Most active commenters
  • gruez(3)

←back to thread

713 points greenburger | 23 comments | | HN request time: 2.59s | source | bottom
1. christina97 ◴[] No.44289755[source]
There’s something particularly paternalistic about this statement from the PM: “Your personal messages, calls and statuses, they will remain end-to-end encrypted”.
replies(4): >>44290025 #>>44290140 #>>44294064 #>>44296250 #
2. blitzar ◴[] No.44290025[source]
Any man who must say, "I am the King", is no true king.

Any tech company who must say, "we don't harvest your information", is a tech company that harvests your information.

replies(1): >>44293422 #
3. paxys ◴[] No.44290140[source]
Every time I read such a statment I mentally add "for now" at the end.
4. gruez ◴[] No.44293422[source]
Signal also claims the same:

> We can't read your messages or listen to your calls, and no one else can either.

Should we be suspicious of Signal as well?

replies(5): >>44293465 #>>44293484 #>>44293857 #>>44296208 #>>44352265 #
5. 7373737373 ◴[] No.44293465{3}[source]
Yes
6. selfhoster11 ◴[] No.44293484{3}[source]
Signal isn't backed by a global data gathering conglomerate, so no.
replies(1): >>44293617 #
7. gruez ◴[] No.44293617{4}[source]
You're right, they're funded by something far more sinister - the US government.

More to the point, I thought the principle was "Any man who must say, "I am the King", is no true king."? That seems to leave no room for hedging, like only distrusting "global data gathering conglomerate" or whatever. If you're have to do a holistic assessment of an organization's governance structure and incentives, you're basically admitting that witty one-liners like the above are pointless, which was my point.

replies(1): >>44295839 #
8. Krasnol ◴[] No.44293857{3}[source]
Sure you should be suspicious. You should always be suspicious. Especially if it's free. And you can do something to calm your suspicions. Like checking out Signlas Open Source code.
replies(2): >>44293904 #>>44295399 #
9. gruez ◴[] No.44293904{4}[source]
>Like checking out Signlas Open Source code.

What's preventing them from serving a backdoored version? xz was open source as well, that didn't stop the backdoor. There might be reproducible builds on android, but you can't even inspect the executable on iOS without jailbreaking.

replies(2): >>44294170 #>>44295706 #
10. rchaud ◴[] No.44294064[source]
US TV channels are inundated with Whatsapp ads claiming the same. Not surprising considering that it's been considered the "foreigners" messaging app for a long time, and the US government is now doing its very best to make them feel completely unwelcome.
11. cherryteastain ◴[] No.44294170{5}[source]
You can instead install a FOSS fork of Signal like Molly [1] built by F-Droid directly from the source code

[1] https://molly.im/

replies(2): >>44295327 #>>44295386 #
12. Tijdreiziger ◴[] No.44295327{6}[source]
Isn’t that against Signal’s terms of service? Won’t they ban you?
replies(1): >>44295455 #
13. ◴[] No.44295386{6}[source]
14. eviks ◴[] No.44295399{4}[source]
How would that calm suspicion if you're not arr/ign-orant and understand that continuous security audit is practically impossible at an individual level?
15. sneak ◴[] No.44295455{7}[source]
It is neither against the signal software’s license, nor it is against the signal service’s terms of service.

This is a false meme spread because the Signal founder (who is no longer with the company) didn’t like people making forks without changing the API server URL and running their own servers.

Open source software doesn’t work like that, however.

replies(2): >>44295897 #>>44295914 #
16. mos_6502 ◴[] No.44295706{5}[source]
Signal designs their systems from the ground up to deliver verifiable trust mechanisms (via remote attestation) along with data minimization/zero-access encryption techniques.

Here’s one such example, which is also an interesting technical deep dive: https://signal.org/blog/building-faster-oram/

17. worik ◴[] No.44295839{5}[source]
> they're funded by something far more sinister - the US government.

What does that mean?

18. ◴[] No.44295897{8}[source]
19. Tijdreiziger ◴[] No.44295914{8}[source]
Whether they’re open source doesn’t matter (for this question). They control (their instance of) the server.

As you say, I do remember them issuing some threats about it, so it would be interesting to know if they’ve changed their stance on this.

(Discord, as an example, has banned users for using alternative clients.)

replies(1): >>44299654 #
20. blitzar ◴[] No.44296208{3}[source]
Yes, in proportion to the number of times they bring it up in a conversation.
21. signal11 ◴[] No.44296250[source]
The key in that statement is “personal”. WhatsApp already has “ads in the chat list”, aka messages from businesses that have your details. Rolled out in Asia first, and now in Europe. WhatsApp allows you to opt out of each sender. No way to opt out of all business messaging.

Messages from businesses are absolutely not private.

22. sneak ◴[] No.44299654{9}[source]
Alternative clients are banned in the Discord TOS. The Signal TOS is on their website and doesn’t prohibit any clients.

Also, separately, the idea that you can only use a service with a certain client is dumb.

Imagine if a website said you can only use a certain browser, or they ban you. It’s ridiculous.

23. andreyf ◴[] No.44352265{3}[source]
That's not the same thing at all. Especially as LLM's get smaller, WhatsApp can make a lot of money reading your messages and listening to your calls on the endpoint in order to market segment your ads while remaining e2e encrypted.