A face-to-face conversation, held in a proper SCIF (Secure Compartmentalized Information Facility), with no decorations, transparent furniture, the best sound isolation you can buy (think bottom of a salt mine and still wrapped in isolating material), no windows, no air-conditioning, shielded from thermal imaging, bring no devices at all, and all participants stark naked (ideally you’d add body cavity search and MRI); That way you can avoid most eaves-dropping.
And then shoot the other party, because a secret shared is no longer a secret.
Well, if eliminating parties is on the table, I’d have to recommend shooting yourself (better: pack your head in a lot of explosives, less chance to accidentally survive), so good ol’ rubber-hose cryptanalysis doesn’t work either ;-)
Ok… that is a bit over the top. What about digital messaging.
Fair enough, I was feeling a bit cheeky ;) I guess you really mean digital, electronic, semi-instantaneous, text-based communications, aka “instant messenger”. I tend to be very careful with recommendations, they always can turn out to be bad advice… For what it’s worth I use either email with GnuPG or Signal. I have a long list of caveats for both, but I do use them…
I read somewhere (on lemmy) that signal might not be a safe and secure option. and i have deleted my account. 😑
and i use the openPGP app. is this good enough to protect my missile launch codes?
As I said, I have reservations about Signal, but I have not found one where I have fewer, so… As to “the” openPGP “app” and literal missile launch codes, it really depends on what exactly that app is (there are many implementations of RFC4880) and on what environment it is running. Most likely it’s adequate for normal people though ;) I use GnuPG 2.x on QubesOS, and OpenKeychain on GrapheneOS, but I’m a cryptology-nerd who enjoys coming across slightly paranoid ;)
I am taking the notes and switching to write letters now. 😭
Snail-mailing a handwritten note to your friend in a secret code that only the both of you know.
that doesn’t hide metadata, the postal service can track it and you can trace back both the handwriting and reverse engineer the code. Someone can intercept the mail from many stations on the way, including your own post box.
I’d say that many messaging services offer more protection than that method.
You could, however, use PGP with elliptic curve cryptography, and send that via packet radio or something similar on a frequency only you know. To an uninvited person this only looks like garbage data or noise.
Every AX.25 packet includes the sender’s amateur radio callsign
The same callsign that’s tied to your physical address as provided to the FCC?
You don’t have to follow these regulations. The requirements in the opening post were just for the most secure way of messaging, not a legal and secure way of messaging.
There is no one answer to this question as more factors need to be weighed in on. For example the most secure way of messaging would be no messaging at all essentially.
One thing that has interested me for some time is that usually when people are weighing in on digital messaging security or privacy is that they usually just think of it “individually”. As in, from the perspective of one person using the messaging platform. Things change a bit when you had large groups of people.
For example, Like many have noted, Signal is probably not 100% to be trusted these days, but because of its ease of use and its popularity it manages to (somewhat) secure the communications of millions of people. While more secure/private solution can be more cumbersome to use and therefor less popular, but will manage to 99.99999% secure the communication of maybe hundreds of people.
So which one is better in this context. A platform managing to provide 50% security to millions of people, or a platform managing to provide 99.9% security to hundreds of people?
edit: in short. it depends on the context and the people you are trying to secure communications with. You have to make compromises here and there to reach the maximum realistic security for that group of people. My family and nearest friends for example use Signal but I am constantly keeping an eye on other solutions and waiting for them to become viable for my situation. (especially after Signal becoming less and less interesting by every day)
actually I was using Signal. But deleted my account last week. Tried Matrix on element but the experience was not good.
Tried Briar but messages sent when i stay offline do not get delivered. So that is not an option for me. Still searching for a good platform.
Tried Matrix on element but the experience was not good.
Define that?
Tried: Tried; Matrix: Matrix.org; on: on; element: the Element App; but: but; the: the; experience: experience; was: was; not: NOT; good: GOOD;
Ok now try to explain what your experience was without using the same words that drove me to ask what you meant by those words.
it (element) was slow.
deleted by creator
yeah, that’s the thing with security and privacy, you often have to sacrifice convenience for those two. The reason messages don’t get sent is because there is no server in between to send the messages. But in the case of signal the messages get sent to the server and then wait there for the other person to come online. So right now IMHO for a lot of people Signal is the best/least bad we can realistically use (at least in the context I live in). But Matrix is coming closer and closer, and I am looking forward to it.
deleted by creator
The most secure way of messaging is becoming thoroughly versed in infosec and only conversing with other deeply security minded individuals using E2E encrypted apps.
