this post was submitted on 09 Jan 2025
107 points (99.1% liked)
Privacy
32722 readers
815 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I'd be curious to hear your criticisms of Signal! While I haven't seen anyone describing it as a "paragon of privacy and security" I do think it is a highly accessible SMS replacement that is also open source, end-to-end encrypted, and operated by a nonprofit.
I wrote a longer one here: https://dessalines.github.io/essays/why_not_signal.html
The short version is, that it's a centralized, US hosted service. All of those are subject to National Security Letters, and so are inherently compromised. Even if we accept that the message content is secure, then signal's reliance on phone numbers (and in the US, a phone number is connected to your real identity and even current address), means that the US government has social connection graphs: everyone who uses signal, who they talk to, and when.
Man I don't even have the time to break down all these very clearly wrong insinuations. There's no reason to believe Signal collects metadata, and every reason to believe they don't. They've been served subpoenas and they shared them, as well as their responses, publicly, and the only thing they included was when the last time the user connected to their server.
Edit: tl;dr this person believes that Signal is inherently insecure because they use servers and require a phone number, despite the fact that there is zero information connected to your phone number.
A phone number is tied to your real identity in most countries, especially the US. This is why phone number leaks are so dangerous, I can probably find your current and past addresses, friends, family, social media, all with just your phone number.
Yes, your phone number is tied to your identity but it's completely useless without any additional information. Your phone number is not supposed to be a secret. Every chat platform has some sort of unique identifier, other than SimpleX.
That doesn't make much sense. With a single piece of info, your phone number, I can learn hundreds of things about you. It's one of the most linkable identifiers out there.
Of course, which is why its super-important that the id not be linked to your real identity.
Here's a test: I'll give you my matrix id, and you give me your phone number. Deal?
I don't understand what that has to do with anything. Yes, you can learn all kinds of information about you but you cannot learn it from Signal...
Lets use your favorite privacy app to communicate. Give me your phone number.
No phone number necessary (anymore).
https://signal.me/#eu/62su5fsZZ63Lr0MlnpgAo7hyVt5Mz1JpO6tKBbadGCLEQJgzLdNAW5LDArwDZKvX
They still require a phone number to sign up, and its a US domiciled company (5-eyes country), so its inherently unsafe. The obama administration issued an average of 60 national security letters every single day of his administration.
If your answer is "I don't think signal is giving my phone number to the US government", then why do you have to "trust" signal to not do that? Actually private chat apps don't ask for identifying information like phone numbers, then say "trust us", like apple or something.
Yes, that is well documented at this point. What I'm waiting for you to explain is how this compromises your privacy or security.
The 5 eyes is an international data-sharing agreement. They cannot share what they do not have. So no, it's not.
I don't doubt it. Those NSLs would have returned zero information from Signal because, as Signal has repeatedly demonstrated, and I have repeatedly stated, they don't have any information to share.
I don't have to. As I've explained several times now, there is nothing to trust them with. I give them a phone number. I give them zero information along with it. Not my name, email, birthdate, nothing.
If you have any actual evidence to share, or any kind of argument I haven't already debunked I'm all ears, but it sounds like your entire argument is predicated on conspiracy theory, which I'm not interested in entertaining further.
Part of the stipulation of NSL's, is that its illegal to disclose that you've been issued one. You are gagged, and you can't even criticize that gagging publicly, or you will face criminal charges. You can read more about that here: https://www.eff.org/issues/national-security-letters
Your phone number is already linked to all that info. I, even as a private person, could type in your phone number right now and get all that information about you in seconds. So you can stop saying "my phone number doesn't have that information", because it 100% does. And signal stores it as their primary identifier.
Again, if you really believe what you're saying, you'll give me your phone number, and the phone numbers of your friends. If this is a secure identifier, that contains none of the information above, then why not? Put up or shut up.