
Signal and Giphy - Spakman
https://whispersystems.org/blog/giphy-experiment/
======
mnx
This is a clever way to do this, but it still seems like someone caring about
their privacy should just do without gifs.

Edit: I should rephrase - I mean someone with a larger-than-usual need for
privacy, someone paranoid for a reason. This is great for the typical privacy
concious user. But if I was sending documents to WikiLeaks, I would not sum
them up with a cute GIF.

~~~
shalmanese
Except that history has shown us that theoretically secure but feature
deficient systems lose out to less ideologically pure systems that provide
what users want, leaving the sum total amount of security provided to be less.

~~~
kuschku
EDIT: Deleted the comment because the of attacks in responses, which I can’t
respond to due to "Submitting too fast".

@dang: If you want users to be able to actually discuss things, allow them to
respond to comments attacking them. This is a retarded system.

~~~
nickik
Basically everything in your comment is wrong.

> The prebuilt Signal APK might in fact be completely malicious, you can’t
> verify anything.

[https://whispersystems.org/blog/reproducible-
android/](https://whispersystems.org/blog/reproducible-android/)

This is already more then for all other options.

> And as Signal only tries to copy the features WhatsApp and co already have

Thats simply not true. WhatsApp does not support gifs, for example. Signal
also has some features that others don't.

> they’ll get exactly the same security with WhatsApp, Telegram or Threema,
> and exactly the same features.

Telegram is less secure by miles. Threema is less secure by yards. WhatApp is
less secure by inches.

> "You can create your own federated server"

Signal has never claimed that you can "federate" the server. They only
mentioned that this is a feature that they might work on in the future. Since
they have publicly said that they are not gone do so.

~~~
jhasse
> Telegram is less secure by miles. Threema is less secure by yards. WhatApp
> is less secure by inches.

Depends. For me closed-source is a no-go for security, that's why IMHO

Signal (open client and server) > Telegram (open client) > Threema (open NaCl
lib) > WhatsApp

------
raverbashing
Good

They know that for a bigger adoption they need those usability improvements,
at the same time, they make sure additional features don't compromise the
security expected from their app

~~~
Bartweiss
I've been really impressed with Open Whisper's focus on usability and
functionality. So many privacy products take the stance of "if you care about
privacy, you won't want to do this", and it seriously harms uptake.

~~~
makomk
Meanwhile, people are accidentally leaking their phone numbers and their
contacts' phone numbers because Signal replaced fingerprints that could safely
be posted publicly with QR codes that can't, and didn't explain it:
[https://twitter.com/webster/status/793657469381713920](https://twitter.com/webster/status/793657469381713920)

~~~
Bartweiss
Shit, _really_? I hadn't published any QR codes, but I sure didn't realize
that was part of the new system.

That's a pretty bad round of dropping the ball... Normally I respect that OWS
explains security stuff in detail if you care, but also has a product that
"just works" if you use defaults without much knowledge. This is pretty much
the exact opposite of that, where they released a dangerous default with
minimal explanation even for people who _do_ read their stuff.

------
cryptarch
Is there a federated and/or self-hosted alternative to Signal with similar
privacy and security properties? Even if it supports fewer platforms?

I've been getting more and more interested in running my own (and perhaps my
friends') infrastructure, but I haven't found anything better than IRC for
chat.

~~~
sschueller
I run a Synapse server ([http://matrix.org/](http://matrix.org/)) which is
federated and works very well. There are many clients but the nicest at the
moment is Riot. Full encryption is now available in the Riot webclient and
it's coming to the app soon.

~~~
berdario
I'm just a Matrix (and Signal) user, I haven't yet had a look into its
encryption implementation yet, but for those who are interested, I think these
are the docs:

[http://matrix.org/speculator/spec/drafts%2Fe2e/client_server...](http://matrix.org/speculator/spec/drafts%2Fe2e/client_server/unstable.html#end-
to-end-encryption)

~~~
Arathorn
There's also
[https://matrix.org/docs/guides/e2e_implementation.html](https://matrix.org/docs/guides/e2e_implementation.html)
for those interested in the guts of Matrix's E2E and
[https://matrix.org/docs/spec/olm.html](https://matrix.org/docs/spec/olm.html)
and
[https://matrix.org/docs/spec/megolm.html](https://matrix.org/docs/spec/megolm.html)
itself. We're currently reviewing the PRs for E2E on the iOS & Android SDKs,
and after they land apps like Riot will have (beta) E2E across all of
Web/iOS/Android :)

------
kbart
_" For instance, if someone messages you with an invitation, you might want to
write back with a message that says "I'm excited." With integrated GIF search,
you could instead do a GIF search for "I'm excited" and send one of the
results instead."_

What? Why? Is it some kind of attempt to become a new "cool" app? Sounds
totally useless function to me, but if it helps to get more users, well, maybe
that's a good thing.

~~~
ascorbic
Why? Because lots of people like sending gifs and prefer to use messaging apps
that support them. If it's totally useless to you then fine: don't use it.

