4 ms·

They mention these Cell Phone message apps, which may be OK. But to me you are better off using email with gnupg if you are really scared. Or better yet, tor

by jmclnx 2y ago

They mention these Cell Phone message apps, which may be OK. But to me you are better off using email with gnupg if you are really scared. Or better yet, tor or tails may be the best choice for people truly concerned. I thought it was weird they did not mention those.

flaburgan 2y ago
Tor is mentioned. But that will probably put a big red alert on you, and is anyway too slow and too blocked for daily usage. /e/ OS, an ungoogled Android by Murena with Firefox and ublock and using website instead of apps, and Signal for all your conversation, and you're already okayish.
frontalier 2y ago
gnupg is a foot gun and it does not encrypt the metadata with signal one gets e2ee and it's hard to fuck up
- yjftsjthsd-h 2y ago
  What metadata is exposed by GPG and not Signal?
  - Zak 2y ago
    Who is communicating with whom, when, and usually from what IP address. Signal writes about how they minimize the metadata they can access here: https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/
  - sudobash1 2y ago
    When using it over Email, all of the normal email headers are there on full display. The subject line, recipients, etc... Everything except the body is exposed.
- autoexec 2y ago
  I wouldn't count on Signal to protect you. I suspect they've been compromised for a while, but at the very least they're not trustworthy. The very first sentence of their "Signal Terms & Privacy Policy" page is a lie. It states "Signal is designed to never collect or store any sensitive information." but for years now signal has been collecting and permanently storing sensitive information in the cloud (your name, phone number, photo, and most importantly a list of all your contacts). They've also refused to update their privacy policy to reflect their new data collection practices. For an app that markets itself to whistleblowers, human rights activists, and journalists whose freedom or lives could be at risk it's inexcusable to mislead people about what data is being collected. People with so much on the line need to be able to make informed choices about their risks, but Signal's communication surrounding their data collection has been extremely evasive, confusing, and dishonest. Further reading: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 https://community.signalusers.org/t/dont-want-pin-dont-want-... https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 https://community.signalusers.org/t/can-signal-please-update... https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...

by jmclnx 2y ago

flaburgan 2y ago

Tor is mentioned. But that will probably put a big red alert on you, and is anyway too slow and too blocked for daily usage. /e/ OS, an ungoogled Android by Murena with Firefox and ublock and using website instead of apps, and Signal for all your conversation, and you're already okayish.

frontalier 2y ago

gnupg is a foot gun and it does not encrypt the metadata with signal one gets e2ee and it's hard to fuck up

yjftsjthsd-h 2y ago
What metadata is exposed by GPG and not Signal?
- Zak 2y ago
  Who is communicating with whom, when, and usually from what IP address. Signal writes about how they minimize the metadata they can access here: https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/
- sudobash1 2y ago
  When using it over Email, all of the normal email headers are there on full display. The subject line, recipients, etc... Everything except the body is exposed.
autoexec 2y ago
I wouldn't count on Signal to protect you. I suspect they've been compromised for a while, but at the very least they're not trustworthy. The very first sentence of their "Signal Terms & Privacy Policy" page is a lie. It states "Signal is designed to never collect or store any sensitive information." but for years now signal has been collecting and permanently storing sensitive information in the cloud (your name, phone number, photo, and most importantly a list of all your contacts). They've also refused to update their privacy policy to reflect their new data collection practices. For an app that markets itself to whistleblowers, human rights activists, and journalists whose freedom or lives could be at risk it's inexcusable to mislead people about what data is being collected. People with so much on the line need to be able to make informed choices about their risks, but Signal's communication surrounding their data collection has been extremely evasive, confusing, and dishonest. Further reading: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 https://community.signalusers.org/t/dont-want-pin-dont-want-... https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 https://community.signalusers.org/t/can-signal-please-update... https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...