top 90 comments

sorted by: hot top controversial new old
[–] 94 points 1 year ago (15 children)

Haha! Do it if the EU does not give up on their Orwellian control!

Wait, I'm in the EU and I use Signal!

  • source
  • hideshow 15 child comments
  • [–] 75 points 1 year ago* (12 children)

    Basically, but what you forget is that Signal is also the standard for every Politician for their group chats because it's secure, so the idea that they might lose their secure, leak-free* form of communication should worry MEPs and other politicians into taking action. Will it? I don't know, politicians are very stupid when it comes to tech it seems.

    * Baring screenshots

  • source
  • parent
  • hideshow 12 child comments
  • [+] 16 points 1 year ago (4 children)
  • [–] 8 points 1 year ago (2 children)

    There's an explicit clause that exempts politicians from the ban. They get privacy because they need it, but nobody else does.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago (1 child)

    politicians are very stupid when it comes to tech it seems.

    They are so so so stupid, about this.

    There will be so much blackmail and ruined political careers if these backdoors get installed.

    A backdoor is never solely used by the folks one might hope would use it.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 15 points 1 year ago (1 child)

    Why are so many European countries doing this? Why the sudden push for chat control and internet restriction laws?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 6 points 1 year ago* (last edited 1 year ago)

    It's understandable from law enforcement perspective that it's important to snoop on actual criminal communications. The EU has pretty reasonable measures and good at cracking down on continental-wide criminal activities. However, can we trust authorities that they won't over reach with the chat control and violate privacy and freedom of speech? Like, come on, nothing good ever came from spying on communications. Catching criminals and/or terrorists is a convenient excuse to spy on dissidents.

    We've seen it happen in America with the PATRIOT Act. People dismissed the opposition to it with "nothing to hide" thought terminating cliche, or accuse you of pedophile or terrorist for not wanting spying on communications. Then twenty years later, Americans have a fascist government who allowed a corporate asshole to steal information from the federal government. And those information will be used for surveillance capitalism. The same will happen to us in the EU if we don't push back hard on this Orwellian desires of politicians.

  • source
  • parent
  • [–] 288 points 1 year ago (44 children)

    Signal CEO Whittaker said that in the worst case scenario, they would work with partners and the community to see if they could find ways to circumvent these rules. Signal also did this when the app was blocked in Russia or Iran. "But ultimately, we would leave the market before we had to comply with dangerous laws like these."

    This is why we need the ability to sideload apps.

  • source
  • hideshow 44 child comments
  • [–] 103 points 1 year ago (19 children)

    That means nothing when the servers stop taking EU traffic. I get your point, but the real solution here is putting a bullet (double tap) in Chat Control, once and for all.

  • source
  • parent
  • hideshow 19 child comments
  • [–] 56 points 1 year ago (2 children)

    putting a bullet (double tap) in Chat Control,

    Yes, please.

    once and for all.

    LOL, no. They'll come back again with some other bullshit to Save the Children!™, it's a never-ending whack-a-mole.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 9 points 1 year ago (11 children)

    That means nothing when the servers stop taking EU traffic

    I don’t use any of these apps, so I’m not quite sure how they work. But couldn’t you just make an app that keeps a local private and public key pair. Then when you send a message (say via regular sms) it includes under the hood your public key. Then the receiver when they reply uses your public key to encrypt the message before sending to you?

    Unless the sms infrastructure is going to attempt to detect and reject encrypted content, this seems like it can be achieved without relying on a server backend.

  • source
  • parent
  • hideshow 11 child comments
  • [–] 7 points 1 year ago (2 children)

    That makes the assumption you want to use your phone number at all. And I'm sure the overhead of encryption would break SMS due to the limits on character counts.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 11 points 1 year ago (3 children)

    That is how the signal protocol works, it's end to end encrypted with the keys only known between the two ends.

    The issue is that servers are needed to relay the connections (they only hold public keys) because your phone doesn't have a static public IP that can reliably be communicated to. The servers are needed to communicate with people as they switch networks constantly throughout the day. And they can block traffic to the relay servers.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 5 points 1 year ago

    It is potentially doable:

    A short message is 140 bytes of gsm7-bit packed characters (I.e. each character is translated to "ascii" format which only take up 7-bit space, which also is packed together forming unharmonic bytes), so we can probably get away with 160 characters per SMS.

