A face-to-face conversation, held in a proper SCIF (Secure Compartmentalized Information Facility), with no decorations, transparent furniture, the best sound isolation you can buy (think bottom of a salt mine and still wrapped in isolating material), no windows, no air-conditioning, shielded from thermal imaging, bring no devices at all, and all participants stark naked (ideally you’d add body cavity search and MRI); That way you can avoid most eaves-dropping.
And then shoot the other party, because a secret shared is no longer a secret.
Well, if eliminating parties is on the table, I’d have to recommend shooting yourself (better: pack your head in a lot of explosives, less chance to accidentally survive), so good ol’ rubber-hose cryptanalysis doesn’t work either ;-)
Ok… that is a bit over the top. What about digital messaging.
Fair enough, I was feeling a bit cheeky ;) I guess you really mean digital, electronic, semi-instantaneous, text-based communications, aka “instant messenger”. I tend to be very careful with recommendations, they always can turn out to be bad advice… For what it’s worth I use either email with GnuPG or Signal. I have a long list of caveats for both, but I do use them…
I read somewhere (on lemmy) that signal might not be a safe and secure option. and i have deleted my account. 😑
and i use the openPGP app. is this good enough to protect my missile launch codes?
As I said, I have reservations about Signal, but I have not found one where I have fewer, so… As to “the” openPGP “app” and literal missile launch codes, it really depends on what exactly that app is (there are many implementations of RFC4880) and on what environment it is running. Most likely it’s adequate for normal people though ;) I use GnuPG 2.x on QubesOS, and OpenKeychain on GrapheneOS, but I’m a cryptology-nerd who enjoys coming across slightly paranoid ;)
I am taking the notes and switching to write letters now. 😭
Not to blow anyone’s trumpet, but this may actually be less secure, as there is always the possibility that the postman/postwoman/postperson will open your letter and read them, then replace them in a different envelope. They could also shine bright light through the envelope to get a better view of the writing, or possibly use some form of scanning such as MRI?
Please read some of these methods that people have suggested on the internet from 2008, which I have found through Google.
i think the actual “classic” way probably doesn’t involve a microwave… try ironing the letter with a lot of steam. but of course opening a sealed envelope is very easy. reclosing it once you’ve opened it is the real trick. consider the attentiveness of your audience. will the person whose mail you’re reading notice if you open really carefully and then re-seal with a glue stick? probably no…
If it’s not a heavy or security-print envelope, throw it on a backlit scanner (any flatbed scanner with a nice, bright transparency lamp should work) and get a 24-bit color scan. Open the scan in Photoshop and manipulate the gamma correction or color correction curves to maximize the contrast between the envelope and the text inside. Rotate as necessary. You can usually get something and you don’t even have to break the seal. This, of course, is unlawful and unethical, and should never actually be done.
Just open it up, read it, then destroy it. The recipient doesn’t need to know that they had a piece of mail.
Upside down can of computer duster air works wonders in making the envelope transparent. Then it evaporates, leaving no traces.
is telepathy safe?
don’t tell me that somebody can intercept it too with radio signals.
I AM CRYING!!
I salute a fellow connoisseur :D
:D /me offers a hug The world is a dark place, but don’t let discourage you :)
You could use end to end encryption which uses one of the more secure and complex encryption/decryption methods available, and only give the private key to that one individual, and using a device which you know does not contain any hardware or software backdoors for any government or business entity. Rotating encryption keys on a scheduled basis can also help verify that only the recipient has access to the correct keys.
I haven’t done any real project which uses encryption, so don’t call me an expert on different algorithms or methods of implementation. However I’d also stress that being excessively paranoid about people wishing to steal your information is not necessarily healthy. If the information you are communicating is important enough that people may try to use highly technical ways of breaking the encryption, it is always easier and more practical for them to make you give them access to that information yourself, through social engineering, rather than through hacking.
Thank you. I will follow these steps. and I completely agree with you on the 2nd para.
deleted by creator
That name, that just made my day
Thank you. tbh Tinfoil goes over my head. I’ll check Briar.
deleted by creator
Matrix / Element or XMPP.
We’ve had many discussions on here for why many of us think that signal isn’t secure.
True: here an interesting video about how using some services make you identifiable by connection maps. This affects also signal since you’re subscribed via your telephone number and people connect you through their contacts list. Additionally, metadata tell how often you talk to some people, what time, how many messages, etc. This shows to an attacker who are your main connections, etc. So things are not about which kind of service you use (which app), but HOW you use it. The video really invites you to think about how these complex things work. Btw here’s the video: https://www.youtube.com/watch?v=IWMZ17Iyu3o
Damn, very good video, thx for that.
