Not that the action against Telegram is right, but there’s a big difference between what Signal and Telegram is doing.

She has her hand in too many strategic places, unlike Telegram.

employed at Google for 13 years

speaker at the 2018 World Summit

written for the American Civil Liberties Union

advised the White House, the FCC, the FTC, the City of New York, the European Parliament, and many other governments and civil society organizations

The very fact that there have never been any attempts in the west to stop Signal from operating says volumes in my opinion.

She’s in the US

Say what you will about US but they are pouring money into the cyber security industry

They won’t there’s no need. Their clients are garbage and they’re most likely backdoored anyways. This action against Telegram is only happening because they can’t get inside it, they can’t backdoor it nor corrupt anyone. If they were able to do that they wouldn’t be doing this.

IIRC She earns around 400+k per year. Which is a nice salary, but rather low compared to other execs.

Tox isn’t the most secure or private. I would go Simplex Chat

I find it intriguing that the people will scrutinize messaging platforms such as Telegram, and explain in detail how one should not entrust their messages’ encryption keys to these services. Yet, these same people seem unable to comprehend the concerns regarding Signal server having access to phone numbers of its users. The fact that these people are able to perceive potential vulnerabilities in one platform while remaining oblivious to similar concerns on another highlights that their arguments are more ideological than rational.

Maybe the US government (or even “deep state” or something) has realized that making everyone use insecure devices for easier surveillance is as smart as forbidding fire exits so that people would be easier to arrest.

I haven’t heard too many bad things about Signal.

Various dictatorships want to simply read correspondence because the social graphs producing actual value and keeping stability in our world, and also protecting their embezzled value stored abroad, are all abroad too, and they won’t hurt these. Some politicians in the west want to invade privacy for the same reason - what they embezzle is stored in ways unaffected by insecure communications in their own countries.

But if you are part of some establishment, even if not well-meaning, you are interested to protect the system from outright erosion, meaning secure communications.

Other than that, WhatsApp and FB Messenger are owned by Zuck and he’s become too big to tolerate, Telegram is an African brothel with no protection and plenty of diseases, and in general it’s all corporate around.

Let’s please also remember that there are people of various views and interests in every organization and force.

That’s outdated information:

• Molly ~5 years in development
• gurk-rs ~4 years in development
• signal-cli ~9 years in development
• Flare
• Beeper

Go forth and contribute, fork, or create your own.

They also refuse to distance themselves from Google’s app store.

This link has existed forever at this point if we count in internet years: https://signal.org/android/apk/ - getting an app directly from the developer with no middleman is about as distant as you can get from Google’s app store.

Yeah, I would like to use it from f-droid instead of google store or apk

What? How is this a red flag? Having third party clients is not good for security.

Do you hate Signal or do you hate the west? There legitimate reasons to not like Signal but calling them hostile toward third party clients is untrue. Last time I checked Signal wasn’t proprietary.

No, they found some billionaires to do it 😉

What part of non-profit and open-source do you not understand?

Review the source, build it yourself, be happy. It uses well-known assymetric encryption algorithms. Not much your agency could really do here even if they harvest all the traffic from the server.

Spell check? If you mean smartphone keyboards, then yes, the non-foss ones are keyloggers. One of my side-projects is a privacy-oriented keyboard, but there are many out there that don’t require network calls to google or apple.

Is this some Network Allowed problem that I’m too Network Not Allowed to understand?

Removed by mod

The problem is actually further - it’s that they push people to use Signal on mobile.

In the official desktop client, there is no option to register (even though it would likely be not that hard to add a box accepting a verification code), they tell you to use it in the mobile app instead. All while far from all phones can have privacy-respecting OSes installed on them at all.

Yes, there are ways around (Signal-cli or an Android VM - and even then you have to use Molly since the official client requires you to scan a QR rather than following a link). But arbitrarily directing people to a platform that is harder to make private is nonetheless weird.

Katherine Maher is a very busy beaver. She’s a major figure in the contemporary manufacturing of consent.

