@myself33
151Y

community should promote federate chat solution like xmpp or matrix. Everything dealing with your privacy should be federated.

@renor
71Y

Well that’s not quite true. First federation means sharing a lot of metadata: you have to federate so finding users on a federated i hard without sharing metadata. Matrix “leaks” a lot of metadata. Privacy with “what” you say? Yes, but most offer you this. Privacy with who talks to who, where, etc? Nope.

Signal is Open Source and server builds are replicable (you can be sure that they run official on their AWS server), being centralised means that almost no metadata is leaked. But I also dislike the ways OWS and Moxie make their decisions.

I recomend you reading the whitepaper of Session at getsession.org. Session is decentralised and it has all the Signal benefits (Signal protocol, and no metadata). How? Onion routing. As said, read about it I recommend you a lot.

@federico3
17M

server builds are replicable

Assuming this is what is really running on the server side, and there is no way to prove it. And there is no way to run an independent server and federate with the walled garden.

being centralised means that almost no metadata is leaked

This is plain false.

SnowCode
21Y

Actually I just tried Session and I don’t know if I will keep it. It drained 30% of my battery, if a app requires additional configuration to make it usable without draining all the battery, it cannot be a wide-used alternative unlike Signal according to me.

SnowCode
21Y

What is the difference between Session and Tox?

If they use AWS, wouldn’t Amazon get all the metadata?

@developred
1
edit-2
5M

deleted by creator

@developred
1
edit-2
5M

deleted by creator

@renor
-11Y

Reproducible builds

@developred
1
edit-2
5M

deleted by creator

@renor
11Y

Well make your own research, you can’t be expecting to always get easy answers from others… Just make the research and you will learn by yourself about it.

https://lmddgtfy.net/?q=Reproducible builds

My biggest issue with that is that you almost never know exactly who is running an instance and what their attitudes or competence on privacy and security are. The attack surface just got widened.

@leanleft
131Y

i think google play services should be disabled

Not just for Matrix, but in general. It’s spyware.

@nutomic
admin
101Y

Well its run by a US company, and they dont allow anyone else to distribute versions of their app (eg fdroid), even though its open source. Also the server code is not open source. I prefer Telegram, at least this way only the Russians get my data.

Isn’t this the signal server code? https://github.com/signalapp/Signal-Server

Having Russians getting your data instead of Americans is a choice one can make, but since TG doesn’t support e2e in Desktop clients, it isn’t really comparable I think. It’s a cloud messenger that also supports e2e in some cases, so while moxie surely gets your metadata, Pavel gets everything.

@nutomic
admin
46M

Ah I’m wrong about that point then, but the others still stand. And I prefer for Russia to have my data, because they certainly dont work with my government, but the USA most likely does.

The best option is Matrix, but so far it still seems too complicated for the average user.

@cipherpunk
41Y

The client app for Signal users is also non-free software soon to be removed from the FSF Directory:

https://directory.fsf.org/wiki/Signal

@developred
1
edit-2
5M

deleted by creator

@nutomic
admin
41Y

Distributing the code is not the same as open source. They prevent others from distributing modified versions of the software, which completely goes against the spirit of open source.

@developred
1
edit-2
5M

deleted by creator

@cipherpunk
8
edit-2
1Y

Huge list of security problems with Signal:

https://github.com/privacytoolsIO/privacytools.io/issues/779

(and note that privacytools.io still endorses Signal even after being made aware of this)

@renor
21Y

People really have to learn to differenciate between PRIVACY and ANONIMITY. Two different concepts.

@cipherpunk
41Y

Anonymity IS privacy. Specifically, anonymity is privacy of identity. So no, it’s not two different concepts. It’s a subset/superset relationship of the same thing.

Calling “privacy” and “anonymity” two different concepts is an attempt to downplay the importance of anonymity. The problem is that you never have absolute privacy, and when privacy is attacked or lost for one reason or another you better have anonymity. You should think of anonymity as a 2nd layer of protection from disclosure.

@renor
31Y

That’s a good point. Thanks for sharing this view

@developred
1
edit-2
5M

deleted by creator

@cipherpunk
31Y

You cannot use Signal without a mobile phone subscription. All mobile phone connections (CDMA or GSM alike) inherently impose tracking. Additionally, most of Europe imposes GSM registration which is linked to national ID. So the mere precondition to establish such service is in itself privacy abuse – and that’s before we even talk about forced disclosure of the phone number to OWS.

@developred
3
edit-2
5M

deleted by creator

@tanuki
21Y

As have I, although using a Google Voice number, so avoiding one devil for a different one.

@pickleprick
1
edit-2
1Y

deleted by creator

Dessalines
admin
51Y

Outside of the phone number identifiers, yeah.

@myself33
31Y

For your information, there is a fork of signal without google services. https://langis.cloudfrancois.fr/

I never tried it though

@developred
2
edit-2
5M

deleted by creator

Apparently it forces you to use reCaptcha. I wonder if it’s possible for the reCaptcha code to access user data.

