this post was submitted on 15 Jul 2023
98 points (82.2% liked)

Privacy

32120 readers
494 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
98
Signal. Privacy. (upload.wikimedia.org)
submitted 1 year ago* (last edited 1 year ago) by FarLine99@lemm.ee to c/privacy@lemmy.ml
 

Link to article from main Lemmy❤️ developer about Signal privacy. Mostly fair points. I kinda distrust so centralized services but basically we have no other options (Matrix is buggy in many aspects). What can you say about this article?

top 50 comments
sorted by: hot top controversial new old
[–] Melpomene@kbin.social 69 points 1 year ago (8 children)

This is posted relatively often, and every time it is posted I feel compelled to note that said dev has not articulated any real reason to consider Signal insecure beyond an implicit conspiracy theory with no real meat to it.

"Signal's use luckily never caught on by the general public of China (or the Hong Kong Administrative region), whose government prefers autonomy, rather than letting US tech control its communication platforms, as most of the rest of the world naively allows."

When you're holding up China as an example for the world to follow for privacy, I have a hard time taking ANYTHING else you're claiming seriously.

[–] 133arc585@lemmy.ml 24 points 1 year ago* (last edited 1 year ago) (4 children)

“Signal’s use luckily never caught on by the general public of China (or the Hong Kong Administrative region), whose government prefers autonomy, rather than letting US tech control its communication platforms, as most of the rest of the world naively allows.”

When you’re holding up China as an example for the world to follow for privacy

I interpret that quote to say that China doesn't trust US tech like the rest of the world does. It's not saying that China has more privacy and the rest of the world should follow, it's saying that the rest of the world also shouldn't be so naively trustworthy of US tech either.

[–] matricaria@feddit.de 4 points 1 year ago (1 children)

I don't think the problem is that China doesn't trust the US but rather that China wants to spy on their citizens.

load more comments (1 replies)
load more comments (3 replies)
[–] KLISHDFSDF@lemmy.ml 20 points 1 year ago

100% agree. I appreciate the guys work on lemmy and the jerboa (the android app) but he's got some weird ideas.

[–] Tangent5280@lemmy.world 14 points 1 year ago (2 children)

Yeah that china comparison majorly derails this argument. When I read it earlier I just glossed over that but now it stands out like a sore thumb.

I don't know what to think about signal anymore. I suppose as laymen we are pretty much non-players as far as the interest of government groups go, but still I suppose I need to learn a lot more about privacy best practices and threat assessment because some of the article was just difficult.

[–] Melpomene@kbin.social 12 points 1 year ago (1 children)

TLDR, the thought is that the USA is spying on users of Signal because some early funding came from the US government. But the evidence suggests not; indeed, governments worldwide are targeting Signal et al because they don't LIKE that they can't just demand access from providers.

[–] slazer2au@lemmy.world 3 points 1 year ago

Also in the same vain didn't the US armed forces (possibly the Navy) develop TOR?

[–] Calzone8585@lemmy.ml 7 points 1 year ago (1 children)

I dunno if Moxie Marlinspike is still behind Signal, but I've met the dude. He eats, sleeps, and shits privacy.

[–] ranok@sopuli.xyz 7 points 1 year ago

He has been stepping back from Signal over time.

load more comments (4 replies)
[–] Midnight 24 points 1 year ago (1 children)

I think a lot of these points have been made better elsewhere.

The extended discussion of hypothetical US interference just because of a tenuous chain of connection to the CIA is just typical US-badism. The US frequently funds tools which they think further geopolitical goals and this doesn't inherently mean its untrustworthy, just that their methodology of control is more resilient to uncensored speech; the best example of this is TOR, decentralized, anonymous, and created by Naval Research and DARPA. The author can't concede this point as it'd bring up they're unsubtly simping for a different colonial power, one who does require such censorship.

Signal's centralized nature has always been a major criticism (and it's reasonable), however as a trade off it's easy to on-board the tech illiterate. It's nontrivial to set up a Matrix server and I've seen the difficulty of migrating activist groups there. It's good as a long term goal, but one also has to recognize that a person struggling with housing has different concerns and will prefer to use whatever their friends and family do.

[–] FarLine99@lemm.ee 6 points 1 year ago (1 children)

yeah. when matrix will be mature and strong, it would be REALLY good alternative.

[–] sam@lemmy.ca 3 points 1 year ago (2 children)
load more comments (1 replies)
[–] winterayars@sh.itjust.works 24 points 1 year ago (1 children)

Lemmy devs don't have a lot of ground to complain about services being insecure imo.

[–] FarLine99@lemm.ee 4 points 1 year ago
[–] UnfortunateShort@lemmy.world 23 points 1 year ago (2 children)

One important thing to keep in mind is that Signal is for private not anonymous communication.

[–] ErevanDB@lemmy.zip 5 points 1 year ago (1 children)

Though it is REALLY hard to get the data of what was sent, or who it was sent to, as they'd have to get inside your pc, log in, unlock signal and hope you don't have disappearing messages.

[–] ReakDuck@lemmy.ml 3 points 1 year ago

Except you installed Signal on your PC, if not encrypted, its pretty easy to get all messages that are synced from the day you setup the sync with your phone.

Except you use a Luks encrypted device or somethinf similar. Bitlocker failed way too many times in history to be actually secure.

[–] FarLine99@lemm.ee 5 points 1 year ago

yup, different concepts.

[–] elouboub@kbin.social 16 points 1 year ago (2 children)

I'm just waiting for the EU's Digital Markets Act (DMA), that requires interoperability between protocols (messenger, whatsapp, that apple thing, signal, matrix, etc., to kick in. Once that happens, I'll take a closer look at matrix.

Matrix is also being rewritten in Go and one day, they'll hopefully support decentralised identities (aka your identity isn't tied to a server). When both are implemented, I think they'll be superior to many things out there.

As to the article: yawn. Proof is lacking everywhere and the "it requires a telephone number" argument just keeps cropping up. Without a telephone number, what is the best way to discover your friends and family on a new network? If someone can respond with a viable alternative that doesn't involve sending a message to everybody over some insecure medium, I'm all ears.

[–] mb_@lemmy.ml 3 points 1 year ago* (last edited 1 year ago)

As much as I love and follow matrix closely, I can't fully trust developers who aren't capable of deploying SSO in their product (look at dendrite mess). Unfortunately, following their SSO ticket chain was a mess and disappointment.

load more comments (1 replies)
[–] cjf@feddit.uk 13 points 1 year ago (1 children)

In January 2021, after WhatsApp, the most popular messaging app in the world, became acquired by Facebook, and announced its sharing of data with its new parent, Signal became the top downloaded app in > 70 countries.

Errr…

WhatsApp was acquired by meta back in 2014.

2021 was when WhatsApp released updated terms of service that allowed them to connect to Facebook servers and share the data they needed/wanted to.

This article seems like the average low effort hit piece against signal that keeps on popping up.

I still think signal is the easiest messaging app out there for the average user to gain a little more privacy in their digital lives.

load more comments (1 replies)
[–] Kekzkrieger@feddit.de 10 points 1 year ago

I disagree with a lot of things in this message, a server will always know who communicates with whom and when, because it needs to deliver these messages.

We know that Pegasus can infect any device without anyone really noticing and fully taking over. No message service could ever get around that meaning that as long as you use a phone you could always be the target of surveilance.

That means there is an inheritated problem with privacy on phones because no matter what a app will never be safe.

End to end encryption just ensures that there wont be a party constantly monitoring all data and enable mass surveilance.

In theory they infected everyone with Pegasus send the traffic somewhere whwre they could analyze that traffic.

[–] JoeKrogan@lemmy.world 9 points 1 year ago (1 children)

https://www.politico.eu/article/eu-commission-to-staff-switch-to-signal-messaging-app/

The EU commission who are actually targets of nation states recommend to switch to signal. Also it was tested in court and the data wasn't there to give.

If you are a target they will go for the weakest link either hack the device or they will go for the other participants device to get the conversation there. They don't need to break the encryption.

