> and shown to be secure/stable

For various definitions of "secure/stable".

For me, anything which Google can reach and amass information from, and thus NSA, is not secure. Rust on Linux where I am playing with, is fine.

And its not only the "conspiracy style" "why would Google put backdoors in its 'Play Services'", no its more like

"oh Google receives and sends notifications for every Signal message sent and recieved, among other information, such as Device ID, phone number, android version" - in short who is using signal and when.

Signal is amassing huge amounts of information for benefit of Google. Look at their github page, where they even say they want more to amass more data and to "annoy the hell out of users" to make them update - shove updates down their throat a la Microsoft style.

> Look at their github page, where they even say they want more to amass more data and to "annoy the hell out of users" to make them update - shove updates down their throat a la Microsoft style.

I imagine this is by design. What do I do if there is a vulnerability that a patch fixed but the person I'm taking to refuses to update?

I am not saying I like the idea of bricking an app if there's no update for three months but if you agree that the fight is against dragnet not targeted surveillance then this is a reasonable compromise.

Nope it isnt, its up to me as user to decide when to update, what Signal/other-app can do in such case is provide a simple in-app messaging system "Hey there was a vulernaribility, read more about it here in this message". Then user can decide.

And not "hey user, take this update which contains backdoors since the main developers got gagged/blackmailed, trust us this time for real".

Again, the idea that Signal's developers were "gagged" or "blackmailed" is a lie, and you should be embarrassed to repeat it.

In a security sense, this is actually a very real concern with which even a warrant canary cannot help. Could you provide hard evidence that Signal's developers have NOT been "gagged" or "blackmailed"? I think such a proof would be infeasible at best.

Again: criticism of Signal is in-bounds, but outright allegations that Signal is a shill for Google is not. Moxie is a member of the HN community, and you cannot make these kinds of allegations about him here in this fashion.

It's got nothing to do with seniority.

https://hn.algolia.com/?query=author:dang%20accusations%20sh...

How does it make more difficult for USA to get your data if encryption is not as good? This is pure nonsense, sorry. If you think the NSA is dependent on Google to suck up your data, oh boy... Sir, would you be interested in purchasing a fine bridge?

I upvoted this comment of yours because it seemed kind of unfair to me for it to be downvoted, and I don't like people being told what they can or can't do, but the gist of what you're trying to argue is complete nonsense. GCM dependence is a complete non-issue in context, and to say that because Telegram doesn't have that dependency it is safer from US intelligence is so over the top ridiculous. Signal-the-app has it's problems, and a fair share of questionable decisions, but GCM and Play Store are not among those.

That Moxie acts with contempt toward people on GitHub issues is true. It is also true that most of those people (in exchanges I have read) are complete ignorants who wouldn't know security if it hit them on the head, yet insist and yell with noble indignation that they're correct. The kind of people who were thought that more FOSS = more security is an axiom and go from there. Since he gets tons of that, I kinda understand why he might act like that. I understand, but do not condone, it's extremely off putting. In the end, one of Signal-the-app's biggest problems is that it's mostly criticized by unreasonable people.

Thank you.

There is 3 issues which Im trying to clear up here. With GCM and Signal:

1, Google and in turn USA based data-centers receive events/more-data to analyze. That this data is not the encrypted message, not the decrypted message doesnt matter. This data can be analyzed and used effectively. Its not impossible to think of "push-message for android phone available at X time - which looking through our other database shows it has Signal but doesnt have WhatsApp, hm, our other databse shows that android device has Signal app usage of X%". Oh boy.

2. Google has root on your phone, so even if the transport security is very good, it doesnt matter as the phone is effectively owned by Google and thus messages/keys can be stolen at will.

3. The choice should be with the users and not Moxie. Moxie has shown contempt and disregard for users wishes, see quote "annoy the fucking hell out of our users".

That commenter's point is relevant here because major groups in threat model have 0-days in the platforms Signal runs on and many black hats hack Android too. So, anyone with that threat model can't trust Signal at all.

Outside that threat model, it's a useful privacy tool in that it at least reduces risk ftom some vectors. Still need OS-level security like putting and trusted path on OKL4 with secure firmware. Even then, subversion risk is so great that still can't use it for nation-states. Better to put usable front end on very cross-platform, easy-to-isolate tool like GPG. Or communicate in person or mailing encrypted files/messages.