this post was submitted on 06 Mar 2024
320 points (87.2% liked)
Privacy
32109 readers
537 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I posted this down below in a comment thread but I'm afraid it won't be seen and not enough people know about this.
Session was at first a fork of Signal without usernames.
Now by design it uses their own custom tor-like service (instead of just... using tor) and does not support forward secrecy or deniable authentication, so anyone who collects the messages in transit can either find a vulnerability in the encryption scheme, or spend enough GPU resources to crack it, and they have confirmation of who sent and received the message and what the contents of the message are. And is headquartered in Australia, which is 5EYES and much more against encryption than the US. Oh, and the server is closed-source.
Regarding Australia's 2018 bill...
Regarding the 'vulnerability or cracking them later' bit...
From Session's own FAQ:
I wouldn't touch it with a 12ft ladder.
The thing I find most suspicious is their "onion routing". An average Joe like me cannot run a node like he can do with I2P or Tor. There is a gigantic upfront payment for that. So that ensures the nodes would be run by crypto bros, companies and governments.
FYI, regular Signal now has usernames available with the option to hide your phone number switched on by default (you may still need tithe beta release for the next few months since it's staggered rollout)
Signal still requires a SIM card & an Android or iOS primary device. Usernames here just let you cloak your phone number, not keep it a secret from the service.
As an Australian, either.do I. They are in Mastodon and I have pointed out that being in Australia should make them a no go for anyone.