Re:A Formal Security Analysis of the Signal Messaging Protocol
by redwood on Tuesday November 08, 2016 @09:22AM
(#12900396)
When I first looked at this, it boggled my mind that they require a phone number to sign up. Maybe that's no longer the case? But assuming it is, it just struck me as the epitome of breaking away from the concept of secure anonymity.
[ Parent
| on HN ]
Re:A Formal Security Analysis of the Signal Messaging Protocol
by Amir6 on Tuesday November 08, 2016 @10:04AM
(#12900757)
You are absolutely right! Plus, getting a copy of all your contacts is and invasion of privacy for an app that is advocating for privacy and security.
You cant even use a online voip phone number for this app. Its just such a turn off and I'm extremely disappointed with endorsements from people like Snowden ignoring such fundamental flaws.
Re:A Formal Security Analysis of the Signal Messaging Protocol
by haffenloher on Tuesday November 08, 2016 @01:44PM
(#12902802)
> You cant even use a online voip phone number for this app.
That's incorrect. Signal works perfectly fine with any mobile, landline or VoIP number.
Re:A Formal Security Analysis of the Signal Messaging Protocol
by Amir6 on Wednesday November 09, 2016 @08:16AM
(#12909998)
In fact, what you just claimed is wrong. The app waits for the phone to receive the text and there is no way to enter the verification code you receive in another voip app.
This is on top of not being able to use this app on multiple devices.
Re:A Formal Security Analysis of the Signal Messaging Protocol
by haffenloher on Wednesday November 09, 2016 @10:48AM
(#12911015)
Let the SMS verification expire and do a phone call verification.
Concerning multiple devices: I use Signal on my phone and on two desktops, works perfectly fine.
Re:A Formal Security Analysis of the Signal Messaging Protocol
by Amir6 on Thursday November 10, 2016 @12:02PM
(#12922079)
I have tried that and it didnt work but I'll give it a try one more time.
Regarding multiple devices I mean multiple mobile devices (iOS and Android apps) and not through a browser and extension.
Re:A Formal Security Analysis of the Signal Messaging Protocol
by MrMullen on Tuesday November 08, 2016 @12:42PM
(#12902270)
> Plus, getting a copy of all your contacts is and invasion of privacy for an app that is advocating for privacy and security.
You really need to do research into this before making this claim. The phone numbers are hashed (Or something like it) before being sent to the Signal servers.
Re:A Formal Security Analysis of the Signal Messaging Protocol
by haffenloher on Tuesday November 08, 2016 @01:46PM
(#12902829)
Unfortunately, hashing provides no meaningful protection here. The preimage space (i.e. the set of all possible phone numbers) is just too small. See https://whispersystems.org/blog/contact-discovery/
Re:A Formal Security Analysis of the Signal Messaging Protocol
by kbart on Tuesday November 08, 2016 @09:39AM
(#12900554)
Hm, Signal was never about anonymity, it's just an end-to-end encrypted chat and marketed as such.
Re:A Formal Security Analysis of the Signal Messaging Protocol
by SomeStupidPoint on Tuesday November 08, 2016 @09:36AM
(#12900525)
I thought the system was supposed to provide encryption to known communication, not anonymity?
If that's the case, choosing to use an existing identity management system most people are part of is an excellent bootstrapping decision. Identity management is hard, and it's a fair problem to punt on if it's not your focus.
Encryption != anonymity. (In fact, it usually does the opposite, because encrypted messages stand out.)