If I run a server, I have access to the raw requests coming in. I can do whatever I want with them even outside Signal protocol. You can't verify that my server is set up to work the way I say it is. You get that right?

i do, of course… and the information you have in that raw request is limited to the information that’s in the request (including metadata like IP address and other header information in the packets that make it up)

You're confusing what Signal team says their server does, and the open source server implementation they released with what's actually running. The latter, you have no idea about.

i’m really not… i’m saying it doesn’t matter what their server is doing, which is the only way to actually verify this: the client is the only thing you can trust in the chain, so you should always assume that the server is compromised: maliciously or not

trusting signal doesn’t even have anything to do with it; they could be compromised and not know it

these are things we both agree on

the server still receives the raw network request and all the metadata attached to it. Your client has to talk to the server and identify itself before any messages are even sent.

i agree with that too. what information contained within that request do you take issue with?

as i said earlier, your IP address is problematic, but that can be said about any service: you have no way to validate any server software, open source or not… so you have to take measures to protect that information no matter the service you’re connecting too

this is pretty trivially achieved with a trustworthy VPN these days (again, this is unverifiable, but you have to draw the line somewhere: can we agree that IP address privacy is within the realm of personal responsibility since that applies to any service?)

When your device connects to send that sealed message, it inevitably reveals your IP address and connection timing to the server.

agree

The server also knows your IP address from when you initially registered your phone number or when you requested those temporary rate limiting tokens.

also agree

By logging the raw incoming requests at the network level, a malicious server can easily correlate the IP address sending the sealed message with the IP address tied to the phone number.

okay, i can see where your problem is

i can agree that’s definitely a vector they can use to build a social graph, and then tie that social graph back to real identities, and also that’s far from what you want in a private platform

id say that it comes down to trade-offs… signal (says) they require the phone number in order to combat spam, which i can see as a real issue (i’d be happier if they didn’t store the phone number, or at least didn’t link it to your account, but that comes with a whole load of other issues)

services need to have some way of combatting spam, which either boils down to “expensive accounts” so that blocking is a viable option, or spam filters which can be abused by corporate entities like they have with email

if you really care about privacy with signal, you can get a VPN that allows you to frequently rotate your IP… most users won’t do that, so i can agree it’s a sub-optimal solution

but i do think it’s a reasonable trade-off

that’s reasonable. perhaps the best service is one with both options: you can somehow have a verified account that lets you msg people you haven’t connected with (perhaps they have an “allow from verified” contact option), and join groups without verification, but that you can also have unlimited anonymous accounts that are assumed spammy

Give me ssh access to their server so I can verify that works like it should.

Can't? Then it's just trust me bro

we can guarantee is that it can’t be tied back to your message history,

Prove it. And not from some just trust me bro statement from signal.

you can never validate what code a server is running

Most halfway-decent messaging services (unlike signal) are self-hostable. So yes with actual open source software, that's very possible.

the whole point is you don’t need to trust them… you can never trust any server: your client is the only thing you can trust. you can verify using your message payloads that your sender information is not ever sent to the signal servers along with your messages

Where I am, Telegram is mainly used by alt- and far right figures close to Russia. Facts don't matter in these circles any more. Feelings do. And Durov knows how to manage those.

replied to your other msg, so i wont duplicate it here and we can continue there if you’d like

Signal has your phone number and everyone else's who signed up. That is more than just client information, and it's possible to build entire social networking graphs with it alone.

His NAME is MARLINSPIKE?? Like the ancestral home of Captain Haddock from Tintin?! We really are living in a simulation

that comes down to a difference in philosophy i think… signal have detailed their reasoning for not making signals servers decentralised and self hostable, and i don’t disagree with some of them… i think everything is a trade-off, and decentralisation has scaling and usability issues

signal has done a pretty good job of creating a platform that’s much much better than alternatives in a package that’s consumable by the general public

i’m not sure that something that’s more like matrix, or xmpp, etc could do that

it might be theoretically and technically not quite as perfect, but its impact on increased privacy across the globe has been far larger because they’ve made some of those compromises

Personally I disagree and think that the way SimpleX already has it is the best way because I don't think trying to protect your privacy as much as possible should automatically get you labelled as a spammer, but I can see your viewpoint.

they do, but that information is disconnected from your messages by sealed sender: that’s the point… your sender identity is cryptographically shielded from the signal servers

they know who you are, but they have no ability to connect that identity with who you message (which you can verify using only your client)

*edit: i will say, because i’m interested in conversation and understanding not just winning an internet argument, that my conversation with yogthos here has underscored i think a place where this could still be improved: your IP address across the entire sealed sender process can be used to tie things together, if it remains unchanged (but you can change your IP address between receiving your sender token and sending messages)

I can't really trust anyone's security philosophy when they market their service as "secure", but then have it built on required phone numbers (linkable to your real identity), and a single centralized US-based server subject to national security letters.

