▲ 141 ▼ Signal Protocol and Post-Quantum Ratchets (signal.org) submitted 1 year ago by Andromxda@lemmy.dbzer0.com to c/technology@lemmy.world 18 comments fedilink hide all child comments
[+] Korkki@lemmy.ml -31 points 1 year ago (11 children) I'm still convinced that Signal is an NSA honeypot. permalink fedilink source hideshow 11 child comments replies: [–] AlmightyDoorman@kbin.earth 24 points 1 year ago (6 children) What why? The e2e protocol is open source as is the client. How would that even work? permalink fedilink source parent hideshow 6 child comments replies: [+] Korkki@lemmy.ml -15 points 1 year ago* (5 children) Central servers basically. Funded by ex-meta people and endorsements from western governments (general "if it's popular then it's compromised" suspicion). Also it requires your phone number gathers things like contact info from the phone, even if one assumes the messages are secure. basically could be seen as relinquishing a list of potential associates... I don't think Signal is unsecure, in a sense. it's just secure for nobodies or anybody who want to use it in non western countries against governments hostile to the west or being designated to regime change targets. I however don't think it's much more secure than whatsapp for an high profile pro-Palestine activist for example. It's a privacy tool for some and honeypot for others depending how they relate to US security state and western governments. Whats better for an intelligence agencies than to have a control of the globally used privacy communication tool. permalink fedilink source parent hideshow 5 child comments replies: [–] Passerby6497@lemmy.world 30 points 1 year ago* (2 children) Tl;Dr - you have nothing other than baseless suspicion of an open source protocol that's been reviewed by tons of security people and is widely considered secure by people who actually know what they're talking about Also, Whatsapp literally runs on the signal protocol, but Meta, so comparing them is stupid considering meta is involved so your privacy is assumed bad/not existent. permalink fedilink source parent hideshow 2 child comments replies: [+] Korkki@lemmy.ml -9 points 1 year ago (1 child) Of course I don't have any concrete proof. If there was concrete proof we shouldn't be having this conversion. My main issue is that it's centralized and that's a huge black box. People obsess with this "but it's protocol open source" like headless chickens when that's not the issue. Open source is like the step one when it comes to private and secure messaging. It just comes down to if you trust the devs and those doing the hosting. When it's central all of that thrust rests on that one group and their hosting service not fucking you over even if they can or can not read the encrypted messages themselves. I'm not concerned signal keeping people's dickpicks private here in that that even whatsapp is as good as any. I see I made the mistake of coming to an obvious fangirl meeting to have an serious discussion about security merits. permalink fedilink source parent hideshow 1 child comment replies: [–] trailee@sh.itjust.works 13 points 1 year ago* Of course I don’t have any concrete proof. serious discussion about security merits. Those two don’t go together, bud. It just comes down to if you trust the devs and those doing the hosting. Ok so let’s talk about “ex-Meta” Brian Acton walking away from nearly a billion dollars due to his moral stance on private communication. Or Meredith Whittaker’s determination to pioneer a tech business model other than surveillance capitalism. You’re absolutely right that it comes down to trusting the devs, which is why WhatsApp is a nonstarter even though it uses Signal’s E2EE. Europe’s chat control proposal doesn’t need to break E2EE, it just needs to demand that the messaging client app scans all content locally before encrypting and has a way to tattle. Meta could also be scanning everything you type into WhatsApp and feeding it into a local AI advertising interests summarizer or whatever else, and still claim E2EE. The open source client is far more important than an open source server when there’s proper E2EE. permalink fedilink source parent [–] AlmightyDoorman@kbin.earth 3 points 1 year ago Contact info gets hashed in a clever way which doesn't send your info (although i guess phone number hashes could be brute forced?) Meta data is also not available. They have no way to know who you are talking to. The only info they have is that you logged ij with a ip at a time. I believe they can't even reliable track how many messages you send. Even with a compromised server most of the magic happens in the open source client side app so that they can't gather very much. I understand your concerns about popular centralized services but i really believe that they are unfound with signal. permalink fedilink source parent [–] Sanguine@lemmy.dbzer0.com 0 points 1 year ago ????????? permalink fedilink source parent [–] Dreaming_Novaling@lemmy.zip 11 points 1 year ago Considering Signal has been subpoenaed several times and proven in court the only thing they can give the feds is: Do you have an account with Signal? (Registered Phone #) When did you make the account? When did you last connect to the service? I don't think it'd be in their best interest to lie to the feds 6 times. You can quite literally read the subpoena for yourself, such as the most recent one in August 2024, which is only 2 pages long. permalink fedilink source parent [–] black_flag@lemmy.dbzer0.com 3 points 1 year ago (2 children) It's actually way simpler than that. It was funded by the CIA for a long time because it was used to support insurgencies that the CIA was into. They pulled that a while back because Americans were getting into it, hence all the calls for donations in the past several years. Too bad I forgot where I heard this. May not be true, idk, who knows these days. But it makes sense. permalink fedilink source parent hideshow 2 child comments replies: [–] 4am@lemmy.zip 2 points 1 year ago Are you thinking of Tor? permalink fedilink source parent [–] Korkki@lemmy.ml 2 points 1 year ago Yeah there was some Radio Free Asia money connection with the open whisper system that now is Signal. permalink fedilink source parent
