A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 84 users / day
- 537 users / week
- 1.5K users / month
- 6.58K users / 6 months
- 1 subscriber
- 2.31K Posts
- 53.4K Comments
- Modlog
My question to those who think Signal is a honeypot is when will they trigger it? Signal gets subpoenaed fairly often amd it always returns next to nothing. If signal is a CIA project, they probably would have used it by now.
yup. Now i don’t think it is honeypot. Simple reason: it is pointless. Government already has WhatsApp. Why bother to create another messenger with very small userbase to spy on 0.05% people on earth in such a difficult way: encryption, different anti-spy practices?) It is not rationale.
Many great answers in here but can someone address this point?
I think if we assume that we run on our devices code that is public we are safe (without additional built in things, backdoors). This code is checked many times so it is good. If you use Android you can use some forks of official Signal client (Molly, Signal-FOSS) and be safe 🙂
Lemmy devs don’t have a lot of ground to complain about services being insecure imo.
😁
One important thing to keep in mind is that Signal is for private not anonymous communication.
yup, different concepts.
Though it is REALLY hard to get the data of what was sent, or who it was sent to, as they’d have to get inside your pc, log in, unlock signal and hope you don’t have disappearing messages.
Except you installed Signal on your PC, if not encrypted, its pretty easy to get all messages that are synced from the day you setup the sync with your phone.
Except you use a Luks encrypted device or somethinf similar. Bitlocker failed way too many times in history to be actually secure.
removed by mod
Now I am also a foreign agent 🙂
There’s Session, which uses some kind of shitty blockchain version of not-quite-Tor. Every user acts like a not-quite-onion-service and your username is a not-quite-onion-address.
not-quite-bad-answer 😏
@FarLine99 I think there are also chat systems that use the real Tor network.
Briar sends hello 😁
I’m just waiting for the EU’s Digital Markets Act (DMA), that requires interoperability between protocols (messenger, whatsapp, that apple thing, signal, matrix, etc., to kick in. Once that happens, I’ll take a closer look at matrix.
Matrix is also being rewritten in Go and one day, they’ll hopefully support decentralised identities (aka your identity isn’t tied to a server). When both are implemented, I think they’ll be superior to many things out there.
As to the article: yawn. Proof is lacking everywhere and the “it requires a telephone number” argument just keeps cropping up. Without a telephone number, what is the best way to discover your friends and family on a new network? If someone can respond with a viable alternative that doesn’t involve sending a message to everybody over some insecure medium, I’m all ears.
As much as I love and follow matrix closely, I can’t fully trust developers who aren’t capable of deploying SSO in their product (look at dendrite mess). Unfortunately, following their SSO ticket chain was a mess and disappointment.
Matrix evolution is REALLY cool. Can’t wait for new mobile clients because old have problems with notifications on iOS devices (relatives are using them).
If someone wants to use Sigbal without Google dependancies, have a look at Molly.
Does anybody know what’s happening about Signal creating usernames to add people instead of numbers?
Signal FOSS also.
It’s seem abandoned, no ?
It’s latest release matches with latest release from GPlay so it is not abandoned in any way. Look at version-FOSS branches, not main (it was not updated a year already).
How does s person install that from F-Droid? Molly has an F-Doid repository.
No way through F-Droid. Only GitHub (or Obtainium app)
I’m a big fan of the concept of Obtainum, but to insure anonymity with apps, Obtainum is not an option due to not knowing if apps use GCM or Firebase, that’s why F-Droid is safer because of removing any dependencies or not allowing an app like native Signal, because of it’s dependencies, that’s why I suggested Molly app as a safer modified version of Signal.
Signal FOSS removes all proprietary bits from builds. It has open builds process through GitHub Actions. So builds are good and clean. Why not to use Obtainium then?)
@FarLine99 @lengsel you can get Signal Foss from it’s repo !!!
Oh, I am stupid🤣 Here is the link - knil. It has F-Droid repo.
https://www.politico.eu/article/eu-commission-to-staff-switch-to-signal-messaging-app/
The EU commission who are actually targets of nation states recommend to switch to signal. Also it was tested in court and the data wasn’t there to give.
If you are a target they will go for the weakest link either hack the device or they will go for the other participants device to get the conversation there. They don’t need to break the encryption.
I am talking about MASS surveillance, not about targeted persons, definetly another talk.
