i’ve just seen a comment in a post, in this very community, saying people trust signal because of missinformation (from what i could undertand).
if this is true, then i have a few questions:
-what menssaging app should i use for secure communications? i need an app that balances simplicity and security.
-how to explain it to my friends who use signal because i recomended?
-what this means for other apps in general?
You must log in or # to comment.
i’m concerned that they require phone numbers and host on AWS, and don’t have a clear monetization scheme. but for now it seems reasonably secure.
Signal no longer requires phone numbers.you no longer need to share your phone number to chat at least (sorry)Not true at all, you still need a phone number to sign up.
The signal protocol is end-to-end encrypted, not even signal themselves knows what is being sent to what.
As I understand it, while they can’t see the contents, the Metadata is still exposed.
Isnt the metadata also encrypted?
Yes
Your phone number is the biggest metadata you could possibly give (it means your real identity, including your current address), and signal has it.
phone number, IP, time of connection, duration of the chat, size of the encrypted chatlog, etc. might be useful for feds
Nothing, it’s good. There’s FUD to get you not robust it
There was one instance of the white house using signal on the down low to evade records retention and then got caught because they accidentally invited a journalist to the houthi bombing group chat, bit that’s a user error
And they didn’t use a trusted Signal app, it was an Israeli clone app IIRC
It’s fine as long as you don’t do something silly like invite a journalist to your top secret government group chat.
Or use a third party client that doesn’t have as much scrutiny on the source code and will Leak your message s
man imagine trusting in an israeli signal fork lmao
Would you say Molly is big/trustworthy enough for this to be negligible, or is it a huge risk?
Molly basically is a fork of the signal client that switches out some notification based things (such as your notifications going through fcm and such) and instead lets you use unifiedpush and/or a molly websocket. Apart from this they’re both the same. Molly uses signal’s codebase.
Molly also supports full database encryption and replaces all proprietary blobs in signal iirc
I’m put off by the centralized server. I’d want to self host without having to build a special client, something like nextcloud. That the company chose to prevent that gives me a bad impression. So I haven’t been using it so far.
I’ve played with GNU Jami a little but it was flaky when I tried it last year. Maybe it’s better now.
You can’t have it both ways. It’s hard enough to get people to switch to signal, or least also use it next to other messengers. Now imagine they’d have to connect to multiple servers to talk to multiple people. Possibly everyone connection details. Even if that’s done in the background, you have to somehow get the connection registered once, discovered if you will.
Anything and everything you send through their server is end-to-end encrypted. Some people hate on the phone number being required to create an account, but it’s also the reason it works at all: anyone in your contacts who also has signal you can talk to. Phone numbers are an international standard. If course this also has downsides…
Finally what you’re asking for exists. NextCloud has “talk”. Which is essentially a messenger app, it’s built in. Go use it. I have a NextCloud instance and I don’t use it either. What’s the point of having an app I can only use to talk with people so close to me that they’re in my NextCloud with an account already?
You can’t have it both ways.
Of course I can. Jitsi Meet lets you do it both ways. I don’t know if Nextcloud has an official hosted server but they could if they wanted. I use it self-hosted and it works, the Talk app is just not very good. Jami uses a DHT instead of a centralized server which is another approach, though it might be part of its flakiness. Linphone (a regular VOIP client, not a secure chat thing) is set up by default to point to Linphone’s own SIP servers but you can change that in Settings. No reason Signal can’t do similar. Heck, even Lemmy works that way (you choose your server).
Signal is simply being evil and your defending them is unconvincing. I could opt to self-host Signal and build a special client for my users, at the cost of hassle for everyone but no serious technical drawbacks. Signal chooses to create that hassle because they want to funnel users through their servers, not incidentally collecting metadata about ALL the user conversations.
There’s actually a configurable Signal client called Amanda or something like that, though I haven’t tried it. Someone here mentioned it last time this came up.
Also, Signal’s own client isn’t on F-droid, which raises more potential questions. I haven’t cared enough to look into it.
Added: oh re Nextcloud, I see what you mean, account creation is an obstacle, though that could be handled like Hipchat used to. You could generate a randomized URL to invite someone to your private chat without their needing an account. Nextcloud has that too, though just for file access, not for chat for some reason. Come to think of it, Signal could also work that way: it shouldn’t need accounts at all.
When I’ve invited people to my Nextcloud I’ve just enrolled the account for them myself and told them “please log in with username X password Y”.
Given what you’ve said, Signal is still what you want and is good for it.
There are two main issues people have with Signal:
First is that it requires a phone number to sign up. That makes some people who want it to be truly anonymous unhappy. It’s not meant to be anonymous, though. It’s meant to be private. Those aren’t the same thing.
Second is that it runs on AWS. This isn’t a problem in the sense that it’s possible for it to still retain privacy while running on AWS. Some people don’t like it because they view the dependence on the infrastructure of an American company to be a risk to availability. They also believe that it would exacerbate a security flaw if one were found.
Personally, I know these risks and still find it to be the best balance between privacy, security, and ease of use.
Second is that it runs on AWS. This isn’t a problem in the sense that it’s possible for it to still retain privacy while running on AWS. Some people don’t like it because they view the dependence on the infrastructure of an American company to be a risk to availability. They also believe that it would exacerbate a security flaw if one were found.
Let’s not pretend the hypervisor doesn’t have full access to the VMs memory and execution. The only thing protecting the Signal server is Intel SGX.
I don’t think Signal trusts the AWS server either, that’s the point of E2EE encryption.
I’m not claiming the contents of the messages are at risk here. You’re social graph and metadata though is another story.
The only data they store are account creation time and last connection time.
The thing if someone has memory access Signal doesn’t need to store anything, transiting data is now available. For example all of your contacts when doing contact discovery. It used to be a simple hash, something for which you could build a rainbow table in a few hours, at the worst. It’s lightly better now, but still.
Don’t take it from me, take it from Moxie:
https://signal.org/blog/private-contact-discovery/
It also doesn’t really matter if the software itself can easily be tampered with in memory by the hypervisor. Like I said, they are putting a lot of trust in Intel SGX.
And let’s not even get into the digital sovereignty issues, and financing of right wing billionaires. Yes, running on AWS is an issue. It’s multiple issues even.
https://signal.org/blog/private-contact-discovery/
Since the enclave attests to the software that’s running remotely, and since the remote server and OS have no visibility into the enclave, the service learns nothing about the contents of the client request. It’s almost as if the client is executing the query locally on the client device.
… Providing you trust Intel SGX (and AWS for giving them access to actual SGX and not just emulating a compromised instruction set)
I don’t take anything from someone I don’t trust that also explicitly doesn’t use warrant canaries because he says they don’t work in contradiction to every legal authority.
It’s also an issue that they run the signal server on one single AWS region.
It isn’t hard or even all that expensive to run on multiple regions.
It’s not me you need to tell this though.
And what about suspicion of intrusions in some accounts of european imlrtznts poeple by the FSB recently ?
I don’t know if it’s a social ingeneering
But now, i think “good enough” attitude is not the good idéal, we are not in 2000’ it’s finish…
Another app exists :
Session
simpleX
Anonymous messenger
Briar
Twinme
But it’ always better to use a verified and audited app, need to have a safe team
why are you making a post instead of replying to a comment?
So i can open a discussion on this question (specificaly)
The problem is that you didn’t bring much, and it sounds like you’re trying to spread FUD yourself:
- didn’t quote the original comment
- didn’t elaborate on misinformation and how it could be a problem to signal
- the questions immediately assumed it (whatever it is) is true
Sorry if that’s the case, i’m just shocked to hear this, and i want help to clarify this question.
Signal is alright IMO.
There is no perfect service. Thats why smarter people than me analyze this and talk about it: https://www.messenger-matrix.de/messenger-matrix-en.html
I think deltachat is pretty cool. Decentralised, open source and quite easy to use and setup.For me it is something for friends willing to try out new stuff and as a fallback when signal fails.
The only secure communication involves a dead drop and one time pad. Everything else is Mossad.
Signal does have your phone number, which is a problem.
On the other hand, the only information linked to that phone number is, “the person with this phone number uses signal”. AFAIK your phone number is not linked to your contacts, your message content, etc.
So in practice, the fact that Signal has your phone number is probably only a problem insofar as you don’t want anybody to know that you use Signal.
But to be fair, why have that issue if you don’t have to. Signal is actually good, still, but there are even better alternatives.
Signal is actually good, still, but there are even better alternatives.
… Would you care to list some of these alternatives and how they are better?
Every alternative I’ve looked at has some major drawbacks that would prevent me from getting any of my friends to move. Having to selfhost my own chat service isn’t really a positive in my mind due to the maintenance required and the higher possibility of outages.
list some of these alternatives
Probably the ones you’re already thinking of (SimpleX, Session, XMPP).
how they are better?
They’re better in terms of privacy. When I said they’re better, I mean specifically in terms of privacy.
Of course they’re less convenient, as you’re alluding to.
Signal gets me all the privacy I need. I don’t care if they know my phone number uses Signal, I don’t use it as anonymous chat, I use it with friends and family.
As others in this post have said, Signal handles privacy perfectly fine, it does not provide anonymity.Unlike several other users here, I actually view Signal’s contact discoverability as a feature, not a security flaw. All it means is if someone I know installs Signal, they can easily send me a message without a complicated back and forth through some other medium.
I myself said “Signal is actually good”, so there’s no need to argue with me about it.
Nevertheless:
I actually view Signal’s contact discoverability as a feature, not a security flaw
Of course it can be both. Many things are both features in one domain, and flaws in another domain. Obviously it’s a feature or else they wouldn’t have purposely developed it.
Well, it’s 100% linked to your contacts in one way or another because when you install it Signal will happily alert you to which ones of your contacts are already using Signal. I can’t see how they could manage that without slurping up your contact information.
I can’t see how they could manage that without slurping up your contact information.
AFAIK the client slurps up your contacts, but the E2E encryption ensures that the Signal server cannot actually see those.
I have managed to get all my friendship group on signal and we use it daily. While it does have its flaws (mainly being centralised and US based), I try in life to not let perfect be the enemy of good. Until there’s a stable and easy to use alternative I can point my friends to, I imagine we’ll stay on Signal.
This is long, but answers your questions: Why Not Signal?
-how to explain it to my friends who use signal because i recomended?
Okay it doesn’t answer that one. But also, whether they should use Signal or not depends on their threat models. Many people don’t see the US police state as a threat.
Best answer/link and cause…
Its not what I would use while communicating with someone else who values anonymity, but, its probably the best out there for communicating with people that dont care about any of that and just want something easy that works. Its easier to onboard people on to it.
Perfect is the enemy of good. Moving to Signal would be way better than getting analysis paralysis and staying with Whatsapp.
Requires you to use a phone number, your phone app needs to be online 24/7 to be connected, and hosted in a questionable jurisdiction with questionable human rights. Try Matrix. It’s selfhostable, doesn’t need a phone number to sign up and the foundation is British, which while this country from what I know has gone down the water, they still have some niceities from time they were in the EU, like GDPR.
I don’t know what the current reputation is but Matrix wasn’t always perfectly trustworthy either: https://hackea.org/notas/matrix.html
The 5 eyes CCTV GCHQ British? The rabid USSA, Shitrael bootlickers?
No thanksAmong other problems, Matrix is not a replacement for a messaging app. It’s more of a community message board with 1:1 private messages with the possibility of encryption. It is way more than most want or need.
I’ve also run a Matrix server in the past, and it’s not simple. The vast majority of people do not have the technical acumen, hardware infrastructure, or time necessary to even begin this endeavor.
Joining a public server where they don’t have control of the data requires a lot of trust in that instance and their owners. To expect them to vet those owners first, verify the servers are in a trusted country, … 10 more steps, before they begin is asinine.
Matrix is not an alternative to any messaging apps mainly intended for 1:1 communication.
The usual conspiracy theory is that Signal is funded by the CIA and therefore a honey pot.
what menssaging app should i use for secure communications? i need an app that balances simplicity and security.
Signal. I can do almost everything that i.e. WhatsApp or Telegram offer, is as easy to use as those and the client is verifiably encrypted and secure.
how to explain it to my friends who use signal because i recomended?
Explain what exactly? Why they should use it?
- It offers the same functionality as other messengers while being verifiably secure and encrypted.
- Signal collects only three datapoints of users
- Date of registration
- Date of last connection to the server
- Your encrypted backups if you enable cloud backups
- Compare that to messengers such as WhatsApp and Telegram where it is not clear which information they collect, whether they store it in an encrypted format or not or who they share it with.
- In the case of WhatsApp it is at least the US government as required by the Cloud Act.
- In case of Telegram the data is unencrypted by default and cooperation with various governments has been reported.
what this means for other apps in general?
Please clarify the question.
the part of the “conspiracy theory” about CIA funding is completely true: signal proudly say they get funding from the OTF, which at the time signal started was a subsidiary of Radio Free Asia, which started out as an open CIA project (before being relaunched as clearly still a CIA project but without the official acknowledgement).
I’m 50:50 on whether signal is a literal honeypot, but even if not it seems pretty likely that the US government wouldn’t have funded an app that could be used by people breaking its laws - let alone people actively organizing against it (foreign spies, domestic revolutionaries and insurrectionists) unless they were getting something pretty big in return.
In return they get an actually secure messing app they can use without having to support it themselves. Which is pretty big.
The epstein files have proven that conspiracy theories are true. Of course powerful gangsters conspire. We already knew that since forever.
The epstein files have proven that conspiracy theories are true.
So the Earth really is flat and run by lizard people?
Be careful with your wording. Yes, some conspiracy theories are true to some degree. But there’s also ones that are complete bunk.
Ok, because the thing, that everybody knew turned out to be true, every conspiracy theory is valid now?
I guess you should go visit the Nazis in New Swabia and discuss this revelation with them.
