Chat Apps, Government Ties, and Transparency
threema.chOver the past days, two popular chat services have accused each other of having undisclosed government ties. According to Signal president Meredith Whittaker, Telegram is not only “notoriously insecure” but also “routinely cooperates with governments behind the scenes.” Telegram founder Pavel Durov, on the other hand, claims that “the US government spent $3M to build Signal’s encryption” and Signal’s current leaders are “activists used by the US state department for regime change abroad.”
You must log in or register to comment.
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 57 users / day
- 383 users / week
- 1.5K users / month
- 5.7K users / 6 months
- 1 subscriber
- 2.42K Posts
- 56.9K Comments
- Modlog
I use Signal as my main daily messenger the two major problems in my opinion are:
Signal is currently the best middleground between security, simplicity and widespread adoption.
how has no one discussed matrix here
Unable to decrypt message
Unable to decrypt message
Unable to decrypt message
Unable to decrypt message
Unable to decrypt message
Unable to decrypt message
…
That must mean it’s working! :D
I don’t get it at all. There are plenty of platforms like matrix, xmpp, simplex that don’t require phone numbers tied to your identity. Signal has somehow managed to convince people that it’s a private platform, despite it being a US hosted service that requires phone numbers.
deleted by creator
Say the US government, in a worst-case scenario in which it constantly monitors all traffic that goes through Signal’s data centers, can ‘only’ see phone numbers, IP addresses and timestamps, right? Or am I forgetting something here?
Metadata and social graphs are more important than message content, esp since not many people have the time to read through individual messages to build meaning.
Signal stores phone numbers (meaning your identity, and home address), and message timestamps: who texted who and when, and who’s in chats with who else. More than enough to build social graphs and connections, and also figure out where people are through their IP addresses.
Do you happen to know what metadata matrix stores? I assume matrix.org specifically stores email and username, right
Yes, but I don’t think user metadata outside of your apub url, name, icon, display name, leaves your homeserver. Email or passwords don’t leave iirc.
Signal can’t see who is texting who. They can’t see which groups you are part of. Those information are end to end encrypted, same as your chats itself, your profile picture, your stories, etc.
Signal doesn’t store message timestamps either.
What Signal itself knows of you is your phone number, the timestamp of your registration, the timestamp of your last connection to the server. That’s it.
Yes metadata is critical but Signal handles metadata very well. Indeed, even though I’m a fan of Matrix, better than Matrix. Matrix is a metadata nightmare due to it’s centralized structure and the way the protocol works.
This is completely false. They can absolutely see who is texting who, in fact they need it to be able to route messages. They have message timestamps, and phone numbers stored in their database.
Question, why do you “trust” signal? You can’t see what code their centralized server is running, unlike matrix which you can self-host and build from source. You don’t have to “trust” matrix, you can verify it for yourself.
Signals server is open source. You can run a server. You just can’t connect to the main net because each server is it’s own thing so it doesn’t make sense besides for development purposes.
Please don’t spread misinformation.
They went over a year without publishing their server updates. And how do you know signal is running the code they say they are? Do you trust them?
Right. So arguably better than WhatsApp, where each users’ contact books, profile photos, bios, and each group chat name, picture and description is not E2E. But to call it ‘private’ is not logical, looking at the alternatives, of which some are much more private.
Who have they convinced that it is private? I think it has more to do with the overall purpose of the platform. Signal is not made for large group chatting with strangers like Matrix.
I use Matrix for my personal 1 on 1 chats with family and friends, so dunno
It’s a Google hosted service, which is arguably worse because they may as well be a nation-state unto themselves.
And the largest homeserver, matrix.org, is MITM’d by Crimeflare.
Fuck matrix.org, just selfhost.
Doable, but a huge pain in the ass because of conflicts in the protocol. I spent about a year trying to suss them out and come up with a fix but never figured it out.
Any homeserver that federates (even indirectly) with matrix.org will still have practically all the same data shared with it, just not your password.
What passwords where?
The password used to login to the homeserver
Wasn’t Amazon involved here as well? It is another “nation-state”.
