Technology

61902 readers

3379 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago

MODERATORS

302

Time to get serious with E2E encrypted messaging (techcrunch.com)

submitted 1 day ago by [email protected] to c/technology

93 comments fedilink hide all child comments

I currently use Telegram for my friends and family, but have reluctantly come to the conclusion that the UK Government is either reaching agreement for backdoors with messaging services, or is trying its hardest to.

I'm also on Element/Matrix. Before I try to get my contacts to join me on there, should I be aware of any privacy issues or is that a good place to head?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 9 points 23 hours ago* (last edited 15 hours ago) (1 children)

it's also effectively tied to Google services due to the app distribution

It's been recently added to FDroid.

and push notification channels

You can use NTFY with Molly (which has been on FDroid for some time).

network-level metadata monitoring by anyone with sufficient access/influence at Signal or their data center provider (such as a government who doesn't like encrypted messaging).

This one is just a straight-up lie. Everything on the server is encrypted and no one has the keys except the participants.

[–] [email protected] 4 points 14 hours ago* (last edited 13 hours ago) (4 children)

It’s been recently added to FDroid.

No, it has not. A third party published it in an f-droid compatible repository. That might be convenient for someone who happens to trust that third party and manually add it to their F-Droid client, but it is not at all like it being added it to F-Droid.

You can use NTFY with Molly (which has been on FDroid for some time).

This does not refute what I wrote. Unless you only communicate with people who get their Signal app from some non-Google source and they all rig up alternative push notification channels, or every one of them uses Signal exclusively on iOS, your conversations are still tied to Google. Perhaps you have so few contacts that you could achieve that, but most people are not in that position.

network-level metadata monitoring by anyone with sufficient access/influence at Signal or their data center provider (such as a government who doesn’t like encrypted messaging).

This one is just a straight-up lie. Everything on the server is encrypted and no one has the keys except the participants.

Encryption doesn't hide network traffic. Signal's centralised design means there is a single point where that traffic can be monitored and traced to reveal which endpoints are talking to each other, and where, and when.

What I wrote is not a lie, which you would know if you actually understood these issues. Please stop making baseless accusations. You are wrong, and you are being very rude.

If you're interested in correcting your ignorance, I suggest starting with this paper, which touches on some of the issues:

https://www.ndss-symposium.org/ndss-paper/improving-signals-sealed-sender/

If the paper is too much for you, the linked video does a pretty good job of explaining.

[–] [email protected] 2 points 5 hours ago (1 children)

Their github releases have the apk available so you can manually download it and install it or use obtainium.

https://github.com/signalapp/Signal-Android/releases

[–] [email protected] 2 points 4 hours ago

It's also available on their website btw: https://signal.org/android/apk/

[–] [email protected] 1 points 5 hours ago

your conversations are still tied to Google

That's simply false. Signal Notifications never include the content of the message or any metadata, no matter if they're sent over FCM, APN, WebSockets or UnifiedPush (via mollysocket). That wouldn't even be possible, since the Signal server sending out the notification doesn't even have the key to decrypt the message. Only the users involved in the conversation have the keys, that's how end-to-end encryption works. Signal simply sends an empty message via FCM (or any other push system), and the Signal app on your device then receives and decrypts the encrypted message and shows you a preview of the message content as a notification on your operating system.

And every build of the Signal client for WhatsApp also supports WebSockets as a fallback push notification system, in case Play services aren't installed or can't be reached. The only reason why FCM is used by default is that it saves some battery, because it only maintains one background network connection for all apps, instead of each app handling notifications themselves.

[–] [email protected] 2 points 9 hours ago

I would be more concerned about how phone-oriented it is. A phone's default OS is such spyware that I am not sure just what is safe from from being uploaded. And even if the person wants a more private alternative, most phones have locked bootloaders. On the other hand, Linux would run on damn near anything... But using Signal on it without a smartphone is very annoying. No way my mom would understand an Android VM or a command-line client, because the desktop client isn't feature-full and doesn't even allow registration.