this post was submitted on 08 May 2024
189 points (100.0% liked)

Privacy

789 readers
33 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

Here's what he said in a post on his telegram channel:

🤫 A story shared by Jack Dorsey, the founder of Twitter, uncovered that the current leaders of Signal, an allegedly “secure” messaging app, are activists used by the US state department for regime change abroad 🥷

🥸 The US government spent $3M to build Signal’s encryption, and today the exact same encryption is implemented in WhatsApp, Facebook Messenger, Google Messages and even Skype. It looks almost as if big tech in the US is not allowed to build its own encryption protocols that would be independent of government interference 🐕‍🦺

🕵️‍♂️ An alarming number of important people I’ve spoken to remarked that their “private” Signal messages had been exploited against them in US courts or media. But whenever somebody raises doubt about their encryption, Signal’s typical response is “we are open source so anyone can verify that everything is all right”. That, however, is a trick 🤡

🕵️‍♂️ Unlike Telegram, Signal doesn’t allow researchers to make sure that their GitHub code is the same code that is used in the Signal app run on users’ iPhones. Signal refused to add reproducible builds for iOS, closing a GitHub request from the community. And WhatsApp doesn’t even publish the code of its apps, so all their talk about “privacy” is an even more obvious circus trick 💤

🛡 Telegram is the only massively popular messaging service that allows everyone to make sure that all of its apps indeed use the same open source code that is published on Github. For the past ten years, Telegram Secret Chats have remained the only popular method of communication that is verifiably private 💪

Original post: https://t.me/durov/274

top 50 comments
sorted by: hot top controversial new old
[–] shrugal@lemm.ee 137 points 6 months ago* (last edited 6 months ago) (2 children)

It's hard to overstate what a nothing-burger this article really is! Let me break it down:

  • Signal got $3 million from the Open Technology Fund at some point in its development
  • Some anonymous source alleges that the OTF's ultimate goal is to promote US foreign interests
  • The current chairman of the board Katherine Maher worked at the National Democratic Institute and Wikipedia before
  • The same anonymous source says she was recruited because of connections to the OTF
  • She has at some point voiced the opinion that a completely free internet without regulation just reproduces existing power structures, and that balancing regulation and 1st amendment rights is a tough problem
  • Signal doesn't have reproducible builds on iOS (it absolutely does on Android btw)
  • Some people feel like Signal chats come up more often than they should in court cases and media reports

That's it, that's the whole story. That's the reason why the Telegram guy of all people thinks you should be careful, and better use his chat service instead, and the Twitter guy agrees.

I mean, reproducible builds on iOS would be nice, but that platform has much bigger problems from a privacy/security/sovereignty/freedom standpoint anyway. And the rest is just nothing turned up to 11.

[–] Coasting0942@reddthat.com 8 points 6 months ago

Getting “Tor is pentagon spyware” vibes from OP

load more comments (1 replies)
[–] DaseinPickle@leminal.space 91 points 6 months ago

Maybe he should focus on adding e2e encryption to the default chats and group chats instead of spreading FUD.

[–] electric_nan@lemmy.ml 80 points 6 months ago (2 children)

Looks like a push to discredit Signal right now. While I know Signal isn't perfect, I do like it and I haven't seen anything that is better (on the whole). The 3rd "emoji-point" is quite an accusation, and I would love to see any evidence of this kind of thing, that didn't result from the cops unlocking a defendants phone, or having infiltrated a chat.

[–] possiblylinux127@lemmy.zip 16 points 6 months ago (4 children)

Tin hat time:

I wonder if Russia's trying to get everyone on Telegram because they have control over it.

load more comments (4 replies)
[–] MajorHavoc@programming.dev 14 points 6 months ago* (last edited 6 months ago) (2 children)

While I know Signal isn't perfect, I do like it and I haven't seen anything that is better (on the whole).

Agreed. But it is worth mentioning that XMPP with OMEMO seems to be the current gold standard - runs almost everywhere, tons of available (free) servers, secure end to end messages, and fully auditable public source code.

[–] electric_nan@lemmy.ml 11 points 6 months ago (8 children)

I have used xmpp a lot, but I can't really recommend it to friends and family as a secure messenger. There are too many compatibility issues between clients and servers. If your friend is on a client or server that doesn't support the same encryption protocols, then you can't have a secure chat. Basically there is too much user knowledge and effort required at this time, for xmpp to be a good, secure, general use chat. I very much look forward to this changing. I also really like Matrix, but it is still a bit rough around the edges as of my last check.

load more comments (8 replies)
load more comments (1 replies)
[–] smileyhead@discuss.tchncs.de 78 points 6 months ago (17 children)

Telegram: There are backdoors in Signal encryption!