Anyone who came up with this idea of security should be laughed out of the room.

I'm convinced signal's entire support is similar to apple's : they make vague untestable claims about security, whilst having a shiny and functional app.

There are so many self-hostable alternatives that have signal beat on both those, that make any reason for using it moot.

Not = content not encrypted, or not worse

yeah, bad choice of words on my part… and i think the verification doesn’t have to be identity-based… it just has to be some limited resource (which identity is, and guarantees fairness because it’s n per identity)

it’s all compromises, and i don’t think there’s a perfect solution… what we want is the largest impact on general privacy the world over, and options that allow verifiable perfect privacy when needed - but understanding that that requires compromise in things like usability simply because it’s more complex to set up things like trust networks than to … just not

I was talking about the "educating people" part. I interpreted as "let's steer them away from Signal towards a better solution".
If it's not the intent then my comment is irrelevant

As much as I'd like to favor foss and federated messenger apps, telegram isn't as much garbage as whatsapp:

1.The client is somewhat open source and have forks like Forkgram, Materialgram and unoffical clients like Telegrand.
2. Telegram isn't E2EE by default but at least it doesn't lie about it and have E2EE secret chat when nessesary, that means crucial chats stay on your device and the rest stay on their database recoverable and syncable across devices.
(Yes, whatsapp supposedly is E2EE but we can't know for sure, it's closed-source.)
3. You can use telegram as a cloud service with only 2GB per file limit, unlike whatsapp.
(There's even a third-party app that utilise this as a cloud gallery.)
4. Even tho telegram has ads in large channels, telegram isn't funded by a greedy big-corp and it doesn't datamine you, ads are based on the channel's topic.

Yes, in terms of privacy, telegram isn't the best option, Signal, Session, XMPP, Matrix, or SimpleX have better privacy features, less linkability and E2EE by default but telegram is very mainstream and got more publicity, making it the whatsapp alternative it advertises itself as-is.
Publicity doesn't make a better messenger app, but for what it tries to do, it's adoptable for simple users, doubles as cloud storage and is more secure than the garbage being whatsapp.

Immigrating users to different apps is a headache on it's own, but if they know of telegram and it's not privacy invasive, that's not bad.

Again, I think people should be aware that there are alternatives to Signal, and be able to make an informed decision on the trade offs that matter to them. My personal view is that there are absolutely better platforms than Signal, but if people understand the potential risks with Signal and use it because it's convenient or their other contacts use it, etc., that's entirely up to them. It's just not what I would personally recommend if people want privacy.

Sure, you can absolutely decide that it's a reasonable trade off, but your original claim was that sealed sender addressed the problem. Sounds like you're now acknowledging that's not actually the case..

I also find it really weird how aggressively Signal is being pushed everywhere, and how any criticism of it gets dismissed or ridiculed. It feels a bit like a cult at this point.

Isn't it possible to verify WhatsApp encryption with packet sniffing?

i think it’s a very clever partial solution, but when combined with signals other ethos (making privacy simple so that more people use privacy-centric options), that means people aren’t going to change IPs between temp token and message to solve the last part of the puzzle: thanks for explaining your line of reasoning

i also think that there’s a way forward where messages are sent or tokens are retrieved via a 3rd party proxy to hide IPs (i thought i read something about signal contracting a 3rd party to provide some of those services but i can’t find the reference to that, and also it’s not verifiable so limited in usefulness), which is a complete solution to the problem, as long as said proxies aren’t controlled by signal (thinking about it now, you could also simply route signal traffic through a proxy so many people share an IP, and they do provide proxy functionality separate to the system proxy configuration)

i still think that signal has made a pretty reasonable set of trade-offs in order to balance privacy and usability in order to have a large impact on global privacy

*edit: actually, adding to the proxy point, turns out EFF run a public proxy

and there’s a big list of public proxies available (not a big list to avoid censorship, but still a good resource)

and they also have support for tapping a link to configure the proxy, so very quick and easy

"sitting on a vulnerability" does this mean he's discovered another exploit but refuses to disclose it essentially?

It is a denial of service attack. He discloses all vulnerabilities ahead of time. The only reason he released the previous one so quickly is because the Matrix team said it "wasnt a real vulnerability".

Yes, but how would you know Meta doesn't have a copy of your encryption key (ex: when you sign up) and keeps a copy of your encrypted messages somewhere?
AFAIK your encryption key resides as whatsapp's data folder but since whatsapp is closed-source you can't guarantee that whatsapp gave the encryption key to Meta's server at some point when it was created; (or it was created on their servers and sent to your device.)

