4 ms·

> Ever since Signal started collecting and permanently storing sensitive user data in the cloud (your name, photo, number, a list of everyone you contact using

by kijiki 4y ago

> Ever since Signal started collecting and permanently storing sensitive user data in the cloud (your name, photo, number, a list of everyone you contact using Signal) None of this FUD is true. None of the information you listed is collected or stored by Signal. You can verify this yourself by looking at the various government warrants and subpoenas, and Signal's responses: https://signal.org/bigbrother/ https://signal.org/bigbrother/

autoexec 4y ago
> None of the information you listed is collected or stored by Signal. That's a lie. I don't blame you for not knowing the truth though, Signal has gone to some trouble to make things unclear, but reality is reality. Signal has the data, but they've set up their system in a way that would require either an exploit (we've already seen examples of these) or a brute force attack to get the data requested and it's doubtful that a standard subpoena would compel them to use those methods. That said, it does leave the data vulnerable to the NSA or any other three letter agency who is willing to employ those types of methods. Signal would surely not be posting about any national security letters they were handed on their website. Similarly anyone who can guess or brute force a four digit pin could also get the data of some users. I've posted other links with more information on all of this further down, you can check my recent comments for them, but here's this to get you started. https://www.vice.com/en/article/pkyzek/signal-new-pin-feature-worries-cybersecurity-experts https://www.vice.com/en/article/pkyzek/signal-new-pin-featur...
- 7v3x3n3sem9vv 4y ago
  if you're paranoid don't use a 4 digit PIN. use a passphrase. problem solved
  - autoexec 4y ago
    Problem solved as long as you're threat model doesn't include three letter agencies within in the US and you don't mind that a company you're supposed to trust. and which promotes themselves to people whose freedom and or lives are on the line, isn't honest with their users about the risks of using their service. The very first line of their privacy policy reads: "Signal is designed to never collect or store any sensitive information." which is demonstrable false. They've ignored requests to update it. (https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 https://community.signalusers.org/t/can-signal-please-update...) I don't think you need to be "paranoid" to suspect it's probably better not to use their software when your privacy/security is critical to safety of yourself or your loved ones.

by kijiki 4y ago

autoexec 4y ago

> None of the information you listed is collected or stored by Signal. That's a lie. I don't blame you for not knowing the truth though, Signal has gone to some trouble to make things unclear, but reality is reality. Signal has the data, but they've set up their system in a way that would require either an exploit (we've already seen examples of these) or a brute force attack to get the data requested and it's doubtful that a standard subpoena would compel them to use those methods. That said, it does leave the data vulnerable to the NSA or any other three letter agency who is willing to employ those types of methods. Signal would surely not be posting about any national security letters they were handed on their website. Similarly anyone who can guess or brute force a four digit pin could also get the data of some users. I've posted other links with more information on all of this further down, you can check my recent comments for them, but here's this to get you started. https://www.vice.com/en/article/pkyzek/signal-new-pin-feature-worries-cybersecurity-experts https://www.vice.com/en/article/pkyzek/signal-new-pin-featur...

7v3x3n3sem9vv 4y ago
if you're paranoid don't use a 4 digit PIN. use a passphrase. problem solved
- autoexec 4y ago
  Problem solved as long as you're threat model doesn't include three letter agencies within in the US and you don't mind that a company you're supposed to trust. and which promotes themselves to people whose freedom and or lives are on the line, isn't honest with their users about the risks of using their service. The very first line of their privacy policy reads: "Signal is designed to never collect or store any sensitive information." which is demonstrable false. They've ignored requests to update it. (https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 https://community.signalusers.org/t/can-signal-please-update...) I don't think you need to be "paranoid" to suspect it's probably better not to use their software when your privacy/security is critical to safety of yourself or your loved ones.