This repository was archived by the owner on Jun 24, 2022. It is now read-only.
Repository navigation
This repository was archived by the owner on Jun 24, 2022. It is now read-only.
❌ Software Removal | Signal #779
Description
Problem with Signal
Signal has copious privacy issues making it unfit for privacytools.io endorsement.
- Users are forced to supply a phone number to Signal (https://github.com/privacytoolsIO/privacytools.io/issues/432) (diagram of mass surveillance)
- Phone numbers are forcibly tied to legal identities in some countries (e.g. many European nations force carriers to copy ID cards)
- Phone numbers are usually not gratis -- the payments of which are traceable. Even cash payments trace to a shop.
- Privacytools.io target audience is unlikely to go through the hoops of getting an anonymous phone number. They will give in to convenience and supply a sensitive phone number.
- Signal's claims to the contrary do not obviate the above points. It's a broken registration process from the standpoint of privacy, all to serve a centralized master. Note that Jami (decentralized) does not require phone number registration, and Wire (centralized) does not require phone reg. if the desktop app is used and it's optional for their mobile app.
- Some people in the US will buy burner phones and thus financially support one of the four privacy-abusing mobile phone carriers. Signal compels people to feed companies working to the detriment of everyone's privacy, when those four carriers should be boycotted.
- Signal retains a record of users phone numbers for account recovery purposes. This means:
- Users who choose to supply a number they do not keep control over (e.g. a hotel phone) are vulnerable to an attacker exploiting that to initiate account recovery.
- Metadata is linked to identified individuals (and it has been subpoenaed)
- If those records are ever breached everyone is needlessly exposed.
- The privacy abuse is viral. When a user opts to sacrifice their own privacy by registering a phone number, they become bait by which their friends are pressured to make the same compromise in order to stay in touch. This is effect a consequence of both phone reg. and part 7 (network protectionism).
- Entities with no connection to OWS are able to deanonymize Signal users using phone number cross-referencing.
- Users are forced to feed Google.
- APK download requires users to connect to Google's server and execute non-free javascript
- Playstore pushed
- Directing users to Google Playstore is contrary to the mission of privacytools.io. From the PTIO front page: "You are being watched. Private and state-sponsored organizations are monitoring and recording your online activities. privacytools.io provides knowledge and tools to protect your privacy against global mass surveillance." By knowingly sending users to signal.org who are then sent to Google Playstore, privacytools.io is failing their mission and betraying the users. At a minimum the link on privacytools.io should be to the APK page that is anchored to the bottom of the page. At least the risk of subjecting novice users to advanced tools is less serious than subjecting them to Google's walled-garden of surveillance.
- Google accounts are required to access Playstore even when using a third-party app.
- Registering for a Google account is in itself a privacy abuse, the process of which requires having a phone number (one abuse) and then disclosing that number to Google (another abuse).
- Use of the account to access the Playstore abuses user privacy through Google tracking (Google keeps track of apps you download and your IMEI number). From this Google also knows all the vulnerabilities a user has. Google also records users’ IP addresses and browser prints when logged in, which is later used to link to logged-out traffic and behavior.
- Users who bought an Android without a PlayStore^(tm) license are excluded if they are not advanced enough to use third-party hacker tools, and those who are advanced are outside the scope of privacytools.io target audience and still must use a Google account (thus still subject to the abuses of using the Google account at the Playstore).
- Playstore is scientifically proven to be relatively insecure compared to F-Droid in the "Understanding the Security Management of Global Third-Party Android Marketplaces" article.
(see also F-Droid: The privacy-friendly alternative to Google Play Store)
- Google's reCAPTCHA used
- Google's reCAPTCHAs compromise security:
- anonymity is compromised.
- (speculative) could Google push malicious j/s that intercepts user registration information?
- Users are forced to execute non-free javascript (recaptcha/api.js).
- The reCAPTCHA requires a GUI, thus denying service to users of text-based clients. If someone were to develop a third-party non-graphical plugin or app, OWS is now dictating that all Signal apps must support a GUI and it must also be javascript capable.
- CAPTCHAs put humans to work for machines when it is machines who should be working for humans. PRISM corp Google Inc. benefits financially from the puzzle solving work, giving Google an opportunity to collect data, abuse it, and profit from it. E.g. Google can track which of their logged-in users are visiting the page presenting the CAPTCHA.
- The reCAPTCHAs are often broken.
- E.g.1: the CAPTCHA server itself refuses to give the puzzle saying there is too much activity.
