Finally, we can have usernames in Signal instead of giving our phone number to everybody.

    • Onii-Chan@kbin.social
      link
      fedilink
      arrow-up
      9
      ·
      10 months ago

      Is Session actually secure though? I know they’re based in Australia, and as an Aussie myself, holy fuck would I not trust this country for even a fraction of a picosecond with anything private or sensitive. We have some of the world’s most draconian and far-reaching digital privacy and surveillance laws, and I’m not ready to accept that Session hasn’t been secretly compromised by the AFP, given the law against revealing government backdoors.

      Happy to be proven wrong, but I always err on the side of extreme caution when it comes to Australia. Digitally, we’re closer to the CCP than any of our fellow western nations.

      • Rikj000@discuss.tchncs.de
        link
        fedilink
        English
        arrow-up
        2
        ·
        10 months ago

        Wasn’t aware of that, would love to hear about it if someome could shine some more light onto the matter :)

        If that’s the case, I have to stop using/recommending Session

        • HyperMegaNet@lemm.ee
          link
          fedilink
          arrow-up
          3
          ·
          10 months ago

          I’m not the person you responded to, but the Assistance and Access Act 2018 is probably a good place to start. Here is a page from the Aus Government about it, but the very short version is that the government can ask tech providers to assist them with building capabilities into their systems to allow the government to access data to help with the investigation of certain crimes. In some cases these will be voluntary requests, in other cases they will be requests that must be fulfilled, including asking providers to add capabilities that the government has developed.

          There’s a lot more detail about it, and the government insists that they won’t ask providers to create systematic weaknesses or to decrypt communications entirely, but it’s not clear to me exactly how those ideas are actually implemented. Unfortunately, much of the process (likely the entire process) is not made public, so as far as I’m aware there aren’t any good examples of requests that the government has made and what sorts of things have or haven’t been implemented.

    • debanqued@beehaw.org
      link
      fedilink
      arrow-up
      6
      ·
      10 months ago

      Sign-up still requires a phone number… -.-"

      Thanks for the warning – that was my first question. It is my top reason (among many other reasons) for avoiding Signal.

      Checkout Matrix/Element or Session,

      All 3 of the sites you linked are Cloudflare sites (thus antithetical to privacy). Yes, I know you can use some of that tech without touching CF, but when they run CF websites it reveals hypocrisy & not understanding the goals of their audience.

    • Radiant_sir_radiant@beehaw.org
      link
      fedilink
      arrow-up
      4
      ·
      10 months ago

      If that’s a concern you could also always use Threema, which has been built from the ground up to use anonymous random IDs and optionally lets you link a phone number or e-mail address to that ID. The company has also won important court cases against having to store metadata preemptively and responding to blanket requests by law enforcement.

      • Rikj000@discuss.tchncs.de
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        10 months ago

        I never heard about Threema before,
        quickly glanced at it’s Github repo,
        but I think I prefer Matrix/Element over it.

        Threema seems to largely rely om GMS (Google Messaging Service),
        meaning that most messages will go through Google’s servers,
        albeit end-to-end encrypted for now,
        I would not be suprised if Google would participate in “Harvest now, Decrypt later”.

        • Radiant_sir_radiant@beehaw.org
          link
          fedilink
          arrow-up
          2
          ·
          edit-2
          10 months ago

          There’s actually an option to turn GMS off entirely if that’s a concern (Settings–>About–>Advanced). It comes at the cost of slightly increased battery usage. Sadly Google does have a bit of a monopoly on mainstream Android there.
          Having said that, the messages themselves should never pass Google’s servers, just a packet saying “check your Threema server, there’s new stuff waiting for you.”

  • EveryMuffinIsNowEncrypted@lemmy.blahaj.zone
    link
    fedilink
    English
    arrow-up
    23
    ·
    edit-2
    10 months ago

    Too little too late, I’m afraid.

    I would love to use Signal more, but I have it for only 1 friend. No one else I know uses it. And the fact that they don’t support SMS is I imagine a large contributing factor.

