands.

I don't think you're doing this person any favors by keeping this debate alive.

I cant see any evidence that Broadcast Board of Governers has funded anything like: Telegram, Briar, any of the third party clients for XMPP or IRC or any of the major privacy mail services like tutanota.

So I think it’s at least a mild mischaracterisation that they funded everything.

in fact the only other major popular software they seem to fund is Tor (also from US govt) and noscript.[0]

“How could you possibly get the three letter agency wrong, your argument is entirely invalid” is a bit of a strawman dude, I admitted the mistake and corrected immediately — but you make it sound as if it matters at all which three letter agency it was.

No, it wasn't the one that is charged with spying on everyone, it was the one linked to disrupting everyone. Much better, but not materially different. I am not finding evidence to suggest what you claim either.

[0]: https://www.usagm.gov/wp-content/media/2017/01/OIF-Factsheet...

You are very poorly informed. You were a Google search away from a sprawling list of projects OTF funds, but instead found a 2017 PDF of "current projects" that listed a tiny percentage of them, and concluded you'd found dispositive evidence for your argument.

It's fine not to be super well informed about this stuff. Why would you be? Most subjects that come up on HN, I'm very poorly informed about, too. But it's not fine to be so noisily poorly informed that you spread misinformation, which is literally what you've done here. I've done that, too! But I believe I apologized when that happened, rather than doubling down. I hope I did! Dealing with this thread has made me super self conscious about that, which is I guess a good thing. Your blog post was so bad I experienced personal growth.

You could have asked people before you posted this story; you could have done any kind of research at all, and improved it. But you didn't: instead, you ran a piece that claimed the NSA funded Signal, and that Signal relies on server security, and that advocates of Signal are part of disingenuous conspiracy.

(You and I are the ~only people reading this flagged, buried thread now, so we can leave it here if you like).

>a number of people in NSA are not using signal

Doesn’t necessarily mean it’s cryptographically insecure. I can imagine any NSA employee installing a typical strong-crypto software like Signal, PGP, or TOR on a personal device is a massive red flag worth investigating. If I were in that position I would not want to garner that kind of attention even if the crypto itself is fine

I have to imagine using Signal with a high level clearance might itself arouse suspicion, for one thing. People inside the intelligence community really can’t expect much privacy for themselves.

> so I am dumb

To be fair, as I read it, the criticism was directed at your work and not you. We all make mistakes.

To be fair, had anyone other than tptacek used that tone on today's HN they'd be downvoted as intolerably rude.

> The NSA thing is the only thing I didn't check out

You might want to check again because your post is full of inaccuracies. From signal being on f-droid to their backend being relevant to security, you got almost everything wrong.

Reply on news.ycombinator.com