This also affects Matrix or XMPP
It doesn’t, because neither matrix nor XMPP require the crucial piece of information linking you to your real identity: phone number, or email.
If we learned anything from the predatory ad industry, it is that you don’t need a piece of proof of identity to track and even deanonymize people.
Matrix / Element or XMPP.
Still leaks metadata, but given that you use your own server and proper e2e keys with enabled encryption, frequent re-keying and current room/software versions, it’s arguably more secure than most messaging systems.
deleted by creator
There is no such thing like “safest way of massaging”
Well, you could take courses to not hurt the people you massage, for starters?
deleted by creator
deleted by creator
actually I was using Signal. But deleted my account last week. Tried Matrix on element but the experience was not good.
Tried Briar but messages sent when i stay offline do not get delivered. So that is not an option for me. Still searching for a good platform.
deleted by creator
Yes. Waiting for a good Matrix varient.
Tried Matrix on element but the experience was not good.
Define that?
deleted by creator
Tried: Tried; Matrix: Matrix.org; on: on; element: the Element App; but: but; the: the; experience: experience; was: was; not: NOT; good: GOOD;
Ok now try to explain what your experience was without using the same words that drove me to ask what you meant by those words.
it (element) was slow.
deleted by creator
Smoke signals.
😳 did not understand. enlighten me
deleted by creator
Snail-mailing a handwritten note to your friend in a secret code that only the both of you know.
that doesn’t hide metadata, the postal service can track it and you can trace back both the handwriting and reverse engineer the code. Someone can intercept the mail from many stations on the way, including your own post box.
I’d say that many messaging services offer more protection than that method.
You could, however, use PGP with elliptic curve cryptography, and send that via packet radio or something similar on a frequency only you know. To an uninvited person this only looks like garbage data or noise.
Every AX.25 packet includes the sender’s amateur radio callsign
The same callsign that’s tied to your physical address as provided to the FCC?
You don’t have to follow these regulations. The requirements in the opening post were just for the most secure way of messaging, not a legal and secure way of messaging.
-
Session is an end-to-end encrypted messenger that removes sensitive metadata collection. Designed for privacy and freedom.
-
Jami is a chat, voice and video messenger. All communications are peer-to-peer and end-to-end encrypted.
-
Tox is a chat, voice, video, and file transfer instant messaging client using the encrypted peer-to-peer Tox protocol.
-
I2PChat is a P2P end-to-end encrypted chat messenger over the anonymous I2P network.
What do you think about Briar?
Briar is still Android only I think?
Briar is good if you and the other stays online everytime. Or you can set particular time periods to message everyday. Messages sent when you are offline will not be delivered.
-
deleted by creator
thank you. but this is a gawd level setup. 😶😶
Maybe smth like quantum encrypting? Idk
Secure (knowing but not being able to access) being different from privacy (no-one knows who) and of course remembering that the more private especially, the more difficult to locate anyone you actually know as zero e-mail, phone numbers, etc should be used… I’d still say Matrix is the simpler and easier secure messenger for most to use and where they have a good chance of finding others actually using it.
Can also mention Wickr Me, Wire and Threema. Briar Project would have been a good option except it is only Android which really holds it back from broader use. Another consideration is whether mobile to mobile is satisfactory (peer-to-peer is sometimes an issue with mobile) or whether you would use desktop clients along with mobile, as that then also narrows some choices. From a privacy perspective, specifically metadata is important and why Signal and WhatsApp fall down even though they may have secure E2EE.
deleted by creator
And of course the phone number… I really prefer something that requires zero phone number (like Session as an alternative) but thing is you’ll find most people on Signal (through their phone number)…
deleted by creator
deleted by creator
The most secure way of messaging is becoming thoroughly versed in infosec and only conversing with other deeply security minded individuals using E2E encrypted apps.
In lieu of that, use signal. Matrix if you want some more features. But never for a second assume that using a “secure” platform or service makes you secure. Security and privacy are a never ending dance. The most important part of which is to keep moving constantly. Understanding new threats, keeping a close eye on updates for your client of choice, and maintaining a constant background suspicion will ultimately have a much greater impact than which platform you use.
I would say a self-hosted instance of Matrix.
