Hacker News Reader

Comment by ubercow13 | Hacker News Reader

Yes. Signal's only selling point is privacy. Both of these bugs are huge privacy breaches that kill its value proposition.

Which type of privacy breach is more likely to have tangible and direct negative effects on an average user's life - a nation state storing their communications in a database, Facebook graphing their contacts and using them for friend recommendations, or their friends/family/boss/acquaintances being sent random private photos from their phone and audio of private conversations they have in their home, without them knowing?

One of the main worries with companies having access to your unencrypted private data is that no matter how careful they are with it, it can still end up in the wrong hands. Signal is directly sending your data into the wrong hands.

View on HN

I agree these bugs that Signal has are serious. With hat said, your examples aren't that great for counters.

"a nation state storing their communications in a database" - The power differential and historic missteps of governments makes this ludicrous to think of as "OK" in comparison.

"Facebook graphing their contacts and using them for friend recommendations" - but, it's not just for friend recommendations and possibly more importantly, it's not just their users, is it? Not to mention it's ignoring the purposeful opinion-biasing they have openly taken part in to manufacture consent for any number of issues.

While these bugs are bad and should be prioritized for fix, they are seemingly random. Sure they can possibly be exploited (possible, haven't seen proof of concept for purposeful exploitation), but random bugging vs clear and present danger on current and historical precedents of governments and technocratic oligarchs? Me thinks your trust may be a bit misplaced or you're just being obtuse for sake of obtuseness.

>The power differential and historic missteps of governments makes this ludicrous to think of as "OK" in comparison.

wasn't that kind of the point?

>Yes. Signal's only selling point is privacy. Both of these bugs are huge privacy breaches that kill its value proposition.

Absolutely agree. However, you should always look at the bigger picture

a) How was the issue handled? What was the priority? Did they try to downplay it? Was the type of vulnerability patched altogether?

b) If a) merits for change, what's the alternative that has better overall security, UX, existing userbase, and track record.

Personally, I'd rather take a product with good public incident handling track record, than one without anything on public record.

>One of the main worries with companies having access to your unencrypted private data is that no matter how careful they are with it, it can still end up in the wrong hands. Signal is directly sending your data into the wrong hands.

Categorical label of "wrong hands" is unnecessarily ominous. Company with access to your private data can lead to that data being sold, or stolen by nation states / organized crime. You sending nudes / sensitive documents to your friend on Signal is less dangerous, although it can be much more embarrassing. Your peer probably isn't going to sell it to the highest bidder (or was it the case the recipient could be any Signal user? IIUC that was not the case)

Reply on news.ycombinator.com