@cipherpunk
31Y

It’s javascript, so unless Signalapp takes special defensive actions, anything in javascript is possible. E.g. Google could get your internal LAN IP address even if you proxy your traffic through Tor – which can then be used as part of the fingerprint. Visit wtfismyip.com to see how that works.

@AgreeableLandscape
admin
2
edit-2
1Y

How useful is an internal Lan IP? I’d imagine for most people it’s just 192.168.something or 10.something. Though if you’re on IPv6 is it just the same was your public IP?

@cipherpunk
31Y

I choose a quite obscure LAN IP so it’s less trivial for someone who gets past the firewall to target a host. There are thousands of LAN subnets, so once you divide a non-unique fingerprint into thousands, it’s quite trivial to identify unique hosts, particularly if the traffic to a particular site is not in the thousands.

Even running a browser add-on/extension is sufficient to alter a fingerprint to be more unique.

@l3db3tt3r
31Y

I recently came across this project, does anyone have any information, or background on it? https://getsession.org https://github.com/Loki-project

From my understanding it’s a fork of Signal, with some fundamental differences in network design

@oriond
creator
91Y

Sounds a little like Briar, it is e2e encrypted, travels through the Tor network and uses no servers!!!

@developred
3
edit-2
5M

deleted by creator

@cipherpunk
31Y

it’s also worth noting that Session is founded and staffed by alt right people.

@Tommstein
-11Y

So it is alleged.

@developred
3
edit-2
5M

deleted by creator

@oriond
creator
11Y

Do you have a source of your saying?

It’s time Signal starts working on those logs. they should not be able to even know that.

@developred
1
edit-2
5M

deleted by creator

@developred
3
edit-2
5M

deleted by creator

@gravity
51Y

This, centralization, requires phone number, and being USA based. But… personally, I don’t see Signal as an alternative to decentralized, foss chatting platforms. I see Signal as a replacement for SMS/MMS. I think everyone should be using it as their default SMS/MMS app instead of just a stock SMS/MMS app. It can send and receive SMS/MMS, so you do not need a separate app for family members or friends who are stubborn and don’t want to use it, but also can talk to other people who you have on Signal encrypted. And then you can use a seperate app for truly private communications, decentralized, foss, e2ee, etc. that Signal fails at being. Now I am not excusing the fact that Signal is USA based or centralized, I think centralization seems to go hand in hand with SMS/MMS so personally I am ok with that tradeoff. It being based in the USA though, that is concerning to me. But I’d much prefer using it, and getting family and friends on it, then using essentially plaintext SMS/MMS for everything. It’s extremely easy to use and activate, and not confusing even for the boomers in the family. Imo, this is what a lot of decentralized alternatives fail at. Also it does require your phone number, but again I see this as a plus in the sense of a SMS/MMS replacement. I would never be giving out Signal to people I want to talk to online, as I’d be giving out my phone number, and even when they implement usernames, there’d be no point imo as just using a decentralized alternative is the way to go at that point. Use Signal, replace your stock SMS/MMS app with it. Try to get family & friends on it. For any online friends, people who you don’t want to give your number to, or need truly serious privacy/anonymity, pick a decentralized, foss, alternative and stick with that.

which ‘truly private […], decentralized, foss, e2ee’ communication method do you prefer?

@gravity
11Y

It would depend on my use case, I would take into consideration XMPP, Jami, Briar, Self-hosted Mumble, Jitsi, Rocketchat, Self-hosted IRC. Not all are exactly decentralized and e2ee, a handful are, but those are just what I’d personally consider. Some have different use cases. Some are easier to use than others, for example I’d probably not invite normie friends to IRC, but would consider the other options. Some may not be the best for group voice chat, Mumble is my preference, although not e2ee, it is encrypted. I wouldn’t completely trust unless it was a self-hosted server or I trusted the hoster. Do some research and choose what works best for you and fits your needs.

@ajz
11Y

Interesting take. However, I’m wondering, when it comes to security/privacy levels higher than just friends/family chats, there might be some issues with making Signal the default for SMS app ? If a person installs Signal but removes the app … it looks like you will send unencrypted SMS to them. Isn’t it ?

@gravity
31Y

Not sure off hand, I don’t really consider this a major issue but idk it might detect if they uninstall the app. I’ve never had someone uninstall the app. At the very least the message sends unencrypted and you will see it sent unencrypted.

@ajz
11Y

Years ago I tried Signal on a smart phone. Then decided to take out the sim-card and put it back in a regular phone. After that I received a SMS from a Signal user. I think I pretty soon disabled the Signal account in the settings at some point. I don’t remember the details exactly but this looks like Signal will not inform others that a person did leave the Signal eco-system. At first use Signal will add the contacts it sees active, but at that time it didn’t seem to remove them from your Signal contacts. Not sure whether this is fixed, but with the desktop app I can imagine this can happen still, because it needs to sync contacts from the phone. Maybe not important for daily use for non sensitive context, but the moment people are using Signal as the secure and private e2e software where sensitive data can communicated, this is something to keep in mind. And maybe test whether this bottleneck is still there.

