When Signal was designed, our threat model was protecting the communications of civil society, journalists, just regular citizens ...
The threat model of military operations & sharing your hate of Europeans was not what Signal was designed for. Ephemeral messages and cryptographic deniability are not fit for communications that require accountability.
But I appreciate their effort to make government more efficient by adding journalists to the chat instead of requiring to go through FOIA.
Trump said “Signal could be defective, we're going to have to find out”.
And now we hear that Elon and DOGE are getting involved.
I don't know how to say this respectfully, but the go-to Elon person in DOGE for Cybersecurity doesn't seem at all up to the task. It's the person who designed the flawed encrypted DMs on X, which very much are defective ...
https://thehill.com/homenews/administration/5215547-white-house-asks-musk-investigate-signal/
@fj Blame the tools rather than the obvious operational fuck up: "‘Elon Musk has offered to put his technical experts on this to figure out how this number was inadvertently added to the chat, again to take responsibility and ensure this can never happen again’ she added."
It was added because they were inadvertent. Because they didn't follow procedure and rules.
And in a fascistic mindset, given all that matters is power and the power balance, this is just another way to test their power.
@hans
This is the unfortunate byproduct of centralization.
Not everything has to be federated, until the BDFL looses their citizenship.
BTW, Signal seems to be on the @guardianproject repo (available in @fdroidorg, but turned off by default).
@fj
Sorry to barge in - but, it seems to me, this is yet another example of shifting the narrative.
What matters is that Signal was not approved for sensitive comms. (One would hope that approved apps are, to the extent possible, checked for defects). They were using it, contrary to THE LAW, both for convenience and quite likely to avoid official records of the communications. THAT’S the story.
@bdf2121cc3334b35b6ecda66e471 @froge @fj maybe but it's better than a #proprietary, #SingleBendor & #SingleProvider solutiom as it just works even on #throttled, sub-#2G speeds over #Tor...
@[email protected] @[email protected] I'm not replacing @[email protected] with *"random tools"* but good options. Like @[email protected] & @[email protected] as well as @[email protected] / #monoclesChat & @[email protected] which owrk flawlessly over @[email protected] / #Tor using @[email protected] / @[email protected] / #Tails and @[email protected] / #Orbot respectably. - Also these allow not only #SelfHosting but just work and I'd highly recommend #monocles as a hoster which finances iself by users paying *and* allows #anonymois accoubts & payments including not just #Monero but also #CashByMail! Considering the costs of even acquiring and upkeeping an #anonymous #SIM, I'd rather pay €2 p.m. for #XMPP+#OMEMO and #PGP/MIME-supported #eMail with thr option of self-custody than $2,50+ p.m. just to keep a phone number. - Plus I don't run around with a #tracking device that could be used to #deanonymize me any second...
@froge @fj I'm not replacing @signalapp with "random tools" but good options.
Like @delta & @thunderbird as well as @monocles / #monoclesChat & @gajim which work flawlessly over @torproject / #Tor using @tails / @tails_live / #Tails and @guardianproject / #Orbot respectably.
Considering the costs of even acquiring and upkeeping an #anonymous #SIM, I'd rather pay €2 p.m. for #XMPP+#OMEMO and #PGP/MIME-supported #eMail with the option of self-custody than $2,50+ p.m. just to keep a phone number.
Or is anyone here expecting @Mer__edith to risk jail for life amd not comply with #CloudAct?
It stenches like #ANØM, because NOTHING IS FOR FREE and running a #VCmoneyBurningParty is expensive...
@[email protected] If your #OpSec, #InfoSec, #ComSec and/or #ITsec relies on @[email protected] and/or @[email protected] [risking jail *or worse*](https://web.archive.org/web/20210908180219/https://twitter.com/thegrugq/status/1085614812581715968), you fucked up! - If #Signal was secure, it would've been shutdown like #EncroChat & #SkyECC. Seriously, to me #Signal stenches #Honeypot like #ANØM & #CryptoAG. - All Signal fans do is #FUD #PGP/MIME and#XMPP+#OMEMO which are truly #decentralized and allow real #SelfHosting as well as #SelfCustody for complete control of all the data and keys... That's why I get people setup with it!
@froge @kkarhan @fj decentralization is something you generally dont want, unless you properly solve it at the protocol level. Thats why matrix sucks and will always be inferior to a centralized solution like signal (unless fixed at protocol level, which most likely wont happen).
and yeah, most "competitors" arent really ones, if they think PFS is optional ...
@kkarhan @froge @fj @signalapp @delta @thunderbird @monocles @gajim @torproject @tails @tails_live @guardianproject @Mer__edith Signal has been asked for data before. I believe they responded that they have the timestamp the user registered and the timestamp they last logged in, and nothing else.
The CLOUD Act does not allow the US government to force Signal include a backdoor into its clients.
@alwayscurious @froge @fj #CloudAct alone not, but it's just the tip of the iceberg.
