3 ms·

Thanks for the blog post, now I finally have a good resource I can point people to next time they claim Telegramm is secure. > I am not specifically calling ou

Thanks for the blog post, now I finally have a good resource I can point people to next time they claim Telegramm is secure. > I am not specifically calling out Telegram for this, since the same problem [with metadata] exists with virtually every other social media network and private messenger. Notably, Signal offers a feature called Sealed Sender[0]. While it doesn't solve the metadata problem entirely, it does at least reduce it a bit. [0]: https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/

fsflover 2y ago
With Matrix, you can use your own (or trusted) server. Doesn't it solve the problem with the metadata? At least when two trusted servers interact.
- Aachen 2y ago
  This is part of what I love about Mastodon: if you PM someone, very often you're talking between two random servers and odds are good that the admin is a friend of a friend. No dragnet statistical analysis stuff, just friends running some software that normal people can also use. Distributed systems at their best
  - fsflover 2y ago
    I wouldn't rely on Mastodon PMs for privacy. It's just not designed for that. Use Matrix instead.
upofadown 2y ago
Sealed sender doesn't really solve the metadata problem at all: * https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1C-4_24180_paper.pdf https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1... Generally you need something like TOR to hide who is talking to who.
- codethief 2y ago
  Interesting, I feared Sealed Sender might be susceptible to statistical analysis (hence my phrasing "reduce it a bit") but it's worse than I expected ("Signal could link sealed sender users in as few as 5 message"). Thanks for the link! As for TOR, that wouldn't really help much, would it, given that the described attack is at the application level of Signal. Or are you talking about not using Signal altogether?
  - upofadown 2y ago
    Yeah, I used TOR as a general example. Briar uses TOR for example to hide the connections between users.
    - maqp 2y ago
      Some other options https://cwtch.im/ https://cwtch.im/ (has better UX and security than Briar) https://onionshare.org/ https://onionshare.org/ chat feature Also https://github.com/maqp/tfc https://github.com/maqp/tfc by yours truly if you need hardware-enforced endpoint security for your keys.
- foresto 2y ago
  Related presentation from Network and Distributed System Security Symposium: https://www.youtube.com/watch?v=HoN6FLC5Hss https://www.youtube.com/watch?v=HoN6FLC5Hss
  - codethief 2y ago
    Thanks, that was a very nice & accessible talk!

fsflover 2y ago

With Matrix, you can use your own (or trusted) server. Doesn't it solve the problem with the metadata? At least when two trusted servers interact.

Aachen 2y ago
This is part of what I love about Mastodon: if you PM someone, very often you're talking between two random servers and odds are good that the admin is a friend of a friend. No dragnet statistical analysis stuff, just friends running some software that normal people can also use. Distributed systems at their best
- fsflover 2y ago
  I wouldn't rely on Mastodon PMs for privacy. It's just not designed for that. Use Matrix instead.

upofadown 2y ago

Sealed sender doesn't really solve the metadata problem at all: * https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1C-4_24180_paper.pdf https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1... Generally you need something like TOR to hide who is talking to who.

codethief 2y ago
Interesting, I feared Sealed Sender might be susceptible to statistical analysis (hence my phrasing "reduce it a bit") but it's worse than I expected ("Signal could link sealed sender users in as few as 5 message"). Thanks for the link! As for TOR, that wouldn't really help much, would it, given that the described attack is at the application level of Signal. Or are you talking about not using Signal altogether?
- upofadown 2y ago
  Yeah, I used TOR as a general example. Briar uses TOR for example to hide the connections between users.
  - maqp 2y ago
    Some other options https://cwtch.im/ https://cwtch.im/ (has better UX and security than Briar) https://onionshare.org/ https://onionshare.org/ chat feature Also https://github.com/maqp/tfc https://github.com/maqp/tfc by yours truly if you need hardware-enforced endpoint security for your keys.
foresto 2y ago
Related presentation from Network and Distributed System Security Symposium: https://www.youtube.com/watch?v=HoN6FLC5Hss https://www.youtube.com/watch?v=HoN6FLC5Hss
- codethief 2y ago
  Thanks, that was a very nice & accessible talk!