from hatingfedizen@lemmy.dbzer0.com to privacy@lemmy.ml on 03 Nov 19:19
https://lemmy.dbzer0.com/post/77934240
Invidious link: invidious.tiekoetter.com/watch?v=TzGEmXync5M
An overview of Signalās long list of flaws (phone number id, Play service payments, centralized infrastructure, etc) and the history of The Signal Foundation of ignoring many of these issues.
Signal is disappointing. And I am tired of pretending that itās not. I have been using and recommending Signal for longer than it existed. Signal just came out with a feature we have been waiting for for 8 years.
You see 8 years ago, the only flaw Signal had was that it required a phone number to register and find contacts. This was bad, because it meant you couldnāt get an anonymous Signal account, which meant you could get hacked or abused by anyone who knew your phone number. It was also easy for authoritarians to censor peopleās access to Signal by denying phone registrations by country code.
The reason for the phone number requirement was to prevent spam. The primary function, was to use your phonebook to quickly onboard new users and send notifications whenever anyone in your contact list signed up on Signal. A very convenient Silicon Valley feature that allowed people to quickly connect with their friends and also let domestic abusers find out their victims are trying to contact a lawyerās office over Signal.
threaded - newest
And after profusely spitting on it, what do you suggest to replace it with?
Clickbait.
Because thatās the thing with these videos: they tear Signal apart, and thenā¦ nothing. No alternative proposed. And even when these people have one, itās never something normal humans actually use in any significant number.
Signal isnāt perfect, I wonāt pretend otherwise. But my actual choice isnāt between Signal and some hypothetical perfect messenger. Itās between Signal and Messenger, WhatsApp and Telegram. On that scale, Signal wins, and itās not even close.
And no, my family and friends are not moving to Matrix. Getting them all on Signal was already a nightmare. Iām not going to explain homeservers and Matrix IDs to my relatives. If your alternative requires a tutorial to even register, itās not a replacement, itās a hobby for tech enthusiasts.
So yes, keep the pressure on the Signal Foundation, some of it is deserved. But until a better option actually gains mainstream traction, Signal remains the only realistic way to get regular people out of Metaās and Telegramās data
We should all switch to using one-time pads. Sure, itās not as convenient, but I assume everyone will understand.
I donāt know if you wrote this in bad faith, but there are many alternative chat applications and platforms mentioned during the video that are more secure than signal.
I agree, the title of the video is awful.
The author mentions many times how they support Signal, but we shouldnt just accept their excuses for the lack of advancement on certain issues just because itās the most convenient option.
The alternative is clear: Matrix.
I think your family have a point to not listen to you if yoy previously switch them to shitty things like Signal.
Try DeltaChat. Seriously.
The best messaging app is the most private and secure app I can actually get people to install. I canāt get anyone to install SimpleX or Matrix.
SimpleX has been a lot easier.
Got my boio, roomie, and a coupla frens there.
Unfortunately, Simplex seems to be developed by a fascist: drewdevault.com/weird-guys/
Devault is a pederast freak. Pick your poison, I guess.
I donāt trust VC fuckers, but the underlying protocol is good work.
I would love to see a noncommercial reimplementation and network, especially one which doesnāt have crypto integration.
Or at the very least for signal to stop requiring a phone number and allow you to register from a desktop.
This is letting perfection be the enemy of progress. Lots of complaints, but what realistic alternative is there?
Damn you(r implications) are right. Thereās no alternative messengers around š /s
Alternative messengers which are privacy focused or friendly?
I noticed you didnāt list any.
The best messengers are no messengers at all, theyāre protocols. But here are just a few off the top of my head:
Matrix is far more superior to Signal, both in usability and privacy!
Thanks, need to look into this.
It is 1000% not superior in usability.
I think thatās one of the things: itās hard enough to convince people to use Signal. Itās probably not the best choice, but I can get (some) people to use it.
Uhhhh no, it sure doesnāt do thatā¦
The gripes are valid but the title is sensational.
Itās very bad title but I didnāt want to change the original
One thing to note, Signal has never purported to be āprivateā. It is āsecureā. Thereās a huge difference. Everyone has to find a balance between privacy and usability. Not having phone ID means no way to reduce the chance a user is bot as well as if you donāt register a personal name or phone number or anything else traceable, it makes it difficult for users to find eachother. And as for tracking the source and destination of messages, again if those are random destination routing IDs for a particular conversation, it makes it difficult to route to multiple devices. And if you donāt include source identifiers then thereās no way to block a spammer or other hostile user or provide delivery receipts to the sender. If you eliminate the storage of messages on the centralized server entirely and have it just be for routing, then if a device is offline at the moment a message is composed, it canāt be sent. These are just some examples of privacy vs usability. I wonāt go into real-time video and audio as they are even more complex.
What signal is, is a system that does not store the keys for the messages themselves, thus as long as all userās devices are secure, the messages are secure. This it does very well.
If you want a private messaging system, there are many options out there, but Signal needs to be usable for the masses of technically illiterate as well as secure. These are more for things like journalist who need privacy for whistleblowers. In that case the lack of usability is a reasonable tradeoff.
Of course Iām oversimplifying some things, but the basic idea is that Signal is not a private messaging app, it is a secure messaging app.
Uhhhh yes it has? Thatās like the main thing itās purported to be? You can control + F āprivacyā 4 separate times on the homepage. I think youāre conflating this with anonymity .