~~~
petre
It clutters the UI with unecessary stuff. Wire also provides such a
misfeature. I would rather disable it, but cannot.

~~~
tdkl
You have to specifically click a button to use it. That's a good compromise
between jumping through hoops to enable it if opt-in.

~~~
CoryG89
I think it would be acceptable if these types of things were on by default,
and have the option to disable it or opt-out.

~~~
tdkl
Yeah perhaps, but that would complicate the app development quite a bit. I'd
rather see company invest developer time in other ways - maybe bringing
desktop client support.

------
StavrosK
It would be interesting for services to publish a public encryption key, so
the signal client could encrypt the payload with that.

However, that has very limited usefulness, so I don't see it happening soon.

~~~
Arnt
That's more or less what TLS+pinning does. Also DNSSEC+DANE+TLS if you want to
argue about that.

~~~
StavrosK
Yes, but it's done at a lower level, which enables a host of attacks, like the
announcement says. What I'm talking about would just encrypt the payload, so
none of the metadata would be encrypted (and thus preserved).

Although I guess you'd also need to specify a "reply" public key in the
encrypted data, so this is becomes more of a protocol.

------
wst_
Can I, as a receiver, turn off this feature? Ex : get text messages instead of
gifs.

~~~
newsignup
We do not always search for exact phrase so the text might not convey the
emotion..

~~~
wst_
Unless the API can somehow place proper phrase instead of image. If text would
be matching all images, this should work fine.

------
newsignup
> The GIPHY service could use subtleties like TLS session resume or cache hits
> to try to correlate multiple requests as having come from the same client,
> even if they don't know the origin.

How would a cache hit mean same user tried to search? TLS session resume, I
can understand but cache hit only means same resource was accessed not same
user tried to access.

~~~
StavrosK
You cache a unique ID and then see if you get a hit.

~~~
newsignup
Which unique id? I thought the point of sending it via Signal was to not
include any user id or any other id.

~~~
StavrosK
I don't know which attack the Signal guys had in mind, but usually how this
works is that the server serves a file with a unique ID to a person, sees that
it gets requested, then serves the same thing again in a subsequent request to
a suspect, sees that it's not requested, and treats that as evidence that the
two accounts are actually the same person.

It's obviously easier when you can correlate this with a single account, but
that's the gist of the attack.

~~~
newsignup
Ah!

But this will correlate one file to that person and will not be able to
correlate multiple file requests that they all belong to the exact same
person.

------
nzp
Great! Now that these easy, low-hanging-fruit features are taken care of,
maybe we'll get some of the more involved security oriented ones, like, IDK,
having an indication if I verified a contact or not so I can, you know, know
whether I should verify or not when the opportunity presents itself.

------
biznickman
Now if only my friends would use the service!

------
hk__2
Reading this title I thought it was a word play on “Signal and Noise” and it’d
be a post about how /giphy adds noise to Slack conversations.

------
aluhut
It makes me sad so see that they waste time on decoration like gif search but
they don't have a client I can use on my PC for example.

~~~
Vinnl
Not perfect, but: [https://whispersystems.org/blog/signal-
desktop/](https://whispersystems.org/blog/signal-desktop/)

~~~
knz
I've given up on Signal (for now at least). Yes the encryption and privacy is
great but without a decent desktop client it's hard to get others in my
network to switch to it.

Two things bothered me about the desktop application - it runs as a Chrome
application rather than in a tab (not sure if there is a technical reason for
this?). If I care enough out privacy to run Signal then I probably don't want
to broadcast to anyone watching my screen that I'm running it (like a boss
walking past etc) and would rather bury it amongst my other open tabs. I also
couldn't find any obvious way to sign out of or lock the desktop client - if
this isn't just user error then it seems like a significant oversight for a
secure messaging app to not allow the user to control access if someone else
was able to access the computer.

It also really bothered me that signal doesn't give me better control over
what contacts can see my phone number. When I signed in I could see phone
numbers for a contractor I had used for remodelling my home. The desktop
client had them listed as someone to message on the default page. It's not a
huge deal in this situation but if the phone number was for someone I no
longer wanted to be in touch with (a former partner etc) then there was no
obvious way in either the Android app or desktop client to block them. I
assume that the other user can also see my details - security should include
having control over who can see your phone number.

Edit: Screenshots from the desktop app as a response to comment below:

[http://imgur.com/5nK07ER](http://imgur.com/5nK07ER) \- the default screen
[http://imgur.com/mmEyQWH](http://imgur.com/mmEyQWH) \- the settings UI

[http://imgur.com/gjdyPsF](http://imgur.com/gjdyPsF) \- showing Signal in my
dock for all to see.

~~~
morsch
There is a desktop client. It's packaged as a Chrome app. Some people
downthread think a "decent" desktop app must be (more) standalone. You seem to
think a "decent" desktop app should live inside a browser tab. It's hard to
make everybody happy. People need to stop claiming there is no desktop app
just because the very clearly existing one does not fulfill their own
arbitrary set of criteria.

I don't know if you can sign out within Signal desktop (I assume you can, but
I can't verify at the moment); you can sign out existing Signal sessions from
within the mobile app.

