Things are heating up. Millions of people are taking to the streets against Trump's rising authoritarianism. Communities around the US are organizing to defend against ICE raids, to protest Israeli genocide, for mutual aid, and for other forms of fighting fascism. Signal can help people safely organize in all of these contexts.

all 2 comments

sorted by: hot top controversial new old
[–] 5 points 1 year ago

use signal to safely organize, but remember to faraday cage your phone before you leave. no proof that you were there.

  • source
  • [–] 3 points 1 year ago

    What if a gestapo officer is undercover? How to trust members of a protest?

  • source
  • 9 comments in c/inperson@slrpnk.net view that post
    [–] 2 points 1 year ago (1 child)

    Why is Signal not good enough any more?

  • source
  • hideshow 1 child comment
  • [–] 2 points 1 year ago* (6 children)

    When it comes to encrypted messengers there is no better option. Most cannot hold a candle to Signal's encryption.

    Edit: Nor their security and transparency.

  • source
  • hideshow 6 child comments
  • [–] [S] 3 points 1 year ago (5 children)

    XMPP implements the exact same encryption method as Signal.

    The problem is not the encryption, but everything around it. Signal has certain trade-offs due to its centralized nature (that are made significantly worse by being under US jurisdiction), and XMPP has other tradeoffs due to its decentralized/federated nature.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 3 points 1 year ago* (4 children)

    We disagree it's exactly the same as it's not on by default for everything and it has been slightly weaker in previous versions of omemo.

    Also most XMPP clients do not keep up to date with the latest version of omemo, sadly.

    Also, yes, XMPP is a pain to use, especially when it comes to omemo, there is no easy way to verify, as comparing a long string of numbers is not easy or accessible.

    I doubt many servers have a transparency report, nor can they fight court orders, I would imagine.

    Edit: Trying to join XMPP groups with encryption can pretty much be forgotten too, as comparing the verifications strings for everybody in that group, especially in big groups, would take far too long.

  • source
  • parent
  • hideshow 4 child comments
  • [–] [S] 2 points 1 year ago* (last edited 1 year ago) (3 children)

    The latest version of that encryption adds features that are beyond what Signal does. It would be indeed nice to have in more clients, but this is not an disadvantage over Signal at all.

    And there is a method to cross-sign keys that makes verification quite easy, but it comes with other trade-offs.

    Of course if you have many servers there will be a variety of different ones. As I said there are trade-offs. Still better though than having only one single option that is under one of the worst possible jurisdictions.

    Edit: you don't need to do that, there is TOFU for that, and that is entirely sufficient for larger groups where trust is necessarily limited anyways.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 1 year ago (2 children)

    The latest version of that encryption adds features that are beyond what Signal does.

    Do you have a link that explains them in an easy to understand way as I'm very interested in what those are.

    And there is a method to cross-sign keys that makes verification quite easy, but it comes with other trade-offs.

    What are the trade-offs?

    Also, would be nice to have that in all clients.

    Of course if you have many servers there will be a variety of different ones. As I said there are trade-offs. Still better though than having only one single option that is under one of the worst possible jurisdictions.

    I'm still not jurisdiction matters if the encryption is good enough, but maybe. Do you have any recommendations for good servers?

    Edit: you don’t need to do that, there is TOFU for that, and that is entirely sufficient for larger groups where trust is necessarily limited anyways.

    I'm not sure if TOFU is in all clients, but yeah, I'm aware of it, still don't fully trust TOFU, but it's good enough, I suppose. Fair about big groups, I tend not to like those anyway, so I guess it doesn't matter.

    I think the only thing that XMPP is missing, like similar projects is easy to use, well encrypted group calls, or maybe even well encrypted one-to-one calls, I could be incorrect about that though.

  • source
  • parent
  • hideshow 2 child comments
  • [–] [S] 2 points 1 year ago (1 child)

    Omemo >8.x has some encapsulation of metadata. I am not aware of an easy article about it though. Arguebly this is adding something similar to what Signal partially achives with work-arounds only possible due to their centralized infrastructure and single app only architecture, but doing that in the encryption layer is ultimatly the better approach.

    Cross-signing of keys ultimatly outsources trust to someone else. From a security perspective having to manually verify each key yourself is the best way. Cross-signing is a bit controversial in xmpp developer circles as a result, because many think it adds a lot of internal complexity while being only marginally more secure than TOFU.

    I don't think I can give you any recommendations for good servers, as it is very context specific. Jurisdiction is IMHO among the most important issues, because even if your encryption is water-tight it doesn't help you much if the provider can be coerced into tracking you or can be easily shut down and replaced with a honeypot.

    As for calls: the popular xmpp mobile apps do have well encrypted peer to peer calls. Currently most are limited to 1:1 calls, but some others are experimenting with small group calls as well (currently only Dino, Movim and Libervia support these).

  • source
  • parent
  • hideshow 1 child comment
  • 7 comments in c/privacy@lemmy.dbzer0.com view that post
    [–] 13 points 1 year ago

    Also beware that the target entry is always people. Any group you don't know extremely well is going to "leak" and so it's best, in general, whenever it involves electronics, to not do things you wouldn't want to be found out doing.

  • source
  • [–] 3 points 1 year ago

    Some users are mentioning SimpleX, which has some very good features, but for activism I'd really suggest Briar. Just scan each other's QR codes to add all the needed contacts with no real names and create a mesh network through WiFi or Bluetooth connections between devices (no internet needed). If everyone is still bent on using Signal, whoever owns an Android phone should at least download the .apk from Molly.im. This version of the app is better suited for this.

  • source
  • [+] 5 points 1 year ago (4 children)
  • [–] 7 points 1 year ago (3 children)

    Very insecure. Vulnerable to MITM, jamming, etc.

  • source
  • parent
  • hideshow 3 child comments