undefined | Better HN

0 pointsquasirandom5y ago0 comments

My read on that statement was "the censors can't just /dev/null anything with a plaintext CONNECT".

Given its broad user base, it wouldn't hurt for Signal to clearly state "we can't keep the fact of the communication private, only the contents".

That would short-circuit attempts to gain notoriety by pointing out obvious facts and calling them vulnerabilities. It's also common sense for anyone who knows their way around a puter, but that's not Signal's median user.

"Privacy" products are a market for lemons, and Signal's public messaging should strive to insulate its users from FUD.

0 comments

3 comments · 1 top-level

csydas5y ago· 2 in thread

I currently live in a country without such strong protections for individuals, and discussing this with a friend, I feel this is a disconnect between many of the HN posters who don't live in countries where such concerns are very common. This is not a judgement of "who has it worse", but more that from my observation, there are many important elements missing from the discussion that those who haven't had to consider that their posts/comments might land them or their family (or both and more) in jail.

Everyone in my country of residence uses Telegram; not because it's secure, but because for non-serious chats, it's convenient.

This is a statement/truth that I think a LOT of people don't quite get; Pavel Durov and his team might push that Telegram is secure, but no one uses Telgram for security because nothing about its security ensures a circle of trust.

This is true for any messaging app. The general consensus I've encountered is that any application you can readily pull from the AppStore/GooglePlay, so can adversarial persons. If they really want to target you for some reason, it's as simple as getting your friend and unlocking their phone, knowing the the same protections that people in the United States have don't apply world wide.

Signal et.al., can have the world's most amazing crypto, but it means nothing if the person behind the unlocked phone is an adversary, and I think a threat-vector that is missed in the 200+ post discussion here is that in many parts of the world, __this is a real threat vector__. A password/second screen/whatever is not a guarantee of protection! It's a speed bump, and how resilient you are to the person driving over the speed bump is how effective that bump is.

So, for the article when I read persons concerned about the statements made by Signal and not outlining the threat factor for countries where the Circle of Trust might literally be a matter of life or death, yeah, I side with the concerned persons. Signal has impressive tech, but again, that tech means __nothing__ if the person behind the unlocked device is adversarial.

dublinben5y ago

What technology can address that threat model? Signal certainly doesn't try to.

_carbyau_5y ago

Disclaimer: I not a security expert by any means. Also I am NOT from a country "where such concerns are very common".

So I feel like I am missing something here.

I don't want to minimise empathy towards living under such a society but if The Adversary can obtain your friends unlocked phone, what do you want to have happen?

A sham-password for Signal that sends out a "I've been caught." message to all contacts? So you can "fat finger" the password in front of your captor?

j / k navigate · click thread line to collapse