Item — HN Reader

>Signal isn't even that popular

WhatsApp integrated¹ Signal's secure messaging protocol. Since then, at least one government was unable to compel² the company to produce unencrypted messages from users under investigation.

Given the popularity of WhatsApp, I think its safe to say a lot of people are now using a relatively secure messaging protocol.

¹ https://whispersystems.org/blog/whatsapp-complete/

² https://www.forbes.com/sites/parmyolson/2016/05/03/whatsapp-...

1 comments

I don't want to harp on about this again, but I really don't think you can put any sort of trust into such things as this. With GPG, you're producing an encrypted version of some text/data with a bit of code you can build yourself and run completely on your equipment, airgapped or whatever.

With signal/whatsapp, there is no way of even knowing if the code you're using "in app" is the code in github or in whatever rev wherever. Yes, I know reproducable builds -- but what stops the app fetching more code from elsewhere? Wanna bet there's a webview and some JS in that app somewhere?

It's nice to make things harder for the NSA to read, but this architecture seems to be just creating the illusion of safety and it's kind of weird to see how much advocacy it gets here when there are such obvious faults in it.

I'm not saying there's a better alternative, and congrats to all who are working on it and I'm happy to see it succeed -- but this isn't a solved problem and there's massive danger in trusting such things.

I'd love to have the time to really inspect whatsapp/signal to see what I'm sending/getting -- has anyone done this? Google isn't giving me much..

Complete protection from the NSA is not your typical user's need. Having your message opaque to bulk surveillance is about as good as a typical user can expect. If you are the explicit target of a state level actor, you're not going to win. If the Mossad wants to Mossad you, you're gonna get Mossaded.

> Complete protection from the NSA is not your typical user's need.

     They do not know. But they must be educated because it is ethical.

There is a extremly large difference between passiv listening and recording everything and cleverly hacking the Signal app, or even forcing OWS to do it for them. The cost differences alone are massive, not to mention that its harder to do while remaining hidden.

Yes its not perfect, but calling it a illusion of safety is just overly negative. If the NSA really wants you, they will get you, but that does not mean all your safty is illusion.