6 ms·

I know this tiresome argument comes up every time Signal is mentioned, but there's an elephant there that seems relevant. An totalitarian state would not need

I know this tiresome argument comes up every time Signal is mentioned, but there's an elephant there that seems relevant. An totalitarian state would not need to run a packet inspecting firewall to find out who is using Signal. They have this information already in the plaintext SMS Signal broadcasts in order to collect verified phone numbers of their users. It is most likely in their power to turn off cell service for these endpoints, or even locate them and let the security service round them up. It's a great service in many ways, but if you are revolting an authoritarian state, it's something to be careful of. At the very least, please be mindful of this and take care of yourself.

Tepix 4y ago
The state probably knows who signed up to use Signal, Whatsapp, Viber or some other service back when it was legal to do so. So what?
keewee7 4y ago
Signal has 100 million installs on Android alone. Arresting people for having Signal installed is not a scalable approach for a totalitarian state.
- deleted 4y ago
  [deleted]
- turminal 4y ago
  No, but banning them from the cell network is.
  - zikduruqe 4y ago
    Then you can go off network... https://berty.tech https://berty.tech
    - NaughtyShiba 4y ago
      Messaging over… Bluetooth?
- tux2bsd 4y ago
  - sofixa 4y ago
    I find your focus on totalitarian left peculiar. It's not like they were somehow unique - plenty of totalitarian regimes of all kinds have arrested and executed countless people for whatever. A few random examples: * Ottoman genocide of Armenians, on ethnic/religious grounds. The Ottoman Three Pashas regime was as far from left as possible, but plenty totalitarian. * US internment of "foreign elements", including those with US citizenship, during both World Wars. US was never even center-left, let alone farther, and totalitarian is a stretch. Less bad than the other examples here, but still. * The many White and Red terrors in the Interwar and post-WW2 years, where vague association was guilt and execution. * Of course Jews, Roma, Gypsy, dissident in Nazi concentration camps. * The Herero and Namaqua genocide by the rightist totalitarian-ish Imperial Germany. * UK mass internment of Boers. Not leftist, not really totalitarian. Need i go on? Why did you feel the need to pain totalitarian leftist as worse than any other totalitarians?
    - tomohawk 4y ago
      [flagged]
      - jknoepfler 4y ago
        The common factor in mass state murder is militant Facism. There's no right or left, there's a willingness to commit mass-murder and a violent takeover of the state. It's incontrovertible that democide was one of the worst forces of the 20th century, but bizarre and dangerous to associate it with some one-dimensional "left/right" projection of 21st century identity politics. Pol Pot, Mao, Hitler - these are figureheads that became objects of popular worship. If Monarchies were a thing, they would have been monarchs. If Theocracies were a thing, they would have been theocrats. If corporations were a thing, they would have been admirable profiteers. Violent self-righteousness is just that.
      - stephen_g 4y ago
- xorcist 4y ago
  Not in Iran. Not during demonstrations. Not in Kurdish-dominated areas. You can narrow it down as much as you'd like. And while you'd think that senseless violence against civilians do not scale, times of civil protests in totalitarian regimes is not good time to be naive. Shutting down routing for the entire country is pretty much par for the course. There's not such thing as collateral damage when the regime itself gets scared.
- acdha 4y ago
  > Arresting people for having Signal installed is not a scalable approach for a totalitarian state. Not all of those are in the same country, though, and it’s worth thinking about how the install base would change after a particular country banned an app. The first time someone gets an official warning a lot of people are going to say “not worth it”.
- masterof0 4y ago
  Not in places like Cuba, where I know first hand, people who participated in the protest in July 11th where charged based on the apps the police and G2(Cuban FSB) found in their phones.
nibbleshifter 4y ago
Signal have been promising vaguely to move away from using phone numbers for... A really long time now.
_8j50 4y ago
That's what a security model is for, the best you can do is difficult security/privacy not absolute or perfect. I don't get this "totalitarian state" b.s., subverting legitimate government's policies seems silly and dangerous. If I was a dictator or something I would have people's phone's searched randomly by street cops, if they see signal then you are a subverter and a traitor so off with your head. I can't imagine security against that. Security and privacy against nation state actors are one thing but against your nation state actor is a whole different ball game.
- darawk 4y ago
  Security against random searches is easy. There are plenty of ways to hide an app behind something innocuous, e.g. requiring a particular input sequence known only to the user to open the app.
  - _8j50 4y ago
    Plausible deniability is what you mean. It is until it isn't (if it is scanned by something "smart" or purpose made).
    - darawk 4y ago
      Ya, that's right, but there are cryptographically secure forms of plausible deniability, commonly known as "deniable encryption": https://en.wikipedia.org/wiki/Deniable_encryption https://en.wikipedia.org/wiki/Deniable_encryption
- AndrewUnmuted 4y ago
mikece 4y ago
> They have this information already in the plaintext SMS Signal broadcasts in order to collect verified phone numbers of their users. This assumes one is using the phone number attached to the handset running Signal as their Signal number. Personally, I don't do this: I have used Google Voice and even a basic Twilio number that sends SMS messages to me via Email to register a number with Signal. There are many reasons to do it this way, not least of which is that I can publish my Signal number without needing to worry about people direct-calling my phone. Until Signal drops the requirement for a phone number (verified by SMS) to spin up service, this is the most secure way to use Signal.
- ananonymoususer 4y ago
  Governments can easily correlate GV numbers to mobile devices. I personally no longer trust Signal. Moxie's departure stinks like a canary.
  - mikece 4y ago
    "Governments can easily correlate GV numbers to mobile devices." Google Voice doesn't need to be installed on a mobile device. I have my Google Voice accounts (yes, multiple) set to forward SMS to me via email. "I personally no longer trust Signal. Moxie's departure stinks like a canary." I never really trusted Moxie to begin with but events like this make me wonder all the more if Signal is really being run from Fort Meade. Fortunately for me I used Signal as my "non-secure" messaging platform and use other messenger options for secure comms.
    - Melatonic 4y ago
      "Moxie" just seemed so hilariously stereotypical in the first place I could not help but think it was all BS. The name, his style, his online blogs.....maybe he just wants to craft a certain type of image but it seemed a little too perfectly matched to the type of person who would create a free, easy to use and super secure messenger. Personally I really liked Wickr Messenger (no phone number required) but they were recently acquired by AWS :-( edit: Also looking up Wickr now it seems like they ended up specializing in providing secure messaging FOR the government (and even are the only ones to pass some NSA specific test) so maybe that was not the best choice.....