    According to crypto.stackexchange, a 2048-bit private key generates a base64 encoded public key of 392 characters.

    That would mean 3 SMSs per person you send your public key to. For a 4096-bit private key, this accounts to 5 SMSs.

    As key exchange only has to be sent once per contact it sounds totally doable.

    After you sent your public key around, you should now be able to receive encrypted short messages from your contacts.

    The output length of a ciphertext depends on the key size according to crypto.stackexchange and rfc8017. This means we have 256 bytes of ciphertext for each 2048-bit key encrypted plaintext message, and 512 bytes for 4096-bit keys. Translated into short messages, it would mean 2 or 4 SMSs for each text message respectively, a 1:2, or 1:4 ratio.

    • NIST recommends abandoning 2048-bit keys by 2030 and use 3072-bit keys (probably a 1:3 ratio)
    • average number of text messages sent per day and subscriber seems to be around 5-6 SMS globally, this excludes WhatsApp and Signal messages which seems to be more popular than SMS in many parts of the world [quotation needed, I just quickly googled it]

    Hope you have a good SMS plan 😉

  • source
  • parent
  • [–] 88 points 1 year ago (5 children)

    I have become convinced by Cory Doctorow's (tech writer and inventor of the term "enshittification") argument that the fact that we're even discussing this in terms of "sideloading" is a massive win for tech companies. We used to just call that "installing software" but now for some reason because it's on a phone it's something completely weird and different that needs a different term. It's completely absurd to me that we as a society have become so accustomed to not being able to control our own devices, to the point of even debating whether or not we should be allowed to install our own software on our own computers "for safety." It should be blatantly obvious that this is all just corporate greed and yet the general public can't or refuses to see it.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 9 points 1 year ago

    There are groups to support:

    And in the UK:

    Some political groups are better than others, but most politicians are clueless.

    The key is to get muggles to understand we are living in Technofeudalism and why being digital serfs is bad. The problem is ineffective competition law and that monopolies are bad. That monopolies and standards are not the same thing. I have no idea how. Most people are just naturally compliant and unquestioning of something seemingly so abstract.

  • source
  • parent
  • [–] 2 points 1 year ago

    In the 80's (I'm that old), many home computers came with the programming manual, and the impetus was to learn to code and run your programs on your own device. Even with Android it's not especially hard (with LLM's even less so than it used to be) to download Android Studio, throw some shit onto the screen, hit build, and run your own helper app or whatever sideloaded installed via usb cable (or wirelessly) on your own device.

    In certain cases (cars, health related hw etc.) I get why it's probably for the best if the user is not supposed to mod their device outside preinstalled sw's preferences/settings. But when it comes to computers (i.e. smartphones, laptops, tablets, tv boxes etc.) I fully agree with Cory here. Such a shame everything must go to shit.

  • source
  • parent
  • [–] 27 points 1 year ago (17 children)

    Most likely the reason, among others, they're fighting tooth & nail to remove side loading too.

  • source
  • parent
  • hideshow 17 child comments
  • [–] 2 points 1 year ago (15 children)
  • [–] 27 points 1 year ago (14 children)
  • [+] -48 points 1 year ago* (last edited 1 year ago) (13 children)

    Google will soon stop you sideloading unverified apps

    unverified

    ie, unsigned, so they are not

    fighting tooth & nail to remove side loading too

    Sideloading is still available: you can sign it yourself or bypass verification with adb as they documented.

    Will Android Debug Bridge (ADB) install work without registration? As a developer, you are free to install apps without verification with ADB.

    If I want to modify or hack some apk and install it on my own device, do I have to verify? Apps installed using ADB won't require verification.

    So, cool misinformation.

  • source
  • parent
  • hideshow 13 child comments
  • [–] 67 points 1 year ago (12 children)

    Bruh, you're trying to sanewash this of all things? Right now I can go to any third-party app store and click install on an app without me nor the developer having to kiss the ring of Google or by extension the regulators (EU with Chat Control) that they are beholden to.

