undefined | Better HN

0 pointspadraic7a9y ago0 comments

"Signal is bad as explained previously, it requires Google on your phone to even work.

If you think Google is more trustworthy than Facebook, sure go ahead and just use Hangouts or whatever."

Every time Signal comes up on HN people make this point (Signal is bad) as if it is true.

And every time it is exposed as bs.

0 comments

A legitimate criticism is that they make it hard for people who don't want to use play services to user their app. For the privacy of the messages themselves, google really cannot interfere, unlike WhatsApp/Facebook.

padraic7aOP9y ago

There are certainly people who want to use Signal without Google services.

I don't know how legitimate a complaint it is since Moxie et al have said that they would accept a well written pull request which provides similar functionality. But this just hasn't been forthcoming.

What I dislike about Signal mentions on HN is that aggressive posters conflate a number of different issues people have with Signal - lack of federation, reliance on Google push notifications, lack of SMS support, etc - and somehow lump them in together.

[Just to be clear - I am not saying you are doing this].

yoo1I9y ago

I don't have a lot of skin in the game, but I am genuinely curious as to what you mean. How else other than "lump[ing] them in together", would you comprehensively criticize it?

I mean, two things good about Signal is that it let's you chat with friends and family in a secure manner.

There are these following issues though: I doesn't federate, it relies on Google Push, it doesn't support SMS. Also, I don't like how Signal does [...]"

Is that already an invalid way to make an argument ?

1 more reply

JJJollyjim9y ago

AFAIK, Play Services is controlled by Google and has system-level permissions, so it could easily access Signal messages post-decryption if Google wanted it to.

jononor9y ago

The JVM is also under Googles control, so they could similarly access it there? Or is that open and audited? How to verify which JVM my device runs?

EDIT: of course the fewer attack vectors the better

1 more reply

j / k navigate · click thread line to collapse

0 comments

otalp9y ago

padraic7aOP9y ago

There are certainly people who want to use Signal without Google services.

[Just to be clear - I am not saying you are doing this].

yoo1I9y ago

I don't have a lot of skin in the game, but I am genuinely curious as to what you mean. How else other than "lump[ing] them in together", would you comprehensively criticize it?

I mean, two things good about Signal is that it let's you chat with friends and family in a secure manner.

There are these following issues though: I doesn't federate, it relies on Google Push, it doesn't support SMS. Also, I don't like how Signal does [...]"

Is that already an invalid way to make an argument ?

1 more reply

JJJollyjim9y ago

AFAIK, Play Services is controlled by Google and has system-level permissions, so it could easily access Signal messages post-decryption if Google wanted it to.

jononor9y ago

The JVM is also under Googles control, so they could similarly access it there? Or is that open and audited? How to verify which JVM my device runs?

EDIT: of course the fewer attack vectors the better

1 more reply

j / k navigate · click thread line to collapse