One would just assume the encryption key is made on your device and never sent to Meta and all the E2EE messages aren't kept on Meta's server after they are sent.

Again, Meta is a company that is profiting on targeted advetising and selling user data, how would whatsapp be a free service without any profit?

Also, Here's someone who saw their whatsapp chat used for targeted ads on them in case you have doubt.

It's not really a partial solution, it's just sophistry to obscure the problem. The fact that I've had this same discussion with many people now, and it always takes effort to explain why sealed sender doesn't actually address the problem leads me to believe the the actual problem it's solving is not of making the platform more secure. The complete and obvious solution to the problem is to not collect personally identifying information in the first place.

You have a very charitable view of Signal making the base assumption that people running it are good actors. Yet, given that it has direct ties to the US government, that it's operated in the US on a central server, and the team won't even release the app outside proprietary platforms, that base assumption does not seem well founded to me. I do not trust the people operating this service, and I think it's a very dangerous assumption to think that they have your best interests in mind.

It's not really a partial solution

disagree, and that’s fine… STEM is full of partial solutions that become complete solutions as additional pieces are added (and as i said with the proxy, imo the proxy makes it a complete solution)

The complete and obvious solution to the problem is to not collect personally identifying information in the first place.

but that creates other problems… for example, with spam and usability

it’s all trade-offs, and signal has done a lot of global privacy when compared to alternatives exactly because of the compromises they’ve made

You have a very charitable view of Signal making the base assumption that people running it are good actors

i don’t consider it charity… they’re making a lot of right moves, and are explaining their compromises. they’ve given me no reason not to trust them, and plenty of reasons to say they’re a good compromise that will have the greatest impact to global privacy

are there better privacy solutions? sure… will they ever take off? personally, i doubt it… not letting perfect be the enemy of better or good enough is important: a solution that keeps people who don’t care about privacy relatively safe is important, including for the privacy of people who do care about their privacy because it allows everyone to blend in with the crowd

Yet, given that it has direct ties to the US government, that it's operated in the US on a central server, and the team won't even release the app outside proprietary platforms

imo the fact that it’s hosted in the US is pretty irrelevant… as you’ve pointed out: it shouldn’t be a matter of trust… validation of the client is the only thing you can rely on, so even if the NSA hosted the servers you should still theoretically be able to “trust” the platform (outside of the fact that you couldn’t ever trust that they’re using encryption that they don’t have a secret back door in or something)

I do not trust the people operating this service, and I think it's a very dangerous assumption to think that they have your best interests in mind.

i trust them as much as i trust anyone running any other privacy service

It's also the name of a tool for working with braided rope.

you can’t, and shouldn’t… lemmy never claimed to be, nor has the architecture to enable it to be a private service. lemmy instances are run by arbitrary people on the internet, and some of them do run forked versions of the codebase (eg blahaj)… we have no way of verifying what’s running on the server

but interaction on lemmy doesn’t require trust. i don’t think anyone is expecting lemmy to be private

I want you to actually try sauna sex and report back to me, if you don't believe me. But don't say I didn't warn you lol

What is not mentioned... there's no privacy when the device itself is compromised. For instance, Android phones can read and phone home data from your notifications. In that case, any messenger app wouldn't be private from Google's eyes.

I apologize if my comment came off as an attack, that was not my intention.

I appreciate you putting in the effort to bring up a concern, but I still don't get it.

Hope you enjoy your weekend

Fair enough

...and once you get to "AI" with system level access that is supposed to scan for "bad content" (like with Apple's supposed "CSAM scanning" and Google's Android System Safety Core), all bets are off.

All of the major platforms owned by corporations (including Apple) are or will be compromised.

The only way out is degoogled Android (for now) or, better, a true Linux device.

These people are foolish to use telegram, it's just a plain-text unencrypted app. Plus there's scams and spam all the time on telegram but not on signal.

What about the astrological signs of the people?

probably depends on how people use in different regions. down here it is mostly a news aggregator or thematic dumpster type of thing - so kinda like reddit. i had to look up when was the last time anyone wrote DMs to me in Telegram and it's been a little over 4 years. Viber is the go-to messenger down here, followed by WhatsApp and Signal and it is always a headache to figure out who is using what and when someone uses a couple of those it is a bitch to find anything across multiple chats.

except for Steve Hoffman forum. It's a colloquy

then suddenly people will start really caring about how much information a service has access to

I sincerely doubt it. The majority of people will accept that this is just "how it is" and will move on with life. After all, they're not doing anything wrong.

I predict yet another Signal-related hack within the month.

What

It’s not his real name

No, I don't think we live in an ideal world. I repeatedly said you ultimately have to use the platform that your contacts use. I'm merely pointing out that you should understand the trade offs.