Comment on Time to get serious with E2E encrypted messaging

Ulrich@feddit.org ⁨1⁩ ⁨year⁩ ago

• fangleone2526@lemmy.world ⁨1⁩ ⁨year⁩ ago

  Signal requires a phone number on setup.

  Also, matrix has bridges, which alone make it worthwhile for me. They, of course, don’t help privacy, but they are so so nice for convenience.

  Matrix is definitely slow though, and a grand majority of the clients are heavy terrible buggy electron apps. There are a few good ones ( nheko and the new beeper clients ), but even they have some rough edges.

  I still use matrix all the time and love it.

  If max privacy was the goal I think simplex looks wonderful. No required info for sign up, no way for them to possibly collect any metadata ( because there are no identifiers sent over internet for anyone at all ), E2EE, and decentralized.

  source

  • Ulrich@feddit.org ⁨1⁩ ⁨year⁩ ago

    Signal requires a phone number on setup.

    It is dumb and annoying and inconvenient but doesn’t affect its use or privacy.

    source

    • fangleone2526@lemmy.world ⁨1⁩ ⁨year⁩ ago

      It affects its use for me definitely. I don’t want to have a phone number. At all.

      source

      • Ulrich@feddit.org ⁨1⁩ ⁨year⁩ ago

        How do you even exist without a phone number. How do you get cellular data? Does the government not require you to have one? Your employer? What about all the services that require one?

        source

        • -> View More Comments
      • Telorand@reddthat.com ⁨1⁩ ⁨year⁩ ago

        I have to wonder if you could use a burner number and just disable it after setting up your username

        source

        • -> View More Comments
    • AnotherDirtyAnglo@lemmy.ca ⁨1⁩ ⁨year⁩ ago

      It creates a cost for spammers. They have to have an account with a Telco, which isn’t free, which in a lot of countries comes with some sort of National ID to register. That’s the reason.

      source

      • Ulrich@feddit.org ⁨1⁩ ⁨year⁩ ago

        VoIP account costs virtually nothing.

        source
      • Anivia@feddit.org ⁨1⁩ ⁨year⁩ ago

        Lol, let me introduce you to smspva.com

        source
  • mac@lemm.ee ⁨1⁩ ⁨year⁩ ago

    Sure but it allows VOIP numbers. I’m using a jmp.chat number with it just fine.

    source

    • fangleone2526@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Good to know!

      Is the phone number required for 2fa codes or anything like that at any point ?

      source

      • mac@lemm.ee ⁨1⁩ ⁨year⁩ ago

        I got an initial verification code and haven’t heard from signal since. Signal doesn’t support totp or SMS 2fa. But has a pin code set along with your password. A new device that is added doesn’t have access to old messages unless you have the correct seed key iirc

        source
  • Subdivide6857@midwest.social ⁨1⁩ ⁨year⁩ ago

    I’ve been trying SimpleX a little this week. It hasn’t been great, unfortunately. It could be an iOS issue, but notifications aren’t coming through. Maybe Android will be better.

    source

    • Petter1@lemm.ee ⁨1⁩ ⁨year⁩ ago

      On iOS, I had best experience using element X, so far

      source

      • Subdivide6857@midwest.social ⁨1⁩ ⁨year⁩ ago

        I absolutely love Element X. Synapse has been low maintenance to self-host, as well. Win-win.

        source
  • homesweethomeMrL@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Signal requires a phone number on setup.

    Not anymore.

    source

    • fangleone2526@lemmy.world ⁨1⁩ ⁨year⁩ ago

      You can choose to share a username instead of a phone number, but they still require the phone number at setup iirc.

      source

      • homesweethomeMrL@lemmy.world ⁨1⁩ ⁨year⁩ ago

        True.

        source

        • -> View More Comments
    • Ulrich@feddit.org ⁨1⁩ ⁨year⁩ ago

      Yes it does

      source

      • homesweethomeMrL@lemmy.world ⁨1⁩ ⁨year⁩ ago

        You’re right. Only for setup though, which is something I guess.

        How to Use Signal WhatsApp Without Phone Number?

        As mentioned above, a valid phone number that can receive calls and text messages is required to create and verify your Signal Account.

        Since, your mobile device does not have a phone number or you do not want to use your phone number, you can use a Landline Phone Number or a Virtual Phone Number as provided by TextNow, Google Voice and others to verify your Signal Account.

        Once the account verification process is completed, you will be able to use Signal on your mobile device, regardless of whether or not it has a phone number or SIM card installed on it.

        source
• mox@lemmy.sdf.org ⁨1⁩ ⁨year⁩ ago

  Signal is easier to use, more private, and faster.

