I posted this down below in a comment thread but I’m afraid it won’t be seen and not enough people know about this.
Session was at first a fork of Signal without usernames.
Now by design it uses their own custom tor-like service (instead of just… using tor) and does not support forward secrecy or deniable authentication, so anyone who collects the messages in transit can either find a vulnerability in the encryption scheme, or spend enough GPU resources to crack it, and they have confirmation of who sent and received the message and what the contents of the message are. And is headquartered in Australia, which is 5EYES and much more against encryption than the US. Oh, and the server is closed-source.
Regarding Australia’s 2018 bill…
The Australian Parliament passed a contentious encryption bill on Thursday to require technology companies to provide law enforcement and security agencies with access to encrypted communications. Privacy advocates, technology companies and other businesses had strongly opposed the bill, but Prime Minister Scott Morrison’s government said it was needed to thwart criminals and terrorists who use encrypted messaging programs to communicate.
Regarding the ‘vulnerability or cracking them later’ bit…
Messages that are sent to you are actually sent to your swarm. The messages are temporarily stored on multiple Service Nodes within the swarm to provide redundancy. Once your device picks up the messages from the swarm, they are automatically deleted from the Service Nodes that were temporarily storing them.
From Session’s own FAQ:
Session clients do not act as nodes on the network, and do not relay or store messages for the network. Session’s network architecture is closer to a client-server model, where the Session application acts as the client and the Service Node swarm acts as the server. Session’s client-server architecture allows for easier asynchronous messaging (messaging when one party is offline) and onion routing-based IP address obfuscation, relative to peer-to-peer network architectures.
I wouldn’t touch it with a 12ft ladder.
Session was at first a fork of Signal without usernames.
Now by design it uses their own custom tor-like service (instead of just… using tor) and does not support forward secrecy or deniable authentication, so anyone who collects the messages in transit can either find a vulnerability in the encryption scheme, or spend enough GPU resources to crack it, and they have confirmation of who sent and received the message and what the contents of the message are. And is headquartered in Australia, which is 5EYES and much more against encryption than the US. Oh, and the server is closed-source.
Regarding Australia’s 2018 bill…
The Australian Parliament passed a contentious encryption bill on Thursday to require technology companies to provide law enforcement and security agencies with access to encrypted communications. Privacy advocates, technology companies and other businesses had strongly opposed the bill, but Prime Minister Scott Morrison’s government said it was needed to thwart criminals and terrorists who use encrypted messaging programs to communicate.
Regarding the ‘vulnerability or cracking them later’ bit…
Messages that are sent to you are actually sent to your swarm. The messages are temporarily stored on multiple Service Nodes within the swarm to provide redundancy. Once your device picks up the messages from the swarm, they are automatically deleted from the Service Nodes that were temporarily storing them.
From Session’s own FAQ:
Session clients do not act as nodes on the network, and do not relay or store messages for the network. Session’s network architecture is closer to a client-server model, where the Session application acts as the client and the Service Node swarm acts as the server. Session’s client-server architecture allows for easier asynchronous messaging (messaging when one party is offline) and onion routing-based IP address obfuscation, relative to peer-to-peer network architectures.
I wouldn’t touch it with a 12ft ladder.
I didn’t agree with their decision at all at the time, but now that I realize they made it a little while after it gained widespread adoption and people stopped using it because “Signal isn’t actually secure!” … seems like people were expecting a secure messenger to be, well, secure. So they would chat about anything and everything thinking “I am using a secure messenger, these messages can’t be read…” and tech ignorance is a dangerous thing if you’re trying to be secure. I would’ve preferred a colored window and un-closable message for SMS chats, but oh well. I like that they’ve introduced usernames so you don’t have to give out your real number.
There is a Firefox plugin which I believe is called CleanURLs.
it’s interesting that you mention the shorturls OP… I’m almost positive as of today that those links you can share that are like amazon.com/a/ab3cd4 are customized tracking links.
Problem is, if you paste it in your browser from the app, it doesn’t go back to the original URL. You have to search the product again and customize the color, number, etc, and then strip tracking again from the url.
Most people just want to send a friend a link of the thing they think they’ll like.
Check your email addresses at haveibeenpwned.com and it will tell you what was all was leaked. eye4fraud was likely a fraud credentials hosting site that got hacked and leaked, and yours was in there, and it would have come from a previous leak.
Group of accounts set up webcams outside of busy public restrooms. Records people’s faces as they exit the bathroom and how long they were in there. Auto-ID’s and sends email asking as part of a public poll if they agree with the statement “If you have nothing to hide you have nothing to fear”
N: auto erase image and associated data
Y: auto publish bathroom exiting face and time spent in restroom to tiktok.
Let’s really get the privacy conversation started.
We can call it Operation Feardrop
You’re not wrong. Lokinet and Session are both products from the same parent company. Lokinet was renamed to the Oxen protocol, and they run all the servers AFAIK, so it would be like tor, if tor ran every guard, entry, and exit node. AKA worthless. So you’re spot on, it’s a joy to the intelligence community and after the Encrochat debacle and Session stopped using Signal’s encryption algorithms and code, I would suggest no one use it for anything sensitive.