[broahmed]

I love how Signal (and WhatsApp adopting Signal's protocol) made privacy easy for the general public and technically inclined alike. Privacy will never be the default until it's made easy.

I'm guessing some folks won't like use feature because it's too "social media-y" (myself likely included) but as they say in the post:

- You can turn the feature off and you won't see other people's stories

- You can choose the audience and the max you can share it with is with Signal users in your contacts list

Thank you Signal team for giving the general public what they want and making it private.

[nicce]

> I love how Signal (and WhatsApp adopting Signal's protocol) made privacy easy for the general public and technically inclined alike. Privacy will never be the default until it's made easy.

WhatsApp did not really adapt it in privacy mind, to be fair. All metadata is unencrypted.

Meta harvests your contact information, intervals and time when you message specific persons. Often, this information is more interesting than the message content itself.

[Calvin02]

I don't think that's accurate.

Pretty sure both work the same way regarding metadata. Think about it: if Signal didn't know that A was messaging B, how would they route that message to B's phone? A has to be able to find B's ip address someway. B can't broadcast its ip address to all the Signal users -- that would be a huge security hole.

It probably works like this: 1) A sends encrypted message + B's phone number to the server 2) server looks up the ip address for B's phone number 3) server routes the message there.

Also, both WhatsApp and Signal hash the contacts data the same way. Signal does seem to go a bit further, however.

WhatsApp's implementation: https://www.whatsapp.com/legal/information-for-people-who-do... Signal's implementation: https://signal.org/blog/private-contact-discovery/

[nicce]

WhatsApp contact uplod mechanism continues here [1].

It means, that if the contact list contains numbers which have not accepted WhatsApp ToS, their content is stored only as hash. When the user starts using WhatsApp, their number and hash is being mapped.

Vaguely described as

> Each cryptographic hash value is stored on WhatsApp’s servers, linked to the WhatsApp users who uploaded the corresponding phone numbers before they were hashed so that we can more efficiently connect you with these contacts when they join WhatsApp.

Which means that WhatsApp knows the numbers of the WhatsApp users, and how they interact together.

Signal does not know numbers or how these contatcs interact.

It is described here [2]. Number is only needed for creating the unique hash. Server knows only the recipient, not the sender.

[1]: https://faq.whatsapp.com/423109552047857/?locale=en_US&refsr...

[2]: https://signal.org/blog/sealed-sender/

[topdancing]

> Signal does not know numbers or how these contatcs interact.

> It is described here [2]. Number is only needed for creating the unique hash. Server knows only the recipient, not the sender.

Signal does know everyone's numbers as everybody is logged into a Signal account on the server end (this is how your client fetches messages for your number). That same account and IP are also used when you send a message.

On top of that fact, sealed sender has been known to be broken for some time now: https://www.ndss-symposium.org/ndss-paper/improving-signals-...

[pvg]

Pretty sure both work the same way regarding metadata.

They don't, that's covered pretty extensively in the many technical writeups of various Signal features. It's one of the main value propositions of Signal, that it doesn't work like most secure messengers especially when it comes to metadata.

[josh2600]

https://signal.org/blog/sealed-sender/

Worth reading.

[Calvin02]

Interesting! I hadn’t heard about this. This would make it so that Signal could say that they don’t know the message pair.

[jbc1]

Have a look at what they reply to subpoenas with.

https://signal.org/bigbrother/cd-california-grand-jury/

[topdancing]

This is just a marketing gimmick, it's been broken as a technology since its inception: https://www.ndss-symposium.org/ndss-paper/improving-signals-...

[quonn]

The server does not really store IPs, since mobile phones are likely behind CGNAT.

In theory, B could publish a new public key as identity per target user.

I see two main problems: First, push notifications do require the server to actually identify the user and second efficiency: The client would like to maintain a single long connection instead of many short lived requests with pseudonyms.

Of course there would still be some timing patterns …

[jhoechtl]

> Think about it: if Signal didn't know that A was messaging B, how would they route that message to B's phone?

There is no need for signal to know because their servers are not involved to transport the message but only ip routing infrastructure in between and of course the two parties. That's P2P

[Calvin02]

Signal is not P2P. Signal servers relay messages to/from clients.

[jhoechtl]

Thank you, TIL. I really thought their protocol is P2P

[krono]

> All metadata is unencrypted

And all the rest of the data too, for all intents and purposes.

After all it is Meta that provides the keys, operates the network, and controls the closed source apps. Also, it is precisely Meta's type of behaviour that warrants encrypting personal data in the first place.

[dont__panic]

Perhaps that's the real reason they renamed to Meta. Not for the metaverse, but because of their incredible volume of metadata.

[NayamAmarshe]

> WhatsApp adopting Signal's protocol

Is there any solid evidence for this or are we just believing what Facebook says?

WhatsApp's APK files have obfuscated code. A few years ago they forgot to obfuscate a file and they got exposed.

Not to mention so many severe vulnerabilities discovered in WhatsApp every now and then.

People who really think WhatsApp's claims about E2EE are true and it's making them safer or private, are trusting Facebook too much.

[wilg]

I'm pretty technically inclined and I lose my Signal history every time I get a new phone because I just can't remember to transfer it. (I don't use it a ton.) I really wish this was more seamless. (I understand the complexity of the security issues around it.)

[codethief]

Here's an easy way not to forget (on Android):

1) Enable daily backups in Signal

2) Set up Syncthing to automatically send these backups to your laptop/whatever.

3) Profit.

[wilg]

On iOS, but thanks!