4 ms·

> Interviews will typically last between 45 and 60 minutes and will be conducted on Signal Why would someone use SecureDrop instead of Signal?

ape4 4y ago
Apparently you can signup for Signal anonymously but it doesn't look so simple https://www.howtogeek.com/712590/how-to-sign-up-for-signal-or-telegram-anonymously/ https://www.howtogeek.com/712590/how-to-sign-up-for-signal-o...
- O__________O 4y ago
  FYI: Advice given in that guide is horrible for using Signal anonymously; burner phone OpSec is hard; Google Voice requires phone number for signup; landlines are easy to trace. Core point is that survey requests prior experience using SecureDrop, then uses Signal, email and/or https-form to communicate. Why? Feel like at very least SecureDrop should themselves be explicitly stating why they opted use alternatives instead of their own service.
  - flangola7 4y ago
    Google voice only needs a Google account
    - alwayslikethis 4y ago
      Google account requires a phone number in all cases, which is a tracking tool.
      - flangola7 4y ago
        Since when do you need a phone number to make a Gmail account? That doesn't make any sense, I've made literally dozens over the years.
        O__________O 4y ago
        Google requires a phone number for most users to create a new account; there are currently ways around this, but for obvious reasons, I have no intention of sharing how to do this. Google Voice has always required a phone number for signup, since its legacy design was to forward calls. When creating the account you’re able to allow Google to generate a Google Voice number for the account, disconnect the setup number, and use Google without a phone number. Why though go to all that trouble when Signal just needs a PIN one-time from a throw away number; at which point Signal allows user to lockout future registrations from that number as long as the Signal account is active per their definition.
antisocialist 4y ago
Who ever told you Signal provides anonymity to the sender or recipient?
- O__________O 4y ago
  Signal supports anonymous connections, anonymous user accounts, secure operating systems, etc — not saying it’s easy, but neither is securely using SecureDrop to my knowledge. OpSec is hard by definition, if it was easy and cheap, counter measures including laws banning such activities would rapidly appear.
  - antisocialist 4y ago
    "Supports some feature" vs. "suitable for specific use case" are two very different things. Does the foundation claim their application is suitable for such use cases? They have no choice but to assist the government with whatever info they may have. https://tech.hindustantimes.com/mobile/news/recent-court-filing-reveals-exactly-how-much-data-signal-collects-about-you-71619595504148.html https://tech.hindustantimes.com/mobile/news/recent-court-fil... I agree SecureDrop is complex (in fact I mentioned that in another comment). It's way more complex than sending a file with Signal or other modern privacy apps, but at least all parts are private and secure (as far as we know) so it's up to the user to not make mistakes. With Signal we know that Signal itself may be compelled to provide information about its users and I think that's why they wouldn't recommend their application for such use cases.
    - O__________O 4y ago
      Again, Signal supports anonymous connections, anonymous user accounts, secure operating systems, etc. If anything, it’s more secure than SecureDrop because it doesn’t require using Tor, which is a huge red flag and appear to acknowledge odds of it being secure are questionable at best. Also, assuming user uses an anonymous connections, anonymous user account, secure operating systems, etc — Signal would have no information it could be compelled to provide.
  - egberts1 4y ago

ape4 4y ago

Apparently you can signup for Signal anonymously but it doesn't look so simple https://www.howtogeek.com/712590/how-to-sign-up-for-signal-or-telegram-anonymously/ https://www.howtogeek.com/712590/how-to-sign-up-for-signal-o...

O__________O 4y ago
FYI: Advice given in that guide is horrible for using Signal anonymously; burner phone OpSec is hard; Google Voice requires phone number for signup; landlines are easy to trace. Core point is that survey requests prior experience using SecureDrop, then uses Signal, email and/or https-form to communicate. Why? Feel like at very least SecureDrop should themselves be explicitly stating why they opted use alternatives instead of their own service.
- flangola7 4y ago
  Google voice only needs a Google account
  - alwayslikethis 4y ago
    Google account requires a phone number in all cases, which is a tracking tool.
    - flangola7 4y ago
      Since when do you need a phone number to make a Gmail account? That doesn't make any sense, I've made literally dozens over the years.
      - O__________O 4y ago
        Google requires a phone number for most users to create a new account; there are currently ways around this, but for obvious reasons, I have no intention of sharing how to do this. Google Voice has always required a phone number for signup, since its legacy design was to forward calls. When creating the account you’re able to allow Google to generate a Google Voice number for the account, disconnect the setup number, and use Google without a phone number. Why though go to all that trouble when Signal just needs a PIN one-time from a throw away number; at which point Signal allows user to lockout future registrations from that number as long as the Signal account is active per their definition.

antisocialist 4y ago

Who ever told you Signal provides anonymity to the sender or recipient?

O__________O 4y ago
Signal supports anonymous connections, anonymous user accounts, secure operating systems, etc — not saying it’s easy, but neither is securely using SecureDrop to my knowledge. OpSec is hard by definition, if it was easy and cheap, counter measures including laws banning such activities would rapidly appear.
- antisocialist 4y ago
  "Supports some feature" vs. "suitable for specific use case" are two very different things. Does the foundation claim their application is suitable for such use cases? They have no choice but to assist the government with whatever info they may have. https://tech.hindustantimes.com/mobile/news/recent-court-filing-reveals-exactly-how-much-data-signal-collects-about-you-71619595504148.html https://tech.hindustantimes.com/mobile/news/recent-court-fil... I agree SecureDrop is complex (in fact I mentioned that in another comment). It's way more complex than sending a file with Signal or other modern privacy apps, but at least all parts are private and secure (as far as we know) so it's up to the user to not make mistakes. With Signal we know that Signal itself may be compelled to provide information about its users and I think that's why they wouldn't recommend their application for such use cases.
  - O__________O 4y ago
    Again, Signal supports anonymous connections, anonymous user accounts, secure operating systems, etc. If anything, it’s more secure than SecureDrop because it doesn’t require using Tor, which is a huge red flag and appear to acknowledge odds of it being secure are questionable at best. Also, assuming user uses an anonymous connections, anonymous user account, secure operating systems, etc — Signal would have no information it could be compelled to provide.
- egberts1 4y ago