Comment on Signal Protocol and Post-Quantum Ratchets
Korkki@lemmy.ml 3 weeks ago
I’m still convinced that Signal is an NSA honeypot.
Considering Signal has been subpoenaed several times and proven in court the only thing they can give the feds is:
I don’t think it’d be in their best interest to lie to the feds 6 times. You can quite literally read the subpoena for yourself, such as the most recent one in August 2024, which is only 2 pages long.
It’s actually way simpler than that. It was funded by the CIA for a long time because it was used to support insurgencies that the CIA was into. They pulled that a while back because Americans were getting into it, hence all the calls for donations in the past several years.
Too bad I forgot where I heard this. May not be true, idk, who knows these days. But it makes sense.
Are you thinking of Tor?
Yeah there was some Radio Free Asia money connection with the open whisper system that now is Signal.
AlmightyDoorman@kbin.earth 3 weeks ago
What why? The e2e protocol is open source as is the client. How would that even work?
Korkki@lemmy.ml 3 weeks ago
Central servers basically. Funded by ex-meta people and endorsements from western governments (general “if it’s popular then it’s compromised” suspicion). Also it requires your phone number gathers things like contact info from the phone, even if one assumes the messages are secure. basically could be seen as relinquishing a list of potential associates…
I don’t think Signal is unsecure, in a sense. it’s just secure for nobodies or anybody who want to use it in non western countries against governments hostile to the west or being designated to regime change targets. I however don’t think it’s much more secure than whatsapp for an high profile pro-Palestine activist for example. It’s a privacy tool for some and honeypot for others depending how they relate to US security state and western governments.
Passerby6497@lemmy.world 3 weeks ago
Tl;Dr - you have nothing other than baseless suspicion of an open source protocol that’s been reviewed by tons of security people and is widely considered secure by people who actually know what they’re talking about
Korkki@lemmy.ml 3 weeks ago
Of course I don’t have any concrete proof. If there was concrete proof we shouldn’t be having this conversion. My main issue is that it’s centralized and that’s a huge black box. People obsess with this “but it’s protocol open source” like headless chickens when that’s not the issue. Open source is like the step one when it comes to private and secure messaging. It just comes down to if you trust the devs and those doing the hosting. When it’s central all of that thrust rests on that one group and their hosting service not fucking you over even if they can or can not read the encrypted messages themselves. I’m not concerned signal keeping people’s dickpicks private here in that that even whatsapp is as good as any.
I see I made the mistake of coming to an obvious fangirl meeting to have an serious discussion about security merits.
einkorn@feddit.org 3 weeks ago
And how is the central server supposed to know anything when every message it transmits is verifiably e2e encrypted?
Korkki@lemmy.ml 3 weeks ago
Even if we assume that man in the middle attack is impossible with signal. Intelligence agencies care more about metadata anyway. Remember that getting meaning from terabytes of daily messages hasn’t really been viable way to mass spy anybody until very recently, since you needed humans to read them individually to get any wider sense of chat logs. if they know who talked to who and when. With those they can social graphs and get a list of suspects when everybody is tied to an identifiable phone number. Yeah they won’t directly get incriminating chat of somebody ordering drugs, but they can go nab the dealer and their associates with that info. Or they can have a group of key activists followed if they know that when messages between these people spike just before a protest happens.
AlmightyDoorman@kbin.earth 3 weeks ago
Contact info gets hashed in a clever way which doesn't send your info (although i guess phone number hashes could be brute forced?)
Meta data is also not available. They have no way to know who you are talking to. The only info they have is that you logged ij with a ip at a time. I believe they can't even reliable track how many messages you send. Even with a compromised server most of the magic happens in the open source client side app so that they can't gather very much. I understand your concerns about popular centralized services but i really believe that they are unfound with signal.
Sanguine@lemmy.dbzer0.com 3 weeks ago
???