Also Telegram: not encrypted

load more comments (17 replies)
[–] rivvvver@lemmy.dbzer0.com 54 points 6 months ago* (last edited 6 months ago) (3 children)

arent telegram chats unencrypted by default?

An alarming number of important people I’ve spoken to remarked that their “private” Signal messages had been exploited against them in US courts or media

source?? (i bet this ends up being a "they had full access to my unlocked phone" situation again)

also the whole thing abt US funded encryption is the same bullshit argument ppl use against Tor all the time. it doesnt mean shit.

this just reads like someone desperately trying to get more market share by spreading FUD

[–] penquin@lemmy.kde.social 20 points 6 months ago (4 children)

"an alarming number of important people" is the source. That's more than enough, right?

[–] rivvvver@lemmy.dbzer0.com 6 points 6 months ago (1 children)

im gonna assume ur joking. its hard to tell sarcasm on the internet.

obviously i would like an actual source like at least one of those "important" ppl talking abt what happened to them

[–] penquin@lemmy.kde.social 6 points 6 months ago

😂. Of course I'm joking. That claim is bullshit. Hey I know a guy who sold a bridge, and he's wealthy now. Source: trust me, he told me.

load more comments (3 replies)

https://www.spiegel.de/netzwelt/apps/telegram-gibt-nutzerdaten-an-das-bundeskriminalamt-a-0e4d3fcb-8081-4b87-b062-db412bbc294b

Well, Telegram seems to be giving user data to the German Federal Criminal Police Office, and if they're cooperating with the German authorities, I don't see why I'd presume they aren't cooperating with others as well.

All this is actually documented, compared to those nebulous "important people".

load more comments (1 replies)
[–] WolfLink@lemmy.ml 43 points 6 months ago (3 children)

Go read the GitHub issue. The main difficulty in implementing reproducible builds is the code signing Apple requires as well as other tweaks Apple makes to modify the binary from what the dev submits to what gets downloaded from the App Store. Note that Android already has reproducible builds. Also the reason the GitHub issue was closed wasn’t “refusal” to implement the feature, they wanted to move the discussion to their forums.

load more comments (3 replies)
[–] lemmyreader@lemmy.ml 40 points 6 months ago (2 children)

This comes a few days after Jack Dorsey confirmed that he had left the board of Bluesky and then starting to use Tw(X)tter and calling Tw(X)tter "freedom technology". Coincidence ?

load more comments (2 replies)
[–] PotatoesFall@discuss.tchncs.de 38 points 6 months ago (3 children)

Okay first things first Jack Dorsey is a tool

The US government / CIA did in fact develop the protocol back in the day, with the goal of helping people in China and other countries message securely, probably with ulterior motives.

But the protocol itself is open source, and you can use it without any affiliation with the US government.

The claim " It looks almost as if big tech in the US is not allowed to build its own encryption protocols that would be independent of government interference 🐕‍🦺" is therefore so stupid it almost invalidates everything else being said because the person writing is either an idiot or purposely misrepresenting the facts.

Not having reproducible builds is definitely weird though. Does anybody have more information on that?

[–] bamboo@lemmy.blahaj.zone 6 points 6 months ago (1 children)

Not having reproducible builds is definitely weird though. Does anybody have more information on that?

They boast this as a feature, but on the instructions for how to do this for iOS, even Telegram admits "As things stand now, you'll need a jailbroken device, at least 1,5 hours and approximately 90GB of free space to properly set up a virtual machine for the verification process". Browsing the steps, it's extremely complex, and doesn't seem like something that is very user friendly and that you'd do weekly or monthly when a new version is released.

On the GitHub issue linked to in the body, it's disingenuous to claim they refused to implement this, and that the technical hurdles Apple has in place make this extremely difficult which halted progress. In the community forums where the conversation was moved to, someone pointed out that even if you were to reproduce it on a jailbroken iPhone, that there's no way to confirm that non-jailbroken iPhones aren't receiving a version with a backdoor.

And even if you are using a jailbroken device exclusively and can confirm the reproducibility of the iOS app, then the risk becomes the latest available jailbroken iOS could be outdated from the real versions, and you'd have other issues with not receiving timely security updates. This same issue applies to Telegram also.

load more comments (1 replies)
load more comments (1 replies)
[–] DaseinPickle@leminal.space 27 points 6 months ago (1 children)
[–] Dark_Arc@social.packetloss.gg 5 points 6 months ago (16 children)

I can't read it because of the paywall but IIRC (based on a similar article) that was such a nothing-burger issue.

People turned on an entirely optional (I think off by default setting) for some feature that allowed discovery of users by location ... and shocked pikachu they could be tracked or something like that.

load more comments (16 replies)
[–] dolle@feddit.dk 25 points 6 months ago (1 children)

Yes, sorry, but I can't take something seriously if every paragraph begins and ends with an emoji. I know it's dismissive, but all my Facebook lunatic conspiracy theory alarm bells are blaring.

