Layer 8 security issue

The actual military grade (xmpp based) messengers implement security lables, meaning messages are tagged with the required security clearance and if you invite random people to a chat they can't see the messages.

Actually RCS has encryption in the new spec now, and we could see encrypted RCS messages implemented on iOS and Android within a year.

But even so, use Signal.

xmpp is like if deltachat was good

Isn't DeltaChat just PGP encrypted email? Could be wrong

I use signal myself but I also use simple X. I can't use delta chat because I use proton for my email and therefore can't use delta.

at least not when using a public instance - they could fork the project to keep decryptable records on gov servers where the official gov instance would run

All the people in the chat were high enough that the government for free provided them with secure rooms in their homes so everything would be done through government hardware and encryption programs.

The protections for classified information are not just about information security. They are about physical and operational security as well. That's why s SCIF has a "two locks" policy, and requires things like 4" steel doors.

because "they" don't trust the people they "represent" and they want to avoid federal archives

they must know something about WhatsApp that we don't

The government does not "own" Meta. Words have meanings.

Disappearing messages

Signal recently implemented "usernames" instead of phone numbers

Privacy != anonymous

Immediately had that thought as well.

Don't blame the barn for not holding the horses when you leave the fucking door open.

I don’t think that’s the case, I just think it is old people not know how to use technology.

Additionally, all these people in power are using signal, how is that not a loud endorsement that everyone should be on it.

Sadly, my contact list remains mostly on WhatsApp and Facebook messenger only.

Out of band key exchange is great -as long as people can physically meet and exchange QR codes. In reality, they are often sent via less secure means. As always, the humans are the weakest security link.

It does, I tried it. Though, that may have been an addition since the attacks started.

Though, in that specific case - Russian agents conducting espionage via targeted individuals - it's very likely they surveil their targets long enough to catch their device PIN before they nab the phone and return it. In the end, there is very little recourse to defend against this type of Evil Maid attack. Signal is really better at protecting against mass surveillance, but for individuals directly targeted by state espionage? You would need serious opsec, using air-gapped computers kept in safes or guarded by humans 24x7 and other crazy stuff. They have rules about what can be physically done with devices containing top secret information for a good reason.

"The only metadata that Signal would have access to, is the phone number used to register, the date of initial registration, and the date of last use."

https://www.reddit.com/r/signal/comments/exd92f/what_kind_of_usermessage_metadata_is_observed_and/

The issue of centralization can be a problem, but in regards to metadata, sealed sender does a lot to prevent Signal's servers from knowing who messages who, which makes Signal a lot more private than described here.