Simple steps to take before hitting the streets

  • toastal@lemmy.ml
    link
    fedilink
    arrow-up
    17
    arrow-down
    6
    ·
    6 months ago

    Signal & WhatsApp are not secure enough. Meta/Facebook regularly give data & metatadata to the cops & Signal is centralized & not self-hosted by your crew so while messages are encrypted, the metadata still isn’t. If you must use Signal, I would pick Molly as an Android client since you can a) encrypt the messages under a separate password for storage on seizure & b) you can use the UnifiedPush version to make sure your notification metadata isn’t going thru Google’s Firebase servers. Protests are the ideal place for Briar as it is works via mesh net so internet & SIM cards are not required (but years ago wden I tried it, the app was a major battery drainer).

    • Simon Müller@sopuli.xyz
      link
      fedilink
      arrow-up
      9
      ·
      6 months ago

      the metadata still isn’t.

      That doesn’t quite work in the case of Signal

      The only data that they have, based on transparency reports and dissections of their source code, is the time you created your account and last connected to the servers.

      Messages themselves are essentially only relayed, with sealed sender, and anything that would be actually useful to identify who was at a protest and who wasn’t encrypted.

      Things like, e.g when messages arrive at the server would have to be monitored live on compromised servers, which reasonably unless you assume* it is wiretapped already prior to a protest, isn’t realistic.

      *: of course, I am saying this because making an assumption and portraying it as truth (e.g assuming something is already wiretapped based on no evidence at all) is not the smartest of moves when it comes to threat modeling…especially if you wanna stay sane whilst having a threat model

      • toastal@lemmy.ml
        link
        fedilink
        arrow-up
        1
        arrow-down
        1
        ·
        6 months ago

        With the right intel you could piece back some of the pieces, especially with some pieces from other sources, with just that metadata. With metadata, it’s about putting together lots of sources to see the picture clearly which is why Facebook bought WhatsApp for just the metadata (& address book). The thing is that you, can skip Signal & you will still have several free software messaging alternativ where nothing is on a US-based server where they can subpoena.

        • RealJoL@feddit.de
          link
          fedilink
          arrow-up
          1
          ·
          6 months ago

          But that’d already entail control over the whole Signal AWS in- and egress as well as any VPN you may be using and/or your local ISP. And then you still have to prove the actual link to the natural person. At that point we’re speaking of a threat level assuming the US DoD as adversary. While not impossible, I think if you’re willing to pick that kind of fight, you’re clever enough not to rely on Signal (or most digital communication).

          Signal is not WhatsApp, there aren’t a lot of data points linking your communications to end points in the same way Meta does link them.

          • toastal@lemmy.ml
            link
            fedilink
            arrow-up
            1
            ·
            6 months ago

            Not saying you are wrong, but I think the argument a) should mention WhatsApp in the same breath as Signal & b) stopping at Signal instead of linking to where to find more info

    • BrikoX@lemmy.zipOP
      link
      fedilink
      English
      arrow-up
      7
      ·
      edit-2
      6 months ago

      You are absolutely right about metadata, but as far as protests, just having encryption is enough to prevent anyone from accessing the data. Extracting metadata from 3rd party companies or extracting a phone requires a lot more resources than cops can spare.

      • toastal@lemmy.ml
        link
        fedilink
        arrow-up
        1
        ·
        6 months ago

        In the corpo cases, I’m sure all they have to do is ask. There are better alternatives & this guide feels radically incomplete stopping at such pedestrian option instead of labeling them in a bottom tier of like suffiecent-if-you-literally-can’t-use-anything-else.

    • WolfLink@lemmy.ml
      link
      fedilink
      arrow-up
      2
      ·
      6 months ago

      If your problem with signal is that it isn’t self-hosted, just self-host it? It’s all open source.

      • toastal@lemmy.ml
        link
        fedilink
        arrow-up
        5
        ·
        6 months ago

        Those components are not really meant for self-hosting, its open to be looked at. You would need to patch out the SIM requirement, point the hardcoded server/clients elsewhere, find some way to sideload modified clients to those using iOS lol, & it’s not federated so you would need a separate app for just this task. At this rate you are 100% better off using a choosing systems where server & clients are actually built with this in mind… Signal’s chat features are not novel

      • ReversalHatchery@beehaw.org
        link
        fedilink
        English
        arrow-up
        1
        ·
        6 months ago

        The developers are very hostile about alternative clients and networks. Also, the app does not support this in any form, so you would have to distribute modified APKs that want to use your hosted server.