Signal and Black Boxes - Free software secures less than you might think

[ShooterOfCum]

I browsed community happenings and came across this thread in A&N. In it, I saw users talking about installing Signal and using it to communicate privately over telecommunication networks. Looking through existing threads to see if somebody else has made a thread about Signal, I found this thread that uncritically praises a largely performative response to Californian government subpoena. This is a mistake and this thread will explain why.

If you want a clean and comprehensive explanation of why Signal cannot be trusted, I recommend reading "Why not Signal?" (a). It's written by a USA-hating Marx lover, but the explanations of Signal are sound. It does contain some stuff about how Signal likely has its origins in CIA operations, which I am not going to vouch for. For the most part, it's irrelevant. However, this thread is not going to be specifically about Signal but more generally about how inclusion of free (as in freedom) software does not necessitate uncompromised software. A lot of people on this subforum probably already will know most of what I will talk about, so this is mainly to serve as a reference for the uninitiated in how free software can and cannot secure freedom for you.

#1 Issue: Signal is centralised​

Signal is not compromised, because it never was trustworthy in the first place. Signal's infrastructure can sort of be self-hosted, meaning you can host your own Signal servers. There is some information about the server-side workings like in this GitHub repository. However, this does not really help anything, but I will get to that in a moment.

Black boxes and you​

The age-old problem that is the Achilles' heel of free software is that you can never know two things, even if the source code is free:

• That the binary executable you are running was produced from a given source code. There is some progress made in this domain, but it remains a largely unsolved problem. The only solution is to compile your software from source, which can be annoying.
• More pertinent to the topic: that the online service you are using is running a given source code. This is likely never going to be solved. The best we got are legal mechanisms such as licensing service software under AGPLv3, which Signal actually licenses their server software under.

In a brief summary, AGPLv3 is a licence that mandates that any user interacting with the software over the network is entitled to a copy of the source code that powers the service. If Signal's servers are licensed under this licence, what is the problem? The problem is that Signal could simply choose to not run the software from the above GitHub repository, and it is just a red herring to lull you into a false sense of security. Nothing says they cannot simply do that. If they can do that, it's best assume that is what they do. You are still interacting with a black box that you have no idea what it does. It just takes input, and outputs output. None of that tells you how the input is processed or how the output is made, or if it's licensed under AGPLv3.

"But it's end-to-end encrypted?"​

It is true that the client seems to work as advertised, wherein it generates keys and encrypts your messages until they are received by its intended recipient. Let's assume that end-to-end encryption in Signal is completely uncompromised and flawless. There are still two critical things that Signal, the company, can collect to fuck you over:

• Message dates and times
• Message senders and recipients

You do not need to be able to decrypt messages to compile a social networking graph from this metadata. As this forum continues to illustrate time and time again, you can dox a person with even less information than that. The more you use Signal, the more the company knows about your social network, and this is possible because you are connecting to their central server. In this context, end-to-end encryption means absolutely nothing to preserve your privacy.

#2 Issue: Signal is openly hostile to freedom​

I did mention that Signal can be self-hosted, but only sort of. There are major obstacles that make Signal incredibly painful to self-host to the point where it is practically impossible:

• The whole infrastructure is designed from the ground-up to only run the company server, nothing else. Programming it to do otherwise is resource-intensive, from what people on the Internet are saying. I can readily believe this, considering I have not found any big project that allows an easy "run this script" self-hosting solution. In this respect, Signal is free software in name only. They do not give a single fuck about you being able to run your own instance of Signal, and it shows.
• The Matrix project has already once approached Signal with a proposition to federate with the Matrix protocol, and Signal refused (a), citing a non-concern as reason. Considering that Signal refused to federate with the biggest federated communication networking protocol currently out there, we can only conclude that Signal would prefer to keep absolute authority over all Signal communication. They say as much (a). The head of company, Moxie Marlinspike, is also an unstable character in general.
• Signal cannot federate even with itself, and any attempts to do so are aggressively put down by the company (a).

