8 ms·

Let's see if they try to search the Signal servers for any evidence. And if there is really no information stored. Or if that will disrupt Signal services. The

• movedx 6y ago
  Agreed. I really wish they would go decentralised. If they did, I'd order up my 1gbit/1gbit dedicated link at the office and offer it up immediately.
  • zdkl 6y ago
    If you want something decentralised what's wrong with doing the same with Tor and/or Matrix?
    • andix 6y ago
      Matrix is not ready for non-technical people. Way too much stuff to consider as a user. It's similar to PGP a technology that will probably never go mainstream.
      • bayesianbot 6y ago
        Is there? I'm definitely the kind of person who wants to set up my own server and bridges for it at some point, but when I tried Matrix for the first time last week I just created an account at matrix.org, installed a quite polished client and just started chatting.
        • wayoutthere 6y ago
          The iOS client (Element) is garbage unless they fixed it in the last month. I suspect that’s what they’re referring to.
        • mulander 6y ago
          Last time I tried matrix, and mind you that was over 3 years ago. Was with riot.im and trying to use the e2e encryption. The major surprise was not being able to suddenly decrypt older chat messages when OpenBSD changed the User-Agent string for Chromium which as I understand was used to establish the device identity. This is not something non-technical people can or want to diagnose.
          • miloignis 6y ago
            It's significantly better now! They've done a lot in the last 3 years, and during that timeframe was when cross signing and e2ee DMs became default. It's not perfect, but it's by far the best I've found for my priorities, and I think it's much more reasonable for regular people now. And if not now, hopefully soon! As a sibling mentioned, some of the alternative clients are also getting good.
      • 1MachineElf 6y ago
        I used to believe the same as you about the usability of Matrix, but then I discovered the Fluffy Chat matrix client. It aims and looks to be as simple to use as WhatsApp or Telegram. Check it out if you haven't seen it: https://fluffychat.im/en/ https://fluffychat.im/en/
      • BlueTemplar 6y ago
        Comparing Element to PGP is ridiculous.
  • Phenix88be 6y ago
    I used to think the same, but I changed my mind after this talk : https://www.youtube.com/watch?v=Nj3YFprqAr8 https://www.youtube.com/watch?v=Nj3YFprqAr8 There is a lot of very good point in this talk by Moxie, it's a bit long, but worth it.
    • consumer451 6y ago
      Thank you for sharing that talk! Very thought provoking for sure, and wow what a brave guy for giving that talk to that crowd. I also learned a lot about why Signal does what it does. I highly recommend this video to everybody, no matter your background or current work role.
• swiley 6y ago
  Even if it's decentralized there's only one client and they can always push updates to male it send keys/messages back for targeted users. Smartphones in their current form cannot have secure messaging.
  • hans1729 6y ago
    >Smartphones in their current form cannot have secure messaging. What about self-hosted matrix/element, used from the browser?
    • kenniskrag 6y ago
      I think the parent poster wanted to highlight the auto update feature of phones.
      • tormeh 6y ago
        There are alternative clients for Matrix. You don't need to use Element.
        • kenniskrag 6y ago
          which android can force update or remove if they have to.
          • BlueTemplar 6y ago
            How can Android do that ?
      • Cullinet 6y ago
        it may be worth mentioning that every Sony phone still supported except for this year's models are officially supported by Sony for AOSP. https://developer.sony.com/develop/open-devices/ https://developer.sony.com/develop/open-devices/ furthermore Sony provides blobs to enable full feature sets of the cameras and even the 120Hz refresh options that Sony doesn't enable with stock firmware / Android. This gets you notch free real UHD (but not DCI) 4K 120HZ HDR screens and the same performance as a Galaxy S10 for ~$150 | XZ Premium / the XZ Premium 2 model adds a 12MP monochrome camera and wireless charging for a bit more... up to the first Xperia 1 models are supported including dual SIM SKUs. I'm seriously thinking of going back to either of these from the iPhone 11 Pro Max 512GB I'm typing this on, because the PDF reading experience (even in 2K standard resolution) of the Sony was a unique experience of being able to read full page papers set Euro A4 and 8pt and less text and no problems for my 6th decade eyes. if you're in the UK, www.aaisp.net is a isp that hasn't reached the statutory customer base numbers to require keeping the extensive and extremely detailed records of communications UK laws require. The company is privately owned by a PhD and Reverend and the people recognise you by voice if you establish a relationship needing the contact. Andrews and Arnold they can fulfil our compliance with encrypted call recordings by email and ability to configure your landline numbering plan over cellular for PBX equivalence. (I dunno if it's helpful but if you do speak with Phil Boddy I think he'll be willing to confirm that John K isn't a commission agent only a impressed customer about to resurface with new business because there's nobody else short of starting your own MVNO.. Incidentally in Europe only Andorra has cellular operators who don't spill location metadata with every SMS. this story involves Vodafone Greece deleting potentially vital call records evidence of a assassin of a minister : https://en.m.wikipedia.org/wiki/Greek_wiretapping_case_2004%E2%80%9305 https://en.m.wikipedia.org/wiki/Greek_wiretapping_case_2004%... I can't find it (on my phone) but the fuller story is that due to high licensing costs of traditional (not vRAN) basestation equipment features, common practice in Europe retains virtually no call records evidence / data and overwrites everything on cycles only long enough for billing. if anyone is interested in the public spectrum of 5G applications and the acquisition of test sites in London, my lock down research got as far as only