Users of the Signal messaging app got hit by a hacker attack. We analyze what happened and why the attack demonstrates that Signal is reliable.

  • JonesOP
    link
    fedilink
    arrow-up
    5
    ·
    2 years ago

    To be fair, even though they bypassed the 2FA, they did not get access to previous conversations and contact list. That’s the point of the article, right?

    • bkrl
      link
      fedilink
      arrow-up
      5
      arrow-down
      3
      ·
      2 years ago

      Even if the encryption does not collapse, it is still an app full of identifiers. That makes metadata available. An attacker could figure out who contacted whom.

      • JonesOP
        link
        fedilink
        arrow-up
        6
        arrow-down
        1
        ·
        2 years ago

        Whenever someone says “Signal is not good enough”, my answer is “what’s your threat model”? For me it’s a pretty damn good compromise given that all my friends and family are on it (as opposed to e.g. using WhatsApp or Telegram 99% of the time and a perfect alternative with one contact). The day I can realistically think about making my contacts move to a better alternative, I’ll do it. In the meantime, that’s the best I’ve got. And it’s not too bad, to be fair.

        • bkrl
          link
          fedilink
          arrow-up
          1
          arrow-down
          1
          ·
          edit-2
          2 years ago

          Uh, I forgot to tell you that the “account” is safely saved locally (something) like jones.zip. That’s it!

        • bkrl
          link
          fedilink
          arrow-up
          2
          arrow-down
          2
          ·
          2 years ago

          In the meantime, that’s the best I’ve got. And it’s not too bad, to be fair.

          Are you quite certain? Have you looked hard and concluded that Signal is the best alternative available today?

          I can tell you that my messenger doesn’t use identifiers, it doesn’t track me, it doesn’t care who my contacts are, it doesn’t ask for my email, phone number, and importantly it does everything Signal does.

          • JonesOP
            link
            fedilink
            arrow-up
            4
            ·
            2 years ago

            Yes, I have been following Signal and alternatives since… well since TextSecure was only for SMS. And I find that many times people critical about Signal don’t really know much about it except for the fact that it uses the phone number (not the email).

            Again, not saying it’s perfect. Just that for my threat model (which arguably is a valid threat model for billions of people), it’s a very good solution.

            • bkrl
              link
              fedilink
              arrow-up
              2
              arrow-down
              1
              ·
              2 years ago

              You cannot know what kind of government we will have in ten years, nor is it said that your good behavior will be enough to keep you out of trouble. Millions of Jews had done nothing wrong, yet they were persecuted. Moreover, the fact that you have nothing to hide does not fully express what you could do if you had instead: sort of like giving up your right to speak because you have nothing to say.

              • JonesOP
                link
                fedilink
                arrow-up
                4
                ·
                2 years ago

                This seems completely off-topic to me. I never said I have nothing to hide. The Signal client app (i.e. the part that you can audit, compile and run, not the server) provides a lot of privacy already: e2e encryption via the excellent Signal protocol, private profile, private groups, sealed sender. So in terms of metadata, the Signal server never knows what you write, who is in which group, and to whom you are writing. Again, from the client code that you can audit yourself before you run it.

                On top of that, leveraging the secure enclaves, the Signal server (tries to) guarantee(s) the private contact discovery (based on the hashes of your contact list). Which means that if you trust the SGX enclave, all that the Signal server knows is your phone number. If you don’t trust the enclave, then you can assume that the server got access to your contacts when you did the discovery (i.e. when you installed the app).

                That’s very, very, very far from saying I have nothing to hide.

                • linzilla
                  link
                  fedilink
                  arrow-up
                  2
                  arrow-down
                  2
                  ·
                  2 years ago

                  Signal introduced closed-source server side code last November. The founder and CEO stepped down from his position this January… End of story to me about Signal

                  • JonesOP
                    link
                    fedilink
                    arrow-up
                    2
                    ·
                    2 years ago

                    Signal introduced closed-source server side code last November.

                    What? I’m not aware of that. Source?

                  • bkrl
                    link
                    fedilink
                    arrow-up
                    1
                    ·
                    edit-2
                    2 years ago

                    Oh yeah bro. You have my thumbnail up. Seems only a detail but freedom defenders (Signal) have their backs sitted in California…

            • bkrl
              link
              fedilink
              arrow-up
              2
              arrow-down
              3
              ·
              2 years ago

              It is the sole messenger that doesn’t use identificators. You cannot get wrong.

                • bkrl
                  link
                  fedilink
                  arrow-up
                  1
                  arrow-down
                  2
                  ·
                  2 years ago

                  At the moment I think more than 3000 people. Young app. Needs it to spread.