[–] rottingleaf@lemmy.zip 9 points 6 months ago

It's more normal in Russian-speaking Web.

Shouldn't trust this guy anyway, it's VK's founder talking.

[–] possiblylinux127@lemmy.zip 24 points 6 months ago (3 children)

The kettle calls the pot black...

load more comments (3 replies)
[–] dessalines@lemmy.ml 24 points 6 months ago (2 children)

I don't care about dorsey or whatever, but a lot of privacy advocates don't consider signal secure, drew devault for example. I'm def among them, you should not trust any centralized US-hosted service.

[–] tcit 11 points 6 months ago

Linking to their post to say it's a little bit more complicated that "it isn't secure" https://drewdevault.com/2018/08/08/Signal.html

[–] kixik@lemmy.ml 7 points 6 months ago

I'm all for Jami, and XMPP.

[–] Sneptaur@pawb.social 22 points 6 months ago (4 children)

This is also just a few days after Durov published Nazi dogwhistles in the latest Telegram update blog post.

https://plush.city/@PsyChuan/112336464469767051

load more comments (4 replies)
[–] firefly@neon.nightbulb.net 22 points 6 months ago (8 children)

Telegram: We keep you private. Now enter your phone number to sign up.

[–] SLfgb@feddit.nl 16 points 6 months ago

Signal does the same

load more comments (7 replies)
[–] drwho 19 points 6 months ago

Points 0 and 1: None of this is new. This goes back to 2011 or 2012.

Point 2: If someone gets hold of your phone and unlocks it (meaning, they can interact with it), they have access to your Signal messages on-board. This is why additional security measures (not using biometrics, encrypting your phone natively) are recommended. If your phone is off and someone dumps the data from it, they get encrypted data.

[–] electro1@infosec.pub 17 points 6 months ago* (last edited 6 months ago)

Yeah, he needs to fix his broken secret chat feature first... I think it's broken on purpose..

After seeing his interview with Tucker Carlson, I'm 100% sure the guy has some really dark agenda..

[–] Takios@discuss.tchncs.de 17 points 6 months ago (3 children)

I wonder if their recent blog post promoting conspiracy theorists and right-wing people turned away more people from telegram than they expected and now they feel the need to spread FUD against their competitors.

load more comments (3 replies)
[–] MrSoup@lemmy.zip 17 points 6 months ago (6 children)

Still got server-side code closed source and by default messages are not encrypted.

load more comments (6 replies)
[–] kellenoffdagrid@lemmy.sdf.org 16 points 6 months ago* (last edited 6 months ago)

Saw someone post that City Journal article on mastodon a couple days ago and I'm amazed that so few people picked up that the City Journal and the article's author are basically puppets of the Manhattan Institute, a conservative think tank. I know most people aren't tuned to look out for think tank propaganda but it came off as really obviously FUD-y and unsubstantiated.

[–] Steve@communick.news 13 points 6 months ago (1 children)
load more comments (1 replies)
[–] AsepticFuturisticFox 6 points 6 months ago

The article about Maher is written by a conservative who can't accept that we can limit individual freedom to reach true collective freedom.

Also he wrote for FoxNews lol

Stop spreading propaganda please, it's just a CEO trying to shill its product

[–] Sims@lemmy.ml 6 points 6 months ago (2 children)

I feel hustled, bc I recommended Signal to others :-( However, ANY contact with the US elite is a clear sign of the NSA/CIA/NED propaganda/spying network. I think It is safest for everyone, to voluntarily adopt the Russian, Chinese, Iranian, etc blocklist/firewall of western big-tech propaganda and spy methods, and seek out trustworthy open source. Oc Lemmy/federation as well as any other point of contact with the commoners are valid targets for these guy's, but a minimum of defense like that seems to be the only way to keep the US Capitalist elite out of our lives.

Anyway, bye bye Signal. Gnu? Alternative ?

[–] rivvvver@lemmy.dbzer0.com 16 points 6 months ago

please get some more opinions on this, try to understand the arguments here better, before making up ur mind and believing the founder and CEO of a competing platform that u should switch away from their competitors

load more comments (1 replies)
[–] AnAnonymous@lemm.ee 6 points 6 months ago* (last edited 6 months ago) (2 children)

If someone really care about privacy you can use Session instead. Good luck!!

[–] hanrahan@slrpnk.net 8 points 6 months ago (2 children)

Sarcasm ? An Australian company, with zero constitutional protection from a 5 eyes nation? It screams honey pot

load more comments (2 replies)
load more comments (1 replies)
load more comments
view more: next ›