Tepix 4y ago

The state probably knows who signed up to use Signal, Whatsapp, Viber or some other service back when it was legal to do so. So what?

keewee7 4y ago

Signal has 100 million installs on Android alone. Arresting people for having Signal installed is not a scalable approach for a totalitarian state.

deleted 4y ago
[deleted]
turminal 4y ago
No, but banning them from the cell network is.
- zikduruqe 4y ago
  Then you can go off network... https://berty.tech https://berty.tech
  - NaughtyShiba 4y ago
    Messaging over… Bluetooth?
tux2bsd 4y ago
- sofixa 4y ago
  I find your focus on totalitarian left peculiar. It's not like they were somehow unique - plenty of totalitarian regimes of all kinds have arrested and executed countless people for whatever. A few random examples: * Ottoman genocide of Armenians, on ethnic/religious grounds. The Ottoman Three Pashas regime was as far from left as possible, but plenty totalitarian. * US internment of "foreign elements", including those with US citizenship, during both World Wars. US was never even center-left, let alone farther, and totalitarian is a stretch. Less bad than the other examples here, but still. * The many White and Red terrors in the Interwar and post-WW2 years, where vague association was guilt and execution. * Of course Jews, Roma, Gypsy, dissident in Nazi concentration camps. * The Herero and Namaqua genocide by the rightist totalitarian-ish Imperial Germany. * UK mass internment of Boers. Not leftist, not really totalitarian. Need i go on? Why did you feel the need to pain totalitarian leftist as worse than any other totalitarians?
  - tomohawk 4y ago
    [flagged]
    - jknoepfler 4y ago
      The common factor in mass state murder is militant Facism. There's no right or left, there's a willingness to commit mass-murder and a violent takeover of the state. It's incontrovertible that democide was one of the worst forces of the 20th century, but bizarre and dangerous to associate it with some one-dimensional "left/right" projection of 21st century identity politics. Pol Pot, Mao, Hitler - these are figureheads that became objects of popular worship. If Monarchies were a thing, they would have been monarchs. If Theocracies were a thing, they would have been theocrats. If corporations were a thing, they would have been admirable profiteers. Violent self-righteousness is just that.
    - stephen_g 4y ago
xorcist 4y ago
Not in Iran. Not during demonstrations. Not in Kurdish-dominated areas. You can narrow it down as much as you'd like. And while you'd think that senseless violence against civilians do not scale, times of civil protests in totalitarian regimes is not good time to be naive. Shutting down routing for the entire country is pretty much par for the course. There's not such thing as collateral damage when the regime itself gets scared.
acdha 4y ago
> Arresting people for having Signal installed is not a scalable approach for a totalitarian state. Not all of those are in the same country, though, and it’s worth thinking about how the install base would change after a particular country banned an app. The first time someone gets an official warning a lot of people are going to say “not worth it”.
masterof0 4y ago
Not in places like Cuba, where I know first hand, people who participated in the protest in July 11th where charged based on the apps the police and G2(Cuban FSB) found in their phones.