I know and in the case of mass surveillance the data is not there to give by design. https://signal.org/bigbrother/central-california-grand-jury/
will assume so 🙂
What’s the argument against allowing anyone to host their own signal server? I mean, the code is open sourced, why not allow people to set up their own servers too?
The argument from Signal seems to be that they don’t want to expend resources supporting it or potentially federating with them. They do seem to have past experience doing this with CyanogenMod, and it sounds like it went poorly.
Thanks, that does add some clarity. It all comes down to resource use in the end.
Because Signal is against it. Read the article, there is some talk about it.
This same thing has been reposted here so much. So I am going to copy-paste my original response once again.
Why is it beneficial for the government to have these tools? They already have such for internal use. I am sure that the officials do not use Signal. Why not kill Signal as an organization so that users don’t even think of leaving WhatsApp?
You are really underestimating how hard it is build and maintain such easy to use and secure services. So using a trusted service like Signal is convenient. And government officials across the world use it:
https://www.zdnet.com/article/in-encryption-push-senate-approves-signal-for-encrypted-messaging/
https://theprint.in/tech/netanyahu-zelenskyy-join-world-leaders-to-signal-each-other-why-is-encrypted-app-popular/1204419/
https://www.politico.eu/article/eu-commission-to-staff-switch-to-signal-messaging-app/
And moreover, the essay by the tankie creator of Lemmy does the mistake of assuming everything the US government funds or has funded at some point as nefarious. The US government is not unified by any stretch of the imagination. It is full of competing interests and some agencies do want to support ideas like freedom of information and right to privacy. If you look at the things that the Open Technology Fund has donated to, you will see that it has pretty much stuck to its objective of supporting “open technologies and communities that increase free expression, circumvent censorship, and obstruct repressive surveillance.”
And I still fail to see any real evidence for the claim that Signal’s privacy is compromised.
Very good answer, thank you! Why some agencies in the US government may want world to be more private? It is not in their interests as I understand.
The interests of government agencies are not aligned and quite often contradict each other. Not all of them want to snoop on you.
I disagree with a lot of things in this message, a server will always know who communicates with whom and when, because it needs to deliver these messages.
We know that Pegasus can infect any device without anyone really noticing and fully taking over. No message service could ever get around that meaning that as long as you use a phone you could always be the target of surveilance.
That means there is an inheritated problem with privacy on phones because no matter what a app will never be safe.
End to end encryption just ensures that there wont be a party constantly monitoring all data and enable mass surveilance.
In theory they infected everyone with Pegasus send the traffic somewhere whwre they could analyze that traffic.
This is posted relatively often, and every time it is posted I feel compelled to note that said dev has not articulated any real reason to consider Signal insecure beyond an implicit conspiracy theory with no real meat to it.
When you’re holding up China as an example for the world to follow for privacy, I have a hard time taking ANYTHING else you’re claiming seriously.
I don’t agree with the Lemmy dev and won’t read his stuff, but I also stopped using Signal years ago. First they won’t allow third party appa or self hosted servers, then they got into Crypto and were building a wallet and currency, which is their right, then they announced a proprietary closed source part of their application that can’t be auditted in the name of fighting spam. Yes there’s a blog post out there about it that they themselves posted and no I can’t look it up atm. I’m personally tired of sacrificing privacy for the name of security so I left.
I moved to Matrix and Element. I have my entire family on it, all nontech folks except me, and none of them have any issues. We use it for text and video constantly and have for years. It’s gotten very intuitive.
To each their own, but Signal isn’t the bastion of free open source privacy anymore imo.
The ML in the domain “lemmy.ml” stands for Marxist-Leninist.
Oh jeez. That’s nasty.
deleted by creator
heh, maybe 🙂
I interpret that quote to say that China doesn’t trust US tech like the rest of the world does. It’s not saying that China has more privacy and the rest of the world should follow, it’s saying that the rest of the world also shouldn’t be so naively trustworthy of US tech either.
And they offer no reasonable basis for distrusting Signal, the tech that they attempt to vilify. Given said dev’s past comments, it is reasonable to infer that the reference to China presents them as an example to be followed here.
Ok, two things are happening here.
One, is that they did provide what they considered reasonable basis for distrusting Signal. Given that they thought Signal should not be trusted, the quote you posted is pretty obviously to be interpreted as: thankfully China hasn’t naively adopted a compromised communications platform with a USA intelligence backdoor. Now, if you want to say their basis for distrust is not reasonable, or is false, that’s completely fine. But in doing so it doesn’t change the author’s intent behind the quote which you posted.
Two, is that it should be pretty clear they are saying China should be followed here in a very specific and explicit way: they aren’t saying follow China in every way under the sun. It’s very obvious from context and from what is explicitly said that they mean: China’s distrust and refusal to adopt (what they consider) a platform with USA backdoors should be followed. And I think that’s an entirely reasonable statement to make. No one should naively adopt compromised communications platforms.
There is no honest reading of the quote (especially given the rest of the context of the essay leading up to the quote) that could lead someone to conclude that this particular essay is (1) advocating for and supporting China spying on its citizens and (2) advocating for other countries following China in spying on citizens. It’s pretty obvious the only honest reading of this is: “I believe Signal has USA backdoors. Given that, I’m glad China hasn’t adopted its use heavily. I also think other countries should follow China in not naively accepting such technologies”.
Again, you can disagree with the foundational reasons for distrust, and that could be very useful. But painting the essay and quote the way you (and others here) are is just intellectually dishonest. Disagree with what is actually said, not with what you imagine (or wish) was said.
Key of the previous comment is reasonable. One might as well say that Trump provided a reasonable basis for denying the election results, or that climate deniers are being reasonable in denying the wealth of evidence supporting the idea of man-made climate change. If we’re willing to reject abjectly idiotic claims in one case, we should be rejecting them across the board whether we like the politics of the person in question or not.
TL;DR: The author is engaging in agenda driven conspiracy porn which they know or should know is false. As such, it is reasonable to assume that they’re either willfully ignorant or acting in bad faith.
I don’t think the problem is that China doesn’t trust the US but rather that China wants to spy on their citizens.
Ok then you’re wilfully misreading the quote. That quote is not cryptic in the least. I have no clue why the parent comment is framing it as “holding up China as an example for the world to follow for privacy”. It doesn’t follow from the quote in any way.
Yeah that china comparison majorly derails this argument. When I read it earlier I just glossed over that but now it stands out like a sore thumb.
I don’t know what to think about signal anymore. I suppose as laymen we are pretty much non-players as far as the interest of government groups go, but still I suppose I need to learn a lot more about privacy best practices and threat assessment because some of the article was just difficult.
I dunno if Moxie Marlinspike is still behind Signal, but I’ve met the dude. He eats, sleeps, and shits privacy.
He has been stepping back from Signal over time.
TLDR, the thought is that the USA is spying on users of Signal because some early funding came from the US government. But the evidence suggests not; indeed, governments worldwide are targeting Signal et al because they don’t LIKE that they can’t just demand access from providers.
Also in the same vain didn’t the US armed forces (possibly the Navy) develop TOR?
100% agree. I appreciate the guys work on lemmy and the jerboa (the android app) but he’s got some weird ideas.
Errr…
WhatsApp was acquired by meta back in 2014.
2021 was when WhatsApp released updated terms of service that allowed them to connect to Facebook servers and share the data they needed/wanted to.
This article seems like the average low effort hit piece against signal that keeps on popping up.
I still think signal is the easiest messaging app out there for the average user to gain a little more privacy in their digital lives.
yup. definetly the most convenient!
I think a lot of these points have been made better elsewhere.
The extended discussion of hypothetical US interference just because of a tenuous chain of connection to the CIA is just typical US-badism. The US frequently funds tools which they think further geopolitical goals and this doesn’t inherently mean its untrustworthy, just that their methodology of control is more resilient to uncensored speech; the best example of this is TOR, decentralized, anonymous, and created by Naval Research and DARPA. The author can’t concede this point as it’d bring up they’re unsubtly simping for a different colonial power, one who does require such censorship.
Signal’s centralized nature has always been a major criticism (and it’s reasonable), however as a trade off it’s easy to on-board the tech illiterate. It’s nontrivial to set up a Matrix server and I’ve seen the difficulty of migrating activist groups there. It’s good as a long term goal, but one also has to recognize that a person struggling with housing has different concerns and will prefer to use whatever their friends and family do.
yeah. when matrix will be mature and strong, it would be REALLY good alternative.
matrix 2.0 coming soon
Cool!
Here is an alternative Piped link(s): https://piped.video/watch?v=eUPJ9zFV5IE
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source, check me out at GitHub.