Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I get the feeling you don't want to understand at this point, but ok, I'll byte:

The difference is the action of encryption and decryption is completely transparent to the user in the case of Signal or this thing they used. You don't encrypt anything, you input plain text and then the system takes over and you have to trust it. If the rumors are true the authorities compromised the servers, pushed an update to the app and the encryption no longer happened.

Just one example on how to do it yourself: using PGP you can use any hardware (not a phone marketed to criminals) and keep it completely offline. And use a phone (worst option but whatever) in which you input the encrypted thing directly. So you don't have to trust the network device. Bonus: neither do you have to use something that makes you stand out to authorities.



Okay, but unless you implement the encryption yourself, PGP can push an update and use weak RNG input so that your message is decryptable, and you'd never know.

"Don't rely on others" makes no sense for encryption, you have to rely on others because it's too hard otherwise. You just have to pick trustworthy others.


PGP can not push an update in the example I offered. And I already explained what was meant with "Don't rely on others" - btw now I see you cut the quote to fit your straw-man argument.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: