this post was submitted on 28 Aug 2024
537 points (96.5% liked)
Privacy
32103 readers
953 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
My reply from the other thread. People who claim this isn't true aren't being honest. The phone number is the key metadata. Meanwhile, nobody outside the people who are actually operating the server knows what it’s doing and what data it retains. Faith based approach to privacy is fundamentally wrong. Any data that the protocol leaks has to be assumed to be available to adversaries.
Furthermore, companies can’t disclose if they are sharing data under warrant. This is why the whole concept of warrant canary exists. Last I checked Signal does not have one.
https://en.wikipedia.org/wiki/Warrant_canary
JWZ seven years ago: Signal
Wow didn't even know about that, what a shit show. It's so weird how Signal has become a sacred cow in the west now, and you can't have a rational discussion about its many problems without a whole bunch of trolls piling on saying you should just put faith in Signal unconditionally.
It is a decent app, it does what it says. Daddy can't read your shit until quantum break encryption.
Real question is whether it is a honeypot to make edgelords feelz good. Strong allegation, no doubt but we are also in the grey zone it seems. Based on that, you have to assume, they are farming the info at least to the security apparatus.
That's my view as well, the only way to know that data isn't being used for adversarial purposes is not to share it in the first place. I think it's fine to use Signal as long as it's an informed choice. The primary issue I have is that people don't seem to want to accept that Signal collects phone numbers and that this could be used in a nefarious way. It seems to be an ideological stance as opposed to a rational one.
The app (locally, on your device) checks if someone from your contact list installed (became available) on Signal, and if they did, you get notified by the app.
Someone can get notified only if they already have you in their contact list (so they already have your phone number), and have Signal installed.
I still wish you could choose if you want others to be notified tho...
phone number isn't just any metadata; it is the anchoring data around which the rest of metadata is collected, and it is also connected to govt/corporate verified real identity.
why would anyone even claim to offer privacy around such an anchor ?
Exactly, especially when we're talking about the US government that has access to all the data from other large US based media companies like Google and Meta. We know this for a fact thanks to Snowden leaks. Once you have a phone number, you know the identity of the person, and you can trivially cross reference all the other data to see if that person is of interest. And thanks to their Signal connection graph, the government can easily tell what other people they communicate privately with.
So what? I'm sure your neighbor couple talk privately to each other most of the time and you know that happens. The important part is that the conversation is private.
Signal is not an anonymous messenger app. It never claimed to be. It's for you to have a private conversation where your device holds the encryption keys.
Not like WhatsApp, where Meta has access to the keys of all conversations. Also 95 % of the worlds population is on WhatsApp, so why don't you go and complain to them for lack of privacy and security?
If you want an "anonymous" chat client they are out there to use. Good luck getting more people onboard other than your savy friend.
If you understand that this information is being leaked, and that's not part of your threat profile that's perfectly fine. The problem is that a lot of people don't seem to understand the implications of Signal harvesting phone numbers, and therefore make bad assumptions regarding the safety of using Signal. It's pretty clear that a lot of people aren't conscious about this in this very thread in fact.
yes most people seem oblivious what mass bulk data collection can do.
and nobody has yet to answer, if there is something to stop Signal from collecting metadata logs of its users and their groups.
it does not seem people understand this risk.
either way, nobody produced a reasonable position on this. so presumption is that signal can farm this data and sell/give it out. since best we got is Signal's responses to US courts which would also be subject to the same conditions if national security type people got involved.
Wire uses Signal protocol and doesn't harvest phone numbers, so I'm pretty sure we do actually know what the answer is. The fact that Signal made this design choice is very concerning to anybody who understand the implications of doing that.
i don' disagree with the thesis and i think the best we will get is not answer that tan effectively rebuke the position.
stupid AI said that server would know who start the connection but not back and forth. connection is static and is reset, so presumably longer convos would involve several timestamps.
I am not sure if signal would know who the recipient but that's the logical next conclusion.
Signal's use case is "authentic communication". like when a govt person interacts with other govt person and doesn't want a second govt to snoop on the actual contents on the communication, but accepts that metadata is public.
It is whatsapp for such people, without being whatsapp.
But then why would you use whatsapp either ?
This is really interesting. It brings two questions to mind.
Don't all messaging apps use phone number as a primary metadata value?
Are you suggesting that Signal could either not use this metadata or not collect it and yet they choose to collect it and can therefore lose it to exfiltration or warrant?
Exact same argument that applies for wanting e2e encrypted messages that aren't seen by the server also applies to any metadata associated with these messages.