In other words, even if you do manage to somehow host a Signal server instance, it is a lot of work for laughably little gain. You cannot federate with a bigger network, or even the big boy Signal server itself. You would probably have a buggy mess that seizes constantly since it is geared at every level to only work with a specific company's infrastructure. It is completely pointless. In this context, the software being licensed under a copyleft licence means very little.

You are much better off hosting actually free implementations of widely known protocols, such as Matrix or XMPP, which can connect to a wider network of users. They also have a wider range of clients available than Signal, so anybody can connect to those networks however they want, on any device.

Conclusion​

While free software is the way to go, people seem to underestimate or not pay attention to what it cannot do for you to secure your freedom and privacy. Signal aggressively shills itself as the "end-to-end encrypted platform, it has end-to-end encrypted this, it has end-to-end encrypted end-to-end encryption, everything is end-to-end encrypted," but it is just a marketing gimmick. The platform is fundamentally nothing different from other proprietary platforms such as Discord or Telegram. You are still trusting a black box. As an occasionally wise drama whore, Drew DeVault, said, "Truly secure systems do not require trust" (a).

 

[herefortheactualthreads]

bro its so hard to read this with the dreamybull gif next to it.

 

[ShooterOfCum]

It's the reader's reaction to information in my OP.

 

[BMO_]

1 Have they even explained why you need a phone number to use their application?
2 Are Kiwi Farms PMs secure?

 

[Instant_Pot_User]

Fuck, now I have to convince my privacy-sperg friends that we all were duped by some fucker named Moxie Marlinspike.

 

[Scout Trooper]

Are Kiwi Farms PMs secure?

No.

 

[BirdUp]

Are Kiwi Farms PMs secure?

secure from attackers but not from surveillance under a gag order
the lack of transparency about code is harmless enough if you dont care about SOCMINT

 

[BMO_]

secure from attackers but not from surveillance under a gag order

Josh isn't into BDSM so I don't think a gag may be used on Kiwi Farms.

 

[BirdUp]

Josh isn't into BDSM so I don't think a gag may be used on Kiwi Farms.

itd be used on signal itself

 

[Lord Xenu]

1 Have they even explained why you need a phone number to use their application?

Signal used to be an sms application called "TextSecure". You only used internet access to exchange your keys with your signal contacts. Then it would encrypt & decrypt your sms messages in the application. When they moved to this newer model it was a big deal and made news on tech sites.
The Signal blog wrote some explanation that people did not widely accept. Most of the people I used Signal with moved to other services because they lost trust in the app. That doesnt explain why they need to continue using a phone number, but it does explain why many of the people who continued to use it didn't make a stink about it.
From a contemporary Github issue:

Dear @moxie0, the first thing I do before having breakfast is having a coffee and reading the current security news. Today, this article on Heise Security was the worst news of the day: Are you honestly thinking that SMS are going to be replaced by data connections in the future and are thus thinking that nuking the offline SMS encryption feature (as discussed in #1737) is necessesary? Are you FUCKING serious? Excuse my cursing, but I simply cannot believe you seriously decided that!

Up until this point I've been a huge fan of the Whisper Systems products - be it RedPhone, TextSecure or anything else. I've been recommending TextSecure to all of my friends, recommended them to full erase WhatsApp, explained how to connect through TextSecure, even fiddled with their phones until it worked - and now you are blatantly coming along saying that it's "too much work and confusion" connecting people through exchanging keys? I really hope that mentioned article is wrong and all this is not true.

Please rethink your decision. If TextSecure will nuke offline SMS encryption (which always was the reason why people like me and my friends used it), I'm going to fully eliminate TextSecure and replace it with a smarter choice. And I will not only do that for my own phone, but for every phone if brought TextSecure to. To be honest, even thinking about it hurts! But deep within myself I simply cannot support a Project who eliminates its upmost important feature! Have you ever thought of the fact that there are countries out there who lack data connections due to poverty or war (and probably will continue to do so for the next few decades)? What about the people living in supressed countries with supressing governments?