[–] AlmightyDoorman@kbin.earth 24 points 1 year ago (6 children) What why? The e2e protocol is open source as is the client. How would that even work? permalink fedilink source parent hideshow 6 child comments replies: [+] Korkki@lemmy.ml -15 points 1 year ago* (5 children) Central servers basically. Funded by ex-meta people and endorsements from western governments (general "if it's popular then it's compromised" suspicion). Also it requires your phone number gathers things like contact info from the phone, even if one assumes the messages are secure. basically could be seen as relinquishing a list of potential associates... I don't think Signal is unsecure, in a sense. it's just secure for nobodies or anybody who want to use it in non western countries against governments hostile to the west or being designated to regime change targets. I however don't think it's much more secure than whatsapp for an high profile pro-Palestine activist for example. It's a privacy tool for some and honeypot for others depending how they relate to US security state and western governments. Whats better for an intelligence agencies than to have a control of the globally used privacy communication tool. permalink fedilink source parent hideshow 5 child comments replies: [–] Passerby6497@lemmy.world 30 points 1 year ago* (2 children) Tl;Dr - you have nothing other than baseless suspicion of an open source protocol that's been reviewed by tons of security people and is widely considered secure by people who actually know what they're talking about Also, Whatsapp literally runs on the signal protocol, but Meta, so comparing them is stupid considering meta is involved so your privacy is assumed bad/not existent. permalink fedilink source parent hideshow 2 child comments replies: [+] Korkki@lemmy.ml -9 points 1 year ago (1 child) Of course I don't have any concrete proof. If there was concrete proof we shouldn't be having this conversion. My main issue is that it's centralized and that's a huge black box. People obsess with this "but it's protocol open source" like headless chickens when that's not the issue. Open source is like the step one when it comes to private and secure messaging. It just comes down to if you trust the devs and those doing the hosting. When it's central all of that thrust rests on that one group and their hosting service not fucking you over even if they can or can not read the encrypted messages themselves. I'm not concerned signal keeping people's dickpicks private here in that that even whatsapp is as good as any. I see I made the mistake of coming to an obvious fangirl meeting to have an serious discussion about security merits. permalink fedilink source parent hideshow 1 child comment replies: [–] trailee@sh.itjust.works 13 points 1 year ago* Of course I don’t have any concrete proof. serious discussion about security merits. Those two don’t go together, bud. It just comes down to if you trust the devs and those doing the hosting. Ok so let’s talk about “ex-Meta” Brian Acton walking away from nearly a billion dollars due to his moral stance on private communication. Or Meredith Whittaker’s determination to pioneer a tech business model other than surveillance capitalism. You’re absolutely right that it comes down to trusting the devs, which is why WhatsApp is a nonstarter even though it uses Signal’s E2EE. Europe’s chat control proposal doesn’t need to break E2EE, it just needs to demand that the messaging client app scans all content locally before encrypting and has a way to tattle. Meta could also be scanning everything you type into WhatsApp and feeding it into a local AI advertising interests summarizer or whatever else, and still claim E2EE. The open source client is far more important than an open source server when there’s proper E2EE. permalink fedilink source parent [–] AlmightyDoorman@kbin.earth 3 points 1 year ago Contact info gets hashed in a clever way which doesn't send your info (although i guess phone number hashes could be brute forced?) Meta data is also not available. They have no way to know who you are talking to. The only info they have is that you logged ij with a ip at a time. I believe they can't even reliable track how many messages you send. Even with a compromised server most of the magic happens in the open source client side app so that they can't gather very much. I understand your concerns about popular centralized services but i really believe that they are unfound with signal. permalink fedilink source parent [–] Sanguine@lemmy.dbzer0.com 0 points 1 year ago ????????? permalink fedilink source parent
