Hacker News Reader

Comment by rvz | Hacker News Reader

I was just talking about Signal one hour ago whether if it was available on PinePhones or the Librem 5 which seems very unclear, and now this happens on Android devices.

Does this mean that not only I can't yet recommend a PinePhone or Librem 5 yet, but for current Android users I can't even recommend Signal to anyone due to this issue?

View on HN

Email. Why are we still trying to push these instant messaging apps that are a privacy and security nightmare? (I realise email has security issues too).

Email has weaker EtoE encryption than these IM solutions. Even with GPG. Too much metadata is leaked. However the decentralised nature of email is one crucial advantage it has over these apps.

I agree about the EtoE encryption weaknesses. However since I can send email from my own email server to another email server without it touching a 3rd party (not including the ISPs and DNS servers) means EtoE is not such a massive issue.

I can't make phone calls or video calls over email, but for text, small files and images it's perfect (given how long email has been around it goes to show how good it is).

You could in theory (but this is like putting plasters on a colander) relocate some of the MIME meta data (Subject:, To:, From:) to the email body and then encrypt it.

So basically obfuscate the MIME headers and use some kind of guid@domain type addresses for the MTA routing.

"Weaker E2EE" as in "PFS is not commonly used with email". As for the metadata, no metadata is leaked that signal does not also leak.

>As for the metadata, no metadata is leaked that signal does not also leak.

Signal does not leak to third party servers with whom I talk to. There's encrypted comms to the server, and that's it. I try to talk to someone who has gmail account, Google now has access to 100% of my metadata with that contact. I trust Signal more than I trust Google with my metadata.

Also, there's precedent from TWO court cases Signal doesn't collect your metadata. Show me one email vendor that has such real-life proof about not collecting metadata about their users.

Metadata is leaked only to your server and to the server of the person that receives the email, just like signal. The only difference is that with email you get a maximum of 2 servers while with signal you get one.

> I trust Signal more than I trust Google with my metadata.

Fair enough, I will agree with this.

I really enjoy the email chains that have about 1mb of HTML for a footer. The chain ends up being 100s of MB for about 6 paragraphs of text. Very inefficient

Reply on news.ycombinator.com