191–200 of 241 posts
Earlier quoted context omitted.
If the US government wanted to send a hit squad to Russia to take him out, the fact that he uses Signal instead of WhatsApp isn't what would be holding them back.
One could read into Snowden's tweet that he has sent/received messages using Signal that would with certainly have pushed the US government into wanting to send that hit squad.
Earlier quoted context omitted.
Assuming you have: - read the source code and are satisfied that it's secure - compiled that version of the code - installed it on your mobile or desktop You're still only as secure as the client on the other side of the conversation. If that one is compromised (has not gone throught the steps above) it could very well be sending all messages in clear text to a malicious party. Edit: formatting
Yeah and since you have the possibility of dealing with state actors with deep pockets, you have to wonder if Android or iOS doesn't have the ability to copy your private keys and send those off somewhere for storage. Because of signal's popularity, it feels pretty possible to me. If the NSA did have it backdoored somehow through the OS, it's a good bet they'd force LE agencies to use parallel construction to keep th…
Your solution?
* Magical amulets?
* Fake your own death, move into a submarine?
* YOU’RE STILL GONNA BE MOSSAD’ED UPON
Earlier quoted context omitted.
I prefer to look at the history of who founded and continues to run the Signal Foundation... Moxie Marlinspike. Moxie has a long history of improving security in all kinds of tech and fighting for privacy. The Signal app itself is opensource as well various pieces of the tech stack. You can audit yourself what is being sent and how their protocols work. The protocol itself has won awards due to its security and elega…
Curious. Is there an easy way to validate the code running on my phone is exactly the same code available on Github (here: https://github.com/signalapp ) ?
Earlier quoted context omitted.
Technically they could get the signature key, but they can't force Signal to publish it via the store. Users would have to download an .apk file and install it directly. At that point there is no reason to have the signing key at all as the phone will recognize a sideload as a third party install. As far as I know, the government cannot compel a company to do something like update an app.
> but they can't force Signal to publish it via the store Is there not a suspicion that Google, another US-based corporation, may have some agreement with American national security to supply malicious APKs to individual targets via the Play Store? Having Signal’s signing key would allow the state to present that custom-targeted APK as an ordinary Signal version update.
Signal: operations that involve sending your contacts (like contact discovery) use a pattern Signal invented where the client can validate the software running on the server. The server runs inside the SGX secure enclave. Before your client sends any data, it performs remote attestation on the running server code to ensure it matches the published open source code. See the full explanation at https://signal.org/blog/…
Also whole security dangles on Intel to be trusted to not give its private keys to anyone. Which is a big ask for any company. NSA/CIA likely can get those keys legally via FISA court order or illegaly via hacking and/or insider.
[1] - https://arstechnica.com/information-technology/2020/03/hacke...
[2] - https://www.theregister.com/2020/06/10/intel_patches_sgx_aga...
Signal’s claim to fame here is that they were subpoenaed in 2016 and could only supply account creation and last connection times: > The American Civil Liberties Union announced Tuesday that Open Whisper Systems (OWS), the company behind popular encrypted messaging app Signal, was subpoenaed earlier this year by a federal grand jury in the Eastern District of Virginia to hand over a slew of information—"subscriber na…
https://www.nytimes.com/2021/01/13/technology/telegram-signa...
Signal’s claim to fame here is that they were subpoenaed in 2016 and could only supply account creation and last connection times: > The American Civil Liberties Union announced Tuesday that Open Whisper Systems (OWS), the company behind popular encrypted messaging app Signal, was subpoenaed earlier this year by a federal grand jury in the Eastern District of Virginia to hand over a slew of information—"subscriber na…
"And Mr. Musk's endorsement of Signal last week sent publicly traded shares of Signal Advance Inc., a small medical device maker, soaring from a roughly $50 million market value to more than $3 billion. (The company has no relation to the messaging app.)" https://www.nytimes.com/2021/01/13/technology/telegram-signa...
Can they keep the money?
Earlier quoted context omitted.
Assuming you have: - read the source code and are satisfied that it's secure - compiled that version of the code - installed it on your mobile or desktop You're still only as secure as the client on the other side of the conversation. If that one is compromised (has not gone throught the steps above) it could very well be sending all messages in clear text to a malicious party. Edit: formatting
Ok, sure. But what do you propose? It's still a much better situation than what we have with Whatsapp. Is there something that the Signal Foundation could do to alleviate that concern you have? There's no technical solution in any technology for preventing the other side being compromised, as far as I can see.
Signal is open source, you and anyone else can inspect the code. You can then build it from source and install on your android directly avoiding the play store.
While this is a great way to build trust, there is obviously no way to confirm the App Store version is the same as one built from their public source. In fact, due to the way Apple optimizes apps for each device, this becomes even harder. Furthermore, just because you compile it from source and put it on your phone does not mean that you can reasonably stay aware of or understand all the internal workings that happe…
Can you elaborate on this? That's exactly what I'd expect of an app I compiled from source.
Earlier quoted context omitted.
What I don't get is people are trusting unverifiable builds of Signal, Telegram, WhatsApp, etc as "secure" on each of their E2EE implementations when that part of the binaries we install on our phones isn't even verifiable by code and compilable by ourselves. But what I do like about Telegram is their good user experience and Bot API developer experience. It's soooooooooo fucking good I'm telling you. It just works,…
> At this point who the fuck knows if Durov can be trusted (hell we all wish, right, no harm in that). It's a threat model decision. If you're someone who wants privacy from the US or other Western governments (think Antifa on the left side, or corona-deniers, qanons and other conspiracy nuts on the right side), Telegram is the best option since the Western governments can't hold them accountable. If you're a Russian…