I know, it’s just a “Someone Is Wrong On The Internet” piece, but that NYTimes piece about Why Signal Is Bad And Privacy Is Bad needs to be refuted in a compact explainer, so here’s mine: https://www.tbray.org/ongoing/When/202x/2022/12/29/Privacy-is-OK
Privacy Is OK

ongoing by Tim Bray

@timbray My biggest issue with Signal is it's not federated. Signal won't let third party clients on the network.

Also, the protocol does have flaws around metadata.

But these are minor complaints. The overall message is good. We must have end-to-end encrypted communication. Signal is a great start!

P.S. I wrote my own p2p end-to-end encrypted communication system. love p2p and encrypted communications 🙂

@timbray Point number 1 is very funny. Of course, according to Reid Blackman, “law enforcement” means “the good guys”. The only good country with good guys being the U.S so therefore basically any U.S government official who carries a badge counts and they get unlimited power to look at anyone’s phone at any time.

They are the good guys so therefore it is impossible for them to abuse that power.

@timbray thanks for writing this, the NYT piece is deeply flawed but sounds very plausible at first glance 😐

@timbray There's _always_ an XKCD for it:

https://xkcd.com/538/

Security

xkcd
@timbray 100% agree. And the ‘good guys’ are well know to abuse warrants and do a terrible job keeping track of even legitimate ones. FISA warrants, you would think, would be well documented and hard to abuse. Not so: https://www.lawfareblog.com/fbis-fisa-mess
The FBI’s FISA Mess

The inspector general’s latest report on FISA implementation at the FBI is not as bad as it looks, but it’s not good either.

Lawfare
@timbray You say "There have been no credible proposals for taking privacy away just from the bad people" which I don't quite understand . . . a cop can suspect something and search your car for instance. And courts have broad powers to invade your privacy.
@tooshel In the specific context of e2e encryption I mean
@timbray No proposals as in we don't have a PKI like standard that includes Alice and Bad Bob and Cop?
@timbray Not to lean too much on credentialism, but Reid Blackman seems to have no technical credentials at all. And may have written this piece just to tell his would-be clientele what they want to hear anyhow.
@timbray I disagree Tim...it isn't just "Someone is wrong on the internet"....this is a major media organization pushing feudalism.
@timbray Well-said. Thank you. Because as much of the general public knows, the 'good guys' are not always good.
That the piece came from a guy whose job is 'AI ethics' is concerning. :/
@tankgrrl @timbray couldn't agree more. The most concerning bit for me is that there will be plenty of tech-unaware people that will buy into that, only because it's published by an authoritative source

@timbray

I live in a country where when some policy was being reversed that hurt the people the original policy was intended to help, the Prime Minister was quoted as saying, off camera, "We'll write an Op-Ed."

The article you criticize justifiably, is a lobbyist's or representative's op-ed about something about to be attacked.

Lets fight it, refutations should include warnings about the actions implied by the excuse. [ The article is an excuse for a planned for action ]

@timbray Wtf is going on at NYT lately?
What broke the New York Times?

The New York Times entered the digital era under duress. In 2011, the Times erected a paywall in what it called a ‘subscription-first business model’. The gamble was that readers would want to pay for quality journalism. It was a risk, and at first it didn’t seem to be paying off: after a challenging 2014, […]

The Spectator
@mjgardner @timbray Sad but true. Honestly it's not like I've ever subscribed to an actual print newspaper (I am the problem lol) but the drama seeped into my Crosswords subscription over the last couple weeks, which made me a little uncomfortable.
@timbray you make some excellent points. Criminals have always used covert methods to communicate. That's not the problem. Back dooring encryption is an idea founded on ignorance. Promoted by people who see answers where there simply aren't any. Usually politicians. They appear to be relying on the assumption that if you repeat something often enough it becomes acceptable. #nobackdoors #encryption #DumbIdeaOfTheDay
@timbray what do you think about their MobileCoin? I almost wanted to talk my family to switch to Signal, but right then they introduced MobileCoin in their app. I am actively hostile to cryptocurrency. For me it's bad smell.

