Re:Signal's Sealed Sender anonymity is broken
by tptacek on Tuesday March 07, 2023 @06:04PM
(#35062603)
Which "important features with major vulnerabilities" are you referring to?
[ Parent
| on HN ]
Re:Signal's Sealed Sender anonymity is broken
by autoexec on Tuesday March 07, 2023 @06:40PM
(#35063014)
The "sealed sender" feature mentioned in the article.
Re:Signal's Sealed Sender anonymity is broken
by tptacek on Tuesday March 07, 2023 @07:02PM
(#35063260)
Just so we're clear: this is (a) a feature no other mainstream messenger has, meaning that the worst implication of it is that Signal is no more anonymous than alternatives, and (b) is a pretty straightforward traffic analysis attack. The server is oblivious to the identities of senders, but recipients reply to senders and can be correlated.
Re:Signal's Sealed Sender anonymity is broken
by autoexec on Tuesday March 07, 2023 @08:46PM
(#35064107)
> Just so we're clear: this is (a) a feature no other mainstream messenger has, meaning that the worst implication of it is that Signal is no more anonymous than alternatives
No more anonymous than some alternatives, although likely no more than mainstream alternatives, but while also leaving users with a false sense of security since this feature was supposed to prevent the exact thing it's allowing.
> is a pretty straightforward traffic analysis attack.
"straightforward" traffic analysis attacks that expose people who would normally be protected by VPNs and/or TOR, but now aren't purely because of how Signal works.
I mean, not only did these researchers find and disclose the flaw for free, they also came up with and tested solutions to the problem but still signal is like "nah, we'll keep it broken!"