Re:Cross-signing and end-to-end encryption by default
by xorcist on Friday May 08, 2020 @07:57AM
(#23113742)
> Who the message they received is _to_ in the sense of which Signal account it's for, they need to know
And, by extension, the exact real world identity and location of this person.
Signal promises not to store metadata, but definitively have access to it.
Re:Cross-signing and end-to-end encryption by default
by tialaramex on Friday May 08, 2020 @08:36AM
(#23114120)
> And, by extension, the exact real world identity and location of this person.
Not at all? Most likely what's happened here is that you don't understand what "by extension" does in a sentence.
Re:Cross-signing and end-to-end encryption by default
by xorcist on Saturday May 09, 2020 @04:23AM
(#23123089)
Not unlikely. Feel free to explain further.
Hopefully the difference about having access to data and storing data is still clear?
Re:Cross-signing and end-to-end encryption by default
by hiq on Friday May 08, 2020 @07:01AM
(#23113391)
More info on the sealed sender functionality which is IMHO one of the main distinguishing feature of Signal: https://signal.org/blog/sealed-sender/
Apart from that, group membership is also E2EE, which is a signifiant piece of metadata.
"Who you send a message to" is actually a relationship between two pieces of information, a sender and a recipient but Signal doesn't collect this in most cases.
Who the message they received is _to_ in the sense of which Signal account it's for, they need to know in order to store it and pass it on. But who you were they don't need in most cases because of their Sealed Sender feature.
When you converse with Alice your phone fetches profile data that it is able to unlock because Alice's phone agrees you're a friend and provided the key to do so. Alice's profile includes tokens that her friends can use to send her messages. Subsequently your phone presents a token authorising you to send messages to her, and so Signal does not ask it to identify itself when sending this message.
As a result Signal intentionally does not learn who sent these routine messages between friends and acquaintances even though the message recipient can determine who sent them.