- E.g.2:
- The CAPTCHAs are often unsolvable.
- E.g.1: the CAPTCHA puzzle is broken by ambiguity (is one pixel in a grid cell of a pole holding a street sign considered a street sign?)
- E.g.2: the puzzle is expressed in a language the viewer doesn't understand.
- Google's reCAPTCHAs compromise security:
- APK download is implemented in a privacy-hostile manner:
- ^ That link is hidden. From the landing page users are directed to Google Playstore exclusively. There is also no way to navigate to the APK download from the home page. The only way to get the APK page URL is word-of-mouth or searches on 3rd-party websites.
- The small minority of users who will actually take initiative to proactively search for the APK may or may not discover this buried page, which the Signal project calls the "Danger Zone". And these users are not the ones that Signal puts at risk with Google surveillance- it's everyone else.
- Those who find the page will only see Signal pimping Google Playstore again. Many won't realize they must scroll down to see the Danger Zone. Fooled me a couple times. Even after I knew about the APK download I thought the download option got removed but I actually neglected to scroll down.
- The page says "The safest and easiest way to install Signal for Android is through the Google Play Store" (emphasis mine).
- Visitors of that page who use the noscript or uMatrix plugin do not get an APK download link. They see a blob of text below "Danger Zone" which doesn't include a link so they won't even bother reading it. If they do read it then it just appears like a broken page. They actually have to realize that they must enable javascript from Google in order to render the download button. So making a connection to Google is still inescapable even for the APK download.
- The Signal project says that link is for "Advanced users with special needs". So not only are they undermining their more secure distribution by calling it dangerous (when really it's the Playstore link that should be in a "Danger Zone"), they also say it's only for a subset of advanced users - this is not the audience privacytools.io is targeting. The privacytools.io audience should be able to find the app on f-droid.org.
- Platform limitations (due to refusal to cooperate)
- Open Whisper Systems takes a hostile posture toward developers of third-party apps like LibreSignal for using OWS-owned networks and having "Signal" in the name (likely it's the "Libre" they really don't like, but use of "Signal" invokes legal power).
- No official Debian distribution. Debian is the most common linux distribution and it's known for high quality standards and high standards of software freedom. The fact that Open Whisper Systems distributes an Ubuntu package directly from their own repository calls into question why they've not achieved the quality standards of having an official Debian release. One side-effect is that #debian on freenode will not support unofficial packages and in fact they advise against them. And in this case support is lacking (see the next section).
- Users seeking support are forced into CloudFlare.
- CloudFlare mushrooms into many privacy abuses, listed here
- Signal is centralized on Amazon AWS.
- When users connect to AWS, privacy abuser Amazon gets their IP address and likely knows they are using Signal. That IP address can then be cross-referenced to other activity recorded by Amazon (both their shop and other AWS-based services like Wire). (This is speculation - investigation needed).
- There are several privacy-related ethical problems with AWS.
- Network protectionism: the Signal network is a closed walled-garden in itself. "Open" Whisper Systems does not allow tools developed by others to use their network. OWS also will not federate their network with another network. So they've capitalized on the marketing benefit of free software licensing but implement a policy that prevents the freedoms of free software from actually having a practical usable effect. They do this while telling users: "As an Open Source project supported by grants and donations, Signal can put users first."
- Detrimental partnerships that aid privacy abusers:
- (Facebook) OWS contributed to the development effort of Facebook Messenger and WhatsApp
- (Google) OWS contributed to the development effort of Allo
Playstore history
The Signal-Playstore discussion (quite rightly) never dies. Threads keep popping up over the years and moving, but one thing that never changes is the project's unwillingness to deviate (in short, they want their stats). The most recent discussion lives here if anyone wants to follow it.
Perhaps it's worth mentioning that Google can possibly exceptionally be avoided entirely if a user downloads the source code and compiles it from scratch. I've not verified that, but it's somewhat moot anyway since privacytools.io target users would not be doing that.