[+] Korkki@lemmy.ml -15 points 1 year ago* (5 children) Central servers basically. Funded by ex-meta people and endorsements from western governments (general "if it's popular then it's compromised" suspicion). Also it requires your phone number gathers things like contact info from the phone, even if one assumes the messages are secure. basically could be seen as relinquishing a list of potential associates... I don't think Signal is unsecure, in a sense. it's just secure for nobodies or anybody who want to use it in non western countries against governments hostile to the west or being designated to regime change targets. I however don't think it's much more secure than whatsapp for an high profile pro-Palestine activist for example. It's a privacy tool for some and honeypot for others depending how they relate to US security state and western governments. Whats better for an intelligence agencies than to have a control of the globally used privacy communication tool. permalink fedilink source parent hideshow 5 child comments replies: [–] Passerby6497@lemmy.world 30 points 1 year ago* (2 children) Tl;Dr - you have nothing other than baseless suspicion of an open source protocol that's been reviewed by tons of security people and is widely considered secure by people who actually know what they're talking about Also, Whatsapp literally runs on the signal protocol, but Meta, so comparing them is stupid considering meta is involved so your privacy is assumed bad/not existent. permalink fedilink source parent hideshow 2 child comments replies: [+] Korkki@lemmy.ml -9 points 1 year ago (1 child) Of course I don't have any concrete proof. If there was concrete proof we shouldn't be having this conversion. My main issue is that it's centralized and that's a huge black box. People obsess with this "but it's protocol open source" like headless chickens when that's not the issue. Open source is like the step one when it comes to private and secure messaging. It just comes down to if you trust the devs and those doing the hosting. When it's central all of that thrust rests on that one group and their hosting service not fucking you over even if they can or can not read the encrypted messages themselves. I'm not concerned signal keeping people's dickpicks private here in that that even whatsapp is as good as any. I see I made the mistake of coming to an obvious fangirl meeting to have an serious discussion about security merits. permalink fedilink source parent hideshow 1 child comment replies: [–] trailee@sh.itjust.works 13 points 1 year ago* Of course I don’t have any concrete proof. serious discussion about security merits. Those two don’t go together, bud. It just comes down to if you trust the devs and those doing the hosting. Ok so let’s talk about “ex-Meta” Brian Acton walking away from nearly a billion dollars due to his moral stance on private communication. Or Meredith Whittaker’s determination to pioneer a tech business model other than surveillance capitalism. You’re absolutely right that it comes down to trusting the devs, which is why WhatsApp is a nonstarter even though it uses Signal’s E2EE. Europe’s chat control proposal doesn’t need to break E2EE, it just needs to demand that the messaging client app scans all content locally before encrypting and has a way to tattle. Meta could also be scanning everything you type into WhatsApp and feeding it into a local AI advertising interests summarizer or whatever else, and still claim E2EE. The open source client is far more important than an open source server when there’s proper E2EE. permalink fedilink source parent [–] AlmightyDoorman@kbin.earth 3 points 1 year ago Contact info gets hashed in a clever way which doesn't send your info (although i guess phone number hashes could be brute forced?) Meta data is also not available. They have no way to know who you are talking to. The only info they have is that you logged ij with a ip at a time. I believe they can't even reliable track how many messages you send. Even with a compromised server most of the magic happens in the open source client side app so that they can't gather very much. I understand your concerns about popular centralized services but i really believe that they are unfound with signal. permalink fedilink source parent [–] Sanguine@lemmy.dbzer0.com 0 points 1 year ago ????????? permalink fedilink source parent
[–] Passerby6497@lemmy.world 30 points 1 year ago* (2 children) Tl;Dr - you have nothing other than baseless suspicion of an open source protocol that's been reviewed by tons of security people and is widely considered secure by people who actually know what they're talking about Also, Whatsapp literally runs on the signal protocol, but Meta, so comparing them is stupid considering meta is involved so your privacy is assumed bad/not existent. permalink fedilink source parent hideshow 2 child comments replies: [+] Korkki@lemmy.ml -9 points 1 year ago (1 child) Of course I don't have any concrete proof. If there was concrete proof we shouldn't be having this conversion. My main issue is that it's centralized and that's a huge black box. People obsess with this "but it's protocol open source" like headless chickens when that's not the issue. Open source is like the step one when it comes to private and secure messaging. It just comes down to if you trust the devs and those doing the hosting. When it's central all of that thrust rests on that one group and their hosting service not fucking you over even if they can or can not read the encrypted messages themselves. I'm not concerned signal keeping people's dickpicks private here in that that even whatsapp is as good as any. I see I made the mistake of coming to an obvious fangirl meeting to have an serious discussion about security merits. permalink fedilink source parent hideshow 1 child comment replies: [–] trailee@sh.itjust.works 13 points 1 year ago* Of course I don’t have any concrete proof. serious discussion about security merits. Those two don’t go together, bud. It just comes down to if you trust the devs and those doing the hosting. Ok so let’s talk about “ex-Meta” Brian Acton walking away from nearly a billion dollars due to his moral stance on private communication. Or Meredith Whittaker’s determination to pioneer a tech business model other than surveillance capitalism. You’re absolutely right that it comes down to trusting the devs, which is why WhatsApp is a nonstarter even though it uses Signal’s E2EE. Europe’s chat control proposal doesn’t need to break E2EE, it just needs to demand that the messaging client app scans all content locally before encrypting and has a way to tattle. Meta could also be scanning everything you type into WhatsApp and feeding it into a local AI advertising interests summarizer or whatever else, and still claim E2EE. The open source client is far more important than an open source server when there’s proper E2EE. permalink fedilink source parent
