5 ms·

They either already store or would be able to log everything about who is sending messages to whom, and when. That's the vast majority of what intelligence age

They either already store or would be able to log everything about who is sending messages to whom, and when. That's the vast majority of what intelligence agencies actually care about. They rarely care about message contents anymore.

growse 3y ago
Nope. https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/
- kuschku 3y ago
  > On the opposite end of the spectrum, users who want to live on the edge can enable an optional setting that allows them to receive incoming “sealed sender” messages from non-contacts and people with whom they haven’t shared their profile or delivery token. This comes at the increased risk of abuse, but allows for every incoming message to be sent with “sealed sender,” without requiring any normal message traffic to first discover a profile key. By default, the first message between someone and you clearly identifies who is communicating with whom. That's enough.
hprotagonist 3y ago
we know specifically that signal does not do this.
- kuschku 3y ago
  We assume they don't log this data. We don't know whether an intelligence agency is listening in on their servers and logging this data. Assuming an eavesdropper that can defeat TLS or is listening via DMA attacks on the signal servers, - you can log initial signup or login, which allows you to connect user id and phone number - you can log the first time a chat is created, which allows you to build a social graph of which person is connected to which other people - even with sealed sender, you still know the identity of the receiver and the IP address of the sender, which is often enough to figure out who is in contact with whom This would be enough dragnet surveillance to automatically figure out the contacts of people you've already identified as threats. You'd also have enough evidence to get a sealed court order to do targeted surveillance on these people.

growse 3y ago

Nope. https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/

kuschku 3y ago
> On the opposite end of the spectrum, users who want to live on the edge can enable an optional setting that allows them to receive incoming “sealed sender” messages from non-contacts and people with whom they haven’t shared their profile or delivery token. This comes at the increased risk of abuse, but allows for every incoming message to be sent with “sealed sender,” without requiring any normal message traffic to first discover a profile key. By default, the first message between someone and you clearly identifies who is communicating with whom. That's enough.

hprotagonist 3y ago

we know specifically that signal does not do this.

kuschku 3y ago
We assume they don't log this data. We don't know whether an intelligence agency is listening in on their servers and logging this data. Assuming an eavesdropper that can defeat TLS or is listening via DMA attacks on the signal servers, - you can log initial signup or login, which allows you to connect user id and phone number - you can log the first time a chat is created, which allows you to build a social graph of which person is connected to which other people - even with sealed sender, you still know the identity of the receiver and the IP address of the sender, which is often enough to figure out who is in contact with whom This would be enough dragnet surveillance to automatically figure out the contacts of people you've already identified as threats. You'd also have enough evidence to get a sealed court order to do targeted surveillance on these people.