3 ms·

Why would criminals not use expiring messages? Bizarre that you’d go to these lengths to use e2e chat and then not expire your messages after say an hour.

hnrodey 6y ago
Criminals are quite often not the sharpest tools in the shed. Expiring messages, staying up on the latest hardware, etc.
- dredmorbius 6y ago
  Criminals who get caught, one should note. Sort of a reverse survivorship bias at play here.
moftz 6y ago
The smart ones don't get their phones seized by the FBI
girvo 6y ago
All the ones I knew did, for exactly this reason, and still didn’t speak too freely on it. Cant be too careful.
csydas 6y ago
Because expiring/detonating messages are not valid security. Signal even warns of this: https://support.signal.org/hc/en-us/articles/360007320771-Set-and-manage-disappearing-messages https://support.signal.org/hc/en-us/articles/360007320771-Se... If Charlie is selling drugs to Bob and Alice, expiring messages don't help Charlie out if the others are finding ways to capture data on the screen before the message expires (which, is very common for very innocent, non-malicious reasons). Similarly, though I've not tested this with signal specifically, other chat apps' implementations of expired messages can be futzed with by simply disconnecting the phone from all network connections. People who need true privacy, regardless of the reason, aren't using chat apps readily available from stores since the apps only prevent passive snooping, they do nothing to help establish circles of trust. Such business is either conducted out in the open without concern for who sees what (you can see this in countless pictures online when people openly sell stuff like weed), or such business stays off chat apps completely because there's no way to validate who is holding the phone on the other end. The transactions occur indirectly using proven safe methods for the courier and buyer (dead drops, mail tricks, etc)
- r00fus 6y ago
  If one were to need true privacy as you say, shouldn't there be benefit to overlapping security approaches? Ie, use E2EE, use expiring messages, use out-of-band challenge/accept (ie, recipient has to mention keyword or conversation stays plausibly deniable) all seem applicable.
- bscphil 6y ago
  Suppose I use a public key authentication scheme to communicate with a collaborator, Bob. To avoid any possible failures of technology, we've developed a simplified scheme that can be done with pencil and paper and sent through the mail. When Bob receives the message, he uses his private key to decrypt the message, writing each letter in the plaintext on a piece of paper so he can read it. After reading, he burns the paper completely with a small fire. Are you going to insist that this last step, burning the plaintext copy, is not "valid security"? If you do, haven't we so mangled the meaning of security that it's not even intelligible any more? I believe that "Let's not keep around unencrypted / minimally protected copies of our communications after we're done using them" is a perfectly valid security measure for two people to use. No, it doesn't solve "trust issues", in that one of them could simply refuse to delete the messages, but neither is it intended to.
alexpc201 6y ago
They should use Confide app.

hnrodey 6y ago

Criminals are quite often not the sharpest tools in the shed. Expiring messages, staying up on the latest hardware, etc.

dredmorbius 6y ago
Criminals who get caught, one should note. Sort of a reverse survivorship bias at play here.

moftz 6y ago

The smart ones don't get their phones seized by the FBI

girvo 6y ago

All the ones I knew did, for exactly this reason, and still didn’t speak too freely on it. Cant be too careful.

csydas 6y ago

Because expiring/detonating messages are not valid security. Signal even warns of this: https://support.signal.org/hc/en-us/articles/360007320771-Set-and-manage-disappearing-messages https://support.signal.org/hc/en-us/articles/360007320771-Se... If Charlie is selling drugs to Bob and Alice, expiring messages don't help Charlie out if the others are finding ways to capture data on the screen before the message expires (which, is very common for very innocent, non-malicious reasons). Similarly, though I've not tested this with signal specifically, other chat apps' implementations of expired messages can be futzed with by simply disconnecting the phone from all network connections. People who need true privacy, regardless of the reason, aren't using chat apps readily available from stores since the apps only prevent passive snooping, they do nothing to help establish circles of trust. Such business is either conducted out in the open without concern for who sees what (you can see this in countless pictures online when people openly sell stuff like weed), or such business stays off chat apps completely because there's no way to validate who is holding the phone on the other end. The transactions occur indirectly using proven safe methods for the courier and buyer (dead drops, mail tricks, etc)

r00fus 6y ago
If one were to need true privacy as you say, shouldn't there be benefit to overlapping security approaches? Ie, use E2EE, use expiring messages, use out-of-band challenge/accept (ie, recipient has to mention keyword or conversation stays plausibly deniable) all seem applicable.
bscphil 6y ago
Suppose I use a public key authentication scheme to communicate with a collaborator, Bob. To avoid any possible failures of technology, we've developed a simplified scheme that can be done with pencil and paper and sent through the mail. When Bob receives the message, he uses his private key to decrypt the message, writing each letter in the plaintext on a piece of paper so he can read it. After reading, he burns the paper completely with a small fire. Are you going to insist that this last step, burning the plaintext copy, is not "valid security"? If you do, haven't we so mangled the meaning of security that it's not even intelligible any more? I believe that "Let's not keep around unencrypted / minimally protected copies of our communications after we're done using them" is a perfectly valid security measure for two people to use. No, it doesn't solve "trust issues", in that one of them could simply refuse to delete the messages, but neither is it intended to.

alexpc201 6y ago

They should use Confide app.