I do not think so, no. However, Amazon is certainly big enough to be un-humorously compared to nation-states as well.
I remembered it as being AWS. Checked their blog, and the article about their spending mentions renting space in AWS and Azure too, indeed.
deleted by creator
The server / backend is not open source. Even though it’s audited that’s a red flag.
‘Open source’ misses the point of libre software.
Yes, app does not work without service and we are missing server software to serve this service it needs: broken app. Threema is SaaSS.
removed by mod
Also Tox, Briar, Session etc.
deleted by creator
I can’t believe people are saying Telegram and Threema might be better than Signal. Signal isn’t perfect but Telegram and Threema are worse.
Signal is much worse than Telegram (in terms of privacy)
Please give several reasons why
Please stop spreading FUD.
The encryption used by Signal would not be used if it could be easily broken. It’s fully open source and is regularly audited. People would not recommend it if it were so broken like you say; this is just fearmongering.
lol, lmao even
I’m not forcing you to believe anything. Also this is a free platform where I can say what I think. I won’t hold myself back from expressing my view only because the majority has a different opinikn (looking at the downvotes). I personally just wouldn’t trust it. And it also doesn’t have any difference to Whatsapp and co. (encryprion algos are the same) which completely removes the purpose of it even existing (ik open source is still an argument. But they don’t have reproducable builds so even that falls apart) so there really isn’t any reason for me to switch to it or promote it to anybody at all.
wtf, one would be fine
it’s a futurama joke
sometimes my brain’s just a can opener
deleted by creator
Because we keep saying Signal, Telegram, Threema instead of Anti-Libre Software, Service as a Software Substitute and Centralised.
Signal is not applicable when you need a public space for people to just have a discussion, like in discord. Signal clients are clunky and rely on cross sync from what I see, while telegram clients are well made and convenient to use. Even Whatsapp went away from electron so I’d choose it over signal any day.
Obviously you have never used Element for matrix. Signal is like a Ferrari in comparison.
Yeah I’ve never used matrix really.
Matrix would work for that and would avoid proprietary software and sketchy companies
I would argue that the standard federation fragmentation issues still apply. Many instances end up defederating from each other and you have no idea which wind you’re pissing into.
Does it sync automatically between desktop and mobile? Can I share an image into it on mobile and have it a few seconds later on laptop?
Yes, just keep in mind the encryption is flaky if you use a browser that clears browsing data. Best option is to use a client
Have you tried Signal recently? On Android it’s very well polished.
In fact I believe it’s a shame that not more people use such a beautiful app, regardless of privacy and security implications.
I have no use for it for now and as long as it’s still electron on desktop I don’t want to have it running.
deleted by creator
It really depends on your use case. Most of my simple chat messages are the same as I would have in any public space. I have no need for encryption, I have need for convenience in that regard. With Telegram I have my chat history on all devices and don’t need to use my phone to connect which are two must-haves for me. For my use case, Signal is the worse option. That doesn’t make Signal bad, just not suitable for me.
As a privacy-concious person I am very much aware of the non-secure nature of my chats, but since that is not a factor of consideration to me when it comes to casual chats with a few friends and family members. The worst thing Telegram could do is analyse my chats and … then what?
Let’s be honest, Signal is not perfect either:
(UPD: It was funded by CIA)
(UPD2: Here I will quote www.securemessagingapps.com:
((UPD)Source: https://www.androidpolice.com/2021/04/06/it-looks-like-signal-isnt-as-open-source-as-you-thought-it-was-anymore/#update-2021-04-06-1-39pm-pdt-by-ryne-hager)
(I’m gonna find sources for the last two statements a bit later to not be unsubstantiated)Done.
Although, we all can agree, that Signal is still better than Telegram, or WhatsApp, or Threema, or whatever.
Still, we probably want to look at the better alternatives, like Simplex or Session.
Wait until you find out where computers, the Internet, GPS, weather satellites and Tor came from.
Telegram requires a phone number too? I mean yeah there’s the option to use that blockchain phone number service, but you can do the same for Signal. 🤷
Yes, it does. And yes, it is equally bad in both cases.