I very much loved TextSecure, and while writing this, I still do. In the name of all security-enthusiasts and people ou there wondering how to continue or which App to switch to, I am asking you to NOT just close this Issue, but rather have a grown-up discussion here, which hopefully leads you to the conclusion that offline SMS encryption is really important to keep.

THANK YOU for listening to the community and not just what the "trends" are going to be.

 

[ShooterOfCum]

Just noticed that I accidentally duplicated a link in OP under the "an unstable character in general" hyperlink. Fixed it, the link is the following archive: "Signal Jabs at Facebook and Navigates Growing Pains as Popularity Surges".

 

[StyxHexenHamster1350]

TL;DR: As a general rule, any instant messaging client that asks for your phone number or your email address = Probably Feds.

There are three that I have found to be safe/secure.

Briar ( https://briarproject.org/ )
(+) Open Source.
(-) Mobile only for now. Desktop client is experimental.
(+) Encrypted Chat.
(+) Identity/address is cryptographically generated.
(-) Hard to add contacts, as it requires both parties to share their address with eachother.
(i) Serverless, peer to peer over Tor network.
(+) Your IP address is not revealed to peers.
(-) This means if Tor gets knocked offline, as it has a few times in the past, chat over the internet stops working.
(+) Can chat peer-to-peer on a local network with no server and no internet connection. (probably using avahi or multicast, I dunno)
(+) Can chat peer-to-peer over bluetooth with no internet connection. (which makes it good for "dead-drop" meetings)
(+) Database is encrypted with a password.
(+) Can set up "panic button" app to wipe all app data.
(-) Cannot backup or transfer profile.

Session ( https://getsession.org/ )
(i) Forked from Signal.
(+) Open Source.
(+) Cross platform.
(+) Encrypted Chat.
(+) Identity/address is cryptographically generated.
(+) Easy to add contacts, as only one party needs to share their address.
(i) Server based, Lokinet Blockchain.
(+) Server does not have access to message content.
(+) Your IP address is not revealed to peers.
(-) Can't manually change server in app to specify your own server.
(-) You have to PAY to run your own server on the oxen/lokinet network.
(+) Supports encrypted group chats.
(i) Limit 100 users.
(i) You can host a group chat server (called "SOGS") for session, which allows many more users.
(+) Supports encrypted voice calls.
(+) Can protect app with password or fingerprint reader.
(+) Database can be deleted quickly and easily through main menu.
(+) Can backup and transfer profile.

SimpleX ( https://simplex.chat )
(+) Open Source.
(+) Cross platform.
(+) Encrypted Chat.
(+) Identity/address is cryptographically generated.
(+) Easy to add contacts, as only one party needs to share their address.
(+) You can generate one-time addresses for adding contacts you don't trust fully or don't want to be associated with your main address.
(i) Server based.
(+) Server does not have access to message content.
(+) Your IP address is not revealed to peers.
(+) You can run your own server.
(+) Can set server manually in app.
(+) Server requires minimal setup, just a single executable file to run. Asks a few yes/no questions at first run.
(+) Built in support for Tor.
(+) All official servers also have .onion addresses.
(+) Supports encrypted group chats.
(i) Number of users in a group is limited by bandwidth. Every 100 users uses 1.6mb of data per message, minimum (for the sender)
(+) Supports encrypted voice and video calls.
(+) Can protect app with pin number.
(+) Can set up a secondary "destruct" pin number that when entered on the main pin screen, deletes the entire database.
(+) Can also encrypt app database with separate password.
(+) Can backup and transfer profile.
(+) Supports multiple profiles.

 

[i440BX]

My question is why Edward Snowden endorsed this software. Something is not right if Snowden supported this. I doubt he didn't research the weaknesses of chat applications.

 

[Kosher Dill]

The article is interesting, but I submit that  most people are not deep-cover operatives who need to communicate with their shadowy Resistance Leader without getting black-bagged by the glowies. Not even Snowden (anymore).
The threat model for most users is more along the lines of "Bored fed or tech troon pulls up your plaintext messages and does CTRL-F nigg".
The point about users' social graph leaking is well-taken, but for most ordinary people the cat is already out of the bag just from what they post publicly.
If you're planning to go honk horns in Ottawa, then that may be another story, but for people not actually staring down the barrel of IRL government retaliation, end-to-end encryption is probably fine. Just know what it can and can't do, like any other tool.

