4 ms·

Please, be aware that ICQ was bought by Mail.ru - russian company owned by oligarch Alisher Usmanov, who's very connected to russian crooked elite. It's the com

Please, be aware that ICQ was bought by Mail.ru - russian company owned by oligarch Alisher Usmanov, who's very connected to russian crooked elite. It's the company which was used for a hostile takevoer of VK.com from it's founder after it wouldn't censor it's content. It's voluntarily provided private data about it's users to the state (far outside of what's required by law) and was involved in a number of similar breach of privacy cases. Basically, it's company in the pocket of russian government, and you should use any of it's product if you completely disregard your privacy.

zzzcpan 7y ago
They are also required by the government to link phone numbers to accounts and log and store messages for a long time and make them directly accessible by FSB.
maqp 7y ago
To add, never rely on products that require you to trust the company respects your privacy. E.g. Telegram lacks ubiquitous end-to-end encryption (E2EE) so even if the company chooses not to abuse the insane amounts of valuable data, nation state hackers are most interested in hacking these centralized troves of data. Not even opt-in E2EE is good because that leaks metadata about desire to use proper encryption. Always use apps that are E2EE by default (e.g. Signal) to ensure you're not leaking content or metadata about wanting to keep discussion hidden.
- zzzcpan 7y ago
  > To add, never rely on products that require you to trust the company respects your privacy. > Always use apps that are E2EE by default (e.g. Signal) You are contradicting yourself here. You are required to trust Signal the company to respect your privacy, to trust that it's actually doing end-to-end encryption, doing it properly and doesn't issue an update breaking it because of some secret US government order. Because Signal controls software distribution, it's pretty much just a binary blob that some guy from Signal can update any time. A proper end-to-end encryption at minimum requires an open source implementations and distribution to avoid trusting the company to respect your privacy, since this is the primary reason for end-to-end encryption to exist. Otherwise incentives are misaligned and it will be broken by the same company it is supposed to protect from as soon as they need your messages for something.
  - maqp 7y ago
    You aren't required to trust Signal. You can read the source, you can compile it yourself, and you can use it. You can also do a reproducible build and check that it matches the hash of the APK served by the play store. "Open source distribution?" What is that? If you can't trust the vendor, no F-Droid is going to help there. If you need to verify the source, you need to do it yourself. >some secret US government order Explain how that would work on legal level when compelled speech violates the constitution. Your reasoning isn't exactly solid.
    - zzzcpan 7y ago
      > You can read the source, you can compile it yourself, and you can use it. I can read some source code they provide, not necessarily what everyone has installed at any given moment. Even if I could review it and compile it and run it the other ends of end-to-end won't, so I still have to trust Signal the company to not violate the other ends. Open source distribution means packages in various open source repositories, not controlled by software vendors. > If you can't trust the vendor, no F-Droid is going to help there. F-Droid model is exactly what's going to help with not having to trust the vendor. It's sort of an infrastructure to reduce trust in software vendors. Independent parties maintaining forks and packages are more likely to notice if vendor does something stupid, more likely to have people and tools to verify claims and implementations, provide a way for independent implementations. > Explain how that would work on legal level when compelled speech violates the constitution. It doesn't matter, they can come up with plenty of bullshit excuses claiming child porn or whatever. The important thing is you have to trust Signal the company, the US government, the legal system, etc.
      - maqp 7y ago
        >not necessarily what everyone has installed at any given moment That applies to any distribution mechanism. >I still have to trust Signal the company to not violate the other ends. 99% of people are going to download the app from Play store, even if F-Droid was available. You're screwed. >It's sort of an infrastructure to reduce trust in software vendors. Oh dear god. No. It's just more steps into distribution chain the user needs to trust. >Independent parties maintaining forks and packages are more likely to notice if vendor does something stupid, The same people might look at Signal's main repository for the same concern, and notice the same things. Furthermore, Signal is the entity innovating on secure messaging protocols, so I wouldn't say the chances are they're doing stupid things. >more likely to have people and tools to verify claims and implementations No. Nobody's looking at some John Smith's Signal fork. Besides, using such fork is an incredibly dangerous weak point, from the maintainer's improper singing key storage and signing process, to just having to trust random maintainers. Absolutely no. >It doesn't matter, they can come up with plenty of bullshit excuses claiming child porn or whatever. So I take it you're not just clueless, you're also not following the news https://signal.org/blog/earn-it/ https://signal.org/blog/earn-it/ >The important thing is you have to trust Signal the company The literal point of the ubiquitous E2EE, FOSS codebase with reproducible builds is to eliminate the need to trust them. The FUD you're spreading is incredibly damaging.
magic_quotes 7y ago
> hostile takevoer of VK.com "hostile takeover" = bought with money
- spxans 7y ago
  Yes, that is part of the definition of a hostile takeover: "hostile takeover n. An acquisition of a firm despite resistance by the target firm's management and board of directors" it's an appropriate label considering the founder was openly against it and had to leave the country
  - magic_quotes 7y ago
    You are conveniently forgetting Durov never was the owner of Vk. Nor does his person constitute the entire "board of directors" or whatever management they had.