@gravity
21Y

Not entirely sure as I said, I understand where you’re coming from. I’d still rather people use Signal than not at all, but yeah I see the issue here. Maybe try opening an ticket on their forums and you’d get better responses. https://community.signalusers.org/

@dpreacher
21Y

deleting app does not delete account on any online service. reason why people are still messaging me on whatsapp and i am calling people on Duo and we are all waiting endlessly. some services like Telegram, Whatsapp (I probably didn’t cover it) etc. have a default inactive account cleanup schedule…not sure about Signal.

@developred
2
edit-2
5M

deleted by creator

@koalp
31Y

Isn’t the server running the one on github ?

I always though that you could self-host your signal server, but would have to recompile the mobile applications because the keys identifying the server are hardcoded.

@developred
2
edit-2
5M

deleted by creator

@ajz
31Y

What about the (collapsing ?) crypto laws in the USA ? Signal foundation is USA based.

@developred
3
edit-2
5M

deleted by creator

Dessalines
admin
91Y

:index pointing up: . My problem with signal isn’t necessarily that its encryption is broken, but that it uses phone number identifiers, which in most countries are 100% linked to your identity (and cost money too). Since signal is US based, we have to assume its DB is compromised, so they might not be able to see message content, but they can certainly see connections between people, and timestamps, building social graphs that way.

You and I can’t even use signal, unless you wanted to tell me your phone number, so its also useless as general-purpose online communication.

@cipherpunk
6
edit-2
1Y

Bingo. Not to mention that people without mobile phones (either by choice or by poverty) are excluded from contacting friends through Signal. The absurdly reckless mandate to get a mobile phone and share the ph# with OWS is what inspired this issue:

https://github.com/privacytoolsIO/privacytools.io/issues/779

which grew into something quite large. Something like requiring a mobile phone is so fundamentally indicative of an organization with little regard for privacy that you can easily expect to find other issues. Once you take a close look at it, the red flags are like mushrooms (after spotting the first one you start to see there are many clustered in the same area). And there are many mass surveillance vectors with OWS Signal. PrivacyTools and PRISM Break continue to lead ppl astray by sending them to Signal.

@dpreacher
31Y

absolutely agree with that last line. My friends on Wire still remain on Wire as I can’t/won’t give my phone number to add them on Signal. #sorry

@jbrown
31Y

You and I can’t even use signal, unless you wanted to tell me your phone number, so its also useless as general-purpose online communication.

Usernames as secondary identifiers are being rolled out so this is no longer true.

“Usernames on Signal are optional. If you choose to create a username other Signal users will be able to find you by this username and contact you without knowing your phone number.” -Pointed out from dev commits on signal forum https://community.signalusers.org/t/signal-introducing-usernames/9157/3

Dessalines
admin
11Y

It’d definitely be a good thing if they added this, but they’re kinda late to have this as an afterthought. Matrix / riot being federated, self hostable, and e2ee capable, is pretty much the future of comms.

@renor
31Y

The metadata that needs to be shared on decentralised services is a lot and Riot/Matrix shares a lot of it. If you seek for anonimity and privacy this is not the best, you will always have to trust your instance admin. I too think that Riot/Matrix is the future but not for Anonimity. Only IM who has achieved not sharing metadata being decentralised is Session with the onion routing used when messaging.

@jbrown
2
edit-2
1Y

Matrix / riot being federated, self hostable, and e2ee capable, is pretty much the future of comms.

I think that’s overly hopeful. Webrtc dependent sollutions can’t be reliably used over TOR and most major VPNs. Being self hostable is definitely a plus, but from the perspective of the communication protocols themselves Matrix is outclassed in both usability and call/message security.

@developred
1
edit-2
5M

deleted by creator

@cipherpunk
11Y

Signal does not accept non-mobile phone numbers.

@developred
1
edit-2
5M

deleted by creator

@renor
-31Y

Server builds are replicable. So it’s not a problem beig hosted on AWS. Don’t spread misinformation. Sealed sender reduces metadata, so Signal along with Session are the two IMs that share the least metadata.

@cipherpunk
31Y

You’re neglecting the elephant in the room. AWS is an Amazon service. Even if you can fully trust the sealed sender mechanism, you certainly cannot stop OWS from paying money to Amazon.

Amazon is a notorious privacy abuser who has pushed surveillance into homes and neighborhoods by way of Alexa and Ring. Amazon has made an astronomical investment in facial recognition technology that’s used to abuse the privacy of countless people globally.

When you feed a vendor or service that feeds Amazon (e.g. Open Whisper Systems “Signal”), you are contributing to privacy abuse.

@renor
31Y

You’re completelly right!

@developred
2
edit-2
5M

deleted by creator

@pickleprick
1
edit-2
1Y

deleted by creator

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

  • Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
  • Don’t promote proprietary software
  • Try to keep things on topic
  • If you have a question, please try searching for previous discussions, maybe it has already been answered
  • Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
  • Be nice :)

Related communities

much thanks to @gary_host_laptop for the logo design :)

  • 0 users online
  • 27 users / day
  • 91 users / week
  • 193 users / month
  • 595 users / 6 months
  • 2953 subscribers
  • 1498 Posts
  • 6650 Comments
  • Modlog