The phone number is Signal's account identifier. You don't see somebody else's
phone number because you've got them on Signal, you're seeing them on Signal
because you've got their phone number. So you're worried about people having
access to your phone number who _already_ have access to your phone number.
Signal using phone numbers as account identifiers has it's issues, this is not
one of them.

~~~
knz
I don't mean to be negative about Signal. I appreciate the work they have put
into it and understand that the platform is maturing - as you said, they can't
please everyone.

The chrome app vs tab is definitely a minor issue related to user preference.
It's not a deal breaker for me personally but others in my network (who are
less concerned about privacy) will not switch if it's not easy. Not being able
to sign out is a possible deal breaker and seems like basic functionality that
has security implications.

Thanks for the information about the phone numbers - I understand that they
aren't a "contact" in the sense that we added each other. I do think the issue
of having control over who can see my phone number is a valid one though. How
would I block someone I no longer want to have contact with without changing
my phone number? Again, this seems like basic functionality for a platform
that is concerned about security and privacy.

Here are screenshots from the desktop app showing the only options I can see:

[http://imgur.com/5nK07ER](http://imgur.com/5nK07ER) \- the default screen
(includes the contact that I mentioned in my first post as someone I can
message right now.)

[http://imgur.com/mmEyQWH](http://imgur.com/mmEyQWH) \- the settings UI

~~~
codethief
On Android there's a button in the conversation settings to block the other
party.

~~~
knz
Thanks - I see it in there now. For anyone else looking for it, it's under
options/conversation settings when you are in conversation view. Thanks again.

------
laluluala
This is what Canonical did with Amazon searches on Unity, they proxified them.

~~~
r3bl
How is this the same? Canonical proxied _every search term_ you've ever typed
to Amazon. In Signal, you have to explicitly click on a button for anything to
happen.

------
piotrjurkiewicz
Still no desktop client?

~~~
berdario
The desktop app is available since almost 1 year (in closed beta at the
beginning), and recently apparently it's also working with iOS

[https://whispersystems.org/blog/signal-
desktop/](https://whispersystems.org/blog/signal-desktop/)

It's also a real app[1], independent from the phone's: after the initial key
exchange, you can send/receive messages even when your phone is off

[1] Compare with the Whatsapp webapp, which solves/sidesteps the E2E
encryption among multiple devices conundrum by simply routing everything
through the phone. The Signal app is also written with web technologies, so it
might not be palatable for everyone, but it's a good compromise imho

~~~
piotrjurkiewicz
Are you kidding me? Do you consider this Chrome extension as a 'real app'
(sic!)?

I won't install Chrome just to host Signal extension.

~~~
mahyarm
Almost every modern desktop chat app is a web app, which is what a chrome app
is. It's how something like franz is possible:
[http://meetfranz.com/](http://meetfranz.com/)

~~~
piotrjurkiewicz
I all cases of 'modern desktop chat app' you are talking about, I can use it
by opening its website with any modern browser.

Signal is the only one which requires me to install one particular browser.

~~~
berdario
If you open them in a browser when you're offline, you won't be able to
load/read your messages (yes, I know about HTML5 manifests for offline data...
but that's a mess), but with Signal you can.

Moreover, being able to vet/verify the updates (which you can apparently even
block altogether) before running the app is of paramount importance for a
secure app like Signal.

With a run-of-the-mill webapp that's also impossible.

Again: tradeoffs. I'd prefer if Signal desktop was built on something
different, but I still happily use it as is everyday.

------
zlatan_todoric
Oh great, they are catching up with Wire
([https://wire.com/](https://wire.com/)).

Now if they would just resolve real bugs (like many people not being able to
register to Signal), that would be maybe cool (but as they implemented Signal
Protocol to WhatsApp and others (if we can trust code we can't see) I can't
say I see any point in it).

Maybe I am wrong, but it lost that appeal it had some time in past.

~~~
zedred
Wire transmits your plaintext GIF search terms to the Wire server. Their
privacy policy even allows those searches to be logged. Combined with Wire's
already bad e2e encryption and metadata story, I don't see how you could
consider this "catching up."

------
MikusR
That fake video on top is interesting. If they can't even get that right what
does it say about their Privacy and Security claims?

~~~
dsacco
Empirically, absolutely nothing. You can't judge the security of a software
based on its marketing material.

~~~
MikusR
But you can determine that nobody at signal has used or even seen an android
phone.

~~~
moosingin3space
What? Signal/OWS seems to develop new features on Android first, and that
animation up top is an Android phone...

~~~
MikusR
It's not an Android phone. Android has either on screen Navigation Bar or
Physical Navigation Bar not both.

~~~
h4waii
What are you on about? You can enable on-screen buttons while still having
physical capacitive buttons.

[http://m.imgur.com/u5hcJYQ](http://m.imgur.com/u5hcJYQ)

Many 3rd party custom ROMs have the feature, including CyanogenMod, the most
widespread open-source build of AOSP.

~~~
MikusR
Not on stock Samsung phones.

~~~
lorenzhs
So they made a screencast and blended it with a video of a hand touching a
phone to avoid shadows and improve image quality. Is that really your takeaway
from the article?

