- cross-posted to:
- technology@lemmy.world
- tech@pawb.social
- crypto@infosec.pub
- cross-posted to:
- technology@lemmy.world
- tech@pawb.social
- crypto@infosec.pub
https://soatok.blog/2025/02/18/reviewing-the-cryptography-used-by-signal/
A very good, extensive and interesting read on cryptography, centered around Signal (my daily driver), from the same guy who has previously analyzed Telegram and Session.
You must log in or register to comment.
I was sceptical until I saw that they had a fursona. This must be an expert!
Soatok’s post about matrix opens with this:
Please keep in mind that this website is a furry blog, first and foremost, that sometimes happens to cover security and cryptography topics.
I’ve actually seen a bunch of people recommend and cite this blog; the person running it knows their shit.
when you get good enough that people care more about that than dumb shit like how you dress, being quirky is a massive benefit because it makes you even more memorable
the need for a telefon number is still a deal breaker. And having to “relock” the phonenumber every week in the app if u used someone elses number (so they cant do account takeover) sound just like a trap
I agree needing a phone number is a dealbreaker, the reasoning I’ve seen is:
- It’s a core dependency on Signal, and replacing it would require a major overhaul.
- Serves as an Anti-spam feature
- Helps with contact discovery among common users
My opinion?
- 1st statement makes sense but maybe it’s somewhat incorrect.
- 2nd statement is true, Signal has had an increasingly amount of spam since they added “username accounts” linked to number, I can tell myself.
- 3rd is true, I discovered two guys I knew used it and it was nice. When SMS on signal was still around, I suppose having a phone number also made more sense.
In general, signal has proved they store no data besides the phone number itself, and in court they have only been able to give phone numbers.
Now it’s up to privacy oriented users like many here to think about ways of getting a burner phone number for his without their name on it.
But I still agree with your point, they could work on better or more private ways of using Signal.
In general, signal has proved they store no data besides the phone number itself, and in court they have only been able to give phone numbers.
My problem with signal is actually this, because it’s only part of the story.
Let’s say the FBI suspects you of doing something horrible, like say you played baby shark in public. They have good cause to believe you’re a Signal user, so they get a judge to authorize a subpoena based on your phone number, and Signal complies - and, yes, all they’re doing is confirming to the FBI that you have an account with them.
Now they’re going to go after you with ‘We know you have a secret messaging app you use, Signal, and we know you used it to plan playing baby shark at the mall last Tuesday.’
And so, if you’re not really clear on how all of this works, it’s a fantastic wedge to try to pry actual incriminating information from you. Or, hell, you let them look at the app on your phone negating the whole damn encrypted part in the first place, because you’re sure they already know.
Properly secure messengers shouldn’t be tied to that level of PII, because, well, cops can still try to use it to bludgeon you.
Maybe a little paranoid, but I’ve decided to embrace some of the paranoia since not doing so means you have to trust in the rules and policies that the law puts in place and well, uh…
Now they’re going to go after you with ‘We know you have a secret messaging app you use, Signal, and we know you used it to plan playing baby shark at the mall last Tuesday.’
This does nothing for their case. They don’t know if you planned the crime on Signal. And, this is on non-issue if you:
- don’t talk to the police,
- have a decent lawyer.
If you fail those two basic principles of dealing with the police, you’ve screwed yourself anyway. Accusing you of using Signal carries no weight in a court and likely wouldn’t be admissible unless they already had evidence of the contents of the messages.
They have no data of you to share with the FBI. No list of your contacts, no list of your groups, no data of stickers you use, basically nothing. That’s what’s great about Signal.
I suggest that you read their transparency reports to see what I mean. They share redacted version of their communications with the govts: https://signal.org/bigbrother/santa-clara-county/
They have good cause to believe you’re a Signal user, so they get a judge to authorize a subpoena based on your phone number, and Signal complies - and, yes, all they’re doing is confirming to the FBI that you have an account with them.
Literally all they need to do is have their own phone with Signal installed, and then create an address book listing with the Suspects phone number on it.
Next time Signal syncs, it will pop up “Suspect is on Signal!”.
Subpoena-ing the Signal Foundation is not required.But it proves nothing, and if you are in a jurisdiction where the police can demand your phone or you are stupid enough to hand it over when they can’t, that’s not on Signal.
Why don’t you have disappearing messages enabled?
deleted by creator
I love this comment was deleted
I deleted it and resposted it in the proper place in this same thread - I accidentally responded to the wrong person.
Edit: omg, hahaha
Yeah but the comment states “deleted” unlike signals disappearing messages which are just gone without a trace.
Fitting username.
That’s why I’m on Briar instead.
