21–30 of 51 posts
Earlier quoted context omitted.
So you wouldn't call Signal private, right? Just wanted consistency.
Signal has sealed sender. So you can tell that a phone number is a signal user but not who they message.
title: secure and private terms: we're not responsible
Earlier quoted context omitted.
Signal has sealed sender. So you can tell that a phone number is a signal user but not who they message.
How does sealed sender work? I couldn't find details. The explanations I saw seemed to start from the assumption that Signal doesn't keep logs of messages moving through their system.
The short version is: Traditionally, Bob needed to “log in” to be able to send a message to Alice’s inbox.
With Sealed Sender, Alice gives Bob a credential that allows him to message her from now on without logging in.
Only Alice can tell that the message she received is from Bob.
There’s some subtlety around bootstrapping these credentials and preventing abuse which means that not every message can be sent as Sealed Sender, but the vast majority are. Read the blog post for the authoritative explanation.
There’s an option in the app settings to make visible which of your messages were sent without identifying your client to the server if you’re curious.
> White Noise stands out by merging Nostr’s decentralized network with advanced encryption. How does White Noise address criticisms surrounding Nostr's implementation[1]: > While nostr offers the ability to send encrypted DMs to user pubkeys, the metadata of these messages are broadcast publicly via relays. This is the same as a bitcoin transaction being viewable on the public ledger. The contents of the direct messa…
So you wouldn't call Signal private, right? Just wanted consistency.
States can use metadata from Signal and ISPs to confirm that party A was in contact with party B and at what times, for example, in charges of criminal conspiracy. If one device on any end of the chats is compromised or confiscated, chats and identities are exposed. Once both devices are confiscated, messages are decrypted on both ends of the Signal app and authorities can grab the message content they used the metadata to get a warrant/subpoena/order for.
Similarly, Signal can be gag ordered to keep a record of phone numbers linked to identities if it already doesn't exist in their implementation. Signal and/or Google/Apple/ISPs/carriers can be compelled to follow wiretap laws and collect more data on specific users, push special updates to them, etc.
It's an app that forces the use of cell phone numbers linked to real identities in order to use it, clients have servers hardcoded, clients make direct connections to servers, etc. Just the first fact alone should be a red flag if your well-being depends on privacy.
As much as I love the idea of these secure messaging apps, until I see how a company responds to government intimidation I am always wary of being too invested and trustworthy of the marketing.
title: secure and private terms: we're not responsible
Software advertising itself as "A truly secure and private messenger" raises my skepticism. It might be truly secure. Its creators might believe it is and have zero doubt that they've made no errors and there are no flaws. Or it is neither and they want me to think it's those things. The only thing definite is that it claims to be truly secure.
Earlier quoted context omitted.
How does sealed sender work? I couldn't find details. The explanations I saw seemed to start from the assumption that Signal doesn't keep logs of messages moving through their system.
https://signal.org/blog/sealed-sender/ The short version is: Traditionally, Bob needed to “log in” to be able to send a message to Alice’s inbox. With Sealed Sender, Alice gives Bob a credential that allows him to message her from now on without logging in. Only Alice can tell that the message she received is from Bob. There’s some subtlety around bootstrapping these credentials and preventing abuse which means that…
But if so, doesn't signal still know that alice and bob are communicating because it's transferring messages between them? Even if Bob doesn't log in IP B is still sending payloads that eventually get delivered to IP A, and if law enforcement later asks signal for logs they could be correlated.
> White Noise stands out by merging Nostr’s decentralized network with advanced encryption. How does White Noise address criticisms surrounding Nostr's implementation[1]: > While nostr offers the ability to send encrypted DMs to user pubkeys, the metadata of these messages are broadcast publicly via relays. This is the same as a bitcoin transaction being viewable on the public ledger. The contents of the direct messa…