4 ms·

> The concept simply boils down to as soon as you find an account’s phone number, it’s a game over for that said privacy You completely misunderstand what kind

by hnarn 3y ago

> The concept simply boils down to as soon as you find an account’s phone number, it’s a game over for that said privacy You completely misunderstand what kind of privacy Signal aims to achieve. Signal protects you from eavesdropping and data hoarding, two major privacy issues with solutions like Facebook Messenger for example. They do not and have never claimed to offer a service where “privacy” means nobody knows who anyone is, it isn’t Tor and I wouldn’t want it to be. If you don’t like the goals and design choices of Signal, just use another service. There are benefits of the choices they’ve made, namely ensuring that most users of the service are “real people”, which I think is great. It’s not a social network, it’s a messaging app between friends that solves issues presented by alternatives like SMS or Instagram; that’s it.

tamimio 3y ago
> Signal protects you from eavesdropping and data hoarding Do they?! We can ask Tucker Carlsons about that https://www.reddit.com/r/signal/comments/16evuej/did_the_nsa_really_decrypt_tucker_carlsons_signal/ https://www.reddit.com/r/signal/comments/16evuej/did_the_nsa... As long as you can’t host and use your own server, you should never assume that. > There are benefits of the choices they’ve made, namely ensuring that most users of the service are “real people” You communicate with your colleagues and clients over emails and you know they are real, you probably play games too and use discord and you know they are real, meanwhile you can be talking to bot in twitter that they are registered with a “real” phone number.
- pyramid301 3y ago
  [dead]
- Sohcahtoa82 3y ago
  > Do they?! We can ask Tucker Carlsons about that https://www.reddit.com/r/signal/comments/16evuej/did_the_nsa https://www.reddit.com/r/signal/comments/16evuej/did_the_nsa... A lot of people in the comments have things to say about that video. Personally, I wouldn't trust anything that comes out of Tucker's mouth.
  - tamimio 3y ago
    Focus on the issue, not the person (Tucker), you might not trust a person which is fair, but you are still trusting Signal’s server, you can NEVER know if they have a memory injection backdoor running in there, you can audit the code as much as you want and it still passes, yet, the messages are compromised.
    - luuurker 3y ago
      There are ways of getting messages without breaking Signal or using a backdoor. One of them is getting the messages from the other party(ies) involved. You can't protect yourself from this even if you self host. Something else that might happen is you ending up with your phone hacked because you're talking with someone close to Putin. The only way to know for sure is for you to create an alternative service, write all code yourself, and host everything without ever leaving your server alone. And even then you can't be sure you haven't been hacked. On a side note, if we're getting information from someone that lies a lot and often leaves out details that don't fit the narrative, then perhaps we should also look at the person, not just the issue.
      - tamimio 3y ago
        > One of them is getting the messages from the other party(ies) involved. You can't protect yourself from this even if you self host. You certainly can, the self destruction messages are one of the ways, sure, it is not the only solution as you need to make sure the OS is secure itself too, but definitely helps in that case, no messages stored at rest and all are encrypted in transit. > Something else that might happen is you ending up with your phone hacked Which is essential to have a messaging platform that allows multi-client/cross platform, say running that app on a hardened OS is an option and possible compared to only iOS with a phone a number for example. > write all code yourself, and host everything without ever leaving your server alone. You don’t need to write it yourself, as long as you can read it, and host it knowing no other services are spying on that server, should be miles ahead of other apps like signal, sure, you can still have that server breached, but first you need to know where’s that server, or even you are using this messaging app in the first place, contrary to Signal for example, all I need is checking if you use it by the phone number. Not to mention it will make it harder for whoever is trying to spy on you, if most people ran their instances, but that’s a little bit more of a dream as the average person won’t, but at least the option should be provided.
eimrine 3y ago
> Signal protects you from eavesdropping and data hoarding How on Earth collecting a phone number may be considered as not data hoarding?
- nrabulinski 3y ago
  Because they don’t know anything except the phone number so all they have is a list of phone numbers which maybe people use. Quite different from Facebook reading everything you send, for example
  - kuschku 3y ago
    They either already store or would be able to log everything about who is sending messages to whom, and when. That's the vast majority of what intelligence agencies actually care about. They rarely care about message contents anymore.
    - growse 3y ago
      Nope. https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/
      - kuschku 3y ago
        > On the opposite end of the spectrum, users who want to live on the edge can enable an optional setting that allows them to receive incoming “sealed sender” messages from non-contacts and people with whom they haven’t shared their profile or delivery token. This comes at the increased risk of abuse, but allows for every incoming message to be sent with “sealed sender,” without requiring any normal message traffic to first discover a profile key. By default, the first message between someone and you clearly identifies who is communicating with whom. That's enough.
    - hprotagonist 3y ago
      we know specifically that signal does not do this.
rglullis 3y ago
Matrix and XMPP also provide privacy without requiring a phone number (Or a phone, even)
- leotravis10 3y ago
  That's a fact, and many people use XMPP and Matrix more because of that. We need to stop relying on phone number identifiers as described here: https://dessalines.github.io/essays/why_not_signal.html#phone--identifiers https://dessalines.github.io/essays/why_not_signal.html#phon... The news today is a step in the right direction for sure, but more needs to be done if they want more privacy and anonymity-focused people to use it. This section on what makes a good messaging platform still resonates: https://dessalines.github.io/essays/why_not_signal.html#what-makes-a-good-messaging-platform https://dessalines.github.io/essays/why_not_signal.html#what...