    After this I'll have to fucking install Google's SDK on my computer, manually download application files, and deploy them to my device over USB with CLI commands. I will never ever ever be able to get friends and family access to third-party applications after this change.

    And fuck, man, there's not even a guarantee this solution will last, either. Google promised they would allow on-device sideloading back when they started adding deeper and deeper settings restrictions on enabling sideloaded app support, their word means fuck-all and you know that.

  • source
  • parent
  • hideshow 12 child comments
  • [+] -32 points 1 year ago* (11 children)

    You misidentified your objection. It isn't sideloading removal, which isn't happening. It's developer verification, which affects the sideloading that remains available.

    Just because you don't understand the value of verifying signatures doesn't mean it lacks value.

    I recall the same alarm over secureboot: there, too, we can (load our certificates into secureboot and) sign everything ourselves. This locks down the system from boot-time attacks.

    I will never ever ever be able to get friends and family access to third-party applications after this change.

    Then sign it: problem solved.

    Developer verification should also give them a hard enough time to install trash that fucks their system and steals their information when that trash is unsigned or signed & suspended.

    Even so, it's mentioned only in regard to devices certified for and that ship with Play Protect, which I'm pretty sure can be disabled.

    Google promised they would allow on-device sideloading

    Promise kept.

    their word means fuck-all and you know that

    No, I don't. Developers are always going to need some way to load their unfinished work.

  • source
  • parent
  • hideshow 11 child comments
  • [–] 30 points 1 year ago (9 children)

    That's twice that you've missed the point that everyone else is saying. Read it again:

    without me nor the developer having to kiss the ring of Google or by extension the regulators (EU with Chat Control) that they are beholden to

    Google is irreversibly designating themselves the sole arbiter of what apps can be freely installed in the formerly-open Android ecosystem. It's the same as if they just one day decided that Chromium-based browsers would require sites have a signature from Google and Google alone. I honestly don't give a shit if they did it just on Pixel devices, but they're doing it to the phones of ALL manufacturers by looping it into Play services.

    I just don't understand: why the fuck are you so pussy-whipped by Google that you're stanning their blatant power grabs?

  • source
  • parent
  • hideshow 9 child comments
  • [–] 10 points 1 year ago

    I just don’t understand: why the fuck are you so pussy-whipped by Google that you’re stanning their blatant power grabs?

    Probably works at google or is a fanboy.

  • source
  • parent
  • [+] -13 points 1 year ago* (6 children)

    I don't understand why you can't read: (1) developer verification can be disabled, bypassed, or worked with, (2) you called it sideloading removal, which it isn't.

    You just don't like the extra steps that limit the ease for ignorant users to install software known to be malicious that could have been blocked. I don't like handholding my dumbass folks through preventable IT problems they created.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 11 points 1 year ago

    This does fuck all for "security". It's targeting, mainly, power users and puts just more hoops for developers. This has nothing with security (they should purge malware from Play store first) and everything to do with consolidating power over users.

    It's a blatant power grab and I'm surprised to see this interpreted as anything else. Arguing about semantics just helps Google fuck everyone over.

  • source
  • parent
  • [–] 7 points 1 year ago (1 child)

    So let me buy a goddamn phone that I can install what I want in it. Again, I do not give a shit about any phone manufacturers that want to make a walled garden out of their Android installations. I agree, it's perfect for the grandmas of the world. But Google is forcibly doing this to every goddamn phone, phone manufacturer, and Android enthusiast.

    The only silver lining is that whenever Google decides that unregulated social media services like Lemmy are not family-safe I won't have to listen to your malicious horseshit.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 0 points 1 year ago

    Seems you don't care about grandmas & gen z.

    forcibly doing this to every goddamn phone, phone manufacturer, and Android enthusiast

    They can manage.

    whenever Google decides that unregulated social media services like Lemmy are not family-safe I won’t have to listen to your malicious horseshit

    So casual users can get wrecked, yet I'm malicious? Maybe think of users other than yourself, weigh the potential losses to them by successful attacks, and consider whether OS designers have a legitimate claim in preventing exposure of known threats to casual users while still allowing power users to bypass those checks.

