4 ms·

Best part of the article: explaining how privacy is a public good. TLDR: privacy isn't just about "keeping secrets" or having "something to hide". Privacy for

by dcposch 10y ago

Best part of the article: explaining how privacy is a public good. TLDR: privacy isn't just about "keeping secrets" or having "something to hide". Privacy for a whole population is power. Once a population has lost its right to privacy, once people's conversations and movements are monitored, they're rendered powerless. It becomes easy to strip away their other rights. -- Worst part of the article: the recommendations at the end. The author lists a kitchen sink full of privacy tools including Telegram, which the entire infosec community agrees is terrible. Do not use Telegram. Use Tor, use Signal.

newscracker 10y ago
> Worst part of the article: the recommendations at the end. > The author lists a kitchen sink full of privacy tools including Telegram, which the entire infosec community agrees is terrible. Do not use Telegram. > Use Tor, use Signal. Usability, or lack of annoyances, will always trump security and privacy. Tor is way too slow for most purposes. In my experience, I don't believe it can be a generic mass solution (people in most places around the world already have slow connections - sharing that with others would be the last thing they'd want to do, even though more people running Tor means it gets better, on average, for everyone). Signal is way too deficient on features and usability compared to Telegram. I want to get out of Telegram and use Signal, but it's at least a few years behind Telegram in various ways (speed, features, lack of good desktop options, relying only on phone number with no usernames or other ways to add/establish contacts, and more). By the time Signal catches up, I believe Telegram would be far ahead again. For messaging and privacy, what would be better to have is a decentralized system that has good usability, multi-device support and can become popular.
- j_s 10y ago
  If you're prioritizing features and usability, WhatsApp is considered more favorably than Telegram.
  - 1propionyl 10y ago
    WhatsApp is owned by Facebook. They almost certainly do not have privacy as a central focus beyond its utility as a marketing bullet. It's just more embrace, extend, extinguish. Facebook is doubling down on Messenger. They don't want to support multiple messengers. As soon as they can find a way to convert those pesky privacy-conscious Europeans to Messenger, WhatsApp is dead.
    - marcosdumay 10y ago
      They may not do it for the best reasons, but they do have a better implementation than Telegram and, the most important, Watsapp is private by default. Telling people to move from Watsapp to Telegram nowadays is bad advice. for any point of view.
    - newscracker 10y ago
      > WhatsApp is owned by Facebook. > They almost certainly do not have privacy as a central focus beyond its utility as a marketing bullet. That's certainly one big concern I have with WhatsApp (and that's why I don't use it). The other thing is WhatsApp is not as good as Telegram in UX like the GP claims it to be. As one example, Telegram has desktop clients that do not need the phone to be around after a one time account verification, whereas WhatsApp, in my knowledge, always needs the phone to be around for the desktop or web app to be useful.
- nbraud 10y ago
  > people in most places around the world already have slow connections - sharing that with others would be the last thing they'd want to do You seem to misunderstand how Tor works. It doesn't require you to become a relay (i.e. carry other people's traffic) to use, and never has. Furthermore, my experience with Tor on bad connections is that, once the connection to your entry guard is established (once per reboot, takes 30s to 1 minute on terrible connections with packet loss), Tor was just as slow as the original connection. For those who have decent Internet access, it just works to watch Youtube videos, for instance, over Tor.
mxuribe 10y ago
I absolutely agree with you note on the "Best part of the article"... ...But as far as the worst part being some of the author's recommendations on privacy tools, while i agree some of those products are not some that I might have chosen, I respectfully disagree with your premise...I believe the author's intent is really good. I would recommend you think of it this way instead: if a non-trivial percentage of civilians (what I call non-techies) all of a sudden begin to use some of these apps (because of some product recommendations that the author made), some users will use some products, and it will at least greatly raise the awareness across the board...As more users utilize these products, no doubt there will be complaints. This will then lead to so many more people demanding ever better privacy tools...Which I believe will increase any positive momentum for privacy tools, both in quality as well as usage...At least that's how I see it; basically an eventual good thing for everyone.
throwaway1023 10y ago
Please DON'T recommend Signal. Signal is nearly as bad as other messengers: They get your metadata, your contact list (the hashing is reversible, they even state so), and they don't do federation (= support other peoples servers). They don't even want other implementations of the Signal-Protocol to use their servers, which would cause a huge fragmentation of the user base even if someone implemented an alternative. The solution? The protocol "Omemo" looks promising: It doesn't require Google Cloud Messaging on Android to implement some power saving features, it sits on top of XMPP which has features like groups or sending images, and it does Multi-Device support while still providing good encryption and deniability (OTR-like). Because it's just XMPP, you can use any Jabber-Server you want (your own, too), as long as it supports some newer fancy features (avatars might be needed, and image uploading if you want that, probably). This means your metadata should be less centralized than with Signal, Telegram or WhatsApp. SecureChat and Conversations.im already support this protocol, so mobile phones and tablets have good candidates for installation. For PC, pidgin and gajim are beginning to have some prototypes for Omemo plugins out. Check out https://omemo.top/ https://omemo.top/ and https://conversations.im/omemo/ https://conversations.im/omemo/ for more info. I've personally tried conversations.im (I bought it. It's free and open source if you get it via fdroid or if you build it yourself) with friends and it works ok (single user + group chat). One of my friends used SecureChat on his iPhone and it seemed to work, too. Checking keys in conversations.im could be easier and the scanning function needs an app that requires too many privileges for my taste. It also seems like you need to announce your presence on Jabber if you want to add someone new (and they need to do so, too), but I'm not 100% certain about that. I haven't tested using multiple devices with the same account yet, but a friend told me that the plugins for Gajim and Pidgin weren't really working with that at the moment. I really hope Omemo solves the messenger problem once and for all. It's 2017, after all.
boomboomsubban 10y ago
The author seems to have noticed the criticism and removed Telegram
BrandonMarc 10y ago
My understanding is that, against certain actors, Tor is compromised. Am I mistaken?

