121–130 of 241 posts
Earlier quoted context omitted.
> I like the fact that I get to login from anywhere in the world. This is a fairly common practice and my understanding is that every major and most minor VPN services offer this.
I never knew. Is it available on PIA and Mullvad?
Source: Another convert from PIA to Mullvad post Kape.
Signal’s claim to fame here is that they were subpoenaed in 2016 and could only supply account creation and last connection times: > The American Civil Liberties Union announced Tuesday that Open Whisper Systems (OWS), the company behind popular encrypted messaging app Signal, was subpoenaed earlier this year by a federal grand jury in the Eastern District of Virginia to hand over a slew of information—"subscriber na…
I think this discussion should also mention that Signal is a non-profit organization, dedicated to enabling secure and private communications. Yes, it's not strong proof, but it should be taken into account when comparing the goals and motivations of organizations developing various other communicators. The organization behind your communicator app could be in the business of gathering data about you and selling it i…
> should be taken into account when comparing the goals and motivations of organizations developing various other communicators.
Business or funding models can change for both for- and non-profit organizations. Especially as people move to options that are believed to have better user-privacy, the idea that they do not sell/monetize collected user data today does not indicate what they will do tomorrow.
Unless users have strong evidence that companies are not collecting and/or monetizing this information (which as the OP pointed out, there is for Signal as found in a subpoena), the "billboard" approach towards promising user privacy via marketing and PR is a shallow one at best for non-profits as well as for-profit companies.
Earlier quoted context omitted.
That's the point. They don't.
I don't want to speak for the parent commenter, but I think the concern is that the local app could be exfiltrating the contact list (and then by the exact same logic, message content as well) in some side channel unrelated to anything seen in the published source code, unless (a) the user builds the apk from published source code themselves, or (b) if there's some way to prove that the apk received via the Play Stor…
It's important to note that Telegram does store all your data by default as they do not enable E2EE for everything like Signal does. So if you're under the assumption that they don't, this is incorrect. Telegram, for all intents and purposes, is about as secure as using Facebook. The best you can do with Telegram is hope they don't sell out or get compromised at some point in the future, because all your private comm…
What I don't get is people are trusting unverifiable builds of Signal, Telegram, WhatsApp, etc as "secure" on each of their E2EE implementations when that part of the binaries we install on our phones isn't even verifiable by code and compilable by ourselves. But what I do like about Telegram is their good user experience and Bot API developer experience. It's soooooooooo fucking good I'm telling you. It just works,…
Signal is open source, you and anyone else can inspect the code. You can then build it from source and install on your android directly avoiding the play store.
While this is a great way to build trust, there is obviously no way to confirm the App Store version is the same as one built from their public source. In fact, due to the way Apple optimizes apps for each device, this becomes even harder. Furthermore, just because you compile it from source and put it on your phone does not mean that you can reasonably stay aware of or understand all the internal workings that happe…
Earlier quoted context omitted.
> I like the fact that I get to login from anywhere in the world. This is a fairly common practice and my understanding is that every major and most minor VPN services offer this.
I never knew. Is it available on PIA and Mullvad?
Mullvad also does this. Here's their server status page, so you can see your options: https://mullvad.net/en/servers/
Earlier quoted context omitted.
> Everything is end-to-end encrypted by default, so you know nobody is collecting your data. I think it's wise to remember that what happens on the other "end" is outside of your control. If the other person in the conversation stores chat backups unencrypted you're still at risk, and there's not much you can do about it.
I believe you have self-destroy timers in Signal. Perhaps those help.
If someone can read it, then they can copy it.
Hello, future? Yes, this is Richard Stallman calling from the 1980s. I think what you might be looking for is the source code to the entire software stack.
I don't think that actually detracts from gist of your point, but just wanted to point it out in case anyone was interested.
Earlier quoted context omitted.
> We don't know that Signal doesn't store data about users on its servers. Even the source code can't tell us that, because we don't run the servers. Yes. Ultimately we have no choice but to trust trust itself.[a] That said, if the OP were a non-technical friend asking me the same question, I would respond more or less like this: "Of all the widely used messaging services, Signal is the only one known to be designed…
I've seen [a] on HN three times in the last week. Don't know if it's recency bias, Baader-Meinhof, a legitimate increase in common popularity/knowledge, or a sign of the times. edit: after a quick algolia search, it has indeed been posted much more this year than years before.