News for hackers. Stuff that matters.
Re:Wrong signal by tptacek on Monday November 28, 2016 @12:09PM (#13056760)
This isn't the security community. The security community is pretty much unanimous in supporting Signal over all other secure messengers. That's not to say that security people aren't critical of Signal, which isn't perfect for all the reasons this blog post points out --- Grugq is a pretty good source for these kinds of criticisms through the lens of an infosec person. But security people tend to deliver these criticisms as, you know, criticisms --- not angry appeals for people to abandon Signal.

The entities most harshly critical of Signal are supporters of other messaging applications and protocols.

I think the most important thing to understand about secure messengers is that messaging in general is a back-ally knife fight of a market, one of the most vicious I've seen in my career. Perhaps it's because of the WhatsApp outcome and a general belief that there's another such outcome for some other messaging app. Or it could just be the network affect. Messaging applications themselves are interesting UX challenges, but as programming challenges they're pretty close to socket projects. So there are a lot of entrants in the market. Whatever the reason, the knives are out for Signal.

I don't so much care what messaging system you use to talk to your friends or chat with your gaming guild. But if you have real adversaries, the security part of your messaging system has to work, even more than the messaging part. For that situation, Signal is the only messaging system I'd recommend unreservedly.

Re:Wrong signal by smarinov on Monday November 28, 2016 @12:59PM (#13057138)
> This isn't the security community. The security community is pretty much unanimous in supporting Signal over all other secure messengers.

Sorry, but I am still yet to see the proclaimed unanimous support for Signal as a messenger. As a protocol – sure, most infosec professionals obviously support Axolotl, but this does not imply your statement in any way.

> The entities most harshly critical of Signal are supporters of other messaging applications and protocols.

So the support for Signal isn't that “unanimous” after all, is it?

Otherwise, of course they will if they think that Signal has lost the proper direction for some reason (according to their view). Even many protocol supporters prefer using something like WhatsApp or Wire, the former due to its purported network effect and the likes of the latter because of features like E2E encrypted file transfers, 1:1 video or group calls w/o apparent security trade-offs compared to Signal.

> I don't so much care what messaging system you use to talk to your friends or chat with your gaming guild. But if you have real adversaries, the security part of your messaging system has to work, even more than the messaging part. For that situation, Signal is the only messaging system I'd recommend unreservedly.

In the end, it turns out that this is your personal opinion, not that of the security community as a whole (hint: there is none), which is fine if you didn't misrepresent it in most of your post. The networks of other people may or may not choose to go a different way, although some (or even many) of them may support the same core technologies, just because they do not agree with some decisions OWS made along the way and don't want to reconsider for any reason opposing parties have presented, e.g. in articles like the one we are commenting under.

To sum up, feel free to suggest Signal as an instant messenger, but please be careful with your supporting claims because there are other great and upcoming messengers out there like Matrix, Wire, Onion.chat, GNU Ring, any of the mentioned elsewhere Telegram and WhatsApp, or many, many others. Signal has legitimate reasons on its side that will make your argument weigh more than unjustified claims that it should apparently be the end-all and be-all of one's instant messaging needs.

Re:Wrong signal by tptacek on Monday November 28, 2016 @01:02PM (#13057158)
I think you misread my comment, which didn't suggest that there is universal support for Signal among everyone, just among security professionals (I adopted the term "security community" from the parent comment, but I agree with the implied criticism that the term "security community" is largely meaningless).

A good way to rebut my claim would be to cite the most high-profile security engineer or security professional or crypto engineer or crypto scientist you can think of who recommends some other system over Signal.

Re:Wrong signal by baka on Monday November 28, 2016 @08:26PM (#13059967)
Unfortunately, and to a large extent why people listen to "open source advocates", the community of security professionals has a surprisingly bad record when it come to things like risk analysis, legal matters, understanding how law enforcement or intelligence agencies work and other ”soft skills”. I trust security professionals when it comes to crypto. Anything else I'm not convinced they aren’t as incompetent as everyone else in software and maybe even more so.
Re:Wrong signal by tptacek on Tuesday November 29, 2016 @12:02AM (#13060956)
So, I totally agree with this but would like to know more, specifically, about why you believe it, to avoid talking past you. What are your specific concerns?
Re:Wrong signal by aftbit on Monday November 28, 2016 @12:39PM (#13056974)
How can you reasonably suggest trusting a mobile device if you have "real adversaries"? If you define your threat model to include any serious governmental interest, you cannot trust a cell phone. They have an always on network connection, remote auto-upgrade capability (at least for the baseband, if not the user software), and built-in microphone, cameras, gps, and other sensors.
Re:Wrong signal by tptacek on Monday November 28, 2016 @12:52PM (#13057083)
Some of these concerns aren't valid (for instance: the baseband of your phone is less powerful, in its systems design, than is supposed by open hardware advocates), but mostly the issue is: security is about costs and prioritization, not absolutes. The systems people propose instead of Signal are likely to cough up secrets directly to adversaries; switching from Signal to something else reduces security.

If you believe people with state-level adversaries should exclusively use transparent and open hardware, that's fine; you should see Moxie's comment on this thread to learn how you might go about ensuring that the tiny minority of users with that hardware have access to Signal on it.

Re:Wrong signal by egh5oon on Monday November 28, 2016 @02:00PM (#13057552)
Spot on. Many companies pushing "secure" applications conveniently forget to warn users about the false sense of security. The cryptography might be flawless, but everything else...
Re:Wrong signal by cwmma on Monday November 28, 2016 @02:40PM (#13057805)
Yeah good point, it's less the infosec community that has the knives out for signal as much as the other messenger app folks and the HN diehards that will never accept a protocol that isn't totally federated and maximally secure.