bad players involved with OWS Signal
| entity | walled-garden? | direct privacy abuse w.r.t Signal | indirect privacy abuse |
|---|---|---|---|
| Amazon | no | Amazon sees all connections, IP addresses, can associate to their webshop data | OWS feeds this notorious privacy abuser |
| Apple | yes | iTunes tracking | funds anti-privacy lobbyists |
| CloudFlare | yes | sees all web traffic to OWS support site and blocks Tor users | OWS feeds this notorious abuser of privacy and net neutrality. |
| yes | none | OWS contributed to the development effort on Facebook Messenger and WhatsApp projects | |
| yes | user tracking in many different ways via playstore and captcha | OWS feeds this notorious privacy abuser and PRISM corp | |
| OWS | yes (OWSs own system is a walled-garden) | forced participation in telephone systems and forced disclosure of sensitive phone numbers | subjects users to privacy abusers in this table |
| phone vendors | no | some (e.g. Motorola) caught putting spyware on phones; factory configs hinder security | most phone makers fund anti-privacy lobbyists |
| phone service | no | CDMA/GSM tracking; reduces the security of phones | all US carriers are privacy abusers and also fund anti-privacy lobbyists |
Prostitution ring diagram showing privacy abuses:
(PDF)
Activity
ThatLurker commentedon Mar 10, 2019
The removal of Signal would but Riot.im and Ricochet as top recommendations.
Do you want to explain the use of Riot or Ricochet to someone who uses Whatsapp and are both of them as easy to use as Whatsapp?
ThatLurker commentedon Mar 10, 2019
At least before final verdict we should get an input on the issues listed from someone at Open Whisper Systems.
Mikaela commentedon Mar 11, 2019
And Riot.im/Matrix.org appear to be using Cloudflare (https://github.com/privacytoolsIO/privacytools.io/issues/374) and the problems with in general haven't been reported as fixed yet (https://github.com/privacytoolsIO/privacytools.io/pull/562#issuecomment-464569232).
Ricochet's situation seems uncertain to me at a quick glance, there is https://github.com/privacytoolsIO/privacytools.io/issues/474 arguing it's unmaintained and pointing to https://github.com/privacytoolsIO/privacytools.io/issues/746 in the latest comment.
Would it be time to think about XMPP (privacytoolsIO/privacy-tools#60 & https://github.com/privacytoolsIO/privacytools.io/issues/141)?
E3V3A commentedon Mar 16, 2019
Have you guys actually contacted Signal devs about:
Until there actually is a de-facto replacement for Signal that is compatible with or without Gplay-store, I think we really need to try to convince them to shape up their privacy issues where warranted, and accept that we're not an ideal world, while a shitload of people are already using Signal, even though most of them don't even know why.
In that regard. Why don't you post a better solution to Signal devs about how they could replace the phone number and still keep shit simple enough for people to actually use. At least Signal is keeping all their shit up-to-date, which is far better than most other alternatives.
I think the [signal] issue is that updates, and new installs should remain transparent to the user and at one point they decided that using the phone number was smart. Well, it's not as we have seen...
So a possible solution would perhaps be by using a combination of (1) the phone's IMEI and (2) the phones serial number. That way it would be unknown to most potential attackers, while leaving the phone number out of the equation.
Perhaps @greyson-signal (or someone from your team) would care to comment?
97 remaining items
t1011 commentedon Mar 17, 2021
It seems that PrivasyTools disregard for the arguments of contributors over the years regarding the unsafe use of Signal has reached an apogee. Remove it at last.
Herohtar commentedon Mar 17, 2021
This is false. They removed the issue section because they had no intention of using it and politely requested that discussion of the proxy be continued on the Signal Community forum. One user was auto-silenced (not banned) on the forum due to Discourse's spam prevention settings, which was promptly reversed by the mods as soon as they realized what happened.
smaragdus commentedon May 16, 2021
Signal is a government op
This was obvious from the very beginning for those who have eyes to see and brains to think.
PrivacyTools? No, thanks.
smaragdus commentedon May 16, 2021
@LongJohn-Silver
All about Signal has always been murky and suspicious to me, from the leading developer (whose name I don't even want to mention) to the distribution model. Proving such stuff like the one mentioned above is from hard to impossible for obvious reasons. The problem with metadata is very grave (Michael Hayden Gleefully Admits: We Kill People Based On Metadata) as is the problem with the currently available chat programs- almost all are either insecure or underdeveloped, or perform miserably, or all of that together. As far as I know setting up your own Matrix server is only theoretically possible and the Matrix desktop clients are very poor. About Session- Session Desktop is forked from Signal Desktop, which is JavaScript/Electron which means firm no to me.
About Signal- I got even more suspicious when Snowden started recommending it enthusiastically, but when creatures like Musk recommend it it becomes more than obvious that it shouldn't be used.
Lunarequest commentedon May 17, 2021
I would not recommend session due to some heavy al-right ties the current developers of session have. You can see more about this here https://twitter.com/WPalant/status/1281540005190672384
smaragdus commentedon May 17, 2021
Your argument is absolutely ridiculous. Unfortunately dumb SJWs and useful idiots have heavily infiltrated GitHub.