zzzcpan 7y ago

They are also required by the government to link phone numbers to accounts and log and store messages for a long time and make them directly accessible by FSB.

maqp 7y ago

To add, never rely on products that require you to trust the company respects your privacy. E.g. Telegram lacks ubiquitous end-to-end encryption (E2EE) so even if the company chooses not to abuse the insane amounts of valuable data, nation state hackers are most interested in hacking these centralized troves of data. Not even opt-in E2EE is good because that leaks metadata about desire to use proper encryption. Always use apps that are E2EE by default (e.g. Signal) to ensure you're not leaking content or metadata about wanting to keep discussion hidden.

zzzcpan 7y ago
> To add, never rely on products that require you to trust the company respects your privacy. > Always use apps that are E2EE by default (e.g. Signal) You are contradicting yourself here. You are required to trust Signal the company to respect your privacy, to trust that it's actually doing end-to-end encryption, doing it properly and doesn't issue an update breaking it because of some secret US government order. Because Signal controls software distribution, it's pretty much just a binary blob that some guy from Signal can update any time. A proper end-to-end encryption at minimum requires an open source implementations and distribution to avoid trusting the company to respect your privacy, since this is the primary reason for end-to-end encryption to exist. Otherwise incentives are misaligned and it will be broken by the same company it is supposed to protect from as soon as they need your messages for something.
- maqp 7y ago
  You aren't required to trust Signal. You can read the source, you can compile it yourself, and you can use it. You can also do a reproducible build and check that it matches the hash of the APK served by the play store. "Open source distribution?" What is that? If you can't trust the vendor, no F-Droid is going to help there. If you need to verify the source, you need to do it yourself. >some secret US government order Explain how that would work on legal level when compelled speech violates the constitution. Your reasoning isn't exactly solid.
  - zzzcpan 7y ago
    > You can read the source, you can compile it yourself, and you can use it. I can read some source code they provide, not necessarily what everyone has installed at any given moment. Even if I could review it and compile it and run it the other ends of end-to-end won't, so I still have to trust Signal the company to not violate the other ends. Open source distribution means packages in various open source repositories, not controlled by software vendors. > If you can't trust the vendor, no F-Droid is going to help there. F-Droid model is exactly what's going to help with not having to trust the vendor. It's sort of an infrastructure to reduce trust in software vendors. Independent parties maintaining forks and packages are more likely to notice if vendor does something stupid, more likely to have people and tools to verify claims and implementations, provide a way for independent implementations. > Explain how that would work on legal level when compelled speech violates the constitution. It doesn't matter, they can come up with plenty of bullshit excuses claiming child porn or whatever. The important thing is you have to trust Signal the company, the US government, the legal system, etc.
    - maqp 7y ago
      >not necessarily what everyone has installed at any given moment That applies to any distribution mechanism. >I still have to trust Signal the company to not violate the other ends. 99% of people are going to download the app from Play store, even if F-Droid was available. You're screwed. >It's sort of an infrastructure to reduce trust in software vendors. Oh dear god. No. It's just more steps into distribution chain the user needs to trust. >Independent parties maintaining forks and packages are more likely to notice if vendor does something stupid, The same people might look at Signal's main repository for the same concern, and notice the same things. Furthermore, Signal is the entity innovating on secure messaging protocols, so I wouldn't say the chances are they're doing stupid things. >more likely to have people and tools to verify claims and implementations No. Nobody's looking at some John Smith's Signal fork. Besides, using such fork is an incredibly dangerous weak point, from the maintainer's improper singing key storage and signing process, to just having to trust random maintainers. Absolutely no. >It doesn't matter, they can come up with plenty of bullshit excuses claiming child porn or whatever. So I take it you're not just clueless, you're also not following the news https://signal.org/blog/earn-it/ https://signal.org/blog/earn-it/ >The important thing is you have to trust Signal the company The literal point of the ubiquitous E2EE, FOSS codebase with reproducible builds is to eliminate the need to trust them. The FUD you're spreading is incredibly damaging.

magic_quotes 7y ago

> hostile takevoer of VK.com "hostile takeover" = bought with money

spxans 7y ago
Yes, that is part of the definition of a hostile takeover: "hostile takeover n. An acquisition of a firm despite resistance by the target firm's management and board of directors" it's an appropriate label considering the founder was openly against it and had to leave the country
- magic_quotes 7y ago
  You are conveniently forgetting Durov never was the owner of Vk. Nor does his person constitute the entire "board of directors" or whatever management they had.