Signal is fine for almost everyone unless you're truly doing dangerous work in a truly oppressive state.
I'm so tired of everyone telling others not to use signal because it uses phone numbers. Everyone in here acting like they're mr. Robot or something.
Anonymity is not the same as privacy. Privacy is good enough for me
I'm gonna be honest I'm not too concerned about people who aren't on Degoogled ROMs messaging me through Signal. I dont believe Theres much I say over text or Phone calls in Signal that can be used against me. While i do have my threat model to be in a state where I want to prevent as much spying as possible (I use FOSS only unless it is literally not possible, I turn on airplane mode when I dont need data/am on WiFi, my VPN is always on etc), I dont expect others to Switch away from their convinence for me and me only. if I can talk them into switching over time (like I have with my SO and most close family) then Thats great, but if not, Id rather talk to them on Signal than on fuckin Discord 🤢
I don't know how the Play Store version does push notifications, but Molly, and I think the apk from their site, work just fine on degoogled phones without Google services.
I don't remember what name it has, but missing it breaks push notifications on most "normal" apps. Many FLOSS ones are coded to have their own methods that don't transmit data to Google, and it appears at least some versions of Signal do too.
My threat model doesn't include state level actors taking an active interest in me, so for my purposes Signal would be secure enough, if only I got people to adopt even it.
APK and play Store versions are identical. Signal runs a check for GMS/GFS and if that Check returns true uses firebase. If not it uses WebSocket. Signal-FOSS on TwinHelix removes GMS/GSF dependencies though, and Molly-UP actually integrates a way for you to use your own push Server.
Edit: Also if you use MicroG without push notifications enabled default Signal is just broken last I checked.
I have Signal and microG with push notifications. Signal still uses websocket on my device. So, I guess it would be fine without microG push.
You are just spreading misinformation! Cite your sources!
There is a strategy used, which allows the government to find out who an account belongs to. They ask the push providers (Apple/Google) for data on the push token from e.g. a messaging app. This way they associate the account from an app with an identity.
Nothing there about message content. It is still safely E2EE.
~~I don’t know how it works in your country, but in mine, phone numbers are already associated with identities, so nothing gained as the gov can just ask signal for the phone number of an account, instead of having to ask signal and the push provider to get the identity.~~ (Edit: apparently it’s hashed, so there seems to be a use for this.) Signal isn’t about Anonymity but Privacy. There is a difference.
If you have another vulnerability cite it!
good points altough the number is note saved. the hash of the phonenumber is hashed so Signal could not hand out your number, just the hash.
So how can Signal send verifying sms?
They ask the push providers (Apple/Google) for data on the push token from e.g. a messaging app. This way they associate the account from an app with an identity.
Very overlooked point. You can find privacy guides online but very few even suggest that FCM etc. might have privacy issues, let alone explain exactly why. It seems this has already been used by law enforcement in the past: https://www.wired.com/story/apple-google-push-notification-surveillance/
The Molly-FOSS fork of Signal (which aims to be even more secure/private) actually supports self-hosted push notifications using UnifiedPush.
I also found this comment:
As far as I know, FCM on Android can be configured to use a notification payload (which is piped through Google's servers). But for a release app this is discouraged, especially if you are privacy conscious. An app would normally use FCM to receive a trigger and look up the received message from the app's own backend. See here for more information.
Took years to get all the ppl I care about on signal & now the effort was definitely worth the reward.
Why don’t you feel comfortable on signal? Honestly it’s worked out for the best in my use case bc I have ppl that use android, iOS, windows, Linux & macOS, so it’s great to not have to deal with shit media quality or messages not going through bc of all the different operating systems. It’s E2EE so I’m not too worried about mass surveillance within my signal groups.
Also, iOS back door? I must have missed that. Haven’t seen any news about that.
Signal is not my tool of choice, so I'll answer from a more general perspective:
Having multiple friends and social groups on an e2ee chat system for the past few years feels great. Knowing that our words aren't being recorded and exploited by half a dozen companies, we no longer feel the need to self-censor. The depth and value of our online conversations have grown noticeably.
Yes, there is more work to do, both at the endpoints and in the protocols. No, not all of us have flipped all the switches to maximize our privacy yet. That's okay. Migrating is a gradual process. We do it together, helping each other along the way, rather than trying to force it all at once. Every step an improvement.
This is exactly my take. It basically holds for Signal too.
The question of self-censorship is too often overlooked IMO. The knowledge that nobody is reading your messages except their intended recipients is empowering and liberating. No one is filling a database with information about you and your friends, because they can't. You can say exactly what you would say at the dinner table and not think twice about it.
In a police state with mass surveillance (we all know the big examples) you don't have this privilege. Whether or not you think about it consciously, you are constantly monitoring and policing what you say - and therefore ultimately, to some extent, what you think.
I've been in a couple of those places recently. I can tell you that just the banal act of using Signal there (sometimes over VPN) felt almost exhilarating, like jumping the prison walls.
In historical terms, free speech is a vanishing rare thing. It absolutely is not the norm and it bothers me that so many people in the West don't seem to know this. We should not take it for granted.
Yeah, Signal is good enough. If people use shitty operating systems like iOS or Google's version of Android that's another problem and not really one that it's my job to care about that much. What matters is the network effect and every user who moves moves from Whatsapp to Signal is one more person who gains the freedom to easily improve their digital lives further if they someday choose to do so without it costing them the ability to chat with all their friends.
“Feel,” “happy,” “comfortable”… Privacy doesn’t care about your feelings.
And it has also been revealed that american feds are able to read everyone’s push notifications and they do this as mass surveillance.
Speaking of the feds, it was they who funded the creation of Signal, which is one of the reasons it ought not be trusted.
They funded encryption too. Why don't you stop using that?
Wait until they find out who started the internet. Or who runs GPS satellites
Wait until they find out who started the internet. Or who runs GPS satellites
And they never spy on people or track them using the Internet or GPS signals?
Why did you think this was a good argument for supporting privacy?
People think that govt developed = bad. It's a consideration for sure but if anything govt developed is so hopelessly and inherently compromised then many of the measures discussed here are useless for privacy already because they almost all run through internet, a govt created system. Even TOR. But yet here we are anyway because they are still useful systems.
Governments pour tons of time money and effort into secure communication, and not for profit, and we can still take advantage of that advancement with some caution.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)