So signel proxy for the win?
this post was submitted on 10 Aug 2024
3 points (100.0% liked)
Privacy
31182 readers
1812 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 4 years ago
MODERATORS
Yes, a Signal proxy, such as https://signal.tube/#fiberchannel.org would be very helpful.
I don't want to go through the whole "DM me for the link" route because the people who need this info are probably not in a position to start creating accounts for random social media sites. If it gets scraped, I'm happy. If it gets DDoSd to the ground by nation state actors, I'm proud. If it gets blocked, I can change the IP address and the domain at the click of a button.
Would peer to peer apps be resistant to this sort of thing?
It depends. Somehow it has to discover the peers. Other than that, they could block traffic between residential IP addresses and there goes large part of the P2P network
Russia and Venezuela are huge hotbeds of piracy from populations without access or capital to access most forms of entertainment.
Breaking P2P in this manner would basically be getting rid of the circus part of bread and circuses. Not a good move for an authoritarian.
matrix stays winning
Probably mostly because almost nobody uses it.
Couple million is absolutely nobody /s
Almost is absolutely \s
Matrix isn't secure depending on how you use it. It also doesn't protect individual identities terribly well.
Simplex Chat would be the better option however the main Simplex Chat server and matrix server could end up blocked as well.
Matrix is entirely self-hostable, and you can turn off both federation, and the requirements for any linkable identifiers.
Signal by contrast requires your phone number, isn't self-hostable, and is based in a five-eyes country.
Matrix doesn't protect metadata, which is arguably just as (if not more) important than message data. Signal by contrast does protect metadata and proper implements Perfect Forward Secrecy for all chats. I do think Signal's centralized design and phone number requirements problematic, but Signal still has many merits. Such as its massive user base for a AGPL-only project.
Matrix also implements Perfect Forward Secrecy, and that's been the case for a very long time: https://security.stackexchange.com/questions/162773/are-matrix-messages-encrypted-using-perfect-forward-secrecy
What do you mean by AGPL-only? Synapse is also AGPL. And you can only guarantee that there won't be projects with other licenses if you prevent them from existing.. which is not something to be desired
- AGPL-only is a license, I didn't want to misrepresent the license by being general. I was just trying to say that it is surprising that a fully open source application like signal has a large user base.
- PFS isnt enabled by default for group chats and generally feels messy as the end user to deal with. I was unaware that they have properly implemented it for group chats as well.
- My point about metadata still stands. Matrix still does not protect metadata (one eg: reactions to messages are in unencrypted).
PFS isnt enabled by default for group chats and generally feels messy as the end user to deal with. I was unaware that they have properly implemented it for group chats as well.
Isn't it? Maybe I'm misunderstanding something, so let's start from the definition. PFS is when future joined users can't read messages sent before they have joined, right?
In that case, it is not just implemented, but cannot be avoided and is a major hassle to deal with. In my understanding when someone joins, all members start a new olm session, meaning they now encrypt future messages with a new key. The old keys are not being sent to the joined users, not even if the room has been set up to allow reading history, and this results in them only seeing undecryptable messages, and all the metadata you're taking about (except when the client hides these to reduce new user's confusion).
Former keys are not shared among clients for now because there's no mechanism (for now, but this is planned) to verify that a new member is actually a legit member, not just someone popped in by the server admin by DB editing or whatever.
Earlier there was a workaround mechanism, where with element clients, when you have invited someone, your client has sent keys to all the previous messages which it had, to the invited user. That was not (yet?) reimplemented in their new crypto library, but apparently they're working on it.
But the point is, that afaik PFS is on and cannot be disabled for encrypted rooms, new rooms are encrypted by default, you have to toggle that off by yourself if you don't want it, and it can't be toggled off after room creation.
My point about metadata still stands. Matrix still does not protect metadata (one eg: reactions to messages are in unencrypted).
That's right. I don't think that'll ever change, but it's for sure that it'll not change for a long time, because fundamental changes would be needed.
But! For when that is a concern, you are not entirely unprotected. For example you can set up a room to never federate, or only federate with specific homeservers. If your group runs their own, on owned real hardware, information can't really leak from your control.
In my experience, room encryption is opt-in and permanent for a room.