Again: The only #security is #decentralization!
#Signal is as vulnerable as #EncroChat if it's not a #Honeypot like #ANØM!
@kkarhan
PGP leaks metadata by design, and doesn't have forward secrecy by default.
(There is sequoia-pgp, that supposedly “unstuck” the PGP development, but being OOTL I've missed it.)
https://www.latacora.com/blog/2019/07/16/the-pgp-problem/
XMPP+OMEMO has a lot of problems.
https://soatok.blog/2024/08/04/against-xmppomemo/
You're left with Matrix, which has some problems, with a wonky security culture (like not hard-depreciating libolm) and leaking metadata.
Still, if you're against Signal, you're left with Matrix on the top.
@dzwiedziu @fj @signalapp not really, as the #Metadata #FUD cited by #Signal is mitigateable with proper measures.
Every claim that things like #ITsec, #InfoSec, #OpSec & #ComSec can be solved with "Just use Signal!" is "#TechPopulism" at best if not being a "#UsefulIdiot"!
Reminder: #Trump kept #topsecret docs in his shitter.
This #administration isn't serious about #security because this administration is purposefully and intentionally making us weaker in soft & #military power for #Russian benefit.
It's a feature, not a bug.
@fj sharing your hate?
Did you read the release? There wasn't hate of Europeans. There was only discussion of the terms of partnership and normal concerns of political framing.
@maccruiskeen ha, I'm not sure you can see where he stands in regard to Europe 🙂
Because I read that exchange in the complete opposite way, talking about the outlines of strategic partnership and how the different groups interact, which has absolutely absolutely nothing to do with hating or not hating Europe.
At worst it's neutrality when setting the terms for partnership. But I think it's more about supporting Europe to follow a path that he thinks would be better for everybody, Europe included, promoting European success as he sees it.
So no, not hatred at all. Support if anything.
Maybe it takes more understanding of the context in which these statements are made, though. It's just like how many misinterpreted Trump's stance on NATO during his first term.
@maccruiskeen to be clear, I'm not saying I agree with it.
Keep in mind that the culture these guys are coming from is shallow and thinks it knows better what everybody should be doing, and when it can it sees a moral Duty to impose that better option on others.
So it's not a weird idea of support. It's actually a very common idea, too common in my opinion, thinking they can help people by telling them what they should be doing.
This is just one example of it. There are so many, but maybe it's something to keep in mind when trying to understand what this administration is doing.
@maccruiskeen Well think of it this way: have you ever had a family member, maybe an older one, who thinks they know what's good for you better than you do? Who has inappropriately tried insert themselves into your business with the best of intention even if they're, well, full of it, and it's not appreciated?
Yes, a couple of these people are sociopathic fucks. I actually agree with that.
But I think a lot of them are just well-meaning but really really stupid, and really really out of touch, and really disconnected from reality.
I think it's a really common experience when somebody with best of intentions tries to tell you what to do with your own life because they think they know better, even though they're completely off base. I think that explains a whole lot of what we're seeing out of the folks in charge right now.
Yeah, and that's not hatred. In context of support provided by US policy over the course of administrations that even has more to say about the US than about Europe.
This administration has been describing previous US policy as giving too much, so this is a continuation of complaining about the direction of US policy over administrations, and a pivot based on themes of the campaign that got them elected.
Not about Europe, about the US.
@fj of course Signal is no different to WhatsApp...
Both are secure BUT not if you ask someone outside your intended group to join of course and shouldn't be better used for government meetings and secrets for many reasons...
Not least that these w**kers are doing it so as to avoid all the oversight and scrutiny that was put into place over such things as email - all government communications are supposed to be kept - (Trump's argument was about this exact issue with Clinton using a private email server in 2016!!!)
@fj I know this was just a joke, but is there any work on what sorts of communication practices and protocols would be appropriate for both accountability and security?
i.e. non-repudiable, verifiable, archived in a way that can be revealed to legitimate authorities, court orders, or enough time passing
Ákos Dián
Frédéric Jacobs
Soatok Dreamseeker
Sophie Schmieg
GunChleoc
αxel simon ↙︎↙︎↙︎
Tom DB 🦣
Sabrina Web 
📎
Hans van Zijst
Dźwiedziu
Scott Wright 🏳️🌈🏳️⚧️
pablonatalino
Bill
Wendy Nather
bdf2121cc3334b35b6ecda66e471
Jen
Kevin Karhan 
CyberFrog
Brahms
Demi Marie Obenour
NosirrahSec 🏴☠️ guillotine enthusiast
john r red-horse
Bandersnatch
Ozzy
volkris
MacCruiskeen
irelephant
Optimistic Moron
Kim Possible 
CockneyLaurie
przemelek
Neil Kandalgaonkar
RejZoR
dirtside
obscurestar
Darwin Woodka
BetsyStansell