2020: Meet Wikipedia’s Ayn Rand-loving founder and Wikimedia Foundation’s regime-change operative CEO

2023: U.S. regime change activist named Web Summit CEO after founder forced out for condemning Israeli ‘war crimes’

2024: Web Summit CEO jumps ship to head up NPR after just 3 months

Yeah, Signal is more than encrypted messaging it’s a metadata harvesting platform. It collects phone numbers of its users, which can be used to identify people making it a data collection tool that resides on a central server in the US. By cross-referencing these identities with data from other companies like Google or Meta, the government can create a comprehensive picture of people’s connections and affiliations.

This allows identifying people of interest and building detailed graphs of their relationships. Signal may seem like an innocuous messaging app on the surface, but it cold easily play a crucial role in government data collection efforts.

Strictly speaking, the social graph harvesting portion would be under the Google umbrella, as, IIRC, Signal relies on Google Play Services for delivering messages to recipients. Signal’s sealed sender and “allow sealed sender from anyone” options go part way to addressing this problem, but last I checked, neither of those options are enabled by default.

However, sealed sender on its own isn’t helpful for preventing build-up of social graphs. Under normal circumstances, Google Play Services knows the IP address of the sending and receiving device, regardless of whether or not sealed sender is enabled. And we already know, thanks to Snowden, that the feds have been vacuuming up all of Google’s data for over a decade now. Under normal circumstances, Google/the feds/the NSA can make very educated guesses about who is talking to who.

In order to avoid a build-up of social graphs, you need both the sealed sender feature and an anonymity overlay network, to make the IP addresses gathered not be tied back to the endpoints. You can do this. There is the Orbot app for Android which you can install, and have it route Signal app traffic through the Tor network, meaning that Google Play Services will see a sealed sender envelope emanating from the Tor Network, and have no (easy) way of linking that envelope back to a particular sender device.

Under this regime, the most Google/the feds/the NSA can accumulate is that different users receive messages from unknown people at particular times (and if you’re willing to sacrifice low latency with something like the I2P network, then even the particular times go away). If Signal were to go all in on having client-side spam protection, then that too would add a layer of plausible deniability to recipients; any particular message received could well be spam. Hell, spam practically becomes a feature of the network at that point, muddying the social graph waters further.

That Signal has

1. Not made sealed sender and “allow sealed sender from anyone” the default, and
2. Not incorporated anonymizing overlay routing via tor (or some other network like I2P) into the app itself, and
3. Is still in operation in the heart of the U.S. empire

tells me that the Feds/the NSA are content with the current status quo. They get to know the vast, vast majority of who is talking (privately) to who, in practically real time, along with copious details on the endpoint devices, should they deem tailored access operations/TAO a necessary addition to their surveillance to fully compromise the endpoints and get message info as well as metadata. And the handful of people that jump through the hoops of

1. Enabling sealed sender
2. Enabling “allow sealed sender from anyone”
3. Routing app traffic over an anonymizing overlay network (and ideally having their recipients also do so)

can instead be marked for more intensive human intelligence operations as needed.

Finally, the requirement of a phone number makes the Fed’s/the NSA’s job much easier for getting an initial “fix” on recipients that they catch via attempts to surveil the anonymizing overlay network (as we know the NSA tries to). If they get even one envelope, they know which phone company to go knocking on to get info on where that number is, who it belongs to, etc.

This too can be subverted by getting burner SIMs, but that is a difficult task. A task that could be obviated if Signal instead allowed anonymous sign-ups to its network.

That Signal has pushed back hard on every attempt to remove the need for a phone number tells me that they have already been told by the Feds/the NSA that that is a red line, and that, should they drop that requirement, Signal’s days of being a cushy non-profit for petite bourgeois San Francisco cypherpunks would quickly come to an end.

Yog is gettin downvoted by dotworld feds but as usual is undefeated in the comments.

It collects phone numbers of its users, which can be used to identify people making it a data collection tool that resides on a central server in the US. By cross-referencing these identities with data from other companies like Google or Meta, the government can create a comprehensive picture of people’s connections and affiliations.

That’s fuck up. I always found bad to have the phone number as requirement but that’s make a lot of sense.

deleted by creator

I use the Molly-FOSS fork, do you know if that removes the metadata collection? I know it doesn’t use any Google Play Services and it comes with its own notification bubble though.