Indeed.
It is optional, but enabled by default when you create a room, at least in the element clients.
Honestly I would've expected it to be blocked much earlier
would have* expected it
That's what would've means?
It’s like a medal of honor for a privacy preserving app 😄
Indeed. If whatsapp isn't on the list, then I have all the confirmation I need.
The Russian government has also allegedly begun preparations to block the WhatsApp messaging app.
https://kyivindependent.com/messenger-signal-blocked-in-russia-media-says/
Let's see what kind of proxy / censorship circumvention measures Meta is willing to develop for WhatsApp. My guess: precisely fuck all.
blocks appear to be part of a crackdown on internal dissent in both countries.
Or... you know... at least for Venezuela, the USA constantly fucking around with their elections and politics and local assets using Signal or something. Maybe, I dunno?
Yeah. Telegram, should be next, there's a huge risk with it too. And email! Social networks too, just in case. And postal mail, we can't forget that. We should crack down any form of uncensored communication.
All for the benefit of the people, of course. \s
I mean signal was funded in part by the US intelligence community up until last year.
Unrelated to what the previous person is saying (banned because it was used by dissidents), but still, we have the source code. If you're arguing they are somehow accessing the data, what's encrypted and what isn't is known.
Signal knows who you are taking to. You can build a network of contacts based on that information. When you send messages your phone number is protected but your ip address is not, and the receivers phone number is not protected. So you can find two people chatting based on that information. The app automatically sends a delivery receipt when a message is received to the other user, exposing the senders phone number and IP address.
However, opposition in the country is backed by western agencies and NGOs, and likely their primary means of communication is signal since it's backed by western intelligence, meaning, western actors believe it to be safe from external interference.
I'm not arguing that the west is reading messages. I'm arguing that they believe it's a safe haven for their agents because they pay money to ensure it's safe for their agents. If it wasn't, they wouldn't use it. Its the same reason why the intelligence community in the west is a large supporter of the tor network. They use it in the field and operate their own exit nodes to protect their operations.
That's what you fail to understand. It's open source, it has been audited. Venezuela and any other country can check and crack the encryption if has holes in it. The long first paragraph is something that's not a secret, but widely known.
You know what's also safe? Encrypted emails. VPNs. Matrix.
If you think this is a movement against foreign agents, you should think it's useless too. For a sufficiently motivated agent, this will be trivial to overcome. For the general population? Not so much.
Unless next all forms of private communication re forbidden, of curse. Surely what people on a privacy community advocate for.
Is the opposition using those services?
Which ones? Signal? Likely. Secure mail and VPN? For sure. Can "foreign agents" use them? Certainly.
Who will have a hard time to use them? General population. Signal is the privacy communication service with the lowest barrier to entry, in terms of cost and setup complexity. Not a tool for spies, but for average Joe.
What service do you recommend BTW? That ensures government cannot snoop and prevents "foreign agents". It seems that any privacy is a risk, so I'm curious what a privacy minded person thinks should be OK.
"Likely"? "For sure"? So you have no idea of the opposition is using them, got it.
Yeah, I don't know. Do you? It's a fair assumption they use email, right? And VPN is standard in most organizations. I never even mentioned the opposition. Dissidents can be non affiliated people, who is discontent with their government or feel oppressed.
Why is it relevant? I thought you were interested about foreign agents? Or is all the opposition foreign agents?
Please tell me, should it be possible to have privacy from the government in Venezuela? If so, how? If you only answer one thing, please do this one.
Lol do you know how to migrate a community off one platform to another? Its about disrupting comms, not stopping them. Regular people will find other ways to communicate, as they always have. They have lots of options, as you've pointed out. I have no failings in understanding here. I told you already, signal is secure. Its security is backed by it's western intelligence financing. It has flaws in leaking meta data, just like matrix, proton mail, and any other means of encrypted communication tools. This move is to disrupt organized communication to make it disorganized.
No one needs to mention foreign agents. If you are able to observe and analyze the greater context for a given action you can arrive at an approximate rationale for the action. The west has a history of attempting to destabilize Venezuela, they back right wing dictators as successors, they regularly fund dissident groups who want nothing more then to violently take power in Venezuela.
