安全与隐私drewdevault.com
我不信任 Signal
I don't trust Signal
2018 — 2020，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
这是 Drew DeVault 2018 年的一篇批评文章：他说自己不信任 Signal，理由包括 Android 版只通过 Google Play 分发而拒绝上架 F-Droid、不与其它聊天协议互通、以及整个系统仍依赖对 Moxie Marlinspike 及其服务器的信任。文章主张改用可自托管、可联邦的 Matrix，并质疑 Signal 的设计哲学是否真的以用户自主为先。
为什么经久不衰：它浓缩了「加密通讯该追求易用还是去中心化/可自托管」这场多年不散的争论，每当 Signal 被当作默认推荐时就会被重新翻出来对照阅读。
HN 评论精选
反驳：文章推崇的 Matrix 当时端到端加密默认关闭，而 E2E 本就不要求信任服务器，论点自相矛盾。
DeVault 不信任 Signal，是因为它的 Android 版本走的是 Google Play 商店——几乎所有真实用户都在用的应用市场——而不是 F-Droid；他还希望 Signal 能与其他聊天软件互通。相比之下他更希望你用 Matrix，而按 Matrix 官网自己的说法，其端到端加密「仍在 late beta」，只在部分客户端提供，且「默认不开启」。这个论点很可笑，它出现在首页我们应该感到丢人。世上确实有人想把手机当服务器来管理，那是他们的自由，我不反对；但绝大多数用户并不想让手机应用市场变得像 Debian 而不像 Play Store。而且，端到端加密的意义恰恰在于你不需要信任 Signal 的服务器。
tptacek查看英文原文
Drew DeVault doesn't trust Signal because its Android incarnation uses the Google Play Store --- the app market virtually all of its real users use --- and not F-Droid. DeVault would also like it if Signal would interoperate with other chat programs. Instead, DeVault would prefer that you use Matrix, a system for which end-to-end encryption is (according to its own website) "in late beta", offered on a select subset of clients, and "not enabled by default"†. This argument is clownish and we should be embarrassed it's on the front page. There are people in the world that want to sysadmin their phones. It's a life choice they are free to make and I don't hold it against them. But the vast, overwhelming majority of users do not want to make the app market on their phone work more like Debian and less like the Play Store. Signal, to put it bluntly, does not care about the desires of the phone sysadmins. Even if they caved to the sysadmins, the application would, for virtually all its users, be no more secure. This bothers DeVault a lot, enough that he's constructed an entire psychoanalysis of Moxie Marlinspike to explain to himself how it could possibly happen that someone else on the Internet doesn't agree with him. Also, just as a note to DeVault: the point of end-to-end encryption is that you don't have to trust Signal's server. All it does is arrange for the delivery of messages, which are secured client-to-client. Compare Signal's server to Wire's, which --- last I checked --- retains a record of every pair of users who have communicated in the past. † When this was pointed out downthread, DeVault responded: "[o]ther alternatives (which I have not reviewed in depth) include Tox, Telegram, Wire, and Ring". Telegram is a particularly funny reference to make, because not only is E2E not the default there, but --- last I checked --- it can't even do E2E group chat. Telegram's owners are adamant that TLS is adequate for group secure chat.
逻辑不自洽：F-Droid 同样需要信任，「真正安全的系统不需要信任」在现实中不存在。
这是一篇很糟糕的文章：满是长期私人恩怨式的挖苦，却没有真正检视问题，论点也站不住。你说不能信任 Play 商店，因为恶意方可能替换信任根——那凭什么就该信任 F-Droid 的签名基础设施？如果真偏执，从下载二进制的同一个页面拿校验和，和干脆不看校验和一样没用。最糟的是那句「真正安全的系统不需要信任」：世上没有真正安全的系统，对端手机可能被入侵，系统乃至硬件都可能有隐藏键盘记录器。好的安全应当承认信任在协议和系统中的角色。
skywhopper查看英文原文
This is a really poor post. Lots of in-the-weeds long-running-feud grudge holding snark, but no real examination of the issues at hand. And his assertions don't make sense in any case. You can't trust the Google Play store because a malicious actor might have swapped out the trusted roots on you. But then why should we trust F-Droid's signing infrastructure? Then he gripes that the posted APK has to be manually checksummed to use it. If you are truly paranoid, trusting a checksum you get from the same page you get a binary is as secure as ignoring the checksum altogether. But why would you trust a hidden signature process you can't see any more? How do you know your F-Droid binary was secure? But worst of all is this pointless assertion: "Truly secure systems don’t require trust." There are no truly secure systems. Malicious actors could replace your Matrix app with a lookalike clone. Your phone could have a hidden keylogger built into the OS. Or the hardware. The person's phone on the other end of your communication could have been compromised. You could be being monitored by all sorts of undetectable means. Perfect security is an unattainable goal, but good security requires acknowledging and enabling trust to play a role in the protocols and systems we develop.
端到端加密不保护元数据，用户仍在信任运营者不记录、不被胁迫。
但我们仍必须信任 Moxie 运行的是他声称的那套服务器软件，信任他没有记录我们和谁通话、什么时候、多久一次；而且 Open Whisper Systems 在旧金山，还得信任他没收到国家安全信函（顺带说，Signal 当时没有 warrant canary）。他可以说自己不存这些数据，但他完全可以存。不过至少有一个数据点：ACLU 公布的传票文件显示 Signal 只存了两个整数——那是在法庭上作证提交的证据，但事情总是会变的。
hprotagonist查看英文原文
But we have to trust that Moxie is running the server software he says he is. We have to trust that he isn’t writing down a list of people we’ve talked to, when, and how often. We have to trust not only that Moxie is trustworthy, but given that Open Whisper Systems is based in San Francisco we have to trust that he hasn’t received a national security letter, too (by the way, Signal doesn’t have a warrant canary). Moxie can tell us he doesn’t store these things, but he could. Truly secure systems don’t require trust. We have at least one data point that says that Signal stores exactly two integers about you, or did when the subpoena was issued: https://www.aclu.org/open-whisper-systems-subpoena-documents things can always change, but that’s evidence submitted in court under the penalty of perjury, which is a fairly strong claim.
手机号注册制造元数据与社交图谱风险，且免费无广告的资金来源值得追问。
我信任 Signal 的端到端加密承诺，但我对它在匿名性和隐私上的缺失有意见：强制用手机号注册，等于把真实的人绑定到 Signal 账号，从而让（它或别人）能够描绘出社交网络图谱。在情报收集中，谁和谁通话、在什么时段、消息频率如何，这些信息价值极高。用户也该问问自己：这款应用免费、无广告，那短信成本和基础设施开销是怎么负担的？
daneel_w查看英文原文
I trust Signal's end-to-end encryption promise, but I have a problem with the application not offering anonymity or privacy. By demanding users to provide a cell phone number to enable their accounts, they are connecting actual people to the Signal accounts and consequently also allowing them (or someone else) to visualize social networks; in intelligence gathering, data such as who speaks to whom, at what hours, with what message frequency etc. is highly valuable. It's also important that users ask themselves how Signal manages to finance all the SMS costs and the infrastructure when the application is gratis and free from ads.
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。
安全与隐私上首页 4 次 · 2013–2017blog.dustinkirkland.comHTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选