Lunarequest commentedon May 17, 2021
Unfortunately it appears a large amount of racist Alt-right groups have infiltrated GitHub
dijit commentedon May 17, 2021
It's not useful to flame each other.
I don't know anything about session, but if it's a FOSS technology then nothing prevents your or I from adopting it independent of undesirables.
In fact, that would be the only way to save its reputation from extremists.
Regardless. It is a tangent and not related to the removal of signal. Which I support for the reasons mentioned above.
ph00lt0 commentedon May 17, 2021
Although I agree that the trend of Signal forcing up more and more Google spyware is worrying, I find it fun to read that people recommend Matrix instead. The sign up process of matrix also requires Google's reCAPTCHA. Session is indeed a great alternative, but yet no support for calls. I guess that for calls, there is a need for good servers... ...from the big boys.
I also wonder why it would be problematic that Signal has enabled other companies to adopt E2EE, I believe this has greatly improved privacy and security of the masses.
Luckily Signal will remove the phone number dependency, so we can take that from the list.
All in all, Signal is for most people (which is the targeted audience of PTIO) a huge improvement over other chat apps. I see no reason to delist it.
freddy-m commentedon May 17, 2021
At the moment, we will not be delisting Signal. However, if you want some legitimate criticism of Signal, see this video: Signal's Terrible MobileCoin Betrayal
lrq3000 commentedon May 29, 2021
Ah indeed, in the past there wasn't a reCAPTCHA but now there is one. However, I think that using the desktop app there is no reCAPTCHA as far as I know. And in-browser it's possible to use Tor Browser which nullifies risks with reCAPTCHA, which is not possible with the Signal app.
lrq3000 commentedon May 29, 2021
Some updates on the issue of requiring a phone number for registration in Signal:
Source: https://community.signalusers.org/t/registration-without-a-phone-number/2222/2
Another interesting discussion at the pros and cons of using email addresses for registration: https://community.signalusers.org/t/registering-with-an-email-address/919/103
From what I gather, it seems Signal is not going to support other form of registration anytime soon, as they want to bar spammers and bots from joining the network from the get go, they chose a strategy of gatekeeping.
lrq3000 commentedon May 30, 2021
I wasn't aware of MobileCoin. This is very concerning. MobileCoin is a fork of Monero, but with the decentralized consensus algorithm being stripped out in favor of a centralized one. This cryptocurrency has all the marks of a scam: centralized (only nodes approved by the parent company can become validators), fully pre-mined, unknown circulating supply and shady allocation (15% already allocated to private investors, public investors can't get more than 5K euros annually, and for the rest we don't know). MobileCoin has been integrated into signal. Signal's co-founder Moxie is also trying to blur lines about his involvement in MobileCoin.
Beyond the very unadvisable MobileCoin, Signal failed to update the server's source code during the last year, and they never explained why despite inquiries.
All these issues seriously raise the question of whether Signal can still be trusted.
I would suggest to re-open this issue to discuss the opportunity of a removal.
ph00lt0 commentedon May 31, 2021
@lrq3000 also on desktop (web) there is. I am not sure if I agree with the statement about Tor. We don't really know what patterns google tracks with Recaptcha. Personally I wouldn't be surprised if the behavior leads to unique fingerprints (or at least put's you in some cohort). In addition we have seen fingerprintJS's findings a few weeks back. Let's agree that using ReCaptcha generally is a very bad decision from both Matrix and Signal. Both do however provide a lot more privacy as other providers. Signal still is a great improvement for most people. Privacy should be approachable for the masses. If we didn't have Signal we would still be needing WhatsApp or texting to contact our relatives.
lrq3000 commentedon May 31, 2021
Yes I agree, it would be better without Google services at all. I don't think the pattern of clicks on the reCaptcha is sufficient to track a user across different Tor circuits when the user reconnects later, but it still is a data leak. Unfortunately it's understandable there is a gatekeeping against bots, and unfortunately reCaptcha is the most reliable of all captcha systems. I have worked myself on an alternative, it's no easy task, always a cat and mouse game, so unless Element/Matrix decides to verify the user's "humanity" by another mean, which likely would involve more intrusive methods such as providing a phone number or an ID, I guess this is the least of evils.
Also worth noting is that if the matrix server is self hosted, then the captcha can be disabled. This is impractical for Signal since it's a centralized system, self-hosting means that you would be gated from interacting with the main network.