4 ms·

For this reason, I never even considered using Telegram. If I were an unethical intelligence service like a Russian one, I would create a messenger app (and/or

For this reason, I never even considered using Telegram. If I were an unethical intelligence service like a Russian one, I would create a messenger app (and/or social network). Based outside my jurisdiction would add to plausible deniability. On another note: I wonder how many of those VPN services are actually fronts of intelligence services.

sam_lowry_ 1y ago
Signal clearly looks like a front shop to collect metadata for US intelligence services. Their reliance on phone numbers for sign in, their release strategy, their attitude towards unofficial clients, their marketing of e2e encryption... all fits.
- fsflover 1y ago
  A few relevant links: https://news.ycombinator.com/item?id=39445976 https://news.ycombinator.com/item?id=39445976 https://news.ycombinator.com/item?id=29888228 https://news.ycombinator.com/item?id=29888228 https://news.ycombinator.com/item?id=42788647 https://news.ycombinator.com/item?id=42788647 Also, Signal forces you to use Android or iOS while knowing that "Apple and Google confirm governments spy on users through push notifications ", https://news.ycombinator.com/item?id=38555810 https://news.ycombinator.com/item?id=38555810 Matrix is the actual solution.
  - neobrain 1y ago
    Your links are a bunch of user comments? The push notification payloads don't contain message/sender data. Signal also runs fine without Google services, which avoids any potential problem entirely.
    - fsflover 1y ago
      > Your links are a bunch of user comments? They themselves contain the actual links and also relevant discussions. One more link: https://github.com/signalapp/Signal-Android/issues/13842 https://github.com/signalapp/Signal-Android/issues/13842 > The push notification payloads don't contain message/sender data. The other metadata may be important too. > Signal also runs fine without Google services, which avoids any potential problem entirely. Not everybody is able to avoid Google services on their phone. I can't run it on a desktop (or GNU/Linux phone) without a connection to an Android phone.
    - hammyhavoc 1y ago
      SIM hijacking is a thing. Telcos also control phone numbers. I have never understood the unflinching attitude towards Signal relying on phone numbers.
- paulryanrogers 1y ago
  Except Signal's client is open source with reproducible builds that have been audited. Their crypto is open, based on standard primitives, and has also been audited. It's also true E2E encryption with alerts on key changes. The only weakness clear to me is the US could force them to release a compromised client. But then auditors would probably notice within weeks, or even days, and their reputation would be ruined forever.
  - fsflover 1y ago
    https://github.com/signalapp/Signal-Android/issues/13842 https://github.com/signalapp/Signal-Android/issues/13842
    - fsflover 1y ago
      The corresponding submission: https://news.ycombinator.com/item?id=44240318 https://news.ycombinator.com/item?id=44240318
    - paulryanrogers 1y ago
      That's a shame. Still on the whole Signal seems far ahead of Telegram. Hopefully users who need the extra security will be taught to enable that setting.
      - fsflover 1y ago
        But is it far ahead of Matrix?
        paulryanrogers 1y ago
        Does Matrix default to E2E yet? With forward secrecy? If so great! More is better
        Arathorn 1y ago
        yup, for the last 5 years: https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-end-encryption-by-default-is-here https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-...
- Thorrez 1y ago
  Do any of the founders or board members of the Signal Foundation show any indication of supporting that?
- leotravis10 1y ago
  Yep. Related discussion: "Why Not Signal?" https://news.ycombinator.com/item?id=28544735 https://news.ycombinator.com/item?id=28544735 https://news.ycombinator.com/item?id=30872361 https://news.ycombinator.com/item?id=30872361
4gotunameagain 1y ago
> an unethical intelligence service As opposed to which ethical intelligence service that you have in mind ? This is the bread and butter of "intelligence". Spying. Both enemies, allies & the populace.
jaoane 1y ago
Are there ethical intelligence services? :P
dongcarl 1y ago
> On another note: I wonder how many of those VPN services are actually fronts of intelligence services. This is why we need more [MPRs](https://www.privacyguides.org/articles/2024/11/17/where-are-all-the-mprs/#a-solution-multi-party-relays https://www.privacyguides.org/articles/2024/11/17/where-are-...)