by dcposch 10y ago

newscracker 10y ago

> Worst part of the article: the recommendations at the end. > The author lists a kitchen sink full of privacy tools including Telegram, which the entire infosec community agrees is terrible. Do not use Telegram. > Use Tor, use Signal. Usability, or lack of annoyances, will always trump security and privacy. Tor is way too slow for most purposes. In my experience, I don't believe it can be a generic mass solution (people in most places around the world already have slow connections - sharing that with others would be the last thing they'd want to do, even though more people running Tor means it gets better, on average, for everyone). Signal is way too deficient on features and usability compared to Telegram. I want to get out of Telegram and use Signal, but it's at least a few years behind Telegram in various ways (speed, features, lack of good desktop options, relying only on phone number with no usernames or other ways to add/establish contacts, and more). By the time Signal catches up, I believe Telegram would be far ahead again. For messaging and privacy, what would be better to have is a decentralized system that has good usability, multi-device support and can become popular.

j_s 10y ago
If you're prioritizing features and usability, WhatsApp is considered more favorably than Telegram.
- 1propionyl 10y ago
  WhatsApp is owned by Facebook. They almost certainly do not have privacy as a central focus beyond its utility as a marketing bullet. It's just more embrace, extend, extinguish. Facebook is doubling down on Messenger. They don't want to support multiple messengers. As soon as they can find a way to convert those pesky privacy-conscious Europeans to Messenger, WhatsApp is dead.
  - marcosdumay 10y ago
    They may not do it for the best reasons, but they do have a better implementation than Telegram and, the most important, Watsapp is private by default. Telling people to move from Watsapp to Telegram nowadays is bad advice. for any point of view.
  - newscracker 10y ago
    > WhatsApp is owned by Facebook. > They almost certainly do not have privacy as a central focus beyond its utility as a marketing bullet. That's certainly one big concern I have with WhatsApp (and that's why I don't use it). The other thing is WhatsApp is not as good as Telegram in UX like the GP claims it to be. As one example, Telegram has desktop clients that do not need the phone to be around after a one time account verification, whereas WhatsApp, in my knowledge, always needs the phone to be around for the desktop or web app to be useful.
nbraud 10y ago
> people in most places around the world already have slow connections - sharing that with others would be the last thing they'd want to do You seem to misunderstand how Tor works. It doesn't require you to become a relay (i.e. carry other people's traffic) to use, and never has. Furthermore, my experience with Tor on bad connections is that, once the connection to your entry guard is established (once per reboot, takes 30s to 1 minute on terrible connections with packet loss), Tor was just as slow as the original connection. For those who have decent Internet access, it just works to watch Youtube videos, for instance, over Tor.

mxuribe 10y ago

I absolutely agree with you note on the "Best part of the article"... ...But as far as the worst part being some of the author's recommendations on privacy tools, while i agree some of those products are not some that I might have chosen, I respectfully disagree with your premise...I believe the author's intent is really good. I would recommend you think of it this way instead: if a non-trivial percentage of civilians (what I call non-techies) all of a sudden begin to use some of these apps (because of some product recommendations that the author made), some users will use some products, and it will at least greatly raise the awareness across the board...As more users utilize these products, no doubt there will be complaints. This will then lead to so many more people demanding ever better privacy tools...Which I believe will increase any positive momentum for privacy tools, both in quality as well as usage...At least that's how I see it; basically an eventual good thing for everyone.

throwaway1023 10y ago

Please DON'T recommend Signal. Signal is nearly as bad as other messengers: They get your metadata, your contact list (the hashing is reversible, they even state so), and they don't do federation (= support other peoples servers). They don't even want other implementations of the Signal-Protocol to use their servers, which would cause a huge fragmentation of the user base even if someone implemented an alternative. The solution? The protocol "Omemo" looks promising: It doesn't require Google Cloud Messaging on Android to implement some power saving features, it sits on top of XMPP which has features like groups or sending images, and it does Multi-Device support while still providing good encryption and deniability (OTR-like). Because it's just XMPP, you can use any Jabber-Server you want (your own, too), as long as it supports some newer fancy features (avatars might be needed, and image uploading if you want that, probably). This means your metadata should be less centralized than with Signal, Telegram or WhatsApp. SecureChat and Conversations.im already support this protocol, so mobile phones and tablets have good candidates for installation. For PC, pidgin and gajim are beginning to have some prototypes for Omemo plugins out. Check out https://omemo.top/ https://omemo.top/ and https://conversations.im/omemo/ https://conversations.im/omemo/ for more info. I've personally tried conversations.im (I bought it. It's free and open source if you get it via fdroid or if you build it yourself) with friends and it works ok (single user + group chat). One of my friends used SecureChat on his iPhone and it seemed to work, too. Checking keys in conversations.im could be easier and the scanning function needs an app that requires too many privileges for my taste. It also seems like you need to announce your presence on Jabber if you want to add someone new (and they need to do so, too), but I'm not 100% certain about that. I haven't tested using multiple devices with the same account yet, but a friend told me that the plugins for Gajim and Pidgin weren't really working with that at the moment. I really hope Omemo solves the messenger problem once and for all. It's 2017, after all.

boomboomsubban 10y ago

The author seems to have noticed the criticism and removed Telegram

BrandonMarc 10y ago

My understanding is that, against certain actors, Tor is compromised. Am I mistaken?