Wouldn’t it be more effective for the government to develop a highly secure communication app, known only to individuals in top-level positions? This app would be discreetly installed upon appointment to a senior government role and automatically removed upon departure from office.
That's ... that's the communication network they're avoiding? Because the problem is not _which_ app, it's that it's _an_ app, on standard hardware, on the public internet?
Only, made by an Israeli company that presumably doesn’t make their version of Signal open source
The point of E2E is only to make sure that Alice is talking to Bob and nobody else can pretend to be either of them or eavesdrop. There is no reason whatsoever to include where else the message may be sent, encrypted or not. Consider E2E protected email service. You send me the final designs over this encrypted channel. Then I put the designs onto a USB drive and give them to my printer to print. Then I hang them as…
Precisely. The security of a message endpoint ends at the point that the opposite party's leverage runs out. If I care more about my snapchat account than I do about saving your disappearing message minus your ability to leverage snapchat into banning my account or apply outside social pressure, then your disappearing message may actually disappear. As the stakes go up, so does the leverage required for “endpoint sec…
Is there a term for any application which offers full control of your messages then, ie, I send you messages on Signal, but I can make them self destruct and you cannot screenshot them? (Pretty sure Signal allows this?). Nothing stopping a user from taking photos of the screen using another device, of course. Or running their own fork of Signal (which, when run from the open source for Android at least, runs on production).
As some details: TeleMessage is/was an Israeli company [1], but was acquired last year by Smarsh [2], itself a subsidiary of K1 Investment Management, both US companies. It me whether the company moved. While not necessarily related at all, their terms of service also seem to explain specific arrangements for messaging in China that appear to involve disclosures to the Chinese government. It's unclear to me how the a…
> unless the archive is considered an end and the connection to it is secure
LMAO NO! I have quite a few clients using Telemeasage, and most of them use Global Relay on the backend. It's a little terrifying actually, as Global Relay just ingests everything via SMTP. I haven't checked if they have DNSSEC or MTA-STS set up, but with how Global Relay operates I would be surprised if they did. I suspect a well-placed proxy or DNS poisoning could siphon off a good chunk of sensitive emails being sent to Global Relay.
Signal is fine, what's not fine is using it for top secret messages on your average everyday phone which is apt to get hacked by state actors and their mercenaries if you're important enough to be on their radar.
Also it's not secure to share info in Signal chats with people who lack clearance.
> TM SGNL appears to refer to a piece of software from a company called TeleMessage which makes clones of popular messaging apps but adds an archiving capability to each of them
Crikey that's terrifying. Not even a US company either.
Telemessage got bought out by Smarsh a couple years ago. (Which several other commenters are saying is a US company) Their service has gone way downhill since.
That’s like in the old days when you needed to get married and grabbed a random nearby person to be the witness.
I doubt that’s happened more than twice in the history of marriage
I was the random person asked once before, didn't work though as my state requires a 72hour wait from filling out marriage application before you can be legally married. (Couple was eloping from another state and wanted to get married same day, were told it would have to be a different state)
If Signal becomes financially dependent on government contracts, the govt gains a lot of leverage over the app. I'm not sure that's a great position for this particular platform to be in.
This is a good point - but at some point we have to trust someone. I feel that the Signal folks are worth trusting. Plus it's open source, so the more technie among us can meaningfully audit what's going on. That's not foolproof, but it does seem better than most alternatives. Certainly it's better for the gov't to pay Signal than to try to do it themselves.
> I feel that the Signal folks are worth trusting.
The MobileCoin integration and the long standing refusal to support a way to use the messenger without using a phone number (or a smartphone at all) make me wary. To me they sit pretty much on the same level of trust as Meta's WhatsApp, which is a sad thing to have to conclude.
Please tell that to European governments too. The Netherlands military police was using Whatsapp (e.g., https://www.defensie.nl/actueel/nieuws/2022/06/15/maatregele... ). Only Germany has the BwMessenger (Matrix) as far as I know. It makes me wonder what the other militaries are using.
This is misleading bordering on rage bait. There were 11 dutch military police who created a WhatsApp group. This was not allowed and is also not sanctioned or any form of official Military Police communications channel. The leader of those 11 was fired because of it. It says it right there in the article. Stop making drama.
I do not get the feeling that using WhatsApp was the source of the disciplinary measures here, but rather the racist contents they shared there. So to be fair to GP, this could be much more prevalent.