Before you spread panic about imaginary issues with Signal, consider why these rumors might be going around right now and in whose interest it might be for them to do so
Comments
Log in with your Bluesky account to leave a comment
I tend to follow @soatok.bsky.social's lead on stuff like this. If he's not shitposting relentlessly about it, it's probably nothing. Not _just_ because he's a friend but because he's written at length and with care for accessibility on the subject of Signal and E2E encryption.
Because you're someone I trust with security, the only one of these "issues" going around that makes sense to me is one I wanted to ask about:
Is it plausible for "message preview" toasts to be something that could be subpoenaed/intercepted? I feel like it *is*, but I'm not sure where that data goes
Because like, I shut those off myself for privacy reasons quite a long time ago (if someone can grab your phone and read what's said without unlocking, that's kinda bad), but I never even considered the idea that someone in theory could intercept them remotely. Is that...a thing?
there have been threat models that involve message previews (generally involving third parties rather than Signal itself), and within Signal you can solve that problem entirely by simply turning them off
right, that lines up with what I suspected. every time I heard about it I'm like, "this actually sounds reasonable and seems like an easy thing to just not have to worry about"
one of the very few "conspiracies" about signal that's just got good security practice to it. thanks!
I mean, you can not have it notify everyone in your address book that you installed Signal finally. That was stopping me for a long time, because I have people whose name I want in my phone so I don't answer them.
Is a real solid tutorial on how to set it up on the computer that walks you through keeping it secure and encrypted on (window/mac) - cuz always feels like it’s an escape vector that a lot of messaging apps fall into problems with
I realize you probably mean well, but this is a bad idea. You do not want to roll your own cryptography. It is not needed because Signal already did it
For it to be trusted for any clandestine activity we would have to control all the infrastructure it uses in the internet. At any rate it's probably overkill the Taliban kicked out americans without even scrambled radio I'm sure
100% this, there's been a lot of rumor mongering about Signal which appears to be intended at driving people to other platforms like WhatsApp and Telegram, and well... It's pretty clear to me why one might want to convince people to switch from Signal to THOSE apps...
"Telegram is error prone, has wonky homebrew encryption, leaks voluminous metadata, steals the address book, and is now known as a terrorist hangout. I couldn’t possibly think of a worse combination for a safe messenger." https://medium.com/@thegrugq/operational-telegram-cbbaadb9013a
Matrix has a slightly higher barrier to entry (in the same way Pixelfed or Mastodon does), but it's better. My instance is external to the U.S. so unless the U.S. goes all N. Korea, we good. Signal is primary tho at this juncture.
I do worry about how centerialized communications are easier to shut down (i.e. us goes bye bye signal), but I don't think that should flat out eliminate signal as an option.
The primary concern (imo) is that the US government could shut it down pretty quickly if they ever really wanted to. I think Signal is great as a primary messaging app, but we should be already connected on decentralized apps that we can seamlessly switch to in that event
Saw a video on how to securely setup Signal, and one thing that was brought up (for android users) was the keyboard ap my be saving your keystrokes. An alternative keyboard being recommended was FUTO keyboard.
Has anyone been able to confirm that keyboard apps are logging our information?
Any good recent public cyber audits of signal, especially the new functionality that lets users export all messages? Would love to see if that's encrypted in a memory dump #noRASP
Or was the last good public audit back when Marlinspike used to run Signal?
I was saying the other day that I think when people spout off bullshit about Signal it (among other things) whether intentional or not seems to deflect people’s attention from actual risk.
Let's recall Musk was one of the people spreading those rumors (though apparently it was because terrible people had their phones physically seized or narc-ed on each other).
Comments
Is it plausible for "message preview" toasts to be something that could be subpoenaed/intercepted? I feel like it *is*, but I'm not sure where that data goes
one of the very few "conspiracies" about signal that's just got good security practice to it. thanks!
I've seen Signal say that they only use that infrastructure to wake up the app to tell it to fetch the notification from Signal, e2ee
Also, don't trust any system. Bee smart and defensive no matter what
If it is those guys, then I understand. They acted like they found an RCE exploit.
write a patch and submit a pull request. :P
https://github.com/signalapp/Signal-iOS
telegram is so fucking compromised
Encryption is encryption
That said, don't be too silly on an electronic device kids lol
But holy hell it's awesome
I do worry about how centerialized communications are easier to shut down (i.e. us goes bye bye signal), but I don't think that should flat out eliminate signal as an option.
Matrix and briar are harder to kill
1) Imaginary / Unable to prove.
2) Able to be fixed with a settings change.
Signal by default balances privacy with usability for the normies (a good thing), and it’s hard to see why they’d be criticized for that.
From an EU perspective the US government is unstable and can’t be relied upon.
More widely, the EU needs to urgently start weaning itself off its lazy reliance on US technology. It puts us in a very weak negotiating position.
Has anyone been able to confirm that keyboard apps are logging our information?
Or was the last good public audit back when Marlinspike used to run Signal?
https://www.bleepingcomputer.com/news/security/signal-will-let-you-sync-old-messages-when-linking-new-devices/