Hacker News Reader

Comment by ggm | Hacker News Reader

Weakness in the linked devices security model. And so by extension, tools like "beeper"

If you don't link devices and check there are no linked devices your side of things is OK but you have no certainty in group chats or the other side one on one. So it's down to your own trust in the other party/parties.

"Two can keep a secret if one of them is dead"

View on HN

This doesn't invalidate your point, but FYI, you can open your contact's info in the Signal app and see the number of linked devices they have. If someone is concerned enough about this, they could ask their contact to unlink all devices.

EDIT: I'm using a fork, which may be why I'm seeing it and others aren't. See below.

Given sufficient mutuality, you can have some assurance of e2e but your risk here is your own and the other ends OPSEC which is all the NSA guidance really can re-inforce: the more people and devices you bring into an exchange the less likely it is you really have secure communications.

I don’t see this information for my contacts in the signal iOS app.

I don't see it in the Android app either, and I find the original claim very hard to believe in the first place, since that would be a weird piece of information for Signal to reveal about a user.

Apologies for the mistake. I'm running a Signal fork called Molly[0]; the feature I mentioned seems to be unique to that fork, based on a search of the code.

However, it shows that the data is being provided to the client by the server, in some way. This is a guess, but it may be because sending clients have to encrypt with a key for each device.

Here's the code:

https://github.com/mollyim/mollyim-android/blob/26403ab1806a...

[0] https://molly.im/

[0] https://github.com/mollyim/mollyim-android

Reply on news.ycombinator.com