151–160 of 241 posts
While not directly about data storage, I loved this tweet [1] from Edward Snowdon this week: > do we really trust signal? cause i see zero reason to. Here's a reason: I use it every day and I'm not dead yet. [1] https://twitter.com/Snowden/status/1347217810368442368?s=20
Earlier quoted context omitted.
PIA used to be my go-to, but I immediately ceased using PIA after the 2019 acquisition by Kape Technologies, which has a rather foul track record.
What did you switch to?
Signal’s claim to fame here is that they were subpoenaed in 2016 and could only supply account creation and last connection times: > The American Civil Liberties Union announced Tuesday that Open Whisper Systems (OWS), the company behind popular encrypted messaging app Signal, was subpoenaed earlier this year by a federal grand jury in the Eastern District of Virginia to hand over a slew of information—"subscriber na…
Earlier quoted context omitted.
What I don't get is people are trusting unverifiable builds of Signal, Telegram, WhatsApp, etc as "secure" on each of their E2EE implementations when that part of the binaries we install on our phones isn't even verifiable by code and compilable by ourselves. But what I do like about Telegram is their good user experience and Bot API developer experience. It's soooooooooo fucking good I'm telling you. It just works,…
> At this point who the fuck knows if Durov can be trusted (hell we all wish, right, no harm in that). It's a threat model decision. If you're someone who wants privacy from the US or other Western governments (think Antifa on the left side, or corona-deniers, qanons and other conspiracy nuts on the right side), Telegram is the best option since the Western governments can't hold them accountable. If you're a Russian…
Earlier quoted context omitted.
I think this discussion should also mention that Signal is a non-profit organization, dedicated to enabling secure and private communications. Yes, it's not strong proof, but it should be taken into account when comparing the goals and motivations of organizations developing various other communicators. The organization behind your communicator app could be in the business of gathering data about you and selling it i…
I prefer to look at the history of who founded and continues to run the Signal Foundation... Moxie Marlinspike. Moxie has a long history of improving security in all kinds of tech and fighting for privacy. The Signal app itself is opensource as well various pieces of the tech stack. You can audit yourself what is being sent and how their protocols work. The protocol itself has won awards due to its security and elega…
Earlier quoted context omitted.
I prefer to look at the history of who founded and continues to run the Signal Foundation... Moxie Marlinspike. Moxie has a long history of improving security in all kinds of tech and fighting for privacy. The Signal app itself is opensource as well various pieces of the tech stack. You can audit yourself what is being sent and how their protocols work. The protocol itself has won awards due to its security and elega…
Curious. Is there an easy way to validate the code running on my phone is exactly the same code available on Github (here: https://github.com/signalapp ) ?
Earlier quoted context omitted.
What I don't get is people are trusting unverifiable builds of Signal, Telegram, WhatsApp, etc as "secure" on each of their E2EE implementations when that part of the binaries we install on our phones isn't even verifiable by code and compilable by ourselves. But what I do like about Telegram is their good user experience and Bot API developer experience. It's soooooooooo fucking good I'm telling you. It just works,…
> At this point who the fuck knows if Durov can be trusted (hell we all wish, right, no harm in that). It's a threat model decision. If you're someone who wants privacy from the US or other Western governments (think Antifa on the left side, or corona-deniers, qanons and other conspiracy nuts on the right side), Telegram is the best option since the Western governments can't hold them accountable. If you're a Russian…
See the full explanation at https://signal.org/blog/private-contact-discovery/ (starts part way down, with "trust but verify"). Or check the client source code yourself!
Telegram: I dunno, they.re closed source, don't encrypt by default, and have shady ownership. I don't trust them at all, personally.
Earlier quoted context omitted.
Is it possible that they could in fact produce this data but were prevented from publicly saying so due to a gag order? I'm asking specifically because I remember Private Internet Access, a VPN provider, also being tested in court in the past [1], and because of this I've chosen to trust them despite them falling under Five Eyes jurisdiction. [1] https://torrentfreak.com/private-internet-access-no-logging-...
PIA used to be my go-to, but I immediately ceased using PIA after the 2019 acquisition by Kape Technologies, which has a rather foul track record.