Hacker News Reader

Hacker News

Comment by motohagiography | Hacker News Reader

Full thread

motohagiography

Trust it to what?

I use Signal because I think it protects my SMS messages from:

a) being harvested and read by other apps on my phone

b) being read by someone who unlocks my phone

c) being passively intercepted and stored by carriers and their snoopy employees

d) opposition researchers or private investigators targeting my friends, acquaintances, and business associates.

For anything targeted and state level, all bets are off anyway, so it's not a solution for people who have that problem. What am I missing?

View on HN

I use Signal because I think it protects my SMS messages

It depends. I think calling them simply SMS messages instead of being more precise is misleading because: Text messages sent through your mobile SMS/MMS plan are insecure and need your phone to be connected to your mobile network.

and

Signal Desktop does not send or receive SMS/MMS messages. Only Signal messages will be sent or received. The desktop app is an independent client that works whether or not your mobile device is present or online. We also want to encourage users to move away from insecure legacy protocols.

https://support.signal.org/hc/en-us/articles/360007321171-Ca...

I find it very confusing.

It has other features, but the main point of using Signal is to send encrypted messages to people using the PSTN directory service (e.g. phone numbers). You are still in that sandbox.

The secondary feature it it ostensibly encrypts messages at rest on your device so they cannot be decrypted and read by other apps. (Assuming that's true.)

If you want a more secure messenger, use Wickr, Riot/Matrix/whatever it's called now, or protonmail or something similar, as these don't depend on the phone directory for identity and so they resist some traffic analysis and contact tracing as well.

The threat model is both the business model and use case for security products, so talking about the features or implementations outside the context of the threat model is going to just add uncertainty, imo.

Sure. Agreed. I was responding to your statement that you can send encrypted SMS messages using that handy PSTN directory access provided by Signal.

You can't.

I think this is a common misconception.

Open loop criticisms are why I often can't stand other security and crypto people.

To be clear, if someone is a Signal user, you use their phone number for directory discovery and initializing identity, then Signal messages themselves are encrypted and transported via Signal servers using WebRTC as a transport protocol?

I think without a sequence diagram, most discussion of security protocols is pointless.

Signal does not send encrypted SMS messages. Period. It can send encrypted messages but they are not SMS.

I think that without using the same words that other "security professionals" (which I would not class myself as) use most discussion becomes absolutely pointless.

Reply on news.ycombinator.com