Is Signal messaging really private?
As Signal get your phone number. Can we considerate this application as private ? What's your thoughts about it ? I'm also using SimpleX, ElementX, Threema, but not much people using it...
Cheers
Right now, for the wider population, it it a heaven sent option compared to Whatsapp, FB messenger etc. Break those bonds first and keep the wheel turning.
I couldn't find any sources regarding this topic
With the phone number, no; and since there's no Signal usage without a phone number, well…. Also, I think somewhere on their website (or some place) they talked about burner phones as if it's a universal phenomena.
Signal has felt "out of place" to me. Odd. It doesn't fit in, doesn't make sense if I think a bit farther about it.
I hope something decentralised comes out of Signal protocol minus the need for a phone number.
SimpleX uses Signal tech AFAIK but without requiring phone number or email address.
You are talking about session. Session is a signal fork, and you don't need phone number. But there is some concerns about its security as, in order to properly work, it removed some signal features, I'm not qualified enough to understand if it's truly a security risk or not. But the option to use it is there.
I used it for a couple years, but came back to signal because I had so many issues with media sharing.
Imo signal protocol is mostly fairly robust, signal service itself is about the best middle ground available to get the general public off bigtech slop.
It compares favorably against whatsapp while providing comparable UX/onboarding/rendevous, which is pretty essential to get your non-tech friends/family out of meta's evil clutches.
Just the sheer number of people signal's helped to protect from eg. meta, you gotta give praise for that.
It is lacking in core features which would bring it to the next level of privacy, anonymity and safety. But it's not exactly trivial to provide ALL of the above in one package while retaining accessibility to the general public.
Personally, I'd be happier if signal began to offer these additional features as options, maybe behind a consent checkbox like "yes i know what i'm doing (if someone asked you to enable this mode & you're only doing it because they told you to, STOP NOW -> ok -> NO REALLY, STOP NOW IF YOU ARE BEING ASKED TO ENABLE THIS BY ANYONE -> ok -> alright, here ya go...)".
Secure and private or anonymous are very different things and nearly impossible to do both at the same time and still make it user friendly. Signal is secure, not fully private or anonymous.
No, and they are supported by US gov (last check), so no good can come of that.
Do you've reference about it ?
Quick googling comes up with only people refuting this claim.
Sure, we had signal gate, but the way that was received should make it pretty clear that it’s not supported for official use.
Even if it is, I don't think we should give the government the power to tell us what to not use. Otherwise they just pick any good projects, throw money at it, leak the data, and people jump to a less secure. Trust the code and nothing more
This is kind of useless fear-mongering suited to no one's threat model.
Are messages truly E2EE and they don't share meta data? Yes? Then you're fine. It needs a phone number for registration? OK, well buy a burner SIM card (you of course have several, right?) to register it if you're that worried. Because if you're already at a level where you're THAT concerned about your phone number pinging for using a widely popular messaging app, then you have lost the game by even having a phone or sending messages to other humans who are the weakest link in the security chain anyway.
Considering that the Feds tried to make some government-compliant front end for Signal for idiot Hegseth to use to talk about national security stuff with the Vice President, I'd say that it's probably fine for you to buy weed or whatever.
OK, well buy a burner SIM card
Illegal in many countries. SIM cards are attached to your real world identity.
And we shouldn't depend on such archaic highly centralized technology like phone numbers from techinical perspective either, it is only like this because it is deeply entrenched and a very easily a suprisingly reliable form of identification and deanomization
Signal has too many red flags, but the biggest one is phone numbers and SIM cards. No application that wants to be secure against nation state spying relies on these.
I'll add that if someone knowing your phone number is an actual threat to your safety, you should already know better about using something more anonymous.
Privacy ≠ anonymity
Blog post about Threema that changed my mind against it: https://soatok.blog/2021/11/05/threema-three-strikes-youre-out/
Why is this furry-themed?
Why not?
It's a furry blog that happens to write about security a lot, and the author usually has very well-founded takes.
Chill out and enjoy it -- you might learn something new. I usually do :D
Why not? Its nice to have fun with your website.
owo
Love it thank you for sharing. Awesome blog and so much relevant information. it's now on RSS feed :)
Oh yeah, same. Great writeup, comprehensive and well written, have it bookmarked in case I need to talk to people about Threema.
Private and anonymous are different things. While anonymity does increase privacy, it is not a strict requirement. So it this private, but not as private as possible.
The best private messenger IMO is simplex, but it not production ready yet
Many people say that SimpleX is not ready to replace the likes of Whatsapp, Telegram and Signal yet but noone specifies exactly what features are missing.
I get that public key cryptography is confusing for the average people but there is no UI fix that is getting around that obstacle if we want people to make informed choices on what platform/protocol to use for communications.
The same thing applies to decentralization - people just need to understand that the trade-off they're making for communications' resilience is the comfort of an online addressbook.
Although I admit that there are certain UI elements that could be made better (for example the nickname setting could be stylized a bit better so people can more easily change the names of their contacts to something more familiar), most criticism towards SimpleX comes from people being a bit lazy and not reading the manual before using the app.
TL;DR: I don't understand what features are missing from SimpleX.
Multi-device message syncing. Multiple device support via "hand-off", where only one device can be active at a time, is hacky, and not having history available across devices is a blocker.
Right now when you establish a connection with someone, you exchange between 2 and 4 connections. Each person shares that receive servers out of which one of them is for, and the other is clear net. If you don't have to running and one of the servers goes down, half of the messages no longer deliver. There is no server rotation. Even if you swap your servers ahead of the server shutting down, contacts don't cycle and they are lost
That is currently my biggest reason not to recommend. There are also UX improvements like live messages which I think are useless and will cause people to get confused (they are messages that the other person can see in real time as you type them). They should also include some soft of recommended backup solution because people WILL get mad about losing everything
I often see convos on SimpleX that are clearly missing messages, so I'm not sure what that's about. I mean I see people quoting messages that are not visible.
Also I really think they need to implement UnifiedPush before it's ready. It consumes an excessive amount of battery life for this reason.
Also worth noting that the creator is an alt-right loon of the highest order.
If you are curious, here is a link for the roadmap so that you can see the things they are still planing. Some are going to bother normies (like shortening the group URLs will probably mean that they have to update them)
stickers
Signal has a backdoor - like many other apps. It's private in most situations but not for all... The backdoor is there, and as such, it will never be as secure and private as it could, or should, be...
Can you point it out so we can close it asap?
\
https://github.com/signalapp
\
(Iirc it's up to date?)
Thx!
(I'm critical of Signal, but "in this economy" is the best I can hope to switch my friends to.)
What are you referring to? I've read many security breakdowns of signal and nobody who knows what they're talking about has ever mentioned a back door
Depends on your threat model, as always. If you require absolute anonymity, it's tricky, because it uses phone number during the onboarding process, so get an anonymous pre-paid number and discard it after registration. After onboarding you don't need the number.
For the rest, it's about as "private" as you make it. It supports group messaing, calls and video, so obviously you need to be careful while using it. Everything is e2e encrypted and stays on your local device, the source is available and has been extensively audited. The company itself is non-profit and has sensible privacy policy.
But yeah, your threat model is the key answer to your question
so get an anonymous pre-paid number
That's not something that exists in many countries. SIM-cards have to be attached to a real world identity by law.
It exists on the internet, so it exists in every country.
you have to register with your phone number.
But you dont have to give your phone number out to friends or peopole you meet.
Some family members use Molly-Foss and have no issues.
I use signal-foss from the Twin helix repo, A fork of Signal with proprietary Google binary blobs removed..
https://www.twinhelix.com/apps/signal-foss/
Signal from the F-droid - The guardian project repo, is just signal.
I read that the issue was with signal using google firebase, and that it was easier for the fascist piglets to track your messages through notifications.
I have found that you can actually delete a contact via molly but cannot do it via signal.
With signal you can only block a contact, which for me, is a privacy issues.
If I meet a random person, say on holiday, and we swap details, I want to delete them, not block them, where they remain in my block list forever.
I swap between Signal-FOSS and Molly if I want to delete a contact.
people will still expect you to share phone numbers to talk in signal in my personal experience, I really don't understand how they get so attached to such an archaic technology and often will refuse to use the alias system completely because remembering a random string of numbers is "simpler" somehow
hey furry toaster
Its very frustrating.
People are very odd when it comes to privacy and tech in general.
I have convinced half my friends to move from text messaging to signal and encrypted email but the other half totally refuse. Some have even changed to SimpleX chat and others to conversations.
I have explained to them how, just having my phone number in their contacts list, is hoovered up by all the other apps on their phones.
I tell them I use opencontacts because I respect their privacy, and that I do not share their phone numbers with any apps, so they should respect my privacy too. which they dont.
https://f-droid.org/en/packages/opencontacts.open.com.opencontacts/
I put my foot down and say that I refuse to contact them or reply to any message they send, unless it is encrypted.
I also tell them to delete my number from their phones because I will not reply to them if they use my phone number.
they still cling on to gmail and the old text messages and dont bother messaging me at all.
very odd people.
They have your phone number but that's really all they have.
Some people say Bozos can read your metadata because it's hosted on AWS servers but I don't believe that.
All the signal fans here should give me your phone number if you think its a secure service. All of them are hosted on AWS btw.
I don't use Signal to talk to people I know only pseudonymously through the internet. I use it to talk to people with whom I would already share my phone number. That social graph can be ascertained a thousand ways already. I think it is worth pointing out as you do, however. If I wanted to attempt to hide the fact that I was contacting someone from the state, I'm not sure where I would start, but it wouldn't be Signal.
You're equating giving my Mom my phone number with broadcasting my phone number on the Threadiverse?
Signal is a US-based entity subject to warrantless NSLs, with all the data hosted on AWS. Its not giving your phone number to your mom. Its giving your phone number to amazon and most likely a US surveillance government agency.
For a threat model you should assume the worst and never trust any US-domiciled data service or platform.
Give me your threat model so I can laugh. You have no idea of what being secure is. Thank you for being yet another troll.
"I bet the DHS, DOJ, FBI, CIA, and NSA are all competing to see who can recruit me or kill me before I graduate highschool"-ass threat model
Simple: I don't use any US-based service due to NSLs
I especially don't use any us-based service that asks for my phone number.
"My hobby is writing James Bond / Freakazoid erotic spy thriller fanfic"-ass threat model
"I drew a dick on Pete Hegseth's face last time he was passed out drunk before Sunday service"-ass threat model
So what client would you recommend? I also feel like if it's offered on Google Play or Apple Store it's sus, but for lower income USians, it looks like Google Play is soon to become the forced option, especially on phones < $100.
I dislike Signal because they are many google play services, and do not try to distribute their app beyond Google Play Store.
https://signal.org/android/apk/
and if you want, you can use molly-foss to remove google notification services
Anything that touches greed-incentivizing cr*ptocurrencies turns to shit. Use Matrix, XMPP, or Tox instead.
✍︎ arscyni.cc: modernity ∝ nature.
Since we are on the topic of signal.. im not tech saviie but i have read lots of blogs and people about how secure is the signal protocol. My question is .. how can i be sure that the protocol is implemented as the open source code shows? Please correct me if im wrong but from what i read on their website the apk they provide has the capability to update itself at anytime. So what stops them to change how it works with an update? is it posible to build the apk yourself and stop the ability to update?