←back to thread

544 points josh2600 | 1 comments | | HN request time: 0.411s | source
Show context
cdogl ◴[] No.26718524[source]
Long-time Signal user here, with a number of technical and non-technical friends, colleagues and acquaintances who also use it. I don't know who was asking for this. And I think it really dilutes Signal's message.

I believe that everyone has a fundamental right to secure, private communication. Some people may hold the same belief for the right to transfer funds. I don't agree and I suspect many others feel the same. That tension alone makes this look like a bad decision to me.

replies(7): >>26718703 #>>26718805 #>>26719043 #>>26719103 #>>26719202 #>>26720779 #>>26726663 #
cookiengineer ◴[] No.26720779[source]
I'm curious: why did you choose Signal when you care about privacy?
replies(1): >>26721022 #
fastball ◴[] No.26721022[source]
Probably because all conversations (1-to-1 and group chats) are E2EE.
replies(1): >>26721105 #
cookiengineer ◴[] No.26721105[source]
> Probably because all conversations (1-to-1 and group chats) are E2EE.

They are in WhatsApp, too. At least Facebook still claims that after the Snowden leaks :) And: Did you verify this? Did you check the source code at signal's android/ios client repo? Did you also verify that no untrusted third party receives your backed up private keys?

Why do you trust Google more than Facebook? [1]

[1] https://github.com/signalapp/Signal-Android/blob/d74e9f74103...

I'm not trying to troll here. I'm trying to point out that babbling about crypto is easy. Verifying it, and actually caring about it is another thing. Most users are probably also the wrong audience for early adoption of TOX.

replies(1): >>26725783 #
1. lxgr ◴[] No.26725783[source]
> Why do you trust Google more than Facebook? [1]

How is using Google for domain fronting for the purpose of censorship circumvention "trusting Google"? They don't get to see the message content (just like Facebook doesn't see the content for WhatsApp).

> Did you also verify that no untrusted third party receives your backed up private keys?

Private keys are not backed up in either service, as far as I know.

> Did you check the source code at signal's android/ios client repo?

Given the lack of reproducible builds on iOS/the app store, any source code audit is pointless if the app vendor is included in your threat model.