this post was submitted on 21 Jul 2024

39 points (97.6% liked)

Technology

1282 readers

49 users here now

A tech news sub for communists

founded 3 years ago

MODERATORS

muad_dibber@lemmygrad.ml

Signal downplays encryption key flaw, fixes it after X drama (www.bleepingcomputer.com)

submitted 1 year ago by yogthos@lemmygrad.ml to c/technology@lemmygrad.ml

19 comments fedilink hide all child comments

I really don't understand why so many people like Signal. It's an utter piece of shit in terms of UX, has questionable security practices, harvests phone numbers, and it's located on a central server in US.

all 21 comments

sorted by: hot top controversial new old

[–] landlords_morghulis@lemmygrad.ml 23 points 1 year ago* (last edited 1 year ago) (2 children)

Signal has always looked like a honeypot operation to me. Keep in mind, too that if you run a CIAware operating system, the key can be remotely pulled off of the filesystem or extracted from memory. It's not possible to have any secure piece of software on an unsecurable OS.

[–] yogthos@lemmygrad.ml 9 points 1 year ago

indeed

[–] muad_dibber@lemmygrad.ml 8 points 1 year ago (1 children)

Totally agree, it has an extremely sus history too. No one should be using any US-based centralized service.

[–] ahriboy@lemmygrad.ml 2 points 1 year ago (1 children)

Someone should give SimpleX or Session a try

[–] ComradePupIvy@lemmygrad.ml 1 points 1 year ago

I have tried session, the crypto wierds me out a little, but I could not find a terrible issue with the service. I will say Quality of Life Features where not there, most notable the messageing service would start to heavily log out if you have it open too long

[–] anarchoilluminati@hexbear.net 8 points 1 year ago (3 children)

I wish there were a secure texting app that was as accessible to normies though.

[–] muad_dibber@lemmygrad.ml 5 points 1 year ago* (last edited 1 year ago) (1 children)

https://element.io has a pretty easy onboarding for matrix, that's good for most platforms.

In the 90s-2000s, we had to make new accounts for every forum-type site if we wanted to use them, but nowadays it's assumed that ppl aren't smart enough to do that anymore.

[–] ComradePupIvy@lemmygrad.ml 3 points 1 year ago

hey how dare you say something so hurtful yet so true

[–] Bart@lemmygrad.ml 5 points 1 year ago

Briar works pretty good

[–] yogthos@lemmygrad.ml 4 points 1 year ago

would be nice

[+] porcupine@lemmygrad.ml 8 points 1 year ago* (last edited 2 weeks ago) (4 children)

[deleted]

[–] ksynwa@lemmygrad.ml 9 points 1 year ago (1 children)

I have zero expertise in this but xmpp is an old decentralised technology with encryption available

[–] landlords_morghulis@lemmygrad.ml 6 points 1 year ago

You can also layer encryption on top of xmpp like omemo and openpgp

[–] muad_dibber@lemmygrad.ml 7 points 1 year ago

Matrix. It can be hosted by anyone, anywhere.

[–] Bisexual_Cookie@hexbear.net 6 points 1 year ago (3 children)

matrix? but that is more of a discord or telegram alternative, session and tox also look interesting for chatting

[–] landlords_morghulis@lemmygrad.ml 9 points 1 year ago* (last edited 1 year ago) (1 children)

Matrix (as a protocol) appears to be very strong end-to-end encryption and is federated/decentralized. It can do encrypted and unencrypted chats for any number of users, so it can replace discord (which is not at all private or secure) and do private 1:1 communications (which I'd say is the best use case for it). It also does not require a phone number like signal does (which is usually tied to your legal identity and can be used for geolocation).

I wouldn't trust any electron apps, which is the framework the official Matrix client, Element, is built on. It's fully open-source so there are other clients out there which may be better. Of course, the biggest weakness is probably going to be the OS/firmware of device you run it on.

Edit: The desktop element clients rely on electron (which is a webapp framework built on google chrome, which is spyware). If you're on android, the app also renders in chrome (which is spyware), but that matters a bit less because android itself is a massive pile of spyware. iOS is also spyware that openly just copies all your files to a server in the US where they are "scanned for very bad things", retained indefinitely and may be accessed by your favourite state agencies without warrant.

[–] muad_dibber@lemmygrad.ml 5 points 1 year ago (1 children)

On android, element, and it's newer version element X, are native android, not electron at least.

[–] landlords_morghulis@lemmygrad.ml 3 points 1 year ago

Thanks, I should have been more specific.

[–] ComradePupIvy@lemmygrad.ml 5 points 1 year ago

Session is, fine, but the app can get really laggy at times of you are in it for a long period of time, pr especially if you scroll to an older message, this is my experience using it

[–] Imnecomrade@lemmygrad.ml 3 points 1 year ago* (last edited 1 year ago)

Isn't Signal very similar to Telegram but focused on "security" and less features? Revolt is more like Discord. Matrix feels more similar to XMPP, and I see it as a compromise between Telegram style and Discord style. Matrix works well as a one to one chat as well as a team collaboration chat, but audio and video chats are very laggy. Self-hosted Jitsi would serve as an alternative to video and audio chats.