As Signal get your phone number. Can we considerate this application as private ? What’s your thoughts about it ? I’m also using SimpleX, ElementX, Threema, but not much people using it…
Cheers
Since we are on the topic of signal… im not tech saviie but i have read lots of blogs and people about how secure is the signal protocol. My question is … how can i be sure that the protocol is implemented as the open source code shows? Please correct me if im wrong but from what i read on their website the apk they provide has the capability to update itself at anytime. So what stops them to change how it works with an update? is it posible to build the apk yourself and stop the ability to update?
Just like any foss project, there some level of trust if you are going with the main distribution. In theory you are correct that not much is stopping them from releasing a malicious update, but because it is open source, soon enough people would notice that either they released new code that is malicious, or that the new version does not match the source code. That kind of scenario is known as a supply chain attack.
Since the code is open, you can literally read it for yourself to see exactly what the apk does. You can also fork it and modify it however you like, just like the creator of Molly did (Molly is a fork of the Signal client that adds some security features)
Thanks for the explanation!
It’s a centralized, US-based service running on AWS, that’s not self-hostable, requires phone numbers, and you have no idea what code their server is running.
Whether the app is you use for it is open source entirely irrelevant for them building social network graphs, considering they have your real identity via phone numbers.
If the answer is “I just trust them”, then you’re not doing security correctly.
It is not as good as a decentralized system, and even though the server is open source, it isn’t self hostable (technically in an intranet you could but not easily)
But the signal foundation is a non profit with external audits and a proven track record with law enforced requesting data and getting basically nothing (If i remember correctly they only have your user to phone number relation and the last time you were online)
So although it is imperfect, it is an amazing solution that is almost the only 1:1 competitor to whatsapp/messenger/imessage that is privacy respecting, so I am very grateful for it’s existence.
What about threema?
Signal is the gold standard of secure messengers. If you’re looking for decentralized go with xmpp and/or matrix.
Hosted in the US on amazon servers, subject to national security letters.
If it was hosted outside the US and not on AWS, would you use it then?
US is the gold standard in surveillance and spying. I will not use any cloud services based in the US.
My brother, you clearly haven’t read much about the CCP’s surveillance efforts.
Also remind me which region is actively attempting to end encryption as a whole?
Read on articles written by usa?
Gullible
No because I don’t think centralized services are a good idea for communications platforms.
Private and anonymous are different things. While anonymity does increase privacy, it is not a strict requirement. So it this private, but not as private as possible.
The best private messenger IMO is simplex, but it not production ready yet
Many people say that SimpleX is not ready to replace the likes of Whatsapp, Telegram and Signal yet but noone specifies exactly what features are missing.
I get that public key cryptography is confusing for the average people but there is no UI fix that is getting around that obstacle if we want people to make informed choices on what platform/protocol to use for communications.
The same thing applies to decentralization - people just need to understand that the trade-off they’re making for communications’ resilience is the comfort of an online addressbook.
Although I admit that there are certain UI elements that could be made better (for example the nickname setting could be stylized a bit better so people can more easily change the names of their contacts to something more familiar), most criticism towards SimpleX comes from people being a bit lazy and not reading the manual before using the app.
TL;DR: I don’t understand what features are missing from SimpleX.
stickers
I often see convos on SimpleX that are clearly missing messages, so I’m not sure what that’s about. I mean I see people quoting messages that are not visible.
Also I really think they need to implement UnifiedPush before it’s ready. It consumes an excessive amount of battery life for this reason.
creator is an alt right loon
What has he said or done?
You’d have to go and look up his Xitter account.
Holy hell! Didn’t imagine him being that far right. Always thought the accusations were half made-up.
It’s always sad to see promising FOSS projects taint their image with deplorable political views or behaviour (Hyprland, GNU, GrapheneOS, probably some others). Although I believe in freedom of opinion, I draw the line on inciting violence and hatred against minorities. Also, I can’t fathom why he would still use Xitter, when so many better alternatives exist?
Right now when you establish a connection with someone, you exchange between 2 and 4 connections. Each person shares that receive servers out of which one of them is for, and the other is clear net. If you don’t have to running and one of the servers goes down, half of the messages no longer deliver. There is no server rotation. Even if you swap your servers ahead of the server shutting down, contacts don’t cycle and they are lost
That is currently my biggest reason not to recommend. There are also UX improvements like live messages which I think are useless and will cause people to get confused (they are messages that the other person can see in real time as you type them). They should also include some soft of recommended backup solution because people WILL get mad about losing everything
If you are curious, here is a link for the roadmap so that you can see the things they are still planing. Some are going to bother normies (like shortening the group URLs will probably mean that they have to update them)
Multi-device message syncing. Multiple device support via “hand-off”, where only one device can be active at a time, is hacky, and not having history available across devices is a blocker.
The main Dev gave a talk somewhere sometime where he explained why doing multi device is a security risk. I always look for it and always lose the URL without watching it so I can’t explain more
Þat sounds like an excuse, especially since þey allow it, just not concurrently, and from þe tickets I’ve read it’s only because of technical issues, not because of some þeory of attack vectors.
I did some quick googling and found this. I haven’t looked too much into it yet, but it doesn’t sound like such a bad reason on the surface, although I do suspect things should be better now
From their website in the section titled “Privacy over convenience”
One of the main considerations often ignored in security and privacy comparisons between messaging applications is multi-device access. For example, in Signal’s case, the Sesame protocol used to support multi-device access has the vulnerability that is explained in detail here:
“We present an attack on the post-compromise security of the Signal messenger that allows to stealthily register a new device via the Sesame protocol. […] This new device can send and receive messages without raising any ‘Bad encrypted message’ errors. Our attack thus shows that the Signal messenger does not guarantee post-compromise security at all in the multi-device setting”.
Solutions are possible, and even the quoted paper proposes improvements, but they are not implemented in any existing communication solutions. Unfortunately this results in most communication systems, even those in the privacy space, having compromised security in multi-device settings due to these limitations. That’s the reason we are not rushing a full multi-device support, and currently only provide the ability to use mobile app profiles via the desktop app, while they are on the same network.
So SimpleX does support multiple devices, but wiþ limitations. If you accept “on þe same network” is sufficient for þem to ensure security, it still doesn’t explain why:
- hand-off (one device at a time) is necessary
- hand-off is so tedious
- and even if hand-off is accepted as necessary for security, none of it explains why even wiþ hand off, þere’s no history syncing between devices.
Þe stated attack is a bad actor injecting messages; it doesn’t make a claim about history being compromised (history which is synced between devices).
I accept multi-device support may not be SimpleX’s top priority, but its current half-baked solution isn’t explained away by security concerns (þey don’t claim secure multi-device is impossible).
Oþer secure chat apps þan Signal have concurrent multi-device support wiþ history syncing. Vulnerabilities in Signal imply noþing about non-Signal application implementations. Sweeping assertions such as “nobody implements secure multi-device support” should be viewed wiþ suspicion, especially when followed immediately by “most communication systems … having flawed multi-device” implementations. All, or most?
Found a better article
https://simplex.chat/faq/#why-cant-i-use-the-same-profile-on-different-devices
Which other e2ee decentralized apps have multi device without relaxing security?
Offtopic: there seems to be some issue with your comments. Any time you type “th” I get a “þ”
Depends on your threat model, as always. If you require absolute anonymity, it’s tricky, because it uses phone number during the onboarding process, so get an anonymous pre-paid number and discard it after registration. After onboarding you don’t need the number.
For the rest, it’s about as “private” as you make it. It supports group messaing, calls and video, so obviously you need to be careful while using it. Everything is e2e encrypted and stays on your local device, the source is available and has been extensively audited. The company itself is non-profit and has sensible privacy policy.
But yeah, your threat model is the key answer to your question
so get an anonymous pre-paid number
That’s not something that exists in many countries. SIM-cards have to be attached to a real world identity by law.
It exists on the internet, so it exists in every country.
Private, not anonymous. No one can see your messages except the recipient. But if the recipient can report you and they would have your phone number.
I dislike Signal because they are many google play services, and do not try to distribute their app beyond Google Play Store.
Signal is in F-Droid and works completely degoogled on Graphene with no Google Play. The annoyance is no notifications, but if you’re rolling completely Google Play free, you’re probably used to needing to just check several things a day for lack of notifications on multiple apps, since everyone under the sun is trying to shovel all your notification contents to Google (I assume for bribes of some sort from Google).
The annoyance is no notifications
Not true. I have GrapheneOS with no Google blobs in a profile where I have Signal from play store (via Aurora) and notifications work perfectly. Signal itself will turn on the no google mode for notifications if not available.
It is not on Fdroid https://search.f-droid.org/?q=signal&lang=en
It’s in the Guardian repo ala torbrowser
Many programs are in 3rd party fdroid repos, you can literally create a fdroid repo for Gmail and Gemini, you just upload apks to the server and run an indexer.
Being included in f-droid.org means the app had to meet some basic standards with regard to privacy. Being included in a 3rd party repo means that someone has uploaded it. And it’s a case with the Guardian-distributed Signal, AFAIK it’s the original version.
OP meant Signal not making any effort to be included in the f-droid.org repo, not Guardian not making effort to upload the apk from signal.org
I assume for bribes of some sort from Google
This one is stick, not carrot: apps are generally required to use Google’s notification system to be allowed in the Play Store.
Signal gets notifications without GMS. I think battery use and latency are a little higher. Molly, a fork can use UnifiedPush for better results.
https://signal.org/android/apk/
and if you want, you can use molly-foss to remove google notification services
I agree that there are workarounds, but I find it frustrating that Signal devs are ignoring very obvious security and privacy issues like this. It erodes trust and my enthusiasm to use Signal.
Just switched to molly-foss and am using mollysocket and have no issues
Was it just a simple switch or would I have to convince everyone to use Molly instead of Signal all over again? Like can I just get Molly and transfer over my contacts and history and all that?
Molly was easy enough, switching the notifications was a bit more painful. I found that the airgapped solution worked more seamlessly than the web server though
This is kind of useless fear-mongering suited to no one’s threat model.
Are messages truly E2EE and they don’t share meta data? Yes? Then you’re fine. It needs a phone number for registration? OK, well buy a burner SIM card (you of course have several, right?) to register it if you’re that worried. Because if you’re already at a level where you’re THAT concerned about your phone number pinging for using a widely popular messaging app, then you have lost the game by even having a phone or sending messages to other humans who are the weakest link in the security chain anyway.
Considering that the Feds tried to make some government-compliant front end for Signal for idiot Hegseth to use to talk about national security stuff with the Vice President, I’d say that it’s probably fine for you to buy weed or whatever.
Signal has too many red flags, but the biggest one is phone numbers and SIM cards. No application that wants to be secure against nation state spying relies on these.
OK, well buy a burner SIM card
Illegal in many countries. SIM cards are attached to your real world identity.
And we shouldn’t depend on such archaic highly centralized technology like phone numbers from techinical perspective either, it is only like this because it is deeply entrenched and a very easily a suprisingly reliable form of identification and deanomization
I’ll add that if someone knowing your phone number is an actual threat to your safety, you should already know better about using something more anonymous.
Privacy ≠ anonymity
I couldn’t find any sources regarding this topic
They have your phone number but that’s really all they have.
Some people say Bozos can read your metadata because it’s hosted on AWS servers but I don’t believe that.
The face that Signal needs phone numbers to sign up is very bad.
No one that has told me this has ever been able to offer up any sort of explanation, but please do feel free to give it ago.
Multiple-accounts and pseudonyms. It’s like the 101 of interacting on the Internet. With a phone number requirement that’s automatically made impossible.
Also SIM-cards/phone numbers are required by law to be attached to your real world identity in many countries.
Multiple-accounts and pseudonyms
What about them?
Also SIM-cards/phone numbers are required by law to be attached to your real world identity in many countries.
Why is that a problem?
Why is that a problem?
Why are you posting as artyom@piefed.social and not <real name>@<home address>?
…because this is not a private message? And because my home address is not a piefed server. Such a weird question…
The explanation is obvious. The phone numbers are a personally identifiable network of connections that is available to the people operating Signal servers. If this information is shared with the US government, then they can easily correlate this information with all the other data they have. For example, if somebody is identified as a person of interest then anybody they want to have secure communications would also be of interest.
Unlike Whatsapp, Signal doesn’t store your network of contacts. They have your phone number, time of registration, and time of last connect to their servers. They go to great lengths to keep the rest private. In Signal’s case, I don’t see an issue at all, but I do see all the benefit.
The only people who know what the server stores are the people running it.
They store your phone number, and have to route all the messages you created to the other phone numbers / user IDs in their database. This means anyone with access to signal’s centralized database has social network graphs: who talked to who, and when.
If your threat model is “I just trust them”, then its not a good one.
Privacy advocates have been raising the alarms about signal forever, but like apple, their fanbase just feels the security “in their gut”, and think that because it has a shiny interface, it must be secure.
SS7 hacking can intercept your calls and text messages as well as your location just by knowing your phone number.
With the phone number, no; and since there’s no Signal usage without a phone number, well…. Also, I think somewhere on their website (or some place) they talked about burner phones as if it’s a universal phenomena.
Signal has felt “out of place” to me. Odd. It doesn’t fit in, doesn’t make sense if I think a bit farther about it.
I hope something decentralised comes out of Signal protocol minus the need for a phone number.
SimpleX uses Signal tech AFAIK but without requiring phone number or email address.
You are talking about session. Session is a signal fork, and you don’t need phone number. But there is some concerns about its security as, in order to properly work, it removed some signal features, I’m not qualified enough to understand if it’s truly a security risk or not. But the option to use it is there.
I used it for a couple years, but came back to signal because I had so many issues with media sharing.
Anything that touches greed-incentivizing cr*ptocurrencies turns to shit. Use Matrix, XMPP, or Tox instead.
✍︎ arscyni.cc: modernity ∝ nature.
Right now, for the wider population, it it a heaven sent option compared to Whatsapp, FB messenger etc. Break those bonds first and keep the wheel turning.
Blog post about Threema that changed my mind against it: https://soatok.blog/2021/11/05/threema-three-strikes-youre-out/
Oh yeah, same. Great writeup, comprehensive and well written, have it bookmarked in case I need to talk to people about Threema.
Love it thank you for sharing. Awesome blog and so much relevant information. it’s now on RSS feed :)
Why is this furry-themed?
It’s a furry blog that happens to write about security a lot, and the author usually has very well-founded takes.
Chill out and enjoy it – you might learn something new. I usually do :D
Why not? Its nice to have fun with your website.
owo
Why not?
crazy that no one’s posted the dessalines article yet https://github.com/dessalines/essays/blob/main/why_not_signal.md
hi. Do you have any suggestions for an app to replace it?
unfortunately not. matrix is probably a no because of this thread. i hear a lot of people saying briar is good but idk anything about it
Ok. Thanks anyway!
Briar is… Signal if you turned security up to 11. It comes with drawbacks, like if you are offline, you miss messages. You can get around it by using their mailbox, but that brings other issues (Securing a server).
do you know of any good in-depth analyses of its security? every time i decide on a new chat app someone has to point out something that totally ruins it lol
Like this?
https://www.opentech.fund/security-safety-audits/briar-security-audit/
Or more a techie in-depth review?
I can attest: Briar requires no PII to create an account, operates over the Tor network (Your device becomes an onion service, basically, for chat). And, it integrates with Ripple, an emergency wipe button app (As does signal).
I like it, because you can keep a blog, create forums, group chats, and a few other really cool features. It sucks down your battery life, though (It’s the notifs, and keeping an always-on server running).
i don’t want to make you do my googling for me but if you have anything else just on-hand i’d love to read it. i can’t trust the open tech fund because of its ties to the cia (see this paragraph by dessalines) but i’ll definitely look into briar
I would disregard, at least, that line of thinking. I mean, Tor was heavily funded by the CIA… However, it’s secure. Linux kernel is largely funded by the US government. However, it’s secure.
What dessalines is doing is called “poisoning the well”.
However, I’ll find some more, as I recently was looking into this.
Right now signal is the best. I’ve basically tried them al and at least for me, the known good confidentiality of messages is worth the lack of anonymous accounts. All the other options have issues or have not been properly verified / audited.
When simplex is ready, it will be the best by a lot. But right now you might randomly lose contacts and a few different