    (Yes, I know SMS is inherently insecure & unprivate, but having that support is a good way to get users’ foots in the door, and also what good is a totally secure platform if no one uses it?)

      • smileyhead@discuss.tchncs.de
        link
        fedilink
        arrow-up
        5
        ·
        10 months ago

        In my region everyone uses Facebook Messenger. And if you don’t use it, to contant people that won’t install an app for you (like meeting you for first time), the only option is SMS.

        • Killing_Spark@feddit.de
          link
          fedilink
          arrow-up
          1
          ·
          10 months ago

          I mean to be honest to only reason to use messengers is just costs, I wish SMS where as cheap as internet flatrates… But that might very well be a regional issue too

          • smileyhead@discuss.tchncs.de
            link
            fedilink
            arrow-up
            2
            ·
            10 months ago

            Just cost? Absolutely no. Internet protocols are better in so many ways that phone based messaging should be obsolete for years.

            • Killing_Spark@feddit.de
              link
              fedilink
              arrow-up
              5
              ·
              10 months ago

              Internet protocols are better in so many ways

              This is VERY debatable because statements that broad are almost always false. There is no need to have a cellular->IP->cellular bridge for 1:1 communication involving more servers, more service providers. If anyone wanted to they could implement at least the 1:1 signal protocol and probably even the messaging layer security protocol on top of SMS to get e2ee group communications.

              Nobody wants to because cell providers sell SMS for horrendous prices compared to internet access.

      • explodicle@local106.com
        link
        fedilink
        English
        arrow-up
        2
        ·
        10 months ago

        In hindsight it’s sad how very right he was. Now when I think “I want to send Alice a message”, I just go to the app I know will work, instead of trying to remember if Alice still uses Signal too.

      • EveryMuffinIsNowEncrypted@lemmy.blahaj.zone
        link
        fedilink
        English
        arrow-up
        1
        ·
        10 months ago

        I genuinely appreciate that there are some people who have the benefit of a group of contacts who are willing to use it. I’m happy for you.

        Also, that’s an interesting thread. Thanks for sharing it. :)

    • sfera@beehaw.org
      link
      fedilink
      arrow-up
      5
      ·
      10 months ago

      It’s never too late. “Back then”, when I started using Signal (called TextSecure), only one other single friend used it. Nowadays, almost all my personal contacts use it. Every additional Signal user adds a contact in someone other’s address book as a potential Signal contact. It just takes time. Good luck!

  • mox@lemmy.sdf.org
    link
    fedilink
    arrow-up
    20
    ·
    10 months ago

    Apparently still requires giving Signal your phone number, so not exactly keeping it private.

    • jawsua@lemmy.one
      link
      fedilink
      arrow-up
      7
      ·
      10 months ago

      There’s anonymity and privacy. This keeps you private from other users, and they already keep you private from themselves other than the initial sign up. What this service isn’t, and never has been, is anonymous. They don’t want that and there are big usability issues with an extended anonymous user base. Decide for yourself what you need

      • debanqued@beehaw.org
        link
        fedilink
        arrow-up
        5
        ·
        edit-2
        10 months ago

        Anonymity is part of privacy.

        Specifically, anonymity is confidentiality of identity. Confidentiality is part of privacy, which is a broad concept. So when a tool or mechanism works against anonymity, it works against privacy. It may not work against a privacy aspect that you care about, but it’s privacy nonetheless.

    • UNIX84@beehaw.orgOP
      link
      fedilink
      arrow-up
      4
      ·
      10 months ago

      This is a big complaint for me. I know that there is the official standalone APK, but if I am running a de-Googled phone, I want to be able to use Signal and have it update on a regular basis.

  • jherazob@beehaw.org
    link
    fedilink
    English
    arrow-up
    5
    ·
    10 months ago

    Many years late, and still requires having your number. Good first step though, we’ll see once a phone number is not required.