7 ms·

> By giving NSA the only thing what they want: metadata from Google What metadata does Google get from Signal messages? The time/date you received a message, t

> By giving NSA the only thing what they want: metadata from Google What metadata does Google get from Signal messages? The time/date you received a message, the size of the message... Is there anything else?

jjnoakes 10y ago
The person you are communicating with.
- haffenloher 10y ago
  No, that's not how it works. The GCM message is empty, it just wakes up your device which then fetches the actual message from the Signal servers.
  - acqq 10y ago
    But the "observer" can still know which mobile phone is yours and who communicates with whom? Especially if the "observer" has the info from the Signal servers. Edit (as i can't post you reply to your answer): And based on the NSA principle of the "thee levels of distance" everybody is reachable as long as some common numbers are in our contact lists which we happily upload.
    - haffenloher 10y ago
      The question wasn't what metadata Signal gets, but what metadata Google gets on Signal messages. Yes, Signal servers know who communicates with whom.
  - jjnoakes 10y ago
    You don't think Google could correlate the two? Google knows device A got messages at times X, Y, and Z, and device B got messages at times X+1, Y+2, and Z+1.5. I'd be willing to bet with some statistical analysis over time, some pretty interesting data could be mined from that raw knowledge.
    - tptacek 10y ago
      Why don't they know that anyways from basic traffic analysis?
      - jjnoakes 10y ago
        This topic was about GCM specifically, which, since it goes through Google servers (unlike, say, my arbitrary browsing, or the network profile of my arbitrary apps), is directly available to Google. Speculating that Google may have access to my full network profile is a little off-topic, but yeah, if they did have that data, they could certainly do similar analysis on it. Did anyone say they couldn't?
        tptacek 10y ago
        So is the answer "there is nothing that GCM is revealing that NSA doesn't already get from simple traffic analysis"?
        jjnoakes 10y ago
        The answer is "GCM may reveal more to Google than one would expect from using an E2E encryption application (like metadata, and more than one would initially assume)". The person I initially replied to was talking about Google, GCM, E2E encryption, and that metadata won't reveal anything to Google except time/date of a single message and the message size. I pointed out there may be more information there. I have no doubt that the NSA can do traffic analysis, or may have some of this data already... I'm not sure why that is in the replies to my comments in this thread.
        tptacek 10y ago
        That's only a meaningful answer if simple traffic behavior wasn't already revealing the same information. Was it, or wasn't it? I feel like I'm having a hard time getting a straight answer.

jjnoakes 10y ago

The person you are communicating with.

haffenloher 10y ago
No, that's not how it works. The GCM message is empty, it just wakes up your device which then fetches the actual message from the Signal servers.
- acqq 10y ago
  But the "observer" can still know which mobile phone is yours and who communicates with whom? Especially if the "observer" has the info from the Signal servers. Edit (as i can't post you reply to your answer): And based on the NSA principle of the "thee levels of distance" everybody is reachable as long as some common numbers are in our contact lists which we happily upload.
  - haffenloher 10y ago
    The question wasn't what metadata Signal gets, but what metadata Google gets on Signal messages. Yes, Signal servers know who communicates with whom.
- jjnoakes 10y ago
  You don't think Google could correlate the two? Google knows device A got messages at times X, Y, and Z, and device B got messages at times X+1, Y+2, and Z+1.5. I'd be willing to bet with some statistical analysis over time, some pretty interesting data could be mined from that raw knowledge.
  - tptacek 10y ago
    Why don't they know that anyways from basic traffic analysis?
    - jjnoakes 10y ago
      This topic was about GCM specifically, which, since it goes through Google servers (unlike, say, my arbitrary browsing, or the network profile of my arbitrary apps), is directly available to Google. Speculating that Google may have access to my full network profile is a little off-topic, but yeah, if they did have that data, they could certainly do similar analysis on it. Did anyone say they couldn't?
      - tptacek 10y ago
        So is the answer "there is nothing that GCM is revealing that NSA doesn't already get from simple traffic analysis"?
        jjnoakes 10y ago
        The answer is "GCM may reveal more to Google than one would expect from using an E2E encryption application (like metadata, and more than one would initially assume)". The person I initially replied to was talking about Google, GCM, E2E encryption, and that metadata won't reveal anything to Google except time/date of a single message and the message size. I pointed out there may be more information there. I have no doubt that the NSA can do traffic analysis, or may have some of this data already... I'm not sure why that is in the replies to my comments in this thread.
        tptacek 10y ago
        That's only a meaningful answer if simple traffic behavior wasn't already revealing the same information. Was it, or wasn't it? I feel like I'm having a hard time getting a straight answer.