Hacker News Reader

Comment by sjfiekzjndn | Hacker News Reader

No, you have factually incorrect information. OWS shut down this fork because it removed Google Cloud Messaging:

https://github.com/LibreSignal/LibreSignal

In what way is it out of bounds to point out deeply suspicious behavior?

To say "OWS shut down this fork" is a rather drastic distortion of the truth. The project was simply not entitled to running on OWS servers, or of re-using the Signal trademark, both of which are perfectly understandable.

And if you look at the repo that you linked, this is called out right at the top of the README:

In the same thread, Marlinspike said that he would be willing to consider "a clean, well written, and well tested" pull request that would add WebSocket support to the Android version of Signal. This would effectively eliminate Signal's dependency on GCM and thus allow the official Signal app to function on custom Android ROMs that do not include Google Play Services. There is now a bounty on making this pull request, and the person/team making the pull request would also receive whatever the BitHub payout would be at the time.

...

To be clear, Signal relying on GCM is only an issue for people who use a custom Android ROM without Google Play Services. For the vast majority of people who do have Google Play on their phone, this issue is completely irrelevant. Signal is designed so that GCM is only used for a wakeup event and never sees any of the encrypted Signal messages.

Moxie has explained this over and over again, and comments like this continue to pretend that he hasn't, while re-raising the falsehood that Google sees Signal messages. This is tendentious trolling, not good-faith conversation and debate. Which is why your last comment was flagged off the site.

You're mischaracterizing my claims. GCM allows Google to extract metadata about who you are messaging and when you are messaging them. They then have the capability to reconstruct your social network graph and select you for further targeting via silent updates if needed.

No, it does not. GCM is used to wake the app, and for no other purpose. No message metadata is sent over it.

And why do you suppose that they're unable to record the wake events? They don't need metadata from Signal: they can make their own, which is precisely what I've been trying to say this entire time. That's enough for them to reconstruct your social graph.

Signal is seemingly built around providing the image of anonymity and security, but has glaring design flaws which negate these.

I'm sorry, I seem to have given the impression that I doubt your ability to play six-degrees-of-Google-breaking-Signal. I do not doubt that. You've ably demonstrated your ability.

Assuming you are in fact the other newly created account with the random-looking username above, then you explicitly stated that Signal "forces you to send messages over Google servers".

This is straightforwardly false: the user does not send anything over Google servers in the course of using Signal. Signal sends an empty push notification over GCM to users who have received a message; while technically true, to, in a discussion of a messaging platform, refer to empty push notifications as sending "messages over Google servers" is prone to misinterpretation as false statements that the "messages" going over Google servers contain any information about the messages being sent over the messaging platform.

Additionally, the use of GCM only allows Google to extract metadata about when a user receives messages; GCM messages aren't necessary to notify you when you've sent a message, so I'm not sure how you propose that Google can infer when a user sends a message and who that user is messaging. Could you elaborate on this?

Reply on news.ycombinator.com