needing to be formalised and pursued. I have put much more interesting details in my profile concerning this because I am as serious as I'm probably crazy but at the lowest utility I'm trying to find London interest in getting quality time with some installed, legal, vRAN systems and possess the necessary means and certifiability. what gets me about the Huawei affair is how much straightforward argument there is to drop this monoclonal monopoly supplier in preference for massively more flexible and capable equipment from a plethora of suppliers who need to be made to do bake offs again like we used to (I remember reading 3Com white papers proudly reporting successful bake offs and recognising that that company was going places..) I mean Joe Public understands the arguments that matter to common sense and national security simply follows with unavoidable obviousness. Microsoft and Huawei were the only phone manufacturers who provided user defeat switches to 2G and hence the stingray intercept vulns. Both also made surprisingly good hardware, or could do. I'm old enough to worry about reds under the bed but I think it is positively the most amazing thing how given today's sensitivity to ecological impact of industry waste that we cannot require the reuse of the tools and process equipment created for closed product lines. Of course I understand the tax write off and the trade secrets concerns. But the incredible cost of manufacturing today surely has to force us to deliver mothballed factories to people who have ability to use them. At the very least I would use my day to be dictator to enforce the auction of all such manufacturing facilities. I just decided against cutting my diversion into factory and product design recycling because I think far too much of the irresponsible attitude towards security comes out of the assumption that everything is going to be forklift upgraded every 2 years. This is precisely what is happening with cellular networking. The very same thing is opening the door to China to try and drive through standards and protocols that suit China for 6G and next generation Internet. Samsung basically just ignore the existence of every phone after 2 years from launch. Not from the day you purchase your Samsung phone. From the product launch date you have 2 years of maybe possibly a few updates and patches. There is no way that anyone would have tolerated this 40 years ago. Why now? I'm concerned that there's a more serious systematic failure of the human cognitive capability.
• capableweb 6y ago
  Surprisingly, the response from the Signal team hints that Signal is sometimes P2P. This is the first time I hear about this, what is it referring to exactly? I, like you, thought Signal was 100% centralized. > [...] because the data is transmitted peer-to-peer or relayed through a third-party server [...] Attachment A, Section 2C
  • giords 6y ago
    I believe that voice and video calls work using WebRTC, which is a P2P technology
    • capableweb 6y ago
      WebRTC (still) requires a centralized server in order to setup the connection (via STUN/TURN), so if so, Signal could be forced to turn over any logging they have of those setup requests.
      • sfifs 6y ago
        Very likely they don't log. Otherwise they'd have had to disclose
      • kodablah 6y ago
        You can use existing decentralized systems, e.g. bittorrent DHT or IPFS DHT, to handle signaling and not require a centralized server. STUN is only needed to retrieve the public IP, which you may not need to use (and didn't have to be centralized). In some heavily NATd cases, you'd need a TURN proxy, but not often.
        • capableweb 6y ago
          Both of those DHTs are using centralized signalling servers to first be able to establish any P2P connections. Maybe there has been some recent invention in DHTs, but AFAIK, 100% P2P discovery is still not "there" (meaning "accessible, fast, not using too much resources and can find other peers")
• airhead969 6y ago
  Yep. Lavabit. Centralized is never raid/DDoS-proof. Okay boys, take all these servers because evidence is hiding on them and these lefty pinkos aren't helping us find it. Let's get them back to the lab to find out what that evidence is.
  • sicco 6y ago
    Afaik, Signal uses AWS. Is a raid/confiscation of AWS servers even possible?
    • Red_Leaves_Flyy 6y ago
      Why raid when they can just ssh in?
      • Y_Y 6y ago
        It's cheaper.
    • BlueTemplar 6y ago
      It's always possible, but the collateral damage might be pretty bad...
    • dylan604 6y ago
      Wouldn't the system see a raid's confiscation of a server as just a down machine and do the normal thing to bring up a new server to handle the load correctly? "Okay boys, now go get that server. Wait, now that one, now that one"
    • heavyset_go 6y ago
      Yes, they're just one court order or subpoena away. With a gag order, you'll never even know it happened.
    • PeterisP 6y ago
      Of course, Amazon is a US company, so with the proper subpoena from a US court AWS technicians will [have to] deliver images of the virtual servers and/or remove them and/or modify them or whatever else is requested, without the right to inform the customer if the subpoena says so.
• goodpoint 6y ago
  Reminder: 1) Signal, Matrix, XMPP and so on do not protect you from timing correlation especially between users connecting to the same server. 2) The social connection graph is easy to extract when people communicate often 3) The more data is captured, the more likely it is to find suspicious coincidences that are actually false positives 4) Not everybody lives in a healthy and safe society Please consider recommending Briar or similar onion-routed messengers instead of Signal, Matrix, XMPP
• ransom1538 6y ago
  Eh. I have worked with US investigators quite a few times. They really try to work with you. If you don't have the information and you tell them you don't have the information - they pretty much drop it. FBI/local police are not interested in pulling servers and doing forensics. This isn't what their prosecutors want. Prosecutors want: "Hey, give me all data you have for IP address X." If you honestly can explain to them you don't have it -- they just drop it move on to easier cases IMHO.