    You're assuming I use an Android app (trash) to get on here, and not a proper workstation or web browser. You're welcome to this "malicious horseshit" for eternity.

  • source
  • parent
  • [–] 5 points 1 year ago* (last edited 1 year ago) (2 children)

    developer verification can be disabled, bypassed, or worked with

    In reality this is useless given the technical capabilities (or access to the technology necessary) of nearly every android user. What percentage of them do you think has the capacity and capability to use ADB?

    you called it sideloading removal, which it isn’t.

    Strictly it ticks the box, however effectively it is sideloading removal. Arguing otherwise honestly makes me think you work for them. It's such obvious marketing bullshit "Oh, we left this tiny window open to tick the box which people can use, but almost certainly not you and even if you are capable, it's a pain in the arse". There are lots of intelligent people in my house. I'm the only one capable of using ADB without enormous effort, making it a deliberately huge barrier and even I'm not going to do it to install a trusted open source app.

    Let's be clear; the only reason they left that little window open was to have people like you say "no, sideloading is still possible" to cover their arses legally and also for actual developers, not because they care about an open ecosystem.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 0 points 1 year ago* (last edited 1 year ago) (1 child)

    What percentage of them do you think has the capacity and capability to use ADB?

    All of them: they can follow procedures, plug a cable, and push buttons if they really want to. Most won't bother: capacity isn't willpower.

    it’s a pain in the arse

    That's the idea: welcome to an effective deterrent.

    even I’m not going to do it to install a trusted open source app

    Good, then it'll deter as designed.

    the only reason

    Nah, the use cases are legitimate:

    • It will actually deter installation of malicious software once it's been identified & flagged that way in their system.
    • It also verifies install packages haven't been tampered (possibly maliciously) from their original releases.

    Malicious software on devices connected to everything including highly sensitive information poses high-cost risks that you & casual users overlook because muh inconvenience 😭. If casual users can't bother with a straightforward procedure as you say, then how prepared are they to handle the real challenges of a successful attack?

    From a security perspective, it makes sense for OS designers to choose to limit exposure to that threat to power users who can be expected to at least have a better idea of what they're getting themselves into.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago* (last edited 1 year ago)

    Google employee confirmed. Absolute trash reasoning verging on trolling it's so ridiculous. Wild that you arguing so vehemently in favour of reduced access to use your hardware the way you want.

    All of them

    Laughable. You've obviously never worked in any kind of customer support role.

    Most people are going to melt at the steps necessary to use adb.

    capacity isn't willpower.

    By capacity I meant access to hardware. There are so many people in poorer countries out there that don't have a laptop, permission to start using one for installing adb on it but also have an android phone.

    welcome to an effective deterrent.

    I don't want an effective deterrent that effectively kills fdroid and the like. That's the whole point. I've favoured android because it's more open. The talking points in favour of it pale in comparison to the loss of freedom.

    If casual users can't bother with a straightforward procedure

    Honestly just jog on. Please. It is not a straightforward procedure and my threat model shouldn't need to include the steps you outline. There are already barriers in place that put off casual users.

    The fact that you want people to stop installing open source apps that they trust is honestly deranged. Deranged.

  • source
  • parent
  • [–] 75 points 1 year ago (2 children)

    I hope more follow, would be funny if "all chat apps have to include a back door" leads to "there are no official chat apps"

  • source
  • hideshow 2 child comments
  • [–] 23 points 1 year ago (4 children)

    If the law is implemented, I would selfhost my own chat server. I don't see this as Signal fault.

    But everybody can`t selfhost. That is a problem I am struggling with.

    I am now sure what I would do about email, I assume it is affected as well?

  • source
  • hideshow 4 child comments
  • [–] 5 points 1 year ago (3 children)

    If the law is implemented I will self host my own signal proxy and distribute patched apps to those in need

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 1 year ago (2 children)

    I looked into signal servers some years ago and found nothing, are you meaning like tunnel things to another country?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 17 points 1 year ago

    I hate this framing. They don't "THREATEN" to leave europe.

    Europe is about to change laws that makes their product illegal.