[–] FarLine99@lemm.ee 3 points 1 year ago (1 children)

I am talking about MASS surveillance, not about targeted persons, definetly another talk.

[–] JoeKrogan@lemmy.world 5 points 1 year ago (1 children)

I know and in the case of mass surveillance the data is not there to give by design. https://signal.org/bigbrother/central-california-grand-jury/

load more comments (1 replies)
[–] TCB13@lemmy.world 7 points 1 year ago (1 children)

Watch out... last time I liked to this article people started to say that I was spreading misinformation...

[–] FarLine99@lemm.ee 4 points 1 year ago

Now I am also a foreign agent 🙂

[–] nyakojiru@lemmy.dbzer0.com 5 points 1 year ago (2 children)

For privacy ? Element or FluffyChat

[–] BitSound@lemmy.world 10 points 1 year ago

i.e. Matrix with the client of your choice, if anyone's confused, they both speak the same protocol

load more comments (1 replies)
[–] birdcat@lemmy.ml 5 points 1 year ago (1 children)

Many great answers in here but can someone address this point?

Signal could very well be another Crypto AG-style honeypot: the Swiss company which provided secure communications services to ~120 governments throughout the 20th century, and was secretly ran by the CIA and West German Intelligence.

[–] FarLine99@lemm.ee 5 points 1 year ago

I think if we assume that we run on our devices code that is public we are safe (without additional built in things, backdoors). This code is checked many times so it is good. If you use Android you can use some forks of official Signal client (Molly, Signal-FOSS) and be safe 🙂

[–] Evoke3626@lemmy.fmhy.ml 4 points 1 year ago (4 children)

I personally recommend Session. Which is like signal but better. It is 100% zero user knowledge with no accounts emails or phone numbers. It just goes “here’s your ID have fun” and that’s it. Love it.

[–] KLISHDFSDF@lemmy.ml 8 points 1 year ago (2 children)

Sessions developers dropped Signal's Perfect Forward Secrecy (PFS) and deniability [0] security features. Personally I would not trust a product that drops an end-user security feature for the sake of making the developer's life easier [1] .

Using existing long-term keypairs in place of the Signal protocol massively simplifies 1-1 messaging.

For those unaware, PFS protects your data/messages from future exploits and breaches. With PFS, each message's encryption is isolated, preventing compromise of current and past interactions [2].

A simple example to illustrate why PFS is beneficial. Lets assume any 3 letter agency is collecting all Signal/Session messages - on top of the tons of data they're already capturing. The great thing is that your messages are encrypted, they can't see anything - YAY - but they're storing them basically forever.

Two ways they may be able to compromise your privacy and view ALL your messages:

  1. A flaw is discovered that allows them to crack/brute force the encryption in weeks instead of years/decades/eternity. If you were using Sessions, because you use the same key for every message, they now have access to everything you've ever said. If you were using Signal, they have access to that one message and need to spend considerable resources trying to crack every other message.

  2. Your phone is compromised and they take your encryption keys. If you were using Sessions, this again gives them access to your entire message history. If you were using Signal, because the keys are always rotating (known as ephemeral) they can only use them to unlock the most recent received messages.

It's important to state that both cases above only really matter if you delete your messages after a certain time. Otherwise, yes, all they have to do is take your phone and get access to your entire message history - which is why ephemeral messaging (i.e. auto deleting messages after a certain time) is crucial if you suspect you may be targeted.

[0] https://getsession.org/blog/session-protocol-explained

[1] https://getsession.org/blog/session-protocol-technical-information

[2] https://www.signal.org/blog/advanced-ratcheting/

load more comments (2 replies)
[–] FarLine99@lemm.ee 3 points 1 year ago

Calls are in beta and buggy. Lacks features, translations. Good concept but not mature realization.

load more comments (2 replies)
[–] lengsel@latte.isnot.coffee 3 points 1 year ago (9 children)

If someone wants to use Sigbal without Google dependancies, have a look at Molly.

Does anybody know what's happening about Signal creating usernames to add people instead of numbers?

load more comments (9 replies)
load more comments
view more: next ›