[akerro]

>1) Make mass surveillance impossible.

By giving NSA the only thing what they want: metadata from Google

>2) Stop targeted attacks against crypto nerds.

Who don't have google services on their devices and don't use google chrome... yeah. Thanks for helping me so much.

The Senate is considering reauthorizing the law the NSA says authorizes it to collect hundreds of millions of online communications from providers like Facebook and Google as well as straight off the internet’s backbone:https://theintercept.com/2016/05/10/senate-kicks-off-debate-...

[neerdowell]

> By giving NSA the only thing what they want: metadata from Google

What metadata does Google get from Signal messages? The time/date you received a message, the size of the message... Is there anything else?

[jjnoakes]

The person you are communicating with.

[haffenloher]

No, that's not how it works. The GCM message is empty, it just wakes up your device which then fetches the actual message from the Signal servers.

[jjnoakes]

You don't think Google could correlate the two?

Google knows device A got messages at times X, Y, and Z, and device B got messages at times X+1, Y+2, and Z+1.5.

I'd be willing to bet with some statistical analysis over time, some pretty interesting data could be mined from that raw knowledge.

[tptacek]

Why don't they know that anyways from basic traffic analysis?

[jjnoakes]

This topic was about GCM specifically, which, since it goes through Google servers (unlike, say, my arbitrary browsing, or the network profile of my arbitrary apps), is directly available to Google.

Speculating that Google may have access to my full network profile is a little off-topic, but yeah, if they did have that data, they could certainly do similar analysis on it.

Did anyone say they couldn't?

[pureIDEOLOGY]

More worried about NSA correlating the two after getting the data from Google, but the one good thing about their centralization model probably is that with millions of users to a central server (and something you do as often as texting) this makes timing analysis extremely difficult.

[jjnoakes]

I have no data to back this up, but I bet patterns would reveal much more than you would intuitively think.

[acqq]

But the "observer" can still know which mobile phone is yours and who communicates with whom? Especially if the "observer" has the info from the Signal servers.

Edit (as i can't post you reply to your answer):

And based on the NSA principle of the "thee levels of distance" everybody is reachable as long as some common numbers are in our contact lists which we happily upload.

[haffenloher]

The question wasn't what metadata Signal gets, but what metadata Google gets on Signal messages. Yes, Signal servers know who communicates with whom.