4 ms·

Signal is still a centralised data silo where by default you trust CA to verify your contacts identify.

trangus_1985 5y ago
Yeah, but it's also useful for getting my friends on board. I think it's likely that I eventually start hosting matrix or some alternative, but my goal is to be practical here, yet still have a privacy protecting posture.
- Sunspark 5y ago
  Your friends aren't going to want to install an app to have it connect to trangus_1985's server. Be happy just getting them on Signal.
  - trangus_1985 5y ago
    My friends are significantly more technical (and paranoid) than the average user. We've already discussed it. But... yeah. Yeah. Which is why I got as many people on Signal as I could. Baby steps. The goal here, right now, is reasonable privacy, not perfection.
    - Sunspark 5y ago
      Well said, as I like to point out sometimes, Signal is a privacy app not an anonymity app.
- playguardin 5y ago
  What is matrix?
chimeracoder 5y ago
> Signal is still a centralised data silo where by default you trust CA to verify your contacts identify. You can verify the security number out-of-band, and the process is straightforward enough that even nontechnical users can do it. That's as much as can possibly be done, short of an app that literally prevents you from communicating with anyone without manually providing their security number.
- Andrew_nenakhov 5y ago
  I said, 'by default'. I know that it is possible to do a manual verification, but I am yet to have a chat with a person who would do that. Also, the Signal does not give any warnings or indication that chat partner identify is manually verified. Users are supposed to trust Signal and not ask difficult questions
  - chimeracoder 5y ago
    > I said, 'by default'. I know that it is possible to do a manual verification, but I am yet to have a chat with a person who would do that. I'm not sure what else you'd expect. The alternative would be for Signal not to handle key exchange at all, and only to permit communication after the user manually provides a security key that was obtained out-of-band. That would be an absolutely disastrous user experience. > Also, the Signal does not give any warnings or indication that chat partner identify is manually verified That's not true. When you verify a contact, it adds a checkmark next to their name with the word "verified" underneath it. If you use the QR code to verify, this happens automatically. Otherwise, if you've verified it manually (visual inspection) you can manually mark the contact as verified and it adds the checkmark.
    - Andrew_nenakhov 5y ago
      > I'm not sure what else you'd expect. Ahem. I'd expect something that most xmpp clients could do 10+ years ago with OTR: after establishing an encrypted session the user is given a warning that chat identify of a partner is not verified, and is given options on how to perform this verification. With CA you can make a mild warning that identity is verified by Signal, and give an options to dismiss warning or perform off-the-band verification. Not too disastrous, no? > That's not true. When you verify a contact, it adds a checkmark next to their name with the word "verified" It has zero effect if the user is given no indication that there should be the word verified. It is not true what you say. This [1] is what a new user sees in Signal - absolutely zero indication. To verify a contact user must go to "Conversation settings* and then "View safety number". I'm not surprised nobody ever established a verified session with me. [1]: https://www.dropbox.com/s/ab1bvazg4y895f6/screenshot_20210806-034914.png?dl=0 https://www.dropbox.com/s/ab1bvazg4y895f6/screenshot_2021080...

trangus_1985 5y ago

Yeah, but it's also useful for getting my friends on board. I think it's likely that I eventually start hosting matrix or some alternative, but my goal is to be practical here, yet still have a privacy protecting posture.

Sunspark 5y ago
Your friends aren't going to want to install an app to have it connect to trangus_1985's server. Be happy just getting them on Signal.
- trangus_1985 5y ago
  My friends are significantly more technical (and paranoid) than the average user. We've already discussed it. But... yeah. Yeah. Which is why I got as many people on Signal as I could. Baby steps. The goal here, right now, is reasonable privacy, not perfection.
  - Sunspark 5y ago
    Well said, as I like to point out sometimes, Signal is a privacy app not an anonymity app.
playguardin 5y ago
What is matrix?

chimeracoder 5y ago

> Signal is still a centralised data silo where by default you trust CA to verify your contacts identify. You can verify the security number out-of-band, and the process is straightforward enough that even nontechnical users can do it. That's as much as can possibly be done, short of an app that literally prevents you from communicating with anyone without manually providing their security number.

Andrew_nenakhov 5y ago
I said, 'by default'. I know that it is possible to do a manual verification, but I am yet to have a chat with a person who would do that. Also, the Signal does not give any warnings or indication that chat partner identify is manually verified. Users are supposed to trust Signal and not ask difficult questions
- chimeracoder 5y ago
  > I said, 'by default'. I know that it is possible to do a manual verification, but I am yet to have a chat with a person who would do that. I'm not sure what else you'd expect. The alternative would be for Signal not to handle key exchange at all, and only to permit communication after the user manually provides a security key that was obtained out-of-band. That would be an absolutely disastrous user experience. > Also, the Signal does not give any warnings or indication that chat partner identify is manually verified That's not true. When you verify a contact, it adds a checkmark next to their name with the word "verified" underneath it. If you use the QR code to verify, this happens automatically. Otherwise, if you've verified it manually (visual inspection) you can manually mark the contact as verified and it adds the checkmark.
  - Andrew_nenakhov 5y ago
    > I'm not sure what else you'd expect. Ahem. I'd expect something that most xmpp clients could do 10+ years ago with OTR: after establishing an encrypted session the user is given a warning that chat identify of a partner is not verified, and is given options on how to perform this verification. With CA you can make a mild warning that identity is verified by Signal, and give an options to dismiss warning or perform off-the-band verification. Not too disastrous, no? > That's not true. When you verify a contact, it adds a checkmark next to their name with the word "verified" It has zero effect if the user is given no indication that there should be the word verified. It is not true what you say. This [1] is what a new user sees in Signal - absolutely zero indication. To verify a contact user must go to "Conversation settings* and then "View safety number". I'm not surprised nobody ever established a verified session with me. [1]: https://www.dropbox.com/s/ab1bvazg4y895f6/screenshot_20210806-034914.png?dl=0 https://www.dropbox.com/s/ab1bvazg4y895f6/screenshot_2021080...