3 ms·

It seems they need a better review process. One of their recommended apps is Signal, which a long time ago began collecting and permanently storing sensitive us

It seems they need a better review process. One of their recommended apps is Signal, which a long time ago began collecting and permanently storing sensitive user data in the cloud, but they never bothered to update their privacy policy which still explicitly states they don't do exactly the thing they're now doing. Requests that they update their privacy policy and provide an opt-out to the data collection have been ignored. Signal was also extremely unclear in their communications surrounding that data collection leading to a huge amount of confusion and misunderstandings about what data is collected and when. Pretty much every time I mention this, at least one signal user asks for details because they were entirely unaware that their data was being collected and stored on servers in the cloud. This is entirely unacceptable for an application that markets itself to human rights activists and whistleblowers whose lives and safety can depend on being aware of their risks. If privacyguides can recommend an application like that it calls into question their judgement, their screening process, or both. Maybe it's just not updated often enough. They also recommend 1password which isn't as private as it used to be. It seems like new versions don't allow local vaults forcing you to keep your stuff in the cloud and they've started collected telemetry.

CrackerNews 4y ago
I would like to know more about the Signal issue too. If these issues are that much of a concern, then perhaps they could be brought up. Privacy Guides seems transparent about the discussions they have behind their decisions, unless I am mistaken.
- autoexec 4y ago
  See this thread of people requesting an opt out: https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 https://community.signalusers.org/t/dont-want-pin-dont-want-... See this thread where objections over the new feature and the security issues surrounding it were mostly ignored (they did allow pins longer than 4 digits, but they continued to call them "pins" which to many users is a 4 digit number): https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... Here's a great comment on the communication issue (although the entire topic is a good example of the confusion they caused): https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/fyjy7a5/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin... Here's an early post calling out the fact that privacy policy has never been updated: https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 https://community.signalusers.org/t/can-signal-please-update... At this point, I consider the fact that the very first sentence of Signal's privacy policy has been a lie since 2020 to be a dead canary. I suspect that the folks at Signal have been telling people their service cannot be trusted as loudly as they can. Perhaps that'd also explain why they've made some other odd choices like removing the ability to use Signal for both secure messages and plain old SMS/MMS and adding cryptocurrency features.
deleted 4y ago
[deleted]

CrackerNews 4y ago

I would like to know more about the Signal issue too. If these issues are that much of a concern, then perhaps they could be brought up. Privacy Guides seems transparent about the discussions they have behind their decisions, unless I am mistaken.

autoexec 4y ago
See this thread of people requesting an opt out: https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 https://community.signalusers.org/t/dont-want-pin-dont-want-... See this thread where objections over the new feature and the security issues surrounding it were mostly ignored (they did allow pins longer than 4 digits, but they continued to call them "pins" which to many users is a 4 digit number): https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... Here's a great comment on the communication issue (although the entire topic is a good example of the confusion they caused): https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/fyjy7a5/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin... Here's an early post calling out the fact that privacy policy has never been updated: https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 https://community.signalusers.org/t/can-signal-please-update... At this point, I consider the fact that the very first sentence of Signal's privacy policy has been a lie since 2020 to be a dead canary. I suspect that the folks at Signal have been telling people their service cannot be trusted as loudly as they can. Perhaps that'd also explain why they've made some other odd choices like removing the ability to use Signal for both secure messages and plain old SMS/MMS and adding cryptocurrency features.

deleted 4y ago

[deleted]