Signal no longer requires a phone number. You can now create an account. Not sure if that helps your outlook on it, but yeah. It was a fairly recent update that this was rolled out.
Edit: being told we still do need numbers to register. I haven’t gotten a new phone since well before the change was made, so I haven’t actually created an account and gone through the process. It looks like I misinterpreted what was going on when I read the changelog.
That’s not true. A phone number is still required to register, you can just set it not to be public.
Source: I just tried to register and it asked for my phone number.
Last I have seen, it still requires a number to register - it just doesn’t have to be public.
What gets me the most is the requirement of a smartphone to register. No way I am trusting my non-public chats to a phone, so that means either Waydroid/VM (which creates issues with copypasting) or signal-cli (which is fairly inconvenient).
Which lines of its libre software source code are malicious?
It’s centralised
It’s not about code, but about funding.
Yes, and it’s the downside, no matter how you look at it.
So, which malicious lines of libre software source code have been funded? This is how we stop FUD. Don’t let them derail us.
Don’t get me wrong. As far as we know, no malicious code have been funded. The very fact that the Signal was sponsored by the CIA is suspicious (maybe I used some incorrect words, sorry if so). Of course, it’s totally up to you whether you think that fact is sus or not.
It’s not. Our devices run software, not funding.
Session is also sus because you effectively cannot host a node, last I have seen. They claim it is “against a Sybil attack” but all it does is making sure only people wih large disposable funds can have nodes, and the effect might be the exact opposite.
Simplex is more interesting in this regard because while I am concerned with initial centralization (the default servers), they made hosting your own easy. But I personally stick with imperfect yet trusty XMPP.
SimpleX is great. BUT it’s not user friendly. Thus general adoption for the average user will be hard. Don’t get me wrong using the app itself is easy but as soon as someone switches their phone that doesn’t have technical knowledge they will loose their chats because they won’t understand the concept of moving their DB. Since you don’t have an identifier like a phone number with SimpleX those people could even lose contacts as a whole since they generate a new DB, hurting their social connections.
That’s the reason I personally never recommend SimpleX to anyone who doesn’t have the technical knowledge to understand stuff like that.
Not anymore, right? Or does it still need your number for signing up?
Just to sign up
https://www.privacyguides.org/en/real-time-communication/
https://www.securemessagingapps.com/
https://bkil.gitlab.io/secuchart/
When it’s anti-libre software, why waste our time showing it fails everything else. These pages are trash, too verbose.
Doing thorough analysis and discussing all the nuance and tradeoffs is “trash”? That is a difficult way to live your life, being anti-intellectualist.
That’s a great way to spread a multiplayer app.
I don’t understand your response in the context of refusing to do comparative analysis
I still stand with Signal App.
I gladly donate it month to Signal. Love my freedom of speech
Last I checked, their provided server code lags behind their production server, so you rarely get to see the current version. However, that’s kinda the point of E2EE, is you don’t have to trust the server.
And one can always self-host or use a different server.
Man, everyone is hopping on the Trash Signal Bandwagon, even though TG is less secure, and nobody (the 99%) uses Threema.
It’s called disinformation and psychological warfare. How else attack E2EE, libre software?
I’m wondering if something interesting will fall off the truck this time :D
Context: before that blogpost, cellebrite claimed they can “hack” signal (or they were kinda closer to the truth, and that was media talking abt hacks without reading stuff)
removed by mod
Don’t forget Threem encryption was broken. Threema is not free
Nicely written article and a good read! However I had not heard of Threema before. It looks like a promising messaging app itself, anyone use it?
I am using it to communicate with 3 people (our common ground as I don’t have an iPhone and don’t use Whatsapp).
A few years ago it felt a bit ruff and awkward to use, but many updates later it is as fluent as any chat app.
The security feels ok. Of course it would be a lot better, if they would open source their code.
It’s relatively popular in DACH countries.
I use it sometimes. It has its fair share of issues, and the back end is not open-source, but it is OK for the most part. Main benefit is that you don’t need a mobile number to sign up.
But if you are looking for an alternative IM to use with friends and family, I would rather suggest XMPP, specifically Snikket.
Cool thanks!