@tdtran Agreed. But IIRC Signal has never pestered me about it or even mentioned it. So it’s easy to ignore.

Good interview with CEO gives a flavor for what kind of people they are: https://www.theverge.com/23409716/signal-encryption-messaging-sms-meredith-whittaker-imessage-whatsapp-china

Why Signal won’t compromise on encryption, with president Meredith Whittaker

Signal messages are more private than iMessage and WhatsApp, and the app recently killed its support for SMS as part of its effort to not compromise on security.

The Verge
@timbray I keep getting stuck on: "Whether law enforcement should tap our phones on the condition that a warrant is obtained is, at the very least, worthy of public discussion. Signal has unilaterally decided for us all." Setting aside the issue of "unilateralism", how is Signal's set of features a unilateral decision "for us all" when -- as he must know -- more people don't use Signal than do use it?
@timbray What I find worrying about this is not the piece itself - it’s an argument that has been raging for some time (in UK at least as part of online safety bill, not sure about US). What’s worrying is that it is placed with NYT, a solidly left leaning paper. Who or what is behind what feels like this quite deliberate political placement?
@charlesroper
The NYT hasn't been reliably left-leaning for a while now, though.
@timbray
@kitrona @timbray Yes, that's the point. They're a left leaning paper. This is not the sort of story you would normally read in such a paper. So why now? I can't believe it is simple ignorance. But I'm not exactly tuned in to the details of American politics, so maybe this sort of message is pretty normal for left of centre media?
@charlesroper
No, they're not left-leaning, and haven't been for quite a while. That was my point. They haven't been left-leaning at least since they started supporting attacks on trans people by allowing anti-trans articles by transphobia to be published. This article is not surprising.
@timbray
@kitrona @timbray Ah, maybe that's it then? (Sorry, I misread what you originally said)

@timbray Ofc Banning signal wouldn't stop the bad guys from using e2e.

I think it is feasible for nation-state-scale surveillance to determine who is talking to whom, from message size and timing correlations alone. Occasionally I wonder if these ridiculous pieces are a counter-op to "reassure" criminal or terrorist networks to stay on signal.

It'll be interesting to see if any messaging e2e platforms escalate to using noisy channels and mix-networks or Tor tricks to evade even that.

@timbray i just went and read it. jeezers that sure is a bunch of words

@timbray It’s indefensible. But to be absolutely fair, it is an opinion piece not news … and not even an NYT columnist. Which is a mild surprise. Anyway. Just clarifying.

(Also adding this to my list of reasons news orgs should ditch op/ed.)

@timbray What’s wrong with “Someone is wrong on the Internet” articles? They constitute most of it, don’t they?

@timbray Well said.

As a famous NSA whistle-blower once said:

"Saying you don't care about privacy because you have nothing to hide is like saying you don't care about free speech because you have nothing to say."

@timbray NYT is not much more than a govt mouthpiece anymore. There is still the occassional piece that's informative, but there are also many pieces seem to sympathize with, or at least downplay the threat that extremists pose to the country currently.
@timbray
Not surprised, sadly, that they would actually try to get ppl to think we should be spied on for our safety. What a bunch of...yeah. IC watching everywhere else, but silent about J6/21, hasnt prevented attacks on power stations across the country. Didnt even prevent the guy in Nashville from blowing up an RV in downtown Nashville a few years back.

@timbray
doesn't look to me like that.

more like another piece trying to explain apparent illiteracy about democracy, communication and basic civil liberty rights things, when in reality it refers just to another intent to maintain actual power structures and in any case expand those because "they can".

The NY peace is just another pay'd hit job, #mercenaryJournalism to stay in power and expand existing power structures.
#journalism

@timbray People have been communicating in secret codes for centuries.

