How Trail of Bits helps verify the integrity of Signal chats (blog.trailofbits.com)
62 points by dgroshev 16 hours ago
pizzaiolo 6 hours ago
Bit of a positive piece amid a negative headline this week: https://cybernews.com/privacy/police-telegram-whatsapp-signa...
wolvoleo 5 hours ago
That requires access to the actual phone and the unlock code in the case of WhatsApp (you need to identify to add a WhatsApp web client).
For telegram it's a bit easier yes, but the user can set up an additional password. I have done so of course. Note that telegram is not E2EE so they can give your stuff to the police at any time unlike WhatsApp and signal.
For signal I don't know as I don't really use it but i understand it works the same way as WhatsApp, scan a QR code and authenticate to the phone.
Also, with all 3 systems it's clearly visible when you look at the linked systems.
xingped 2 hours ago
It is possible to intercept text messages and phone calls in such a way that the recipient never even knows a text message or phone call was sent to them in the first place. SMS is an extremely insecure channel for handling authentication codes.
wolvoleo an hour ago
iamshs an hour ago
Recently a bureaucrat who wanted to make a mass protest out of his criticism of Indian Election Commission's drive to remove voters, was picked up by Indian Police and his Signal metadata was accessible to the Police. What is the solution to this thing?
His interview does not tell us if it was metadata or actual calls that were surveilled which could point to device compromise too.
"What caught him by surprise, he told ThePrint, was the Special Cell officers' access to his calls made via Signal"
https://theprint.in/india/ex-civil-servant-ashish-joshi-reca...
chews 9 hours ago
I have worked with Trail of Bits before and their cryptography teams are of the toppest of notches, I still have deep skepticism of Signal though. There are safer ways to use it, never getting push notifications is one part of it. I think their work is admirable, but the need for them to bootstrap you with SMS is a gotcha... they have usernames now, but even with those you have to have to bootstrap it with a number/identity.
crossroadsguy an hour ago
And apparently, just like Telegram, just like WhatsApp, they readily merge the username with your number if numbers are already saved.
ortekk 9 hours ago
They will allow registering without phone number as a paid option soon.
traceroute66 7 hours ago
> registering without phone number as a paid option soon
Replacing the need to register with a phone number with a requirement to pay is a better option how, exactly ?
thecrash 5 hours ago
some_furry 6 hours ago
anigbrowl 5 hours ago
two weeks
mmooss 8 hours ago
Signal's mission is to provide maximized privacy in a form the non-technical public can use.
A messaging service filled with bots and spammers is not usable, and possibly not affordable to Signal (what proportion of resources would be spent on spam/bots). What is a more private, usable solution for filtering them out than using a phone number?
Lots of security geeks want Signal to adopt practices unusable to the public. They've made clear that unsusable security is not in their mission.
wolvoleo 5 hours ago
True they can make their choices but it also means I won't support them in any way. Or recommend them.
I'd use something that's truly decentralised but signal is just another walled garden like WhatsApp. Just one that promises to behave better. But what's a promise worth these days?
A decentralised network would mean a guarantee that they can't do anything bad. I'll take that over promises and good intentions any day.
I don't care about the masses. If signing up for a matrix account is too annoying for them they don't really care about privacy anyway. After all it's the same they have to do for any online shop. Just create a username and password. Somehow it's not a problem for the masses if they wanna order a phone charger but for matrix it's suddenly 'too complicated'?
tchalla 2 hours ago
fn-mote 4 hours ago
traceroute66 7 hours ago
> What is a more private, usable solution for filtering them out than using a phone number?
Since when is giving out your phone number a "more private" option ?