4 ms·

How do you know what's running on Signal's server? Sidenote: Signal is based in the USA. They do not have the benefit of the doubt.

egberts1 2y ago
You have association revealed openly to anyone having access to Signal server by User ID but barely know the name or phone associated with either end, much less ever able to see any actual and readable message content. Unless it is the end-device being "accessed"/compromised, which any nation-state can do.
- bboygravity 2y ago
  Why would it be impossible for Signal to decrypt and re-encrypt on their server while pretending to be "peer 2 peer encrypted" if we don't know what's running on their server? What's more: we don't even have the source of the client binary running on our phone. Also "which any nation-state can do" is an interesting angle. Let me put that differently: why would Signal NOT be a honey-pot operated by the CIA/NSA/other? Sounds almost too easy to not be true.
poincaredisk 2y ago
You and GP bring signal into this, but TFA is hosted on simplex.chat blog - the communicator famous for not having user accounts at all, so it trivially fixed the problem GP mentioned.
- egberts1 2y ago
  Simplex shy away from User ID, which means you are giving up something in exchange (notably no message encrypted-at-rest in their server): then the government can access the message contents from Simplex server. It says so on their website: "Only client devices store user profiles, contacts and groups; the messages are sent with 2-layer End-to-end encryption." What it does NOT say is that message content remains encrypted on their server like Signal does. It is like time, money, resource: pick only two. But in secured communication, that would be personal anonymity, personal privacy, and personal security: only can pick two. https://simplex.chat/#how-simplex-works https://simplex.chat/#how-simplex-works
  - epoberezkin 2y ago
    Of course it stays encrypted - if it is sent e2e encrypted, it cannot be decrypted by the servers in the middle - it's the whole point of e2e encryption. The privacy policy is very explicit about it.

egberts1 2y ago

You have association revealed openly to anyone having access to Signal server by User ID but barely know the name or phone associated with either end, much less ever able to see any actual and readable message content. Unless it is the end-device being "accessed"/compromised, which any nation-state can do.

bboygravity 2y ago
Why would it be impossible for Signal to decrypt and re-encrypt on their server while pretending to be "peer 2 peer encrypted" if we don't know what's running on their server? What's more: we don't even have the source of the client binary running on our phone. Also "which any nation-state can do" is an interesting angle. Let me put that differently: why would Signal NOT be a honey-pot operated by the CIA/NSA/other? Sounds almost too easy to not be true.

poincaredisk 2y ago

You and GP bring signal into this, but TFA is hosted on simplex.chat blog - the communicator famous for not having user accounts at all, so it trivially fixed the problem GP mentioned.

egberts1 2y ago
Simplex shy away from User ID, which means you are giving up something in exchange (notably no message encrypted-at-rest in their server): then the government can access the message contents from Simplex server. It says so on their website: "Only client devices store user profiles, contacts and groups; the messages are sent with 2-layer End-to-end encryption." What it does NOT say is that message content remains encrypted on their server like Signal does. It is like time, money, resource: pick only two. But in secured communication, that would be personal anonymity, personal privacy, and personal security: only can pick two. https://simplex.chat/#how-simplex-works https://simplex.chat/#how-simplex-works
- epoberezkin 2y ago
  Of course it stays encrypted - if it is sent e2e encrypted, it cannot be decrypted by the servers in the middle - it's the whole point of e2e encryption. The privacy policy is very explicit about it.