Hey, everyone. If you’re looking for a fresh privacy podcast, we recently started a new one called Signal Jam.

Here’s a bit about why we made Signal Jam and what we’re hoping to do differently.

We even have preliminary ways for you to participate in the project, which you can read about here.

Feel free to connect with us on Proton, Tuta, Signal, or here on Lemmy. Looking forward to your feedback and thoughts!

  • Arthur Besse@lemmy.ml
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    17 hours ago

    No, it isn’t about hiding your identity from the people you send messages to - it’s about the server (and anyone with access to it) knowing who communicates with who, and when.

    Michael Hayden (former director of both the NSA and CIA) famously acknowledged that they literally “kill people based on metadata”; from Snowden disclosures we know that they share this type of data with even 3rd-tier partner countries when it is politically beneficial.

    Signal has long claimed that they don’t record such metadata, but, since they outsource the keeping of their promises to Amazon, they decided they needed to make a stronger claim so they now claim that they can’t record it because the sender is encrypted (so only the recipient knows who sent it). But, since they must know your IP anyway, from which you need to authenticate to receive messages, this is clearly security theater: Amazon (and any intelligence agency who can compel them, or compel an employee of theirs) can still trivially infer this metadata.

    This would be less damaging if it was easy to have multiple Signal identities, but due to their insistence on requiring a phone number (which you no longer need to share with your contacts but must still share with the Amazon-hosted Signal server) most people have only one account which is strongly linked to many other facets of their online life.

    Though few things make any attempt to protect metadata, anything without the phone number requirement is better than Signal. And Signal’s dishonest incoherent-threat-model-having “sealed sender” is a gigantic red flag.