Which of Signals privacy claims are false?
this post was submitted on 21 Sep 2021
15 points (100.0% liked)
Asklemmy
1452 readers
53 users here now
A loosely moderated place to ask open-ended questions
Search asklemmy ๐
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- !lemmy411@lemmy.ca: a community for finding communities
~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~
founded 5 years ago
MODERATORS
Pretty much everything about it is unverifiable, because its a centralized service and you ultimately don't know what the server is running. Contrast that with self-hostable apps which must pass verifiability checks, because people can host their own instance.
Clients are open source. Independent clients exists and they work. So the server must kind of do what signal claims, otherwise those devs would notice.
You have no idea what the server is running. It has your phone number, ie your real name and address, and it knows who you sent messages to.
Matrix and even Signal you reject for some reason work fine with no one being able to see the content of your message except the one you sent it to.
Signal is trustworthy
I guess you can use wormhole to transport the data to your peer, and if you're extra paranoid encrypt it asymmetrically with something like age.
Then again you can just encrypt it with age and send it over Signal. There should be no risk involved in sharing public keys even if you don't trust their servers.
When I need extreme security and privacy, I use qTox
https://1ty.me would be described as a "self-destruting pastebin." I'd generally be careful about what you can put in there (e.g. put partial information in it with no context) but it seems to do the job.
But the real answer is probably PGP/GPG.
Use briar.
XMPP / Jabber with OMEMO encryption. Lots of free servers and clients.