-20
Signal is just a company selling privacy
(lemmy.sdf.org)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 05 Jul 2023
-20 points (37.5% liked)
Technology
58133 readers
4383 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
Signal is operated by a nonprofit tax-exempt charity corporation in the United States.
Could you please be more clear about exactly what you are saying here?
Edited: The original poster has provided no evidence for their defamatory statements.
Signal has a single point of failure. If we really want a service that can't be taken away, then we need a free, open source alternative that is impossible for a single entity to control
That single point of failure is to facilitate ease of use, with minimal reduction in security.
The messages are e2e encrypted and the server is designed in such a way that attempting to listen in would bring it down.
The signal org doesn't even have your address book.
If your concern is "I don't like signal", you're not going to make much traction.
Briar is an app that is just as easy to use, plus you dont need a phone number, so it is easier. Yet it has no point of failure and it was simpler to write. It is P2P, uses tor, you dont get better privacy and security than that.
You dont know what their server is running, you cant prove that. They can release the code, but you have to trust them that they are running that exact code.
Ease of use is an excuse, they have a centralized model. That is a big flaw. There is more to security then E2E, xmpp clients have E2E as well, they use the same algorithm.
SimpleX also seems pretty promising and is more cross platform than briar. I'm self-hosting a server for my immediate family.
I think XMPP is more well-known than SimpleX, I simply mentioned Briar for the sake of possible ease of use argument over some XMPP clients.
Could be. I was just giving another alternative. I've had better luck with both SimpleX and briar than some of the other options I've tested.
I'm not goin to shit on Briar, I hope they build out their dream.
It's fundamentally not as easy to use.
My Grandma already has a phone with a full addressbook.
If she's told to install Signal, it'll just work as a drop in replacement for iMessage.
Briar meanwhile suggests sharing your contact info using another such as signal: https://briarproject.org/quick-start/#:~:text=When%20you%20choose%20%E2%80%9CAdd%20contact%20at%20a%20distance%E2%80%9D%2C%20Briar,choose%20a%20nickname%20for%20them.
Briar is chasing different goals.
The only part that is easier to use on Signal is also a serious privacy concern of sharing your phone number.
With decentralized apps you always have an option to add that feature, while with centralized apps like Signal you have to accept that your privacy is damaged.
In short, this argument for phone number is another argument why decentralized apps can be as user friendly as centralized, but not the other way around.
I see your point, but what threat and their level of sophistication are you trying to avoid? The number is used just for registration. You can get a burner phone if you're worried about sharing your number.
In less and less countries we are allowed to buy phones and sim cards without an ID. Phone network is a centralized system, controlled by governments, we can't depend on that for privacy. The main treat to privacy has always been the current ruling government, they fear privacy, because they fear people organizing against them.
I'll give you not being able to buy SIMs without an ID; I didn't know that. But the rest is not as accurate. You should probably just not use a computer or phone to ensure complete security.
I wouldn't if that was a viable option. Today it is not really possible to not use technology, even not using mainstream apps will make you socially isolated and unemployable (which due to lack of decent social services, is a death sentence)
I'm not OP, I'm just explaining.
Okay. Which one are you building?
I'm not, I'm just explaining OP's post.
We have that in XMPP and Matrix. The problem is then to talk to people on it they all have to join the server on which you host your build. What if that server goes down? If you pay for hosting you're putting it into the hands of another corporation. If you self-host at home, what if your electricity goes out? Your internet gets cut off? Is everyone you convinced to ditch signal going to be happy and willing to sacrifice their convenience and ability to talk to people they want (or need) to talk to over ideology?
If we get hit by a big enough solar flare, everyone will be communicating by pigeon again. You make valid points. I haven't actually used XMPP before and only just started with Matrix. I think OP is right that we should keep an eye on alternatives for when/if the time comes.
Every non-profit organization I know of was run as a company. Non-profit is for organization, not for people, you can still pay yourself a nice salary and trips around the world, expensive dinners and so on. A lot of non-profits I know of extract every cent from the donors, which are often big companies like Google, by making an invoice for a clearly overpriced service at company owned by their friends, that send them the money back.
Being a nonprofit tex-exempt charity corporation in United States is no defense of their character, their interests, nor their capability to provide a quality service or withstand a legal pressure.
I will be perfectly clear then, you cant trust them and you cant depend on them. Reddit was a good open service once, now its dying, we need to move to Lemmy. Same will go for Signal. They still work with police, still give data such as phone numbers, when you created your account and we have no proof that they are not storing your IP, when you are sending and getting messages (so they can do a timing attack to figure out who you are talking to, if they don't give that info directly).
I don't need proof that they have done something wrong to prove a point that no single entity should be trusted when we have the technology for over 20 years now that makes that unnecessary.
How do I trust a random XMPP server more or as much as I trust Signal to protect my data? You’re telling me if the government comes knocking for metadata on some user on a small server that the owner isn’t going to just give it away? What about anyone else on other connected servers?
You’re asking me to trust someone who hasn’t shown that they’re actively working towards privacy goals vs a centralized solution from a company that’s shown they care about privacy?
Either way, you have to trust someone to take care of your data and I do not trust a small server owner more than an entity that’s proven they do not give information to governments. Gotta pick one of two evils, I guess.
I never claimed that you should pick a random server. You can pick servers run by groups that have just as good record of privacy or even better or are run by the person you know or yourself.
When you have a decentralized service you can choose who you trust, you are not stuck with one corporation. Picking a completely random server is the worst possible example you could have chosen.
Maybe I’m misunderstanding XMPP but does it not federate? Does it not mean that on top of trusting my home server I have to trust the choice other people made with theirs?
Why would you need to trust their choice? The only data that is sent from your server to theirs is your username (called JID in xmpp terms) and E2E encrypted message. The worst thing their server can do to yours is to send you a message, if your server decides to pass it on.
Wouldn't you have to trust that they're not logging your IP and/or storing your messages?
XMPP clients support end to end encryption, so the servers only get encrypted messages. Also unlike Signal, XMPP clients support use of Tor to hide your IP.