I don’t really have any special hate for Telegram myself, and I never saw it as a secure communication platform. I have more problem with Signal because people treat it like it’s paragon of privacy and security.
Many Signal alternatives also have security issues of their own, often making them less secure than Signal. This includes Matrix and XMPP. In the blog post regarding XMPP+OMEMO, the author replies to a question about which would be better than Signal, Matrix, and XMPP with this suggestion:
Anyone who cares about metadata resistance should look at Cwtch, Ricochet, or any other Tor-based solution. Not a mobile app. Not XMPP. Not Matrix.
In regards to Ricochet, not having a mobile app version makes it difficult to recommend to less tech savvy people.
Sure, every platform has its own set of problems, and it’s fine to make an informed decision that you’re willing to accept the deficiencies of a particular platform you’re using. The issue I have is with people pretending that Signal doesn’t have the problems that it has as we can see happening in this very thread.
I’m with you there. This wasn’t meant as an argument against your statement. I brought up the issues regarding Matrix and XMPP as they are often recommended as alternatives to Signal, and after learning about this blog in a previous conversation I had about this topic, I thought it would be a good resource to bring up so people can be informed about those platforms and some alternatives that may be better than Signal while being metadata resistant.
I’d be curious to hear your criticisms of Signal! While I haven’t seen anyone describing it as a “paragon of privacy and security” I do think it is a highly accessible SMS replacement that is also open source, end-to-end encrypted, and operated by a nonprofit.
The short version is, that it’s a centralized, US hosted service. All of those are subject to National Security Letters, and so are inherently compromised. Even if we accept that the message content is secure, then signal’s reliance on phone numbers (and in the US, a phone number is connected to your real identity and even current address), means that the US government has social connection graphs: everyone who uses signal, who they talk to, and when.
Building on this, I’d be curious to hear your thoughts on GrapheneOS as a whole. The OS recently bundled a new app “store”/repository, "Accrescent”, along with the usual basic apps like a calculator & camera. On Accrescent, the hardened fork of Signal, Molly, is offered on there. I’ve alsoheard one of the Graphene devs has voiced some chuddy politics.
I’ve still installed & use Molly to chat with my closest friends who I was able to get off of big tech platforms previously used for our group chats, but I have been aware of the RFA/Signal connection for several years (your blog post really ties it together) & I do try to remind these friends about it. Really we just use Signal to shitpost and organize hangouts, so I’m not yet locking myself in a bunker over using it for those purposes, but all this has got me considering building a server & hosting a different secure chat service on it.
I learned about possible Unit 8200 connections with the Matrix protocol within the past year or two, but don’t recall exactly what that entails. I haven’t heard much about Briar, but it being android only would make it a harder sell for getting people to switch over to it, so I suppose that leaves simpleX to proselytize.
I don’t know enough about grapeneOS to comment on it.
Any signal app forks still have to use signals main servers, so they still got your phone number and identity.
Matrix was originally funded by an Israeli company until it spun off, but unlike signal, it’s entirely open source, self-hostable, and can be run in a private manner. Phone numbers and identifiers are not required, so even if you connect to a malicious server, the most they get is your matrix id, and things you’ve explicitly leaked about your identity.
The most we could say is that specific servers are compromised, but its also possible to host it outside a five-eyes country, unlike signal.
Unless you compiled the app yourself from source code that you understand, you don’t really know what the app might be saying to Signal’s servers. Almost everyone just trusts that the pre-compiled app supplied by Apple or Google aren’t compromised. But we know from history that Big Tech and the military-intelligence-industrial complex are in bed with each other.
The most obvious one that has been explained to death here is that Signal collects vast amounts of metadata. It’s also a centralized service that’s operated in the US, and it doesn’t even make reproducible builds for the Android client.
Where did you read that they are collecting vast amounts of metadata? Not challenging your claim just that I have been trying to find more info and came up empty. Signal says “we don’t collect analytics or telemetry data” but that’s about it.
You need a phone number to sign up. Phone numbers are metadata that uniquely identifies people, and this data constitutes a network of connections. If this metadata is shared with the government, then it can be trivially correlated with all the other information collected about people.
In my book a phone number is not “vast amounts of metadata” but I see your point. Again, I have never seen someone describing Signal as a “paragon of privacy and security” 9usually it’s presented as an improvement over SMS) but if they do I will put on my Trilby and correct them.
It’s the volumes of phone numbers collected collectively that constitute vast amounts of metadata. Meanwhile, I’ve seen plenty of people advocate using Signal as the best option for privacy. And any time there is a criticism of Signal then then brigades of people inexplicably appear to vigorously defend it.
I know Lemmy hates telegram but it should be common knowledge that all platforms process requests from authorities.
https://www.malwarebytes.com/blog/news/2021/12/heres-what-data-the-fbi-can-get-from-whatsapp-imessage-signal-telegram-and-more
The repeated posting of this story the last few days seems artificial.