Its clear that Venezuela is facing external pressure to dismantle their democracy, and are taking actions to disrupt those efforts.
Lol do you know how to migrate a community off one platform to another?
"Foreign agents" could install a VPN, probably already have to send data. 0 impact whatsoever for those "agents". Even for casual privacy enthusiasts judge be easy, depending on what's already blocked. Average people on the other hand...
Regular people will find other ways to communicate, as they always have. They have lots of options, as you've pointed out.
Also pointed out how those present more challenges. Why you think WhatsApp and face time are popular, anybody can use them. I'm still wondering what alternative you propose. It seems there's nothing that suits privacy and making Maduro happy.
signal is secure. Its security is backed by it's western intelligence financing.
It's security is backed by the fact it can be audited. Of course governments want PQC encryption. You think other countries don't want or invest on it? The only difference here is that is pubic, free and can be checked for backdoors.
Its clear that Venezuela is facing external pressure to dismantle their democracy, and are taking actions to disrupt those efforts.
When preserving "democracy" is the excuse to not be Democratic, something is wrong.
I'm still waiting to know what do you think is a good alternative. You already complained that signal is secure against all parties, and I'm wondering of there's even a truly private messaging platform that is open and approved by Venezuela, Russia, China... Please enlighten me. There has to be at least one... Right?
When preserving "democracy" is the excuse to not be Democratic, something is wrong.
Ah there it is. Its only Democracy if it comes from the democracy region of the west. Got it. Venezuela has one of the most robust voting systems in the world. Requires voter finger prints, signatures, national ID cards, and has paper ballot verifications. Meanwhile elections in America can be decided by some elite cobal system established in the 18th century by rich property owners for the explicit intention of disregarding the will of its people to favor the property class.
I see you have issues with focus, so I'll just ask again. What messaging system is private and has the approval of Venezuela, Russia, China...? Or is privacy against the state bad?
You are the one who lacks focus. This chain stared from this comment:
blocks appear to be part of a crackdown on internal dissent in both countries.
Or... you know... at least for Venezuela, the USA constantly fucking around with their elections and politics and local assets using Signal or something. Maybe, I dunno?
Do nation states have the right to defend themselves from foreign interference in their elections? What actions should a nation state take to ensure the security of its elections? What actions should a nation state take to combat misinformation spreading about their elections?
Based on your previous comments it sounds like you believe a nation should do nothing.
Again, do Venezuelans deserve to be able to communicate privately?
Every state has the right to defend themselves, I'm a big supporter of Ukraine. But this is not that. You asked me of I know what apps the opposition use. Do you have proof that there are foreign agents and they use signal?
From a technical standpoint, this is useless. Only harms the population. If you believe this is wrong, please explain why this can't be bypassed with a VPN or proxy. I'm even forfeiting the proof that it's actively being used for "enemies of the state". And to west l what extend should Venezuela go? Lockdown from outside? Banning all encryption?
I have replied to all or nearly all your questions. If you don't intend to answer mine, then it's a waste of time.
I'm a big supporter of Ukraine. But this is not that.
I see your colors. Ukraine, historically, undemocratic due to western interference. Made the Communist Party illegal and disbanded it. Very good democracy there.
They are very much the same, except Venezuela is better at defending itself from said western interference.
Again, no answers. Why do I try to speak with a Tankie? Just another "useful" idiot that never left his US state.
At least your messages are here to show what you really think about privacy.
Lol Aw, are the geopolitics to complicated for you? At least your comments are here to show how you really feel about democracy.
In UK don't ban them, but jail you if they don't like your posts, more democratic.
I'm not aware of the kingdom of whataboutistan. Is it related to this post somehow?
Yes, different kind of censorship in the world. A more broad vision.
Keep going, then. Any other country to mention, seeing how it's important to you? Russia? China? Italy? India? Pakistan?
I somehow feel your "broad" is actually quite narrow. Usually happens with the whatabautisms
Why going so long when we have a near, english-speaking , clean example of a country famous for the free speech. If you have the highest example of human rights why check the rest.
load more comments
(1 replies)
load more comments
(1 replies)
they figured it out that it's CIA :)
view more: next ›