  • source
  • [–] 14 points 1 year ago (1 child)

    Separate airgapped device running an encryption app. Type text on it, it spits out a ciphertext, then, use internet connected device to scan the ciphertext, OCR*, then send to target receipient, they also use this same airgap encryption device and they OCR, then decrypt using their key.

    *Instead of OCR, you could also use a QR code to have error correction

    Tell me how they can ban this? Anyone using a raspberry pi with a battery and touch display attached into one compact thing, is a criminal?

    What if we just start using One Time Pad? Can they ban that?

    Steganography?

    Like seriously, how do you even stop "criminals" using steganography?

    So, to Big Gov, here's my question: Are you gonna ban talking to other people becuause criminals also talk to other people?

  • source
  • hideshow 1 child comment
  • [–] 15 points 1 year ago

    They don't care about your messages, they don't care about terrorists or pedophiles.

    They do care about the general population, and wants to control it. That's what this is all about. The hard right wants to have effective tools to slam down on dissent when they get in power.

    A game as old as humanity.

    Shameless plug, because I'm trying to do my part ☺️ : Tenfingers sharing

  • source
  • parent
  • [–] 7 points 1 year ago (5 children)

    So now where will Signal go ?

  • source
  • hideshow 5 child comments
  • [–] 7 points 1 year ago (4 children)

    Let's collectively fund an island where we can host Signal, Tor nodes and ThePirateBay in international waters.

  • source
  • parent
  • hideshow 4 child comments
  • [+] -15 points 1 year ago (12 children)

    Where would be the loss with that?

  • source
  • hideshow 12 child comments
  • [–] 15 points 1 year ago (10 children)

    We wouldn't have a simple and secure way of communicating?

    The apple/Facebook alternatives are not good at all.

  • source
  • parent
  • hideshow 10 child comments
  • [–] 2 points 1 year ago* (8 children)

    Simplex, xmpp, deltachat, briar, matrix, even session.

    Anything is better than signal that relies on a centralised proprietary server and requires a phone number.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 12 points 1 year ago* (last edited 1 year ago) (3 children)

    I hate talkingpoints like that. Sure Signal can be critiqued, but it's still the best "mainstream" solution we have. And a lot of people would just stop using secure messanger when signal is gone. Including me because what is simplex or matrix worth for me, when no one I know cares to switch?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 0 points 1 year ago (2 children)

    My personal experience is that if I can convince someone to install signal I can also convince them to install simplex, the process is the same. If I can't then they aren't going to use anything but the popular spyware anyway.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 year ago (1 child)

    I will absolutely try that, but most of the people switched to signal or threema because they already heard about it and could just use it because they already used it for some other contacts (actually this was the most common. They already had an account and the app and just had to use it more) . But I don't think a lot of people would switch to a messanger they never heard about, just for me.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago

    Well, that is fair, also simplex has some serious bugs which I don't mind because I value freedom, security and privacy over reliability, but sometimes the app just stops receiving messages until restarted and I need to message them via other means telling them to restart the app.

  • source
  • parent
  • [–] 3 points 1 year ago (2 children)

    Sure, but tell my family that...

    Has any of those become like easy to install and use? To be fair I haven't checked in some time...

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago

    Simplex is really easy to install and use, unfortunately it's still kinda buggy, specially with public relays, I personally don't mind buggy, I'm willing to make sacrifices for the same of freedom and privacy.

    I just keep a second chat app as a failback so I can send them a message saying "ur simplex broke again, pls restart"

    Xmpp has been stable for decades, tho I guess otr/omemo is hard for family to install, also doesn't support e2ee calls (or rather, it does, but it's complicated). But I haven't used xmpp in a long time.

  • source
  • parent
  • [–] 1 point 1 year ago

    With DeltaChat you don't even need an email address anymore, they provide it for you on the fly. They just ask your name if you (optionally) want to put it.

    Can't be simpler than that tbh.

    If you want a better looking ui, check ArcaneChat for Android. It's 100% compatible with DeltaChat protocol

  • source
  • parent
  • load more comments
    view more: next ›
    27 comments in c/privacy@lemmy.ml view that post
    10 comments in c/privacy@lemmy.dbzer0.com view that post