Since we are on the topic of signal.. im not tech saviie but i have read lots of blogs and people about how secure is the signal protocol. My question is .. how can i be sure that the protocol is implemented as the open source code shows? Please correct me if im wrong but from what i read on their website the apk they provide has the capability to update itself at anytime. So what stops them to change how it works with an update? is it posible to build the apk yourself and stop the ability to update?
Right now, for the wider population, it it a heaven sent option compared to Whatsapp, FB messenger etc. Break those bonds first and keep the wheel turning.
With the phone number, no; and since there's no Signal usage without a phone number, well…. Also, I think somewhere on their website (or some place) they talked about burner phones as if it's a universal phenomena.
Signal has felt "out of place" to me. Odd. It doesn't fit in, doesn't make sense if I think a bit farther about it.
I hope something decentralised comes out of Signal protocol minus the need for a phone number.
SimpleX uses Signal tech AFAIK but without requiring phone number or email address.
You are talking about session. Session is a signal fork, and you don't need phone number. But there is some concerns about its security as, in order to properly work, it removed some signal features, I'm not qualified enough to understand if it's truly a security risk or not. But the option to use it is there.
I used it for a couple years, but came back to signal because I had so many issues with media sharing.
Imo signal protocol is mostly fairly robust, signal service itself is about the best middle ground available to get the general public off bigtech slop.
It compares favorably against whatsapp while providing comparable UX/onboarding/rendevous, which is pretty essential to get your non-tech friends/family out of meta's evil clutches.
Just the sheer number of people signal's helped to protect from eg. meta, you gotta give praise for that.
It is lacking in core features which would bring it to the next level of privacy, anonymity and safety. But it's not exactly trivial to provide ALL of the above in one package while retaining accessibility to the general public.
Personally, I'd be happier if signal began to offer these additional features as options, maybe behind a consent checkbox like "yes i know what i'm doing (if someone asked you to enable this mode & you're only doing it because they told you to, STOP NOW -> ok -> NO REALLY, STOP NOW IF YOU ARE BEING ASKED TO ENABLE THIS BY ANYONE -> ok -> alright, here ya go...)".
Secure and private or anonymous are very different things and nearly impossible to do both at the same time and still make it user friendly. Signal is secure, not fully private or anonymous.
No, and they are supported by US gov (last check), so no good can come of that.
Do you've reference about it ?
Even if it is, I don't think we should give the government the power to tell us what to not use. Otherwise they just pick any good projects, throw money at it, leak the data, and people jump to a less secure. Trust the code and nothing more
Quick googling comes up with only people refuting this claim.
Sure, we had signal gate, but the way that was received should make it pretty clear that it’s not supported for official use.
Not supported for official use because it leaves no trace for the formal record. Not because Signal is insecure.
Signal has a backdoor - like many other apps. It's private in most situations but not for all... The backdoor is there, and as such, it will never be as secure and private as it could, or should, be...
Can you point it out so we can close it asap?
https://github.com/signalapp
(Iirc it's up to date?)
Thx!
(I'm critical of Signal, but "in this economy" is the best I can hope to switch my friends to.)
I don't understand this & need some explanations (I've heard about the dev, it's just USA stuff, much like Telegram mentioned Russian). Where exactly are the backdoors/the encryption compromised?
The biggest security issue in Signal is the requirement for phone numbers and SIM cards. This basically forces all Signal users to identify themselves, and makes Signal highly vulnerable to government spying.
Can I get the ETA for fixing this?
Requiring a Sim is not a backdoor and does not enable "spying". I does allow knowing who is on the platform, who talks to who, when, and probably some more metadata issues. But its not a backdoor
~~Afaik you don't need a phone number for Signal (a "username" can substitute it, a few years back they added it).~~ edit: you still do
(Also the phone number & IP was the security risk, not the messages, afaik.)
This however was a debate about a supposed backdoor (I otherwise agree about Signal & its USA basedness, I just remain glad it exists despite it ~~many~~few blemishes).
You need a number to register, but not to comunicate
try to get a Signal account without a phone number. let me know if it works (hint: it won't work).
I tried to make a new account for my child recently. You need a number. It wouldn't even work as a first signup on a wifi only tablet.
I tried to uninstall on my phone, set him up a new acct with a VoIP number then move the account to his tablet. It constantly failed when I uninstalled and put my account back on my phone.
You can only use one cellphone. Of you switch between two, it has to deactivate on the other.
Then you can have 4 or 5 other devices but that acct is tied to an activated cell phone and it gets screwy if you change that phone.
So those posts they implemented this were lies (meaning I obv didn't read attentively enough)?
Sad :(.
They implemented usernames to identify people so we could stop using numbers to find each other.
They still use numbers (cell and possibly device/network ids) they say to identify and secure (or so they say).
The idea is without access to your cell phone, nobody's going to get access to decrypt your data.
Yeah, no, I get & like that, I just somehow specifically (obviously mis-)remember that they did away with phone number as a prerequisite for creating an account (everything still the same, just that the account can't be reset).
:(
Does it really? Iirc, you can determine: when the account was made, and when the last message was sent. This doesn't sound 'highly vulnerable' to me... Doesn't permit inspection of metadata e.g. contacts, so as vulnerabilities go it's pretty weak sauce
A phone number uniquely identifies a person because in most of the world you need a government ID to get a phone number or a SIM card.
Which means that if one account is compromised, then everyone that person talked to is also compromised. You know what they talked with whom. It's an incredible security risk that Signal devs refuse to acknowledge or fix.
What are you referring to? I've read many security breakdowns of signal and nobody who knows what they're talking about has ever mentioned a back door
Privacy
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)