Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by frontalier | Hacker News Reader

Parent Full thread

frontalier·

gnupg is a foot gun and it does not encrypt the metadata

with signal one gets e2ee and it's hard to fuck up

View on HN

What metadata is exposed by GPG and not Signal?

Who is communicating with whom, when, and usually from what IP address. Signal writes about how they minimize the metadata they can access here: https://signal.org/blog/sealed-sender/

When using it over Email, all of the normal email headers are there on full display. The subject line, recipients, etc... Everything except the body is exposed.

I wouldn't count on Signal to protect you. I suspect they've been compromised for a while, but at the very least they're not trustworthy. The very first sentence of their "Signal Terms & Privacy Policy" page is a lie. It states "Signal is designed to never collect or store any sensitive information." but for years now signal has been collecting and permanently storing sensitive information in the cloud (your name, phone number, photo, and most importantly a list of all your contacts). They've also refused to update their privacy policy to reflect their new data collection practices.

For an app that markets itself to whistleblowers, human rights activists, and journalists whose freedom or lives could be at risk it's inexcusable to mislead people about what data is being collected. People with so much on the line need to be able to make informed choices about their risks, but Signal's communication surrounding their data collection has been extremely evasive, confusing, and dishonest.