Hacker News Reader

Comment by egberts1 | Hacker News Reader

You cannot say flat-out say that E2E alone must be maintained, you must make it harder for others to reach you, thru something done in-person/screen-only QR-code, Bluetooth'd contact vCard, ..., something that prevents drive-by spammers/perps/malicious actors from randomly attaching to an account.

The key thing is to make distribution of account name harder:

1. Send 256-char hash of your account 2. They tag your hash with a name of their own choice

Disassociative of name to account gets maintained when used with a Signal protocol, which is what Signal app can do.

Again, weak sauce on claiming E2E is alone essential for child's privacy.

View on HN

How do you know what's running on Signal's server?

Sidenote: Signal is based in the USA. They do not have the benefit of the doubt.

You have association revealed openly to anyone having access to Signal server by User ID but barely know the name or phone associated with either end, much less ever able to see any actual and readable message content.

Unless it is the end-device being "accessed"/compromised, which any nation-state can do.

Why would it be impossible for Signal to decrypt and re-encrypt on their server while pretending to be "peer 2 peer encrypted" if we don't know what's running on their server? What's more: we don't even have the source of the client binary running on our phone.

Also "which any nation-state can do" is an interesting angle.

Let me put that differently: why would Signal NOT be a honey-pot operated by the CIA/NSA/other? Sounds almost too easy to not be true.

You and GP bring signal into this, but TFA is hosted on simplex.chat blog - the communicator famous for not having user accounts at all, so it trivially fixed the problem GP mentioned.

Simplex shy away from User ID, which means you are giving up something in exchange (notably no message encrypted-at-rest in their server): then the government can access the message contents from Simplex server.

It says so on their website:

"Only client devices store user profiles, contacts and groups; the messages are sent with 2-layer End-to-end encryption."

What it does NOT say is that message content remains encrypted on their server like Signal does.

It is like time, money, resource: pick only two. But in secured communication, that would be personal anonymity, personal privacy, and personal security: only can pick two.

https://simplex.chat/#how-simplex-works

Of course it stays encrypted - if it is sent e2e encrypted, it cannot be decrypted by the servers in the middle - it's the whole point of e2e encryption.

The privacy policy is very explicit about it.

Reply on news.ycombinator.com