[+] Korkki@lemmy.ml -9 points 1 year ago (1 child) Of course I don't have any concrete proof. If there was concrete proof we shouldn't be having this conversion. My main issue is that it's centralized and that's a huge black box. People obsess with this "but it's protocol open source" like headless chickens when that's not the issue. Open source is like the step one when it comes to private and secure messaging. It just comes down to if you trust the devs and those doing the hosting. When it's central all of that thrust rests on that one group and their hosting service not fucking you over even if they can or can not read the encrypted messages themselves. I'm not concerned signal keeping people's dickpicks private here in that that even whatsapp is as good as any. I see I made the mistake of coming to an obvious fangirl meeting to have an serious discussion about security merits. permalink fedilink source parent hideshow 1 child comment replies: [–] trailee@sh.itjust.works 13 points 1 year ago* Of course I don’t have any concrete proof. serious discussion about security merits. Those two don’t go together, bud. It just comes down to if you trust the devs and those doing the hosting. Ok so let’s talk about “ex-Meta” Brian Acton walking away from nearly a billion dollars due to his moral stance on private communication. Or Meredith Whittaker’s determination to pioneer a tech business model other than surveillance capitalism. You’re absolutely right that it comes down to trusting the devs, which is why WhatsApp is a nonstarter even though it uses Signal’s E2EE. Europe’s chat control proposal doesn’t need to break E2EE, it just needs to demand that the messaging client app scans all content locally before encrypting and has a way to tattle. Meta could also be scanning everything you type into WhatsApp and feeding it into a local AI advertising interests summarizer or whatever else, and still claim E2EE. The open source client is far more important than an open source server when there’s proper E2EE. permalink fedilink source parent
[–] trailee@sh.itjust.works 13 points 1 year ago* Of course I don’t have any concrete proof. serious discussion about security merits. Those two don’t go together, bud. It just comes down to if you trust the devs and those doing the hosting. Ok so let’s talk about “ex-Meta” Brian Acton walking away from nearly a billion dollars due to his moral stance on private communication. Or Meredith Whittaker’s determination to pioneer a tech business model other than surveillance capitalism. You’re absolutely right that it comes down to trusting the devs, which is why WhatsApp is a nonstarter even though it uses Signal’s E2EE. Europe’s chat control proposal doesn’t need to break E2EE, it just needs to demand that the messaging client app scans all content locally before encrypting and has a way to tattle. Meta could also be scanning everything you type into WhatsApp and feeding it into a local AI advertising interests summarizer or whatever else, and still claim E2EE. The open source client is far more important than an open source server when there’s proper E2EE. permalink fedilink source parent
[–] AlmightyDoorman@kbin.earth 3 points 1 year ago Contact info gets hashed in a clever way which doesn't send your info (although i guess phone number hashes could be brute forced?) Meta data is also not available. They have no way to know who you are talking to. The only info they have is that you logged ij with a ip at a time. I believe they can't even reliable track how many messages you send. Even with a compromised server most of the magic happens in the open source client side app so that they can't gather very much. I understand your concerns about popular centralized services but i really believe that they are unfound with signal. permalink fedilink source parent
[–] Dreaming_Novaling@lemmy.zip 11 points 1 year ago Considering Signal has been subpoenaed several times and proven in court the only thing they can give the feds is: Do you have an account with Signal? (Registered Phone #) When did you make the account? When did you last connect to the service? I don't think it'd be in their best interest to lie to the feds 6 times. You can quite literally read the subpoena for yourself, such as the most recent one in August 2024, which is only 2 pages long. permalink fedilink source parent
[–] black_flag@lemmy.dbzer0.com 3 points 1 year ago (2 children) It's actually way simpler than that. It was funded by the CIA for a long time because it was used to support insurgencies that the CIA was into. They pulled that a while back because Americans were getting into it, hence all the calls for donations in the past several years. Too bad I forgot where I heard this. May not be true, idk, who knows these days. But it makes sense. permalink fedilink source parent hideshow 2 child comments replies: [–] 4am@lemmy.zip 2 points 1 year ago Are you thinking of Tor? permalink fedilink source parent [–] Korkki@lemmy.ml 2 points 1 year ago Yeah there was some Radio Free Asia money connection with the open whisper system that now is Signal. permalink fedilink source parent
[–] Korkki@lemmy.ml 2 points 1 year ago Yeah there was some Radio Free Asia money connection with the open whisper system that now is Signal. permalink fedilink source parent