• 0 Posts
  • 7 Comments
Joined 1 year ago
cake
Cake day: February 10th, 2024

help-circle
  • It’s been recently added to FDroid.

    No, it has not. A third party published it in an f-droid compatible repository. That might be convenient for someone who happens to trust that third party and manually add it to their F-Droid client, but it is not at all like it being added it to F-Droid.

    You can use NTFY with Molly (which has been on FDroid for some time).

    This does not refute what I wrote. Unless you only communicate with people who get their Signal app from some non-Google source and they all rig up alternative push notification channels, or every one of them uses Signal exclusively on iOS, your conversations are still tied to Google. Perhaps you have so few contacts that you could achieve that, but most people are not in that position.

    network-level metadata monitoring by anyone with sufficient access/influence at Signal or their data center provider (such as a government who doesn’t like encrypted messaging).

    This one is just a straight-up lie. Everything on the server is encrypted and no one has the keys except the participants.

    Encryption doesn’t hide network traffic. Signal’s centralised design means there is a single point where that traffic can be monitored and traced to reveal which endpoints are talking to each other, and where, and when.

    What I wrote is not a lie, which you would know if you actually understood these issues. Please stop making baseless accusations. You are being very rude.

    If you’re interested in correcting your ignorance, I suggest starting with this paper, which touches on some of the issues:

    https://www.ndss-symposium.org/ndss-paper/improving-signals-sealed-sender/

    If the paper is too much for you, the video does a pretty good job of explaining in simple terms.


  • Thankfully, it’s not that simple.

    A centralised service is an easy target for a government. (This is where Signal stands.) A decentralised one is significantly harder, because the government would have to be constantly discovering and processing every node in the network as new ones appear. (This is where Matrix stands, although it doesn’t have many public servers yet.) Fully peer-to-peer decentralisation makes it harder still, because there are as many nodes as there are users, with network addresses that often change. (Some of these exist today, but are mostly experimental with few users. Matrix has done some proof-of-concept work in this area as well.)

    On top of decentralisation, tunnels like VPN and Tor can be helpful in avoiding ISP-imposed blocks.




  • mox@lemmy.sdf.orgtoTechnology@lemmy.worldTime to get serious with E2E encrypted messaging
    link
    fedilink
    English
    arrow-up
    12
    arrow-down
    4
    ·
    edit-2
    21 minutes ago

    Signal is easier to use, more private, and faster.

    Unfortunately, it is also effectively tied to Google services due its app distribution and push notification channels on Android (which most people on Signal use), and as a centralised service, it is vulnerable to shutdown or network-level metadata monitoring by anyone with sufficient access/influence at Signal or their data center provider (such as a government who doesn’t like encrypted messaging).

    (Edit: rephrased for clarity)


  • Matrix is good for private general messaging. The fact that it’s decentralised means it can also withstand things like government-ordered shutdowns or back doors, since there is no central point that controls the whole network.

    Two things to be aware of:

    • Some non-message bits (e.g. room topic text and membership) have not yet been moved to the encrypted channel, so those could be read by the administrator of a homeserver that participates in your chat room. Since most people care primarily about keeping the message content private, this is an acceptable trade-off to get all the things that Matrix offers.
    • The upcoming Matrix 2.0 features and design choices simplify the UI and fix some occasional errors. It might be worth waiting until this stuff officially lands in the client apps before bringing your contacts to Matrix, for a better experience all around.