zlacker

[return to "Privacy is priceless, but Signal is expensive"]
1. Drbles+jW1[view] [source] 2023-11-17 02:59:57
>>mikece+(OP)
2022 Salaries for those interested: https://projects.propublica.org/nonprofits/organizations/824...

Compensation Key Employees and Officers Base Related Other

Jim O'leary (Vp, Engineering) $666,909 $0 $33,343

Ehren Kret (Chief Technology Officer) $665,909 $0 $8,557

Aruna Harder (Chief Operating Officer) $444,606 $0 $20,500

Graeme Connell (Software Developer) $444,606 $0 $35,208

Greyson Parrelli (Software Developer) $422,972 $0 $35,668

Jonathan Chambers (Software Developer) $420,595 $0 $28,346

Meredith Whittaker (Director / Pres Of Signal Messenger) $191,229 $0 $6,032

Moxie Marlinspike (Dir / Ceo Of Sig Msgr Through 2/2022) $80,567 $0 $1,104

Brian Acton (Pres/Sec/Tr/Ceo Sig Msgr As Of 2/2022) $0 $0 $0

◧◩
2. jilles+Fq2[view] [source] 2023-11-17 07:58:20
>>Drbles+jW1
Aside from the salaries, which I agree are a problem, I think there are a lot of architectural issues that are both costly and not so secure.

> We use third-party services to send a registration code via SMS or voice call in order to verify that the person in possession of a given phone number actually intended to sign up for a Signal account. Simple solution, go distributed.

6M $ for that. Stop doing that. What do dictators control? Mobile phone networks and other infrastructure. And, yes, they really do go after people any way they can.

This "cost" puts people into danger. Coupling identity and operator infrastructure is a critical privacy flaw. And a costly one too apparently. If your #1 goal is to be the most private solution, this cannot be tolerated to continue to be the case. Get rid of it. Your identity should be your cryptographic key.

◧◩◪
3. caeril+Vu3[view] [source] 2023-11-17 15:28:12
>>jilles+Fq2
> This "cost" puts people into danger.

They know this, but it's likely a precondition of not getting Joe Nacchio'ed. It's a feature, not a bug. Signal's partners* in FVEY IC/LE have given them a lot of latitude in developing a very solid e2e cryptographic protocol and application as long as the users themselves are identifiable.

The pigs don't need to backdoor the protocol or the keys as long as there is more than one party to a conversation and each party is identifiable. The prisoner's dilemma, in real life, almost always gives the pigs a defection.

My pet conspiracy theory is not that Signal is evil, but that Signal is being allowed to operate by the pigs as long as account identifiers are very difficult to anonymize. They are likely very good people with good intentions, but when the FBI or NSA makes you an offer you can't refuse, you do the best you can.

*: I'm not suggesting Signal is in bed with IC. Just that if you operate a communications service of any scale, IC/LE will be your partners whether you want them or not.

[go to top]