4 ms·

Weakness in the linked devices security model. And so by extension, tools like "beeper" If you don't link devices and check there are no linked devices your si

by ggm 2y ago

Weakness in the linked devices security model. And so by extension, tools like "beeper" If you don't link devices and check there are no linked devices your side of things is OK but you have no certainty in group chats or the other side one on one. So it's down to your own trust in the other party/parties. "Two can keep a secret if one of them is dead"

Cyphase 2y ago
This doesn't invalidate your point, but FYI, you can open your contact's info in the Signal app and see the number of linked devices they have. If someone is concerned enough about this, they could ask their contact to unlink all devices. EDIT: I'm using a fork, which may be why I'm seeing it and others aren't. See below.
- ggm 2y ago
  Given sufficient mutuality, you can have some assurance of e2e but your risk here is your own and the other ends OPSEC which is all the NSA guidance really can re-inforce: the more people and devices you bring into an exchange the less likely it is you really have secure communications.
- Tepix 2y ago
  I don’t see this information for my contacts in the signal iOS app.
  - alex-robbins 2y ago
    I don't see it in the Android app either, and I find the original claim very hard to believe in the first place, since that would be a weird piece of information for Signal to reveal about a user.
    - Cyphase 2y ago
      Apologies for the mistake. I'm running a Signal fork called Molly[0]; the feature I mentioned seems to be unique to that fork, based on a search of the code. However, it shows that the data is being provided to the client by the server, in some way. This is a guess, but it may be because sending clients have to encrypt with a key for each device. Here's the code: https://github.com/mollyim/mollyim-android/blob/26403ab1806ae8512fc28a34fbaba0b16de66aa2/app/src/main/res/values/strings2.xml#L91-L95 https://github.com/mollyim/mollyim-android/blob/26403ab1806a... https://github.com/mollyim/mollyim-android/blob/26403ab1806ae8512fc28a34fbaba0b16de66aa2/app/src/main/java/org/thoughtcrime/securesms/components/settings/conversation/preferences/BioTextPreference.kt#L101-L110 https://github.com/mollyim/mollyim-android/blob/26403ab1806a... [0] https://molly.im/ https://molly.im/ [0] https://github.com/mollyim/mollyim-android https://github.com/mollyim/mollyim-android

by ggm 2y ago

Cyphase 2y ago

This doesn't invalidate your point, but FYI, you can open your contact's info in the Signal app and see the number of linked devices they have. If someone is concerned enough about this, they could ask their contact to unlink all devices. EDIT: I'm using a fork, which may be why I'm seeing it and others aren't. See below.

ggm 2y ago
Given sufficient mutuality, you can have some assurance of e2e but your risk here is your own and the other ends OPSEC which is all the NSA guidance really can re-inforce: the more people and devices you bring into an exchange the less likely it is you really have secure communications.
Tepix 2y ago
I don’t see this information for my contacts in the signal iOS app.
- alex-robbins 2y ago
  I don't see it in the Android app either, and I find the original claim very hard to believe in the first place, since that would be a weird piece of information for Signal to reveal about a user.
  - Cyphase 2y ago
    Apologies for the mistake. I'm running a Signal fork called Molly[0]; the feature I mentioned seems to be unique to that fork, based on a search of the code. However, it shows that the data is being provided to the client by the server, in some way. This is a guess, but it may be because sending clients have to encrypt with a key for each device. Here's the code: https://github.com/mollyim/mollyim-android/blob/26403ab1806ae8512fc28a34fbaba0b16de66aa2/app/src/main/res/values/strings2.xml#L91-L95 https://github.com/mollyim/mollyim-android/blob/26403ab1806a... https://github.com/mollyim/mollyim-android/blob/26403ab1806ae8512fc28a34fbaba0b16de66aa2/app/src/main/java/org/thoughtcrime/securesms/components/settings/conversation/preferences/BioTextPreference.kt#L101-L110 https://github.com/mollyim/mollyim-android/blob/26403ab1806a... [0] https://molly.im/ https://molly.im/ [0] https://github.com/mollyim/mollyim-android https://github.com/mollyim/mollyim-android