Hacker News new | past | comments | ask | show | jobs | submit login

A little. Without reading the Guardian piece, I wouldn't even guess that delivery notifications have anything in common with security properties.

In other words, the messages are secure only when there is a double checkmark, not just a single checkmark. How am I supposed to know that?!? I am not even sure what do the checkmarks mean.

Frankly, that's not a "backdoor", that's just a poorly thought out GUI (in my opinion), that might eventually lead to backdoors with an evil server.




Absolutely. There is no evident connection that can be done from the double checkmark to a "secured communication".

But when you think about it, the double check is a read confirmation so if we are in an end-to-end encrypted scenario, and the message content was read, it means the recipient's device was able to decrypt it successfully.

This tells you that the recipient is still using the same set of keys that your device thought it had and used to encrypt the message.


The single/double checkmark is used with Signal's client as well. When you're sending unsecured texts, you get a single checkmark when you send it; when you are sending encrypted messages, a lock symbol and a single check when sent, and a double check when received.


Except that the obvious interpretation of the second checkmark not appearing is that the message was never received, not that it was decrypted by an attacker. Especially when there's a key change warning afterwards. I think this is still the correct interpretation in Signal proper, but who knows at this point?


Yes, but in Signal, it doesn't have bad security consequences when its meaning is misunderstood.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: