@link2xt
I'm getting the idea that this is not for me. This is a chat app for doing things I do not do - which is ok.

Thanks for answering all my questions.

@link2xt
I have a relative that called me from Viet Nam on Signal and it worked fine. We talked for over an hour and it worked great. I even saw some video during the call.

That said, the people on this chain appear to be far more global than the average person with fears, desires, skills and needs that are greater than my own.

@link2xt

This is a really good article. Thanks for this.

It looks like, if you needed to, there is a path for defeating the subpoena outlined here in the article.

I also don't use my SIMs phone number for Signal, which is another way to obscure your identity. That said, if the FBI was investigating me, they would have my "fake" number. I use it to defeat spammers.

It's because of people like you @link2xt that I ask questions and also love #mastodon.

I really appreciate your time to educate me. Thank you.

> that if Signal decides to ban you because rules in the US, ex. recently they added Cuba to the "terrorist countries" list

i'm running through a us-based proxy at this time and i can reach cuba's website. just because there's a designation as a terrorist state doesn't mean traffic is blocked. the only networks i cannot reach are in the dprk which i have no interest in anyhow.

> imagine how easy would be for US to tell Signal to not allow any Cuban phone number,

sure, i mean it's possible that the us says "signal, don't allow cubanos" but so far there's been no example of this. i think this is speculation at the time, but yes something to keep in mind with riding other's infrastructure.

> that is not possible with decentralized platforms where users can use the provider of their choice and also countries can use their own server and be more resilient/independent while still federating with the rest of the world

what about countries that deny traffic to other countries? russia, china, and others have firewalls and dpi to inspect and block/re-route traffic.

it's absolutely possible to have issues with decentralized infrastructure. since we're talking about email, one of the chatmail servers is blocked due to ip reputation from a mail provider i've used. whether it's deltachat, fediverse, etc if a country or region notes that a certain ip space is not welcome they can block it and there's nothing we can do to change this besides hopping proxies and more hoops.

this all being said i use deltachat for personal communications, signal i keep for people who pay my bills and prefer a bit more security than sms over ss7

@ax3

That’s a lot of “ifs” that don’t fit needs. But I’m always looking. That’s why I ask the questions.

@newhinton @ax3
I follow @soatok and respect the work. Much of it is above my head, but I have his blog in my reader feeds.

I will take a look.

@newhinton Signal is "open source", sure they have some code published, but that doesn't warranty that the code running in the server matches and they took already a long time to update in the repository the code they had deployed, same for the client, I was looking into it and a file in the source code was not the one actually used in production, it was being fetched from the server

#ArcaneChat fits:

- FOSS
- e2ee (forced)
- safe against MITM

@rob @ax3

@rob @ax3

Since signal protects against itself via it's encryption and envelope protocol, it simply doesn't matter what runs on the server.

Not great that they are regularly behind, but it is simply irrelevant for the security.

@newhinton

by @link2xt: "Signal requires a phone number and the connection between your account ID and phone number is in their database (proprietary Amazon DynamoDB service actually, Signal does not run its own database). It can be requested even if you only get in contact with usernames."

also read: fosstodon.org/@link2xt/1138955…

@rob @ax3

@link2xt @rob @ax3

I have read that. The exposure of usernames is the same as phone numbers. Which means you already need to know that it exists. So not much gained there. Also, what does this have to do with the database or the security?

Signal is demonstrably *the* most secure app. Every "problem" signal has, is a problem for other messengers too. (Usually the problems are worse for them, including and specifically deltachat)

@newhinton
> Signal is demonstrably *the* most secure app. Every "problem" signal has, is a problem for other messengers too.

Not every other messenger has a problem of keeping the relation between non-secret account IDs to phone numbers in a central database. For example, Matrix, XMPP, Session and Delta Chat don't have this problem because you can use them without having any phone number at all.

@adbenitez @rob @ax3

@link2xt @rob @ax3

True! Instead they leak message metadata, user relationships or even message content (if not careful) all over the place.

None of the "competitors" are actually as stringent and secure if it comes to the amount of data leaked to the outside. On that front, there currently simply is no true competitor that does secure and private messaging as well as signal does.

soatok.blog/2024/07/31/what-do…

What Does It Mean To Be A Signal Competitor? - Dhole Moments

A lot of recent (and upcoming) blog posts I’ve written, and Fediverse discussions I’ve participated in, have been about the security of communication products. My criticism of these pro…

^{Dhole Moments}

you are completely ignoring my message where I said that arcanechat.me fits the bar, it enforces ALWAYS encryption, and ZERO METADETA is required, since UNLIKE SIGNAL, it doesn't require ANY private data for registration, its FULLY anonymous and END TO END ENCRYPTED and safe against MITM

@link2xt @rob @ax3