sam_lowry_ 1y ago

Signal clearly looks like a front shop to collect metadata for US intelligence services. Their reliance on phone numbers for sign in, their release strategy, their attitude towards unofficial clients, their marketing of e2e encryption... all fits.

fsflover 1y ago
A few relevant links: https://news.ycombinator.com/item?id=39445976 https://news.ycombinator.com/item?id=39445976 https://news.ycombinator.com/item?id=29888228 https://news.ycombinator.com/item?id=29888228 https://news.ycombinator.com/item?id=42788647 https://news.ycombinator.com/item?id=42788647 Also, Signal forces you to use Android or iOS while knowing that "Apple and Google confirm governments spy on users through push notifications ", https://news.ycombinator.com/item?id=38555810 https://news.ycombinator.com/item?id=38555810 Matrix is the actual solution.
- neobrain 1y ago
  Your links are a bunch of user comments? The push notification payloads don't contain message/sender data. Signal also runs fine without Google services, which avoids any potential problem entirely.
  - fsflover 1y ago
    > Your links are a bunch of user comments? They themselves contain the actual links and also relevant discussions. One more link: https://github.com/signalapp/Signal-Android/issues/13842 https://github.com/signalapp/Signal-Android/issues/13842 > The push notification payloads don't contain message/sender data. The other metadata may be important too. > Signal also runs fine without Google services, which avoids any potential problem entirely. Not everybody is able to avoid Google services on their phone. I can't run it on a desktop (or GNU/Linux phone) without a connection to an Android phone.
  - hammyhavoc 1y ago
    SIM hijacking is a thing. Telcos also control phone numbers. I have never understood the unflinching attitude towards Signal relying on phone numbers.
paulryanrogers 1y ago
Except Signal's client is open source with reproducible builds that have been audited. Their crypto is open, based on standard primitives, and has also been audited. It's also true E2E encryption with alerts on key changes. The only weakness clear to me is the US could force them to release a compromised client. But then auditors would probably notice within weeks, or even days, and their reputation would be ruined forever.
- fsflover 1y ago
  https://github.com/signalapp/Signal-Android/issues/13842 https://github.com/signalapp/Signal-Android/issues/13842
  - fsflover 1y ago
    The corresponding submission: https://news.ycombinator.com/item?id=44240318 https://news.ycombinator.com/item?id=44240318
  - paulryanrogers 1y ago
    That's a shame. Still on the whole Signal seems far ahead of Telegram. Hopefully users who need the extra security will be taught to enable that setting.
    - fsflover 1y ago
      But is it far ahead of Matrix?
      - paulryanrogers 1y ago
        Does Matrix default to E2E yet? With forward secrecy? If so great! More is better
        Arathorn 1y ago
        yup, for the last 5 years: https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-end-encryption-by-default-is-here https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-...
Thorrez 1y ago
Do any of the founders or board members of the Signal Foundation show any indication of supporting that?
leotravis10 1y ago
Yep. Related discussion: "Why Not Signal?" https://news.ycombinator.com/item?id=28544735 https://news.ycombinator.com/item?id=28544735 https://news.ycombinator.com/item?id=30872361 https://news.ycombinator.com/item?id=30872361

4gotunameagain 1y ago

> an unethical intelligence service As opposed to which ethical intelligence service that you have in mind ? This is the bread and butter of "intelligence". Spying. Both enemies, allies & the populace.

jaoane 1y ago

Are there ethical intelligence services? :P

dongcarl 1y ago

> On another note: I wonder how many of those VPN services are actually fronts of intelligence services. This is why we need more [MPRs](https://www.privacyguides.org/articles/2024/11/17/where-are-all-the-mprs/#a-solution-multi-party-relays https://www.privacyguides.org/articles/2024/11/17/where-are-...)