News for hackers. Stuff that matters.

A comment on A Formal Security Analysis of the Signal Messaging Protocol. Parent comment

Re:A Formal Security Analysis of the Signal Messaging Protocol by Amir6 on Tuesday November 08, 2016 @10:04AM (#12900757)
You are absolutely right! Plus, getting a copy of all your contacts is and invasion of privacy for an app that is advocating for privacy and security. You cant even use a online voip phone number for this app. Its just such a turn off and I'm extremely disappointed with endorsements from people like Snowden ignoring such fundamental flaws.
[ Parent | on HN ]
Re:A Formal Security Analysis of the Signal Messaging Protocol by haffenloher on Tuesday November 08, 2016 @01:44PM (#12902802)
> You cant even use a online voip phone number for this app.

That's incorrect. Signal works perfectly fine with any mobile, landline or VoIP number.

[ Parent | on HN ]
Re:A Formal Security Analysis of the Signal Messaging Protocol by Amir6 on Wednesday November 09, 2016 @08:16AM (#12909998)
In fact, what you just claimed is wrong. The app waits for the phone to receive the text and there is no way to enter the verification code you receive in another voip app. This is on top of not being able to use this app on multiple devices.
[ Parent | on HN ]
Re:A Formal Security Analysis of the Signal Messaging Protocol by haffenloher on Wednesday November 09, 2016 @10:48AM (#12911015)
Let the SMS verification expire and do a phone call verification.

Concerning multiple devices: I use Signal on my phone and on two desktops, works perfectly fine.

[ Parent | on HN ]
Re:A Formal Security Analysis of the Signal Messaging Protocol by Amir6 on Thursday November 10, 2016 @12:02PM (#12922079)
I have tried that and it didnt work but I'll give it a try one more time. Regarding multiple devices I mean multiple mobile devices (iOS and Android apps) and not through a browser and extension.
[ Parent | on HN ]
Re:A Formal Security Analysis of the Signal Messaging Protocol by MrMullen on Tuesday November 08, 2016 @12:42PM (#12902270)
> Plus, getting a copy of all your contacts is and invasion of privacy for an app that is advocating for privacy and security.

You really need to do research into this before making this claim. The phone numbers are hashed (Or something like it) before being sent to the Signal servers.

[ Parent | on HN ]
Re:A Formal Security Analysis of the Signal Messaging Protocol by haffenloher on Tuesday November 08, 2016 @01:46PM (#12902829)
Unfortunately, hashing provides no meaningful protection here. The preimage space (i.e. the set of all possible phone numbers) is just too small. See https://whispersystems.org/blog/contact-discovery/
[ Parent | on HN ]