In lieu of that, use signal. Matrix if you want some more features. But never for a second assume that using a “secure” platform or service makes you secure. Security and privacy are a never ending dance. The most important part of which is to keep moving constantly. Understanding new threats, keeping a close eye on updates for your client of choice, and maintaining a constant background suspicion will ultimately have a much greater impact than which platform you use.
Matrix / Element or XMPP.
We’ve had many discussions on here for why many of us think that signal isn’t secure.
Matrix / Element or XMPP.
Still leaks metadata, but given that you use your own server and proper e2e keys with enabled encryption, frequent re-keying and current room/software versions, it’s arguably more secure than most messaging systems.
True: here an interesting video about how using some services make you identifiable by connection maps. This affects also signal since you’re subscribed via your telephone number and people connect you through their contacts list. Additionally, metadata tell how often you talk to some people, what time, how many messages, etc. This shows to an attacker who are your main connections, etc. So things are not about which kind of service you use (which app), but HOW you use it. The video really invites you to think about how these complex things work. Btw here’s the video: https://www.youtube.com/watch?v=IWMZ17Iyu3o
Damn, very good video, thx for that.
This also affects Matrix or XMPP
It doesn’t, because neither matrix nor XMPP require the crucial piece of information linking you to your real identity: phone number, or email.
If we learned anything from the predatory ad industry, it is that you don’t need a piece of proof of identity to track and even deanonymize people.
I think the answer would be “depends.” There is no such thing like “safest way of massaging”. Every option comes with pron and cons. You have to choose carefully according to your trust, user case and threat model. If you want to learn more about “threat modeling” then you should read this article from EFF.
Services like signal and matrix are usually recommended. They are good for the 99% of people.
There is no such thing like “safest way of massaging”
Well, you could take courses to not hurt the people you massage, for starters?
Can you please elaborate? English is not my first language so i’m not really sure if i understand your comment.
edit: i think i got it, you wrote a funny comment hahaha.
Removed by mod
What do you think about Briar?
Briar is still Android only I think?
there’s also Briar GTK for x86 linux, but it doesn’t have all the features of briar android.
Secure (knowing but not being able to access) being different from privacy (no-one knows who) and of course remembering that the more private especially, the more difficult to locate anyone you actually know as zero e-mail, phone numbers, etc should be used… I’d still say Matrix is the simpler and easier secure messenger for most to use and where they have a good chance of finding others actually using it.
Can also mention Wickr Me, Wire and Threema. Briar Project would have been a good option except it is only Android which really holds it back from broader use. Another consideration is whether mobile to mobile is satisfactory (peer-to-peer is sometimes an issue with mobile) or whether you would use desktop clients along with mobile, as that then also narrows some choices. From a privacy perspective, specifically metadata is important and why Signal and WhatsApp fall down even though they may have secure E2EE.
From a privacy perspective, specifically metadata is important and why Signal and WhatsApp fall down even though they may have secure E2EE.
Actually, signal minimize metadata. The sealer metadata is encrypted, only the address remains unencrypted. Also, signal received subpoenas in 2016 from from the Eastern District of Virginia and in 2021 from from the United States Attorney’s Office in the Central District of California. Those subpoenas requested a wide variety of information that fell into this nonexistent category, including the addresses of the users, their correspondence, and the name associated with each account. In fact, signal only provided;
- Unix timestamps for when each account was created
- Unix timestamps for date that each account last connected to the Signal service.
And of course the phone number… I really prefer something that requires zero phone number (like Session as an alternative) but thing is you’ll find most people on Signal (through their phone number)…
I’d also prefer services that requires no phone number. However, in the end it’s not really a concern for the vast majority of people. In the context we usually live almost everyone uses privacy invasive services. so if a person ditch services like WhatsApp for Signal it’s a win. It’s highly unlikely that a regular Joe who doesn’t know a squat about privacy and security is going to use more private services like matrix,session, briar etc.
Signal it’s quite good in this area, the initial setup and GUI it’s quite equal to WhatsApp, E2EE is on by default and doesn’t require any additional user interaction, the metadata collected is minimized etc.