The "personal columns" on the local paper was a common way for people to communicate in secret -- long before Western Union and friends started stringing wires across the US continent.

The International Telegraph Union waged a cat-and-mouse war on "secret codes" over telegram services for decades.

Me choosing to reply to this message, or phrase it the way I have, "could" be a signal to someone. How would you know?

@timbray We use @signalapp at work regularly. Love it.
@timbray It's weird seeing a Crow Wing County mention in the wild
@jonas_trostle Extra points if you can figure out why that county got my attention, although AFAIK I’ve never been anywhere near it.

@timbray it was the MyPillow guy election thing, wasn't it.

At least it's a beautiful spot.

@jonas_trostle
So, I subscribe to "Google alerts" on my name and get occasional emails when I get mentioned in some publication or another. I get way more emails about the exploits of Tim Bray, chief engineer of Crow Wing County, who is much in the local news about intersection upgrades and drainage issues.
@timbray couldn't read the NYT article, did he bother to mention that dispute having access to the vast majority of Jan 6th communication, the 'good guys' proceeded to do nothing?
@damomurtagh @timbray wonderful point! I was going to point out that it seems we have a sh*tload of criminal records on certain (former) politicians and nothing happens. So it’s not about privacy or encryption, it’s about the missing will to do something, but still asking for more and more data.
@timbray Between this and their recent SBF hagiography / apologism the NYT is not looking good lately.
@timbray @mmasnick wait, wtaf, is someone thinking when they are seriously arguing that "privacy is bad" as if it's a claim that should be respected rather than just disregarded as on its faith ridiculous and wrong. Has anyone checked if he has law enforcement connections because this just sounds like a cops take.
@weems @timbray as @cathygellis said, it reads as if it were written by a wiretap.
@mmasnick @timbray @cathygellis or..by an FBI Agent or Congressman, basically the same thing?
@mmasnick @timbray @cathygellis and they think that saying "police officers are violent civil liberties violating monsters" is extreme but that "privacy is bad" is not.
@weems @timbray @mmasnick He's an "AI ethicist and virtue consultant" - i.e. professional grifter
@andrea @timbray @mmasnick an ethicist that thinks "privacy is bad" is an acceptable claim? Must never have any of his claims challenges, and I worry what that means about his view of ethics, generally.
@weems @timbray @mmasnick ethicist the way Leon "wisdom of repugnance" Kass was an ethicist I expect
@andrea @timbray @mmasnick can you be called an ethicist, if you don't have ethics 😅
@weems @timbray @mmasnick plenty of people will pay good money to be pronounced ethical or to have their enemies pronounced unethical
@andrea @timbray @mmasnick that in and of itself is unethical, and they just don't even see it, ignorance that thick is kind of beautiful.
@timbray Thank you, Tim. While it is implicit in your comments about the mathematics, it is worth making explicit that even getting rid of signal doesn't ensure the bad guys don't encrypt all their messages. They just put some bright people to re-apply the mathematics in a new (not publicly available, and more difficult for "law enforcement" to access) app.
So making a hole in signal means that bad people get good people's data, but "law enforcement" doesn't get the bad people's data anyway.
@timbray Very nicely done. These points have been valid for decades now.

@timbray Most everything I've seen criticizing Signal as dangerous has a story like the following. We know what happened, the FBI did police work and a suspect turned over their phone. Encryption isn't stopping the police from catching criminals - if they want to.

"When the F.B.I. arrested several Oath Keepers for rioting at the Capitol on Jan. 6, 2021, one of its primary pieces of evidence was messages on Signal. (It’s unclear how the F.B.I. got access to the messages in this instance...)"

@timbray I bet it was sponsored by meta or something

@timbray People at #NYtimes don't realize that #PrivacyIsAHumanRight and not negotiable.

Period!

Fecking #TechIlliterates....

Uncrackable Pen & Paper Cryptography

YouTube