Nowadays, a majority of apps require you to sign up with your email or even worse your phone number. If you have a phone number attached to your name, meaning you went to a cell service/phone provider, and you gave them your ID, then no matter what app you use, no matter how private it says it is, it is not private. There is NO exception to this. Your identity is instantly tied to that account.
Signal is not private. I recommend Simplex or another peer to peer onion messaging app. They don’t require email or phone number. So as long as you protect your IP you are anonymous
So, late to the party. Me Skuzi. This comment is more targeted towards your responses to user comments, but I would extend that to your entire thesis. So I decided to make an entirely new comment.
Honest questions/comments to follow:
Yes, the US govt can ‘compel’ a organization such as Signal to allow them to monitor/intercept encrypted messages, The government can even ‘compel’ a citizen to disclose their encryption key. The cost of non compliance varies from contempt of court to short term incarceration. United States v. Fricosu et al.
However, Signal would only shrug and hand them metadata. Even Signal can’t decipher your messages. There are other services unrelated to Signal that operate thusly, such as VPNs, that absolutely do not keep logs and run in RAM only. Some of those VPNs have been raided and servers confiscated by multiple governments with nothing to show for their efforts. If I recall correctly mega.nz and other storage facilities operate along the same lines.
As to the requirement for a phone number, yes they do require a phone number. However, unless they’ve changed something recently, you can use a free or paid for, burner phone number for verification. The caveat is that if you ever have to recover your account or future verification, you may or may not have access to that number if you used a free service. So, that might be a consideration.
Also, some free services might not work while others will. If signing up for a paid account, burnerapp.com for instance, will allow you to sign up via their website, however you can’t use a VPN. WiFi can be acquired at any coffee shop. If you prefer more private methods of payment for these services, there are those that accept crypto.
So, there are ‘options.’ You just might have to jump through a few hoops to get there.
Secondly, Signal is open source, no? The whole shebang including the protocol is open source. Where might ‘they’ be putting the backdoor to intercept encrypted messages? I can tell you this, the day the world finds out that the US govt has successfully cracked strong encryption ciphers, is the day you are going to see a lot of movement on this planet. From billion dollar corporations, private entities, governments, and even ne’er-do-wells on Signal.
I’m no ‘fanboy’, tho there is a lot to be a fan of. I’m not getting any kickbacks, compensation, or monetary advancements. If I need to be schooled, please do share.
Signal does plan to add a paid for service as well as their free service.
Signal is private, what you should differentiate is being anonymous or not. Using your usual phone number is NOT Anonymous but is PRIVATE, as in the content of your messages being only available to you and the person you’re talking to
The way you get a phone number depends on you too, so you can be very much be Anonymous even if signal requires a phone number.
the phone number drives me nut since mine changes every few months; everyone i know has my voip number that gets everything forwarded to each new number.
You are very naive if you think that a company located un the US can provide an encrypted messaging service that can be used by anyone including terrorists, druglords and US enemies without the government being able to access the messages. Lavabit was a famous case and had to shutdown because its founder rejected to comply with an order from the US government to grant access to information. If you are using centralized communication service located in the US forget about privacy.
”Lavabit is believed to be the first technology firm that has chosen to suspend or shut down its operation rather than comply with an order from the United States government to reveal information or grant access to information.[3] Silent Circle, an encrypted email, mobile video and voice service provider, followed the example of Lavabit by discontinuing its encrypted email services.[25] Citing the impossibility of being able to maintain the confidentiality of its customers’ emails should it be served with government orders, Silent Circle permanently erased the encryption keys that allowed access to emails stored or transmitted by its service.[26]"
“Levison (founder) explained he was under a gag order and that he was legally unable to explain to the public why he ended the service.[21]”
Since when is encryption dependent on the service’s jurisdiction? When Signal has got subpoenaed it has always been incapable of providing data that involves the content of the conversation https://signal.org/bigbrother/
The app is also open source with reproducible builds (and you can use Molly instead, if you prefer) and when the clients of an end-to-end encrypted system are sound, that is all that matters to secure the content of the communication.
Audits are also performed as listed here https://community.signalusers.org/t/overview-of-third-party-security-audits/13243I don’t understand where this doomerism comes from tbh, (online) privacy will cease to exist when either maths does or it becomes globally illegal to use encryption and the government’s intrusion is really so pervasive that they constantly know what you’re doing. Luckily we don’t yet live in that world, though the pressure is real and we are the first that have to fight for this basic human right
Since when is encryption dependent on the service’s jurisdiction?
The US has a law that applies to any US company operating within its borders: it is illegal to tell your users that the US government has asked your company to spy on their behalf. This is called a key disclosure law, and the US’s version of it, called National Security Letters, underwent an expansion with the PATRIOT act; by 2013, President Obama’s Intelligence Review Group reported issuing on average, nearly 60 NSLs every day.
Companies that don’t comply with this law are forced to shut themselves down, or remain open, and grant access to user communications to the US government. The Signal foundation is a US domiciled company and must comply with this law without being able to disclose that they have been issued an NSL letter.
Luckily we don’t yet live in that world
Comply with the government order of granting access to messages or shut down implies that we are already in that world, long ago. What makes you think that what happened to Lavavit and Silent Circle would not happen to Signal? Only wishfull thinking can make you think that, evidence tells you otherwise.
Ok government here are the messages i’m legally required to provide you.
U2FsdGVkX1/FEry+/NeyfmzA3icvpchwSo5qySzajv87f9PwhJyog+zS1Qv+j8bzYXG5sCLZMbFqUJn9Cp7RkVY79wuUArUaxE59LtdO0LKT+0+d220DxFVioHe8Vlaq
People who actually care about privacy: the quality or state of being apart from company or observation (definition), wouldn’t want a company knowing their phone number and thus identity tied to their phone number. Maybe you believe in a lower level of privacy than I do. That’s fine but my post was for people who never thought about it but will care and those who should care.
Signal doesn’t know your phone number, though. It’s only used to identify other users in your contacts, and not a single thing about it is stored.
That’s not true. When asked to provide data, Signal is able to give your phone number and the last login time.
Wow. You give them your phone number to sign up. They text you a confirmation code but they don’t know your phone number. Magic
lol try signing up for an email account today without tying a phone number to it or another established email account. It’s incredibly difficult.
You might be able to create an account, but then all “3rd party services” (e.g. creating accounts on absolutely fucking anything) will be blocked and your account will be either restricted or forced to submit a kind of verification that doxes you to lift said block, probably.
I found a single sketchy provider that would take verifications from proton mail that allowed me to then create more accounts, but I had to try over a dozen mail providers before I found the obscure one that did not require any pre-existing accounts, phone numbers or identification documents to just create an email to simply sign up for any web forum, service or basically do anything most people do with email. Everything ends up linked to each other at some point.
There’s just no privacy anymore. The ones who think there is are probably not as private as they really think they are today.
Tutamail is the only service I know of that still doesn’t need anything but I don’t expect it to last. Email providers that don’t make you verify anything end up being used for spam and then websites just start blocking their domain from being used for account creation
Protonmail is highly accepted and tutamail didn’t ask for my number or another email. You are in a group called privacy but you think there is no privacy?
I just stop using those accounts that force me to give up my number. It’s called standards, YOU must have them and you will have more privacy than most.
This group function is to help increase privacy. That’s what I’m doing by letting you know not to use your phone number. If you have a defeatist ideology. You lose.
