61–70 of 241 posts
Earlier quoted context omitted.
That is a somewhat misleading statement, you may know what's on your device but you don't know what is happening on the servers
Because of public-key crypto, it doesn't matter if the servers are malicious.
It very much does matter if the server is malicious.
Signal’s claim to fame here is that they were subpoenaed in 2016 and could only supply account creation and last connection times: > The American Civil Liberties Union announced Tuesday that Open Whisper Systems (OWS), the company behind popular encrypted messaging app Signal, was subpoenaed earlier this year by a federal grand jury in the Eastern District of Virginia to hand over a slew of information—"subscriber na…
Is it possible that they could in fact produce this data but were prevented from publicly saying so due to a gag order? I'm asking specifically because I remember Private Internet Access, a VPN provider, also being tested in court in the past [1], and because of this I've chosen to trust them despite them falling under Five Eyes jurisdiction. [1] https://torrentfreak.com/private-internet-access-no-logging-...
Earlier quoted context omitted.
Is it possible that they could in fact produce this data but were prevented from publicly saying so due to a gag order? I'm asking specifically because I remember Private Internet Access, a VPN provider, also being tested in court in the past [1], and because of this I've chosen to trust them despite them falling under Five Eyes jurisdiction. [1] https://torrentfreak.com/private-internet-access-no-logging-...
PIA used to be my go-to, but I immediately ceased using PIA after the 2019 acquisition by Kape Technologies, which has a rather foul track record.
It's important to note that Telegram does store all your data by default as they do not enable E2EE for everything like Signal does. So if you're under the assumption that they don't, this is incorrect. Telegram, for all intents and purposes, is about as secure as using Facebook. The best you can do with Telegram is hope they don't sell out or get compromised at some point in the future, because all your private comm…
As others are pointing out the reason a lot of people trust Telegrem and Signal is that corrupt governments don't!
That the few times the "kimono" had been opened both Telegram and Signal were doing what they said they were doing -- even if they both have different approaches.
This isn't like Facebook who just lie and have been caught doing so.
Earlier quoted context omitted.
Because of public-key crypto, it doesn't matter if the servers are malicious.
The server can MITM the public keys, providing you with a key from the server instead of the key from your conversation partner. It very much does matter if the server is malicious.
Signal also offers to label contacts for which you could verify the authenticity by another way.
Doing a video call with the contact can be a simple way to clear doubts, even if it is not a proper different channel.
Earlier quoted context omitted.
Signal has reproducible builds for Android. https://signal.org/blog/reproducible-android/ Does that help in any way to verify that they do not store data on their servers?
My understanding: If you verify the safety numbers in person, then I believe you can be confident that it's E2E encrypted for that conversation. If the safety numbers are different, then there could be a nefarious actor listening in. Someone please correct me if I'm wrong. Edit: That being said, I believe they could still record IPs, as well as the destination and timestamps of each message.
You don’t. Everything is about trust.
Earlier quoted context omitted.
This might seem like a naive question, but how is it possible to verify that 3 is true? I get how it might be done in theory but real life is complicated. Has anyone attempted to do this?
I imagine it's non-trivial. I think it would involve (in case of iOS): 1. downloading the binary 2. jailbreaking the phone to extract the binary (pretty sure this is necessary on iOS) 3. check the version of the binary, then compile the original sources of the version 4. ??? compare the two binaries, this is likely the most difficult part, they won't be identical because of things like codesigning (and build flags, t…
There is a large group of people who do this sort of research, and some fraction of them do this research and actually talk about it or publish papers. If you could find a deliberate weakness in the security of an app like what we are talking about (or WhatsApp or iMessages) then you have just printed your own golden ticket to whatever mobile cybersecurity job you want for the next decade or two, so there is a bit of an incentive to publish if something like this was discovered...
Earlier quoted context omitted.
Because of public-key crypto, it doesn't matter if the servers are malicious.
The server can MITM the public keys, providing you with a key from the server instead of the key from your conversation partner. It very much does matter if the server is malicious.