 

[Magicat]

I think Signal Messenger needs more attention and scrutiny.

Earlier today the Russian Federation had blocked Signal Messenger: https://www.rt.com/russia/602396-russia-bans-cia-app/ (archive)

Full transcript:

Spoiler

Russia blocks CIA-linked Signal messenger​

RT

2–3 minutes

---

The Russian internet watchdog Roskomnadzor has restricted access to the messaging app Signal, citing legal issues.

Signal has long been promoted as a secure messenger, but critics have warned that it was developed and kept afloat with US intelligence funding.
In a statement to the media on Friday, Roskomnadzor said the ban was “due to the violation of requirements of Russian legislation, the implementation of which is necessary to prevent the use of the messenger for terrorist and extremist purposes.”

The statement came several hours after Russian users of the app began complaining about outages.
Signal was once recommended by NSA whistleblower Edward Snowden and tech mogul Elon Musk as a way to exchange messages away from the prying eyes of intelligence agencies. However, concerns about the application go back almost as far.

The Open Technology Fund that provided seed money for Signal’s developer in the early 2010s was a cutout of the US State Department, under then-Secretary of State Hillary Clinton’s ‘Internet Freedom’ initiative. According to the New York Times, Washington had sought to create “‘shadow’ internet and mobile phone systems dissidents can use to undermine repressive governments” through color revolutions, for example.

In 2017, WikiLeaks revealed that Signal’s encryptions could be easily bypassed by the CIA, using the hacking tools described in the Vault7 disclosures. In January 2022, the Swiss army banned the use of Signal, WhatsApp and Telegram, citing data protection concerns.

The US government funding for Signal reportedly ran dry last December, and the app began to struggle. Musk, who had endorsed the app in 2021, warned about “known vulnerabilities” that were “not being addressed” in May.
Russian authorities have sought to crack down on a variety of Western internet platforms in recent years, usually citing data privacy concerns as well as their hostile policies and censorship in connection with the Ukraine conflict.

This comes after the recent (May 2024) City Journal article calling into question Signal's integrity over their chairman of the board, Katherine Maher (whom Joshua had mentioned in his recent Substacks article): https://www.city-journal.org/article/signals-katherine-maher-problem (archive)


Joshua's article


Edit: translated

---

Signal has a built-in way to bypass the usual censorship measures, so this block won't wipe it out.

 

[gagabobo1997]

If the feds are part of your threat model you probably shouldn't be using ANY well known chat apps. I use signal because it was easier to convince my friends and family to use than some schizo messenger and is normie friendly.

 

[3deadniggers]

IF not signal then what is recommended?

 

[SpellforceFan]

I use signal because it was easier to convince my friends and family to use than some schizo messenger and is normie friendly.

Signal still is a schizo messenger. I had hard time convincing IT colleagues to use it, I don't want to even think about what would it take to convince a normie to use it instead of goy apps like kikebook messenger or whatever it's called nowadays.

 

[gagabobo1997]

Signal still is a schizo messenger. I had hard time convincing IT colleagues to use it, I don't want to even think about what would it take to convince a normie to use it instead of goy apps like kikebook messenger or whatever it's called nowadays.

Signal has a nice UI and is on all major app stores afaik, I haven't had too much of a problem getting people I know to use it.

IF not signal then what is recommended?

pgp encrypted messages printed on microfilm and delivered via carrier pigeon

 

[gampboonerisms]

If the feds are part of your threat model you probably shouldn't be using ANY well known chat apps. I use signal because it was easier to convince my friends and family to use than some schizo messenger and is normie friendly.

How can you live being so normal? Your friends and family think youre cool? You hang out in person with other people without a faraday cage or signal blocker? The feds are always after you, you are never safe, if not your own govt then some other govt will install asbestos walls and kill you slowly.