4 ms·

>This contains good advices but also very doubtful ones. such as "use Whatsap", like something proprietary that is not decentralized? How is this "doubtful" ad

>This contains good advices but also very doubtful ones. such as "use Whatsap", like something proprietary that is not decentralized? How is this "doubtful" advice? Whatsapp and Signal are literally the state of the art of encrypted messaging apps. There simply are no better options. What would you recommend instead? >And use Apple devices/Chromebooks (where everything you do works/syncs in the cloud) as your primary device, you must be kidding.. So what would you tell people to use instead? This is advice for "journalists" not "unemployed people". Google and Apple only have the best security teams in the world, why do you believe their services to be insecure? >The only good security device would be "don't even own a smartphone" if you care about security at all. What if you are a person who is actually trying to do something with their life? >What a bad advice, since the code added by Google on top of Chromium can't be audited at all. Why is that? Have you audited Chromium? Since when can't binary blobs be audited? What is the realistic worst case scenario here?

craftyguy 9y ago
> Google and Apple only have the best security teams in the world, why do you believe their services to be insecure? As US-based companies, they are answerable to the US government. That makes them inherently insecure because your data and privacy is one shitty court order away from being released, at best.
- ryanlol 9y ago
  To which companies does this not apply?
  - ekianjo 9y ago
    well, for one, to non-US based companies and not part of the 5-eyes agreement, and any country not technically a "vassal" of the US.
Shoothe 9y ago
> How is this "doubtful" advice? Whatsapp and Signal are literally the state of the art of encrypted messaging apps. There simply are no better options. What would you recommend instead? Custom XMPP server running as a Tor hidden service with OMEMO enabled (https://conversations.im/omemo/ https://conversations.im/omemo/). Signal and Whatsapp require a phone number which may or may not be good based on one's threat model.
- ryanlol 9y ago
  Signal will accept literally any phone number, you can set up an account with any random voip number. >Custom XMPP server running as a Tor hidden service with OMEMO enabled Is not advice you can give in a "security guide for journalists"
  - Shoothe 9y ago
    Oh sorry, I figured out that if a media company is serious they'd run the server for their journalists. https://conversations.im/ https://conversations.im/ also uses E2E encrypted chats and I don't need to setup any "random VoIP numbers".
    - ryanlol 9y ago
      But what would they gain by using conversations over Tor, shorter battery life?
      - Shoothe 9y ago
        For the record you don't need to use Tor in conversations, it depends on your threat model but using Tor protects against middle man figuring out which services do you use. If you use third party server even when the message is encrypted you are leaking metadata (where do you log in from, who do you contact).
        ryanlol 9y ago
        The fundamental problem here seems to be that Conversations doesn't run on iOS, so it's hardly a realistic option even if there was some reason to choose it over Signal.

craftyguy 9y ago

> Google and Apple only have the best security teams in the world, why do you believe their services to be insecure? As US-based companies, they are answerable to the US government. That makes them inherently insecure because your data and privacy is one shitty court order away from being released, at best.

ryanlol 9y ago
To which companies does this not apply?
- ekianjo 9y ago
  well, for one, to non-US based companies and not part of the 5-eyes agreement, and any country not technically a "vassal" of the US.

Shoothe 9y ago

> How is this "doubtful" advice? Whatsapp and Signal are literally the state of the art of encrypted messaging apps. There simply are no better options. What would you recommend instead? Custom XMPP server running as a Tor hidden service with OMEMO enabled (https://conversations.im/omemo/ https://conversations.im/omemo/). Signal and Whatsapp require a phone number which may or may not be good based on one's threat model.

ryanlol 9y ago
Signal will accept literally any phone number, you can set up an account with any random voip number. >Custom XMPP server running as a Tor hidden service with OMEMO enabled Is not advice you can give in a "security guide for journalists"
- Shoothe 9y ago
  Oh sorry, I figured out that if a media company is serious they'd run the server for their journalists. https://conversations.im/ https://conversations.im/ also uses E2E encrypted chats and I don't need to setup any "random VoIP numbers".
  - ryanlol 9y ago
    But what would they gain by using conversations over Tor, shorter battery life?
    - Shoothe 9y ago
      For the record you don't need to use Tor in conversations, it depends on your threat model but using Tor protects against middle man figuring out which services do you use. If you use third party server even when the message is encrypted you are leaking metadata (where do you log in from, who do you contact).
      - ryanlol 9y ago
        The fundamental problem here seems to be that Conversations doesn't run on iOS, so it's hardly a realistic option even if there was some reason to choose it over Signal.