Hacker News Reader

If an attacker needs your specific signal messages, they wouldn't bother with trying to break encryption as the messages you type and receive are right there in plain text on your device.

(The software that captures your input and the software that writes to your display driver are typically not under your control)

As for large scale surveillance: Definitely an improvement that makes it much more expensive for attackers.

View on HN

> If an attacker needs your specific signal messages, they wouldn't bother with trying to break encryption as the messages you type and receive are right there in plain text on your device.

Good thing then that the Signal Protocol is repudiable? https://signal.org/docs/specifications/pqxdh/#deniability

They definitely can and do scrape Signal logs and use them in court. The protocol doesn’t help them prove the validity of the log, but they don’t need it to: it’s already not plausible to claim that you and your contact falsified your logs, something few people know how to do, in sync, in order to frame yourselves. I think Signal’s approach to deniability is just not making it even more hopeless, while the real protection against future compromise of a currently trusted contact or your own device lies in a different strategy that does work, ephemerality.

Reply on news.ycombinator.com