News for hackers. Stuff that matters.
Re:Why I won't recommend Signal anymore by exo762 on Sunday November 06, 2016 @04:36AM (#12884292)
> Good, so Open Whisper Systems has no metadata. Do any third parties retain metadata about Signal messages?

I'll try to answer to the best of my knowledge (I'm not associated with project, I'm just a happy customer).

Does your ISP know that you are communicating with Signal servers? Yes, IP addresses.

Does it know to whom you are sending messages? No.

Does Google know you are using Signal? Yes.

Does it know whom of your contacts use Signal? Yes, because they have a full list of your contacts and they know if someone has installed Signal.

Does Google know you've sent a message? No.

Does Google know that you are receiving a message? Sometimes, because Signal servers ping your device via GCM with "wake up".

Does Google knows who from your contact list send this message? No, unless you have only one contact who uses Signal.

Can Google infer from pings who is communicating with whom? Yes, although pings are needed only if app has disconnected from server, and this severely limits usefulness of this technique.

Where else may any metadata coming from usage of Signal be? Nowhere.

As for Google having your contact list... Take a look into Flock.

Re:Why I won't recommend Signal anymore by mirimir on Sunday November 06, 2016 @10:38PM (#12888639)
Thanks :)

I get that Signal is probably the best option for smartphones. And that maybe its vulnerabilities are only relevant for "TAO targets". But the problem is that "TAO targets" is in rapid flux, given developments in automation and AI. So arguably, more and more journalists and dissidents are becoming vulnerable.

And there's the fundamental insecurity of devices with cellular-radio connectivity, and operating systems that users can't control and lock down. Signal can do nothing about that. Even something as simple as reliably obscuring identity in connections to Signal servers is nontrivial.

Re:Why I won't recommend Signal anymore by exo762 on Sunday November 20, 2016 @02:12PM (#13000538)
> But the problem is that "TAO targets" is in rapid flux, given developments in automation and AI.

You are implying that cost of TAO consists mostly of labor costs. Which is false. NSA and friends are not really limited by money. They are limited by amount of unpatched software vulnerabilities. Every use of vulnerability in the wild is a chance of revealing it to world and losing it. Snowden docs reveal the existence of automated software which evaluates chance of vulnerability being revealed by attack. XKeyScore or one of related pieces, AFAIR.

Re:Why I won't recommend Signal anymore by jhasse on Sunday November 06, 2016 @04:57AM (#12884353)
Does Google know you are using Signal?

Does it know whom of your contacts use Signal?

Does Google know you've sent a message?

Does Google know that you are receiving a message?

Does Google knows who from your contact list send this message?

Can Google infer from pings who is communicating with whom?

Yes to all of those, because they have root on your phone.

Re:Why I won't recommend Signal anymore by exo762 on Sunday November 06, 2016 @05:07AM (#12884381)
You are assuming that Android reports on every step you take. Do you have sources backing this claim?
Re:Why I won't recommend Signal anymore by jhasse on Sunday November 06, 2016 @05:22AM (#12884423)
It's nearly impossible to find out. But if I trust corporations like Google not to exploit the possibilities, I wouldn't be looking for an open-source alternative to WhatsApp in the first place.
Re:Why I won't recommend Signal anymore by exo762 on Sunday November 06, 2016 @05:29AM (#12884454)
Signal is not positioned as a tool for possible TAO targets. Never was, and never will be. Don't use it and please stop spreading the FUD.
Re:Why I won't recommend Signal anymore by kuschku on Sunday November 06, 2016 @07:14AM (#12884757)
> Signal is not positioned as a tool for possible TAO targets. Never was, and never will be.

Eh, that’s exactly what it is currently advertised as.

A tool, supported by Snowden, to be used by journalists who are at risk of being under active surveillance by state actors.

That is the very definition of a TAO target.

Re:Why I won't recommend Signal anymore by jospoortvliet on Tuesday November 08, 2016 @06:24AM (#12899339)
You shouldn't use a smartphone if you expect to be TAO. Even the hardware could be compromised. Use a laptop with Linux for anything anyone might want to track...
Re:Why I won't recommend Signal anymore by kuschku on Wednesday November 09, 2016 @10:01AM (#12910712)
Then why is Moxie advertising with Snowden the Signal app as communication for TAO targets?

And for non-TAO targets, WhatsApp is just as good as Signal – the users won’t read the source code anyway, and in both cases President Trump gets your social graph.

Re:Why I won't recommend Signal anymore by jhasse on Sunday November 06, 2016 @05:43AM (#12884501)
What exactly is a TAO target?
Re:Why I won't recommend Signal anymore by ethbro on Sunday November 06, 2016 @01:35PM (#12886379)
https://en.m.wikipedia.org/wiki/Tailored_Access_Operations

Aka NSA's "we really need to get access to this device and will fund diverting backbone traffic / writing firmware malware / whatever else we need to in order to get it" team(s).

Re:Why I won't recommend Signal anymore by Kimm0n0 on Sunday November 06, 2016 @08:36AM (#12884982)
Tailored Access Operations from the NSA
Re:Why I won't recommend Signal anymore by type0 on Sunday November 06, 2016 @08:15AM (#12884924)
terrible acronym obviously
Re:Why I won't recommend Signal anymore by curried_haskell on Sunday November 06, 2016 @08:26AM (#12884951)
Google has root on your phone. Even if they aren't "for now", good security sense says that we should assume that are.
Re:Why I won't recommend Signal anymore by fnordfnordfnord on Sunday November 06, 2016 @03:28PM (#12886885)
It did formerly via Carrier IQ, which was widely reported in the press. So that's not unprecedented.