3 ms·

gnupg is a foot gun and it does not encrypt the metadata with signal one gets e2ee and it's hard to fuck up

by frontalier 2y ago

yjftsjthsd-h 2y ago
What metadata is exposed by GPG and not Signal?
- Zak 2y ago
  Who is communicating with whom, when, and usually from what IP address. Signal writes about how they minimize the metadata they can access here: https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/
- sudobash1 2y ago
  When using it over Email, all of the normal email headers are there on full display. The subject line, recipients, etc... Everything except the body is exposed.
autoexec 2y ago
I wouldn't count on Signal to protect you. I suspect they've been compromised for a while, but at the very least they're not trustworthy. The very first sentence of their "Signal Terms & Privacy Policy" page is a lie. It states "Signal is designed to never collect or store any sensitive information." but for years now signal has been collecting and permanently storing sensitive information in the cloud (your name, phone number, photo, and most importantly a list of all your contacts). They've also refused to update their privacy policy to reflect their new data collection practices. For an app that markets itself to whistleblowers, human rights activists, and journalists whose freedom or lives could be at risk it's inexcusable to mislead people about what data is being collected. People with so much on the line need to be able to make informed choices about their risks, but Signal's communication surrounding their data collection has been extremely evasive, confusing, and dishonest. Further reading: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 https://community.signalusers.org/t/dont-want-pin-dont-want-... https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 https://community.signalusers.org/t/can-signal-please-update... https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...

gnupg is a foot gun and it does not encrypt the metadata with signal one gets e2ee and it's hard to fuck up

yjftsjthsd-h 2y ago

What metadata is exposed by GPG and not Signal?

Zak 2y ago
Who is communicating with whom, when, and usually from what IP address. Signal writes about how they minimize the metadata they can access here: https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/
sudobash1 2y ago
When using it over Email, all of the normal email headers are there on full display. The subject line, recipients, etc... Everything except the body is exposed.

autoexec 2y ago

I wouldn't count on Signal to protect you. I suspect they've been compromised for a while, but at the very least they're not trustworthy. The very first sentence of their "Signal Terms & Privacy Policy" page is a lie. It states "Signal is designed to never collect or store any sensitive information." but for years now signal has been collecting and permanently storing sensitive information in the cloud (your name, phone number, photo, and most importantly a list of all your contacts). They've also refused to update their privacy policy to reflect their new data collection practices. For an app that markets itself to whistleblowers, human rights activists, and journalists whose freedom or lives could be at risk it's inexcusable to mislead people about what data is being collected. People with so much on the line need to be able to make informed choices about their risks, but Signal's communication surrounding their data collection has been extremely evasive, confusing, and dishonest. Further reading: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 https://community.signalusers.org/t/dont-want-pin-dont-want-... https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 https://community.signalusers.org/t/can-signal-please-update... https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...