Itās more private than something like Facebook Messenger or most other popular chat apps, thatās not itās primary purpose and again, it does not purport to 100% privacy as it does to 100% security of messages. Anonymity is one way to achieve privacy, but it isnāt the only way. Unfortunately, itās the only way if you want to obey laws in most countries, basically privacy by making it impossible for the company to give any information to police, courts, etc.
The OP though is primarily complaining about privacy and not security and thatās what Iām trying to differentiate. Itās never ever said it gives a 100% private experience but does purport to making messages content as secure as possible.
Again, it does and it is. Itās plastered all over every webpage and document they have. You are confused.
Again, OP video is referring to anonymity, among other things.
Google private vs secure communications. Privacy is the company not sharing information about your communications. Legally this is nearly impossible for a corporate entity without anonymity. But they could just as easily keep the data about who you are talking to secured and thus your privacy protected. They are private commercially in that they donāt sell that information like most messaging apps, but they canāt refuse an order from a government entity and thus are not 100% private. Again anonymity is one method of keeping your data private, the other is to have 100% control over that data like if you self hosted the central server then Signal could be private while still not being anonymous.
So anonymity is the only legal say to be private, but it isnāt the only way to be private. They do keep your data private from data brokers, thus some privacy, but not 100%. Anonymity is much more difficult to accomplish while maintaining usability. Privacy is only difficult to accomplish while maintaining functionality because of legal obligations. So their policies are privacy oriented, but they canāt guarantee that without anonymity which they canāt do without loss of functionality.
What they can do, and do well, is security. Secure messages, security of metadata in motion, etc., but metadata at rest while secure, is not private from governments, only from corporations (currently, though this could change and is why people think they want anonymity not realizing they lose functionality.) Signal is secure, and as private as it can given the legal obligations, but it could change policies and decide not to keep your data private and then anonymity is needed which is what the OP is saying they need, but Signal has never said they will provide.
No u.
It isnāt, and they donāt.
They donāt have to, because they are 100% private. They donāt have information to share.
No they absolutely know who every message on the server came from and who itās bound for as well as various other metadata. Governments can request this data as, while it is stored securely, the company has access and thus must give this information upon receiving valid requests. This is not 100% privacy especially in cases of things like journalists and government corruption whistleblowers. They canāt say what they said, but they can say a particular user talked to a journalist.
Uhhhh no? They absolutely do not? And the page I just linked you to proves it. Itās full of requests from the government where they did not provide any of the information you suggested.
If their servers have no knowledge of who sent the message then whatās the point of accounts and if they donāt know who the message is for, how do they deliver it to all devices logged in under a given account, but not to every other user. Yeah they donāt store an unencrypted list of every contact a user has or their user profile (which is what the site you point to says), but they do store metadata on the message itself and because those accounts are linked to real world phone numbers, they know who it belongs to, or at least the government does, not that itās hard to find out. This is exactly what the OP is saying and why anonymity is the only option for true privacy, which Signal does not provide, nor does it purport to. Yeah they donāt sell your data. Yeah they donāt want your contact lists, but they do hold a lot of private information about your activity out of necessity to receive and deliver messages.
If youāre not even going to read the content of what youāre referencing, Iām sorry but Iāll have to stop my responses here. I donāt have time or energy for trolling or willful or arrogant ignorance.
Thatās not what it says. I already told you what it says. It says they received many subpoenas from the government, and every single time the only thing they can provide is the first and last time a number connected to their servers. If youāre not even going to read the content of what Iām referencing, Iām sorry but Iāll have to stop my responses here. I donāt have time or energy for trolling or willful or arrogant ignorance.
Brother, literally just look at the fucking website. Or their fucking marketing. Or basically fucking anything that they produce. You are high on crack.
Iām going to take your refusal to provide evidence as an admission that you have none. Good day.
I wasnāt even following Ć¾e argument but Ć¾is caught my eye.
Ćank you š
Iāve been using Signal since before it was called Signal. Iām a big fan, and I still use it and recommend it. No, it isnāt perfect, but for my needs, itās still the best all-around. I am always interested in alternatives, but they mostly havenāt stacked up. Top contender for me right now is DeltaChat. Iām also playing around with Sideband/reticulum, which is a super interesting project, but nowhere near ready for primetime.
Edit: forgot to mention Veilid chat :)
Finally after years and years I managed to get more and more people migrating to Signal, away from WhatsApp. Only because more and more people are on signal.
It may not be perfect, but itās so much better than WhatsApp and Telegram.
No one is going to install a super secure app of no one else uses it. Most people donāt care. They just want to be in touch with everyone.
This is the same argument for that Twitter is still the main platform for politicians in my country, even though itās a fascist pedo hate speech board now (the new 4chan). Politicians: āYeah I want to move away from Twitter, but all the journalists are on thereā. Journalists: āYeah I want to move away from Twitter, but I will miss all the politicianās messages.ā
People seriously are this stupid, and in politics at the same time.
Imagine having to convince boomer parents and colleagues / boss to move to an app most of their friends, colleagues, business associates, family etc. are not using. Then imagine having to tell them they should actually move to an app no one they know uses, except me. They will tell you āfuck that shit, I have nothing to hide anyway, Iāll just use WhatsApp instead.ā
I think this should be solved by legislation. There are already many European government instances, and think its the way. itās a risk that institutional communications depend on some billionaireās whim. A legislation that forces politicians (at least the ones in office) to use the corresponding governmental fediverse instances could solve these problems.
I totally agree. The issue however, is that this needs to be implemented by politicians, who are (with just a few exceptions) unwilling to change.
Unwilling and also bribed with millions by the BigTech Lobby