200
i've just seen a comment in a post, in this very community, saying people trust signal because of missinformation (from what i could undertand).
if this is true, then i have a few questions:
-what menssaging app should i use for secure communications? i need an app that balances simplicity and security.
-how to explain it to my friends who use signal because i recomended?
-what this means for other apps in general?
Let's not pretend the hypervisor doesn't have full access to the VMs memory and execution. The only thing protecting the Signal server is Intel SGX.
I don't think Signal trusts the AWS server either, that's the point of E2EE encryption.
I'm not claiming the contents of the messages are at risk here. You're social graph and metadata though is another story.
The only data they store are account creation time and last connection time.
https://signal.org/bigbrother/district-of-columbia/
Well no, they store more data than this. They store your contacts as well, that's how they can do contact discovery. There's a hashing and linked list mechanism for it. It's better now. But it used to be a simple hash, something for which you could build a rainbow table in a few hours, at the worst.
It also.foesnt really matter if the software itself can easily be tampered with in memory by the hypervisor. Like I said, they are putting a lot of trust in Intel SGX. And thus the data doesn't need to be stored for issues to arise.
https://signal.org/blog/private-contact-discovery/
... Providing you trust Intel SGX.
😃
conspiracy begins...
What conspiracy? CPU bugs aren't a conspiracy, they are just a fact. Amazon's involvement with American three letter agencies isn't a conspiracy, it's a fact.
Yea but if you worry about CPU bugs there is no such thing as trust, no matter who owns the infrastructure. Any software can have critical bugs and any system that can be accessed remotely can be compromised. Personally I'd trust the people at Signal that they have made a reasonable architecture section to balance availability and privacy
I don't take anything from someone I don't trust that also explicitly doesn't use warrant canaries because he says they don't work in contradiction to every legal authority.
It's also an issue that they run the signal server on one single AWS region.
It isn't hard or even all that expensive to run on multiple regions.
It's not me you need to tell this though.