I don’t really have any special hate for Telegram myself, and I never saw it as a secure communication platform. I have more problem with Signal because people treat it like it’s paragon of privacy and security.
Many Signal alternatives also have security issues of their own, often making them less secure than Signal. This includes Matrix and XMPP. In the blog post regarding XMPP+OMEMO, the author replies to a question about which would be better than Signal, Matrix, and XMPP with this suggestion:
In regards to Ricochet, not having a mobile app version makes it difficult to recommend to less tech savvy people.
Sure, every platform has its own set of problems, and it’s fine to make an informed decision that you’re willing to accept the deficiencies of a particular platform you’re using. The issue I have is with people pretending that Signal doesn’t have the problems that it has as we can see happening in this very thread.
I’m with you there. This wasn’t meant as an argument against your statement. I brought up the issues regarding Matrix and XMPP as they are often recommended as alternatives to Signal, and after learning about this blog in a previous conversation I had about this topic, I thought it would be a good resource to bring up so people can be informed about those platforms and some alternatives that may be better than Signal while being metadata resistant.
I’d be curious to hear your criticisms of Signal! While I haven’t seen anyone describing it as a “paragon of privacy and security” I do think it is a highly accessible SMS replacement that is also open source, end-to-end encrypted, and operated by a nonprofit.
I wrote a longer one here: https://dessalines.github.io/essays/why_not_signal.html
The short version is, that it’s a centralized, US hosted service. All of those are subject to National Security Letters, and so are inherently compromised. Even if we accept that the message content is secure, then signal’s reliance on phone numbers (and in the US, a phone number is connected to your real identity and even current address), means that the US government has social connection graphs: everyone who uses signal, who they talk to, and when.
Building on this, I’d be curious to hear your thoughts on GrapheneOS as a whole. The OS recently bundled a new app “store”/repository, "Accrescent”, along with the usual basic apps like a calculator & camera. On Accrescent, the hardened fork of Signal, Molly, is offered on there. I’ve alsoheard one of the Graphene devs has voiced some chuddy politics.
I’ve still installed & use Molly to chat with my closest friends who I was able to get off of big tech platforms previously used for our group chats, but I have been aware of the RFA/Signal connection for several years (your blog post really ties it together) & I do try to remind these friends about it. Really we just use Signal to shitpost and organize hangouts, so I’m not yet locking myself in a bunker over using it for those purposes, but all this has got me considering building a server & hosting a different secure chat service on it.
I learned about possible Unit 8200 connections with the Matrix protocol within the past year or two, but don’t recall exactly what that entails. I haven’t heard much about Briar, but it being android only would make it a harder sell for getting people to switch over to it, so I suppose that leaves simpleX to proselytize.
I don’t know enough about grapeneOS to comment on it.
Any signal app forks still have to use signals main servers, so they still got your phone number and identity.
Matrix was originally funded by an Israeli company until it spun off, but unlike signal, it’s entirely open source, self-hostable, and can be run in a private manner. Phone numbers and identifiers are not required, so even if you connect to a malicious server, the most they get is your matrix id, and things you’ve explicitly leaked about your identity.
The most we could say is that specific servers are compromised, but its also possible to host it outside a five-eyes country, unlike signal.
Cheers, helpful stuff & thank you for developing Lemmy!
You are literally incorrect.
You have provided literally nothing to back up your assertion.
Signal does not know who talks to whom. It’s kind of the main thing about the double ratchet.
Unless you compiled the app yourself from source code that you understand, you don’t really know what the app might be saying to Signal’s servers. Almost everyone just trusts that the pre-compiled app supplied by Apple or Google aren’t compromised. But we know from history that Big Tech and the military-intelligence-industrial complex are in bed with each other.
Okay. You tell me what the double ratchet is, since you’re so smart.
The most obvious one that has been explained to death here is that Signal collects vast amounts of metadata. It’s also a centralized service that’s operated in the US, and it doesn’t even make reproducible builds for the Android client.
Where did you read that they are collecting vast amounts of metadata? Not challenging your claim just that I have been trying to find more info and came up empty. Signal says “we don’t collect analytics or telemetry data” but that’s about it.
You need a phone number to sign up. Phone numbers are metadata that uniquely identifies people, and this data constitutes a network of connections. If this metadata is shared with the government, then it can be trivially correlated with all the other information collected about people.
In my book a phone number is not “vast amounts of metadata” but I see your point. Again, I have never seen someone describing Signal as a “paragon of privacy and security” 9usually it’s presented as an improvement over SMS) but if they do I will put on my Trilby and correct them.
It’s the volumes of phone numbers collected collectively that constitute vast amounts of metadata. Meanwhile, I’ve seen plenty of people advocate using Signal as the best option for privacy. And any time there is a criticism of Signal then then brigades of people inexplicably appear to vigorously defend it.