nibbleshifter 4y ago

Signal have been promising vaguely to move away from using phone numbers for... A really long time now.

_8j50 4y ago

That's what a security model is for, the best you can do is difficult security/privacy not absolute or perfect. I don't get this "totalitarian state" b.s., subverting legitimate government's policies seems silly and dangerous. If I was a dictator or something I would have people's phone's searched randomly by street cops, if they see signal then you are a subverter and a traitor so off with your head. I can't imagine security against that. Security and privacy against nation state actors are one thing but against your nation state actor is a whole different ball game.

darawk 4y ago
Security against random searches is easy. There are plenty of ways to hide an app behind something innocuous, e.g. requiring a particular input sequence known only to the user to open the app.
- _8j50 4y ago
  Plausible deniability is what you mean. It is until it isn't (if it is scanned by something "smart" or purpose made).
  - darawk 4y ago
    Ya, that's right, but there are cryptographically secure forms of plausible deniability, commonly known as "deniable encryption": https://en.wikipedia.org/wiki/Deniable_encryption https://en.wikipedia.org/wiki/Deniable_encryption
AndrewUnmuted 4y ago

mikece 4y ago

> They have this information already in the plaintext SMS Signal broadcasts in order to collect verified phone numbers of their users. This assumes one is using the phone number attached to the handset running Signal as their Signal number. Personally, I don't do this: I have used Google Voice and even a basic Twilio number that sends SMS messages to me via Email to register a number with Signal. There are many reasons to do it this way, not least of which is that I can publish my Signal number without needing to worry about people direct-calling my phone. Until Signal drops the requirement for a phone number (verified by SMS) to spin up service, this is the most secure way to use Signal.

ananonymoususer 4y ago
Governments can easily correlate GV numbers to mobile devices. I personally no longer trust Signal. Moxie's departure stinks like a canary.
- mikece 4y ago
  "Governments can easily correlate GV numbers to mobile devices." Google Voice doesn't need to be installed on a mobile device. I have my Google Voice accounts (yes, multiple) set to forward SMS to me via email. "I personally no longer trust Signal. Moxie's departure stinks like a canary." I never really trusted Moxie to begin with but events like this make me wonder all the more if Signal is really being run from Fort Meade. Fortunately for me I used Signal as my "non-secure" messaging platform and use other messenger options for secure comms.
  - Melatonic 4y ago
    "Moxie" just seemed so hilariously stereotypical in the first place I could not help but think it was all BS. The name, his style, his online blogs.....maybe he just wants to craft a certain type of image but it seemed a little too perfectly matched to the type of person who would create a free, easy to use and super secure messenger. Personally I really liked Wickr Messenger (no phone number required) but they were recently acquired by AWS :-( edit: Also looking up Wickr now it seems like they ended up specializing in providing secure messaging FOR the government (and even are the only ones to pass some NSA specific test) so maybe that was not the best choice.....