Chronicon [they/them]

  • 1 Post
  • 75 Comments
Joined 5 months ago
cake
Cake day: May 10th, 2024

help-circle










  • Self-destructing messages can prevent this, and hostility towards 3rd party apps help in that case since you can be more certain that nobody is using some shoddy implementation that ignores self-destruction or improperly deletes things.

    Helps you with local cops for sure. But disappearing messages are also just a false sense of security IMO, there’s nothing technically stopping someone from using a modified client like that, in fact some do exist and generally work despite the hostility, and so do screenshots…

    If you’re somewhere in between like a cartel or terrorist organization, please stay off any app I use to send memes to friends.

    I mean yeah, but I don’t think this is realistic. If you offer people bulletproof un-censor-able security they’re going to take you up on it, even if you don’t like them. But signal isn’t that

    Signal like every mainstream service has some amount of control and uses it to crack down on things like spam. They likely will use that control to censor other things too in the long term. To me that’s a bad thing. If it were federated, that power and responsibility would be with the instance/homeserver, not with one centralized organization.

    The beauty of E2EE is that you don’t need to trust the servers at all, once you verify that you’re actually connected to the person you intend to be.

    This ties back to my point about metadata. There are plenty of reasons to want to trust the server, and with signal, you can’t.

    I do agree though, feds doing targeted surveillance have easier ways. The issue is more one of bulk collection, and principle.

    And frankly the whole argument about open source safety goes out the window when the source and distribution is centralized, development is done behind closed doors (not sure to what extent this is true of signal clients but it was true of the server), and updates are automatically pushed out.

    There are big advantages to the linux-distro-with-maintainers model in that regard, as those are well-versed people who track development and act as a filter between users and a malicious update.



  • The stars hypothesis is interesting but I think it was genuinely caused by that youtuber recommending it. The reason it started 2 days before the video’s release is because he gives early video access to his patrons, if I had to guess. And that’s the only genuinely sus thing about it.

    It is worth waiting for some commit history and consistency to be shown before recommending it on the privacyguides site though


  • Yeah, warrant canaries are kind of a joke. They only work if people actually check them and you think the feds are too stupid to notice (or you think the courts actually care about precedent around not compelling actions but they obviously don’t). Or I guess if the creator gets merc’ed or arrested but servers aren’t seized, but that’s not really what they’re supposed to be for.

    not to be an ultra-anonymous hardened messaging platform to avoid state-level targeted attacks.

    But this is basically how it’s presented to people in a lot of online spaces when the topic comes up, including here. As the gold standard, best you can get, currently unbreakable.

    It’s a design decision, not a security flaw.

    it’s kinda both. Not a flaw per-se, but that design decision precludes any verification that the code they are running is what they publish, and at that point what’s the point of open source? Being actively hostile to any 3rd party apps, servers, etc. is pretty suspect. In open source security transparency is paramount, IMO.

    I’m glad they finally added usernames and stuff but I don’t think we should necessarily trust it either. I use it for day to day chatting. it’s at least not getting read by advertisers which is a feature on its own. I would not use it for serious organizing

    edit: one final thing

    And, since Signal is E2EE, they don’t have any useful data to share when they receive a warrant anyway.

    Metadata is absolutely useful info, and while signal does protect metadata more than the average bear, I don’t think I’d confidently claim they have nothing to hand over if the NSA comes knocking.





  • Matrix (Element is just one compatible client) is up there if Signal is too limiting feature-wise or too sus for yah. It can be annoying but not terribly hard to self-host, there are multiple server and client implementations that generally interoperate (though currently the server side you should probably stick to synapse unless you’re resource constrained or know what you’re doing)

    if you don’t like the UI of element, try fluffychat or nheko or something