4 ms·

Sure, but the main problem here is Apple/Google stores. Remove it there, and 99% of their users disappear. Governments don't care much about Tor, for example,

by mgbmtl 4y ago

Sure, but the main problem here is Apple/Google stores. Remove it there, and 99% of their users disappear. Governments don't care much about Tor, for example, because they have very little leverage (and their law enforcement use it, but members of parliament also use Signal but can't admit it openly).

jakear 4y ago
Have we forgotten about the internet? It wouldn't be difficult to make Signal as a PWA, and with iOS 16.4 coming all the relevant API's should be present. As for TOR, I'd wager governments love it. Everyone the world over has decided to congregate one one official "secret stuff" platform and get this: it's made by the US Government. And by all accounts the US government is well able to spy on it - but won't say how instead preferring to bring up cases by parallel construction^. It's perfect. I don't know what more a government could want. ^ https://www.technologyreview.com/2020/02/08/349016/a-dark-web-tycoon-pleads-guilty-but-how-was-he-caught https://www.technologyreview.com/2020/02/08/349016/a-dark-we...
stiltzkin 4y ago
Less than 99%, many users are aware how to download an APK without Google Store.
lrvick 4y ago
It is fundamentally not possible to have strong privacy or censorship resistance on proprietary operating systems like iOS and Android if a state is targeting you. Even the so-called open source Android ROMs have no choice but to include hundreds of privileged binary blobs to make the proprietary hardware work. All a state actor need do is leverage their no doubt existing backdoors into said binaries and all plaintext is revealed on those devices. They could also issue a secret order to mobile app stores to issue slightly tweaked Signal binaries. In either case Signal would never know that users are compromised. For my own company which does security research, privacy is critical. We bring in only people who have been trained to only access the channel from dedicated QubesOS VMs, with no mobile access permitted. This is not perfect but it is as reasonable best effort until we can run Matrix home servers in a TEE (working on foundations for this atm). Signal by contrast demands a phone number and assumes mobile handsets can be fully trusted so it already has ruled itself out for high risk use cases. Matrix on the other hand I can run a private server of, and enforce whatever rules are appropriate for my threat model.

by mgbmtl 4y ago

jakear 4y ago

Have we forgotten about the internet? It wouldn't be difficult to make Signal as a PWA, and with iOS 16.4 coming all the relevant API's should be present. As for TOR, I'd wager governments love it. Everyone the world over has decided to congregate one one official "secret stuff" platform and get this: it's made by the US Government. And by all accounts the US government is well able to spy on it - but won't say how instead preferring to bring up cases by parallel construction^. It's perfect. I don't know what more a government could want. ^ https://www.technologyreview.com/2020/02/08/349016/a-dark-web-tycoon-pleads-guilty-but-how-was-he-caught https://www.technologyreview.com/2020/02/08/349016/a-dark-we...

stiltzkin 4y ago

Less than 99%, many users are aware how to download an APK without Google Store.

lrvick 4y ago

It is fundamentally not possible to have strong privacy or censorship resistance on proprietary operating systems like iOS and Android if a state is targeting you. Even the so-called open source Android ROMs have no choice but to include hundreds of privileged binary blobs to make the proprietary hardware work. All a state actor need do is leverage their no doubt existing backdoors into said binaries and all plaintext is revealed on those devices. They could also issue a secret order to mobile app stores to issue slightly tweaked Signal binaries. In either case Signal would never know that users are compromised. For my own company which does security research, privacy is critical. We bring in only people who have been trained to only access the channel from dedicated QubesOS VMs, with no mobile access permitted. This is not perfect but it is as reasonable best effort until we can run Matrix home servers in a TEE (working on foundations for this atm). Signal by contrast demands a phone number and assumes mobile handsets can be fully trusted so it already has ruled itself out for high risk use cases. Matrix on the other hand I can run a private server of, and enforce whatever rules are appropriate for my threat model.