by hnarn 3y ago

tamimio 3y ago

> Signal protects you from eavesdropping and data hoarding Do they?! We can ask Tucker Carlsons about that https://www.reddit.com/r/signal/comments/16evuej/did_the_nsa_really_decrypt_tucker_carlsons_signal/ https://www.reddit.com/r/signal/comments/16evuej/did_the_nsa... As long as you can’t host and use your own server, you should never assume that. > There are benefits of the choices they’ve made, namely ensuring that most users of the service are “real people” You communicate with your colleagues and clients over emails and you know they are real, you probably play games too and use discord and you know they are real, meanwhile you can be talking to bot in twitter that they are registered with a “real” phone number.

pyramid301 3y ago
[dead]
Sohcahtoa82 3y ago
> Do they?! We can ask Tucker Carlsons about that https://www.reddit.com/r/signal/comments/16evuej/did_the_nsa https://www.reddit.com/r/signal/comments/16evuej/did_the_nsa... A lot of people in the comments have things to say about that video. Personally, I wouldn't trust anything that comes out of Tucker's mouth.
- tamimio 3y ago
  Focus on the issue, not the person (Tucker), you might not trust a person which is fair, but you are still trusting Signal’s server, you can NEVER know if they have a memory injection backdoor running in there, you can audit the code as much as you want and it still passes, yet, the messages are compromised.
  - luuurker 3y ago
    There are ways of getting messages without breaking Signal or using a backdoor. One of them is getting the messages from the other party(ies) involved. You can't protect yourself from this even if you self host. Something else that might happen is you ending up with your phone hacked because you're talking with someone close to Putin. The only way to know for sure is for you to create an alternative service, write all code yourself, and host everything without ever leaving your server alone. And even then you can't be sure you haven't been hacked. On a side note, if we're getting information from someone that lies a lot and often leaves out details that don't fit the narrative, then perhaps we should also look at the person, not just the issue.
    - tamimio 3y ago
      > One of them is getting the messages from the other party(ies) involved. You can't protect yourself from this even if you self host. You certainly can, the self destruction messages are one of the ways, sure, it is not the only solution as you need to make sure the OS is secure itself too, but definitely helps in that case, no messages stored at rest and all are encrypted in transit. > Something else that might happen is you ending up with your phone hacked Which is essential to have a messaging platform that allows multi-client/cross platform, say running that app on a hardened OS is an option and possible compared to only iOS with a phone a number for example. > write all code yourself, and host everything without ever leaving your server alone. You don’t need to write it yourself, as long as you can read it, and host it knowing no other services are spying on that server, should be miles ahead of other apps like signal, sure, you can still have that server breached, but first you need to know where’s that server, or even you are using this messaging app in the first place, contrary to Signal for example, all I need is checking if you use it by the phone number. Not to mention it will make it harder for whoever is trying to spy on you, if most people ran their instances, but that’s a little bit more of a dream as the average person won’t, but at least the option should be provided.

eimrine 3y ago

> Signal protects you from eavesdropping and data hoarding How on Earth collecting a phone number may be considered as not data hoarding?

nrabulinski 3y ago
Because they don’t know anything except the phone number so all they have is a list of phone numbers which maybe people use. Quite different from Facebook reading everything you send, for example
- kuschku 3y ago
  They either already store or would be able to log everything about who is sending messages to whom, and when. That's the vast majority of what intelligence agencies actually care about. They rarely care about message contents anymore.
  - growse 3y ago
    Nope. https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/
    - kuschku 3y ago
      > On the opposite end of the spectrum, users who want to live on the edge can enable an optional setting that allows them to receive incoming “sealed sender” messages from non-contacts and people with whom they haven’t shared their profile or delivery token. This comes at the increased risk of abuse, but allows for every incoming message to be sent with “sealed sender,” without requiring any normal message traffic to first discover a profile key. By default, the first message between someone and you clearly identifies who is communicating with whom. That's enough.
  - hprotagonist 3y ago
    we know specifically that signal does not do this.

rglullis 3y ago

Matrix and XMPP also provide privacy without requiring a phone number (Or a phone, even)

leotravis10 3y ago
That's a fact, and many people use XMPP and Matrix more because of that. We need to stop relying on phone number identifiers as described here: https://dessalines.github.io/essays/why_not_signal.html#phone--identifiers https://dessalines.github.io/essays/why_not_signal.html#phon... The news today is a step in the right direction for sure, but more needs to be done if they want more privacy and anonymity-focused people to use it. This section on what makes a good messaging platform still resonates: https://dessalines.github.io/essays/why_not_signal.html#what-makes-a-good-messaging-platform https://dessalines.github.io/essays/why_not_signal.html#what...