496
Even State Department-funded Human Rights Watch admits that authorities combine legal and illegal methods to obtain convictions: https://text.hrw.org/report/2018/01/09/dark-side/secret-origins-evidence-us-criminal-cases
Combining dragnet surveillance with device hacking is intended in the design of both tools. Hence, State Department-funded Signal dupes you into handing over your identity as part of the population-centric mapping. In custody, your phone will be hacked when it is taken away if it's important.
https://xcancel.com/hannahcrileyy/status/2034273723667161480#m
I really don't get the big "use signal" push at this point in time because even if it's private and the encryption is solid, it's a fucking American company. It's so easy for letter agencies to get information on their users from them, don't you realize that they can't refuse to give out your number if they ask for it and that once they have that your identity and location are immediately and thoroughly compromised? If you are subject to US jurisdiction and could be seen in any way as opposing its government, I really don't think you should be using it.
Because the other options most people are aware of are by and large even worse? Would you prefer people were sending this shit over Facebook messenger?
All giving out your number provides is that you have ever used Signal.
They're saying ever using a private chat service is terrorism. That's not really on Signal.
All your phone number provides is that you have ever used signal? Not what tower you're connected to and therefore approximate realtime location? Your full identity via your telco? Social graph and history of your calls and texts?
I'm not saying it's their fault or that they are volunteering any information, but that's how it is for any US-based corporation (doesn't matter if it's a nonprofit, any legal entity that can be subpoenaed)
The government already has access to every phone number in existence. They can already track every phone to figure out who attended a protest or whatever. Filtering down to "all phone numbers who've ever connected to Signal" doesn't exactly narrow anything down. They don't have any metadata about who you were chatting with.
They used to publish them in big books, even
that's precisely why you should not trust services that require it as private. phone number = identification.
plus apparently your government considers you a terrorist if you do.
This is fundamentally not how Signal works, but you are generally correct in that a phone number has been shown to provide a lot of context for a person (or a device, at least). But Signal (the app) only uses a phone number for initial verification of an account. You have a lot of options to break that association with you - use a landline and get a call verification code, use a VoIP number (assuming you trust the provider), use a burner SIM, etc.
Once you have an account, you can choose to identify yourself on the network solely via username so the registration number is not presented to other users. The Signal protocol itself is well-audited and generally secure.
If your issue is with Signal the American company, use an open source fork like Molly with your own UnifiedPush instance. Then you're only trusting them with transport of your encrypted messages, which again have shown to be secure at least in public audits.
it all does not matter when most people register with their primary phone number that is already tied to their name
I still don't get it. What is bad about signing up with your phone number? All readable Info that governments can force out of Signal is. "Yep this guy uses Signal, signed up last year" so nothing is lost (except if they use that as a sign you are a terrorist, but then they just wanted to monitor you anyway in the first place)
exactly. what is the question?
also its not "monitor me" and "monitor you", but "monitor whoever is using the service" more closely, and as it seems, retaliate against them.
The question is: What privacy do I loose by signing up to Signal with a phone number instead of hypothetically a username.
If you are being monitored, they know your phone number. With that they know you are using Signal, but nothing more. Messaging through Signal is safe.
If you are not being monitored, nobody knows you are using Signal. Messaging through Signal is safe
if you could sign up with a username, your account couldn't be linked to a real world identity. also the government wouldn't have a phone number to send state malware to (unlike signal the telephony system is full of security vulnerabilities)
if you personally are monitored then yes they know your phone number. but here it's the other way around. you became a person of interest because you use signal.
no. everybody who has the power to issue data requests to signal, and also has access to a database binding phone numbers to identities, knows that you are using signal.
Ah ok now I get what you mean. Hashing for phone numbers is ineffective so it's a two way lookup. Is the population using Signal small enough that this doesn't just equate to surveiling everybody?
If the only data surfacable from Signal is the phone number, not the crypto conversation, they didn't source you on signal and get your number, they got your number through other means and used it to prove you use signal.
They can't see the conversation to contents to supoena the number to id.
i'm convinced the big push for signal is a CIA op. not that it's necessarily signal's fault, it could be and it could not, but setting signal as the defacto private alternative is weird.
better than whatsapp at least i guess, but that's a low ass bar to clear.
We know it's an op, RFA does damage control for signal:
Because its one of the only popular secure methods of communication thats app based.
It's not a company it's a nonprofit foundation. And they've been audited many times by independent auditors.
Sorry but both points are irrelevant, nonprofit foundations can still be forced to turn over user information. That is part of following the law so nothing that would need to be hidden to auditors, unless you were talking about encryption audits which is completely besides the point
What data is there for Signal to turn over? Can you prove that they're keeping messages or logs on their servers that have 'disappeared' from all the associated devices?
Your entire social network graphs, and timestamped message history.
No one can "prove" signal doesn't store everything. If you give me ssh access to their server, then I can verify. Otherwise it's "just trust me bro".
What do you think an independent autit does?
But not the messages, and that's basically all that matters
LOL no is not.
Its the largest part that matters, because if they don't have that, they cannot secretly snoop into everyone's plans (and share that info with ice/dns/etc.)
Relevant xkcd.
If someone is already a suspect of something and they have the social network graphs of them they can cross the information and put others in the watchlist. Enough suspects interacting with each other can lead to a more thorough investigation and extract information by other means, it's not like things like ICE cares for human's right.
the irrededeemable fact that you are using it, which matters because the government now just targets all the signal users. they can't read your messages, so they are applying guilt by association.
The audits determined they don't have any user information to provide. You can see this in previous government requests where the only thing provided was a timestamp of last connection to the network.
and the phone number, which is clearly user information, now being used against the users