  Unfortunately, it’s also effectively tied to Google services, and (as a centralised service) vulnerable to shutdown or network-level metadata monitoring by anyone with sufficient access, like a government who doesn’t like encrypted messaging.

  source

  • jws_shadotak@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

    You can use Molly, a fork of Signal for android. It offers an alternative for push notifications.

    source

    • mac@lemm.ee ⁨1⁩ ⁨year⁩ ago

      Yep, I run my own mollysocket + ntfy server.

      Essentially, molly socket functions as another device, when it recieves a notif, it pings your specified unified push server, which then queues up a notification for the ntfy app on your device.

      You don’t need to run your own unified push server, and can just use one of the main ones, but I figured I might as well.

      I personally have them hosted on fly.io for free via the legacy hobby plan.

      Now all I need to do is get more of my friends to message me on it 🤣

      source

      • Andromxda@lemmy.dbzer0.com ⁨1⁩ ⁨year⁩ ago

        I personally have them hosted on fly.io for free via the legacy hobby plan

        Here’s the link for anyone who’s interested: github.com/pcrockett/mollysocket-fly

        source

        • -> View More Comments
  • Ulrich@feddit.org ⁨1⁩ ⁨year⁩ ago

    Uhhhh yeah, no literally none of that is true

    source

    • mox@lemmy.sdf.org ⁨1⁩ ⁨year⁩ ago

      It’s been recently added to FDroid.

      No, it has not. A third-party published it in an f-droid compatible repository. That might be convenient for people who happen to trust that third party and manually add it to their F-Droid client, but it is not at all like it being added it to F-Droid.

      You can use NTFY with Molly (which has been on FDroid for some time).

      This does not refute what I wrote. Unless you only communicate with people who get their Signal app from some non-Google source and they all rig up alternative push notification channels, your conversations are still tied to Google. Perhaps you have so few contacts that you could achieve that, but approximately nobody else is in that position.

      network-level metadata monitoring by anyone with sufficient access/influence at Signal or their data center provider (such as a government who doesn’t like encrypted messaging).
      

      This one is just a straight-up lie. Everything on the server is encrypted and no one has the keys except the participants.

      Encryption doesn’t network traffic invisible. Signal’s centralised design means there is a single point where that traffic can be monitored and traced to reveal which endpoints are talking to each other, and where, and when.

      What I write is not a lie, which you would know if you actually understood these issues.

      Please stop making baseless accusations. You are being very rude.

      source

      • fushuan@lemm.ee ⁨1⁩ ⁨year⁩ ago

        Their github releases have the apk available so you can manually download it and install it or use obtainium.

        github.com/signalapp/Signal-Android/releases

        source

        • -> View More Comments
      • Andromxda@lemmy.dbzer0.com ⁨1⁩ ⁨year⁩ ago

        your conversations are still tied to Google

        That’s simply false. Signal Notifications never include the content of the message or any metadata, no matter if they’re sent over FCM, APN, WebSockets or UnifiedPush (via mollysocket). That wouldn’t even be possible, since the Signal server sending out the notification doesn’t even have the key to decrypt the message. Only the users involved in the conversation have the keys, that’s how end-to-end encryption works. Signal simply sends an empty message via FCM (or any other push system), and the Signal app on your device then receives and decrypts the encrypted message and shows you a preview of the message content as a notification on your operating system.

        And every build of the Signal client for WhatsApp also supports WebSockets as a fallback push notification system, in case Play services aren’t installed or can’t be reached. The only reason why FCM is used by default is that it saves some battery, because it only maintains one background network connection for all apps, instead of each app handling notifications themselves.

        source

        • -> View More Comments
      • EngineerGaming@feddit.nl ⁨1⁩ ⁨year⁩ ago

        I would be more concerned about how phone-oriented it is. A phone’s default OS is such spyware that I am not sure just what is safe from from being uploaded. And even if the person wants a more private alternative, most phones have locked bootloaders. On the other hand, Linux would run on damn near anything… But using Signal on it without a smartphone is very annoying. No way my mom would understand an Android VM or a command-line client, because the desktop client isn’t feature-full and doesn’t even allow registration.

        source
      • Ulrich@feddit.org ⁨1⁩ ⁨year⁩ ago

        or every one of them uses Signal exclusively on iOS, your conversations are still tied to Google

        Just because someone else uses Google on the other end does not make it dependent on Google on your end.

        you are being very rude.

        I’m being rude because you’re spreading FUD and misinformation and actively making people unsafe. If you have evidence to prove that Signal has access to all of that information, feel free to share with the class. Otherwise, shut it.

        If Signal had access to any of that information they would have been legally compelled to provide it when they were served with warrants but they did not, which proves that you’re incorrect.

        source