Comment on Signal Protocol and Post-Quantum Ratchets

• Korkki@lemmy.ml ⁨3⁩ ⁨weeks⁩ ago

  Central servers basically. Funded by ex-meta people and endorsements from western governments (general “if it’s popular then it’s compromised” suspicion). Also it requires your phone number gathers things like contact info from the phone, even if one assumes the messages are secure. basically could be seen as relinquishing a list of potential associates…

  I don’t think Signal is unsecure, in a sense. it’s just secure for nobodies or anybody who want to use it in non western countries against governments hostile to the west or being designated to regime change targets. I however don’t think it’s much more secure than whatsapp for an high profile pro-Palestine activist for example. It’s a privacy tool for some and honeypot for others depending how they relate to US security state and western governments.

  source

  • Passerby6497@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    Tl;Dr - you have nothing other than baseless suspicion of an open source protocol that’s been reviewed by tons of security people and is widely considered secure by people who actually know what they’re talking about

    source

    • Korkki@lemmy.ml ⁨3⁩ ⁨weeks⁩ ago

      Of course I don’t have any concrete proof. If there was concrete proof we shouldn’t be having this conversion. My main issue is that it’s centralized and that’s a huge black box. People obsess with this “but it’s protocol open source” like headless chickens when that’s not the issue. Open source is like the step one when it comes to private and secure messaging. It just comes down to if you trust the devs and those doing the hosting. When it’s central all of that thrust rests on that one group and their hosting service not fucking you over even if they can or can not read the encrypted messages themselves. I’m not concerned signal keeping people’s dickpicks private here in that that even whatsapp is as good as any.

      I see I made the mistake of coming to an obvious fangirl meeting to have an serious discussion about security merits.

      source

      • trailee@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago

        Of course I don’t have any concrete proof.

        serious discussion about security merits.

        Those two don’t go together, bud.

        It just comes down to if you trust the devs and those doing the hosting.

        Ok so let’s talk about Brian Acton walking away from nearly a billion dollars due to his moral stance on private communication. Or Meredith Whittaker’s determination to pioneer a tech business model other than surveillance capitalism.

        You’re absolutely right that it comes down to trusting the devs, which is why WhatsApp is a nonstarter even though it uses Signal’s E2EE. Europe’a chat control proposal doesn’t need to break E2EE, it just needs to demand that the messaging client app scans all content locally before encrypting and has a way to tattle. Meta could also be scanning everything you type into WhatsApp and feeding it into a local AI advertising interests summarizer or whatever else, and still claim E2EE. The open source client is far more important than an open source server when there’s proper E2EE.

        source
  • einkorn@feddit.org ⁨3⁩ ⁨weeks⁩ ago

    And how is the central server supposed to know anything when every message it transmits is verifiably e2e encrypted?

    source

    • Korkki@lemmy.ml ⁨3⁩ ⁨weeks⁩ ago

      Even if we assume that man in the middle attack is impossible with signal. Intelligence agencies care more about metadata anyway. Remember that getting meaning from terabytes of daily messages hasn’t really been viable way to mass spy anybody until very recently, since you needed humans to read them individually to get any wider sense of chat logs. if they know who talked to who and when. With those they can social graphs and get a list of suspects when everybody is tied to an identifiable phone number. Yeah they won’t directly get incriminating chat of somebody ordering drugs, but they can go nab the dealer and their associates with that info. Or they can have a group of key activists followed if they know that when messages between these people spike just before a protest happens.

      source

      • LastYearsIrritant@sopuli.xyz ⁨3⁩ ⁨weeks⁩ ago

        They also don’t have that data. Who you talk to and when it also concealed from them.

        Check out their blog article about “Sealed Sender” from back in 2018.
        signal.org/blog/sealed-sender/

        Also note that the EFF encourages the use of Signal.
        ssd.eff.org/module/how-to-use-signal

        source
  • AlmightyDoorman@kbin.earth ⁨3⁩ ⁨weeks⁩ ago

    Contact info gets hashed in a clever way which doesn't send your info (although i guess phone number hashes could be brute forced?)
    Meta data is also not available. They have no way to know who you are talking to. The only info they have is that you logged ij with a ip at a time. I believe they can't even reliable track how many messages you send. Even with a compromised server most of the magic happens in the open source client side app so that they can't gather very much. I understand your concerns about popular centralized services but i really believe that they are unfound with signal.

    source
  • Sanguine@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago

    ???

    source