Reviewing the Cryptography Used by Signal - Dhole Moments
soatok.blog
Last year, I urged furries to stop using Telegram because it doesn’t actually provide them with any of the privacy guarantees they think it gives them. Instead of improving Telegram’s c…
  • schizo@forum.uncomfortable.businessEnglish
    24·
    2 days ago

    In general, signal has proved they store no data besides the phone number itself, and in court they have only been able to give phone numbers.

    My problem with signal is actually this, because it’s only part of the story.

    Let’s say the FBI suspects you of doing something horrible, like say you played baby shark in public. They have good cause to believe you’re a Signal user, so they get a judge to authorize a subpoena based on your phone number, and Signal complies - and, yes, all they’re doing is confirming to the FBI that you have an account with them.

    Now they’re going to go after you with ‘We know you have a secret messaging app you use, Signal, and we know you used it to plan playing baby shark at the mall last Tuesday.’

    And so, if you’re not really clear on how all of this works, it’s a fantastic wedge to try to pry actual incriminating information from you. Or, hell, you let them look at the app on your phone negating the whole damn encrypted part in the first place, because you’re sure they already know.

    Properly secure messengers shouldn’t be tied to that level of PII, because, well, cops can still try to use it to bludgeon you.

    Maybe a little paranoid, but I’ve decided to embrace some of the paranoia since not doing so means you have to trust in the rules and policies that the law puts in place and well, uh…

    • athairmor@lemmy.world
      8·
      2 days ago

      Now they’re going to go after you with ‘We know you have a secret messaging app you use, Signal, and we know you used it to plan playing baby shark at the mall last Tuesday.’

      This does nothing for their case. They don’t know if you planned the crime on Signal. And, this is on non-issue if you:

      1. don’t talk to the police,
      2. have a decent lawyer.

      If you fail those two basic principles of dealing with the police, you’ve screwed yourself anyway. Accusing you of using Signal carries no weight in a court and likely wouldn’t be admissible unless they already had evidence of the contents of the messages.

    • hossein@lemmy.sdf.orgEnglish
      6·
      2 days ago

      They have no data of you to share with the FBI. No list of your contacts, no list of your groups, no data of stickers you use, basically nothing. That’s what’s great about Signal.

      I suggest that you read their transparency reports to see what I mean. They share redacted version of their communications with the govts: https://signal.org/bigbrother/santa-clara-county/

    • Mountaineer@aussie.zoneEnglish
      5·
      2 days ago

      They have good cause to believe you’re a Signal user, so they get a judge to authorize a subpoena based on your phone number, and Signal complies - and, yes, all they’re doing is confirming to the FBI that you have an account with them.

      Literally all they need to do is have their own phone with Signal installed, and then create an address book listing with the Suspects phone number on it.
      Next time Signal syncs, it will pop up “Suspect is on Signal!”.
      Subpoena-ing the Signal Foundation is not required.

      But it proves nothing, and if you are in a jurisdiction where the police can demand your phone or you are stupid enough to hand it over when they can’t, that’s not on Signal.