Fuck signal. No “privacy” focused messenger should need a phone number to register…at that point u basically handing the agencys meta data on a platter
No, that is an important distinction. People have different threat models. For most people, privacy without anonymity may suffice (i.e. I don’t mind that you know it’s me, I just don’t want you to see what I’m sending). For others (i.e. journalists, whistleblowers, more privacy-centric individuals), anonymity may be equally important.
Yeah lets use the phone number of a middle man to sign up…sure u wont forget to relock the number every week so they dont get the power for account take over since they manage your number.
Don’t let perfect be the enemy of good. Getting people off of proprietary stuff is the first step. Whatever else is the next step.
I know it’s not the best, but it is great when you want someone to shift from other popular proprietary app like WhatsApp.
Replacing one phone number based system with another may not be a wise choise.
Wrong again. Please research before you start shouting.
WhatsApp uses the Signal protocol. The difference is, it being owned by Meta, it also logs all the metadata it can alongside your real phone number.
Signal messenger uses the Signal protocol. Contrary to WhatsApp, it does not store any metadata. Your phone number is used by the Signal protocol merely as a cryptographic hash. That means, it’s impossible to know who is communicating with whom.
It is not replacing “one system” with “another system”. It essence, signal is WhatsApp, but with all the added spying features stripped, none added.
at that point u basically handing the agencys meta data on a platter
Can you explain what you mean? I’m not sure I understand how that would work.
Well in many nation you can only get a phone number by showing ID, hence the number itself isnt anonymized. So if there is a legal request to signal they hand over the number and u already de anonymized. If you dont use your own number you have to relock signal every week (manual) so the number cant be used for account takeover…why is that lock even on a timer? That just sounds like a trap.
But lets assume u used your own number, and it gets found out. With that number it would be easy af for a state actor to send u a zero day SMS to take over your phone…there are so many reasons why a phone number is just bad to use as a identifier in a privacy focused app. The technical hurdles to allow account creation without phone number or like just to have number as optional, are very low. The official reason for the numbers is spam protection…but there are a lot of privacy messengers out there that dont use numbers and dont have a spam problem.
would be easy af for a state actor to send u a zero day SMS to take over your phone.
Two problema with this logic
- do you think a state actor needs to leak the phone number from signal to find out your number?
- 0-click SMS exploits are possibile, but extremely rare and extremely expensive. Someone with such an exploit won’t burn it for random Joe.
Edit: In any case, if your security depends on malicious actors not discovering your phone number, a generally public piece of information, your have no security to begin with.
there are a lot of privacy messengers out there that dont use numbers and dont have a spam problem.
Because they have not users either. You are talking about niches in a niche segment of a niche market.
Using a phone number that is used only for account creation is a non-issue overblown by a lot of people. Your phone number is likely in the contact list of tens or hundreds of people, already comfortably associated with your name and conveniently shared with many applications that your contacts use. The association between phone number and identity is something that telco companies can already (and do) provide to authorities. The only bit of metadata that is added is that “person X uses signal” which in itself is an irrelevant piece of data.
Why? Because the Dutch national broadcasters keep plugging it as an alternative to Whatsapp.
Aside… Two apps keep getting mentioned as alternatives, Signal and Element/Matrix, but in MHRO both are not viable as replacements.
Signal: still a US app, CIA funded, provides their encryption backbone to Whatsapp, recommended by governments & FBI. Matrix/Element: Developed in Israel, with ties to IDF, preferred by NATO (NI2CE)
Just FYI:
If you want to say “both are not”, you can instead use “neither”.
Signal: still a US app, CIA funded
Honestly, this gives me more confidence in it. The CIA is very interested in keeping its people safe, so if they’re using it, its in their interest to ensure it’s secure. If they do put in a backdoor, I happen to be a US citizen so I’m unlikely to be a target since the CIA is all about surveillance on outsiders (FBI is domestic). FBI and Signal rarely agree, but they agree that Signal is great, so I think that’s a pretty strong endorsement.
Add to that Edward Snowden recommends it, and he’s certainly an enemy of both the CIA and the FBI at this point.
I happen to be a US citizen so I’m unlikely to be a target since the CIA is all about surveillance on outsiders (FBI is domestic)
All of that’s off the table now with Trump in power. It’s more than likely the CIA will be deployed against domestic targets.
Signal does seem to have some ties to the CIA
There seems to be a completely different Israeli company called matrix. I can’t find any link between the two.
Maybe OP means that the Matrix protocol is created by an Israeli company.
I use Telegram, like betamax have I backed the wrong horse?
All kidding aside from the other comments, Telegram is not secure or private. It’s not E2EE by default and getting it enabled is per-chat and convoluted. Frankly, I wouldn’t even trust it with cat pics I send to the bros let alone private messages… not to be fear mongering but do yourself a favor and get off Telegram.
Signal, despite some criticism that it’s “Not private enough etc.”, strikes a balance between usability, privacy and security. It’s also miles better than Telegram on all fronts.
A big issue we have in the privacy community is that it’s easy to have an “all or nothing mindset”. Even small steps in the right direction can be hugely beneficial. So, Signal is great. Use Signal.
I’m sure going all in on a Russian company is just fine. Their Wikipedia entry has nothing at all to indicate any shady behavior.
/s
I would have rather seen Element but hey, it’s a step in the right direction.
Why? Matrix sucks as an instant messenger app, it’s better as a Slack/Discord alternative.
Only because I’m not aware of other decentralised Signal alternatives. That’s on me.
It only sucks because you keep using Element. Its the worst client out there, if you account for “doneness”
Isn’t Element based of Matrix? From what I’ve read, Matrix is a bit mid (not exactly mid, but I can’t think of any other word).
It works as it’s supposed to, though the handling of keys (strictly necessary for self-determined end-to-end encrypted chats) can be hard and annoying for people who have no experience. But once you get the hang of device confirmation you can use it seamlessly across multiple devices.
I guess this means we’re not switching to RCS then?
