- cross-posted to:
- technology@lemmy.ml
- cross-posted to:
- technology@lemmy.ml
“Signal is being blocked in Venezuela and Russia. The app is a popular choice for encrypted messaging and people trying to avoid government censorship, and the blocks appear to be part of a crackdown on internal dissent in both countries…”
You must log in or register to comment.
It’s like a medal of honor for a privacy preserving app 😄
“Banned in 15 dicatorships!”
Indeed. If whatsapp isn’t on the list, then I have all the confirmation I need.
The Russian government has also allegedly begun preparations to block the WhatsApp messaging app.
https://kyivindependent.com/messenger-signal-blocked-in-russia-media-says/
So signel proxy for the win?
why telegram is not blocked? makes you think…
WhatsApp supposedly uses Signal protocol.
Why is THAT not blocked? Certainly they wouldnt roll their own encryption and bypass Signal security protocols after having Moxie come in, right? Right???
It is owned by Meta and is proprietary
Russia is reportedly planning to block WhatsApp as well.
Telegram is not secure, I guess if you can listen to it better not block it.
I mean it was blocked before Signal was blocked. Russia somewhat famously badly broke their Internet trying to shutdown telegram… and eventually gave up.
I’m guessing Signal finally has enough market share to get the Russian government’s attention but not enough market share that they think the web of proxies that kept Telegram online will keep Signal online.
and eventually gave up
or maybe they came to an agreement on mutually beneficial terms
Maybe, maybe not, maybe I’m a duck in a suite.
Honestly I would’ve expected it to be blocked much earlier
I wrote this, but I’d also like to add Drew Devault - Why I don’t trust signal. There’s a huge disconnect between what privacy advocates are saying about signal, and what reddit “privacy” communities think about it. If you read the article I linked, you’ll see its because the Open Technology Fund (a US state-run entity), actively pushes signal in privacy spaces.
Signal is secure and anyone who says it isn’t needs to have very strong evidence. It has been audited by hundreds of people at this point.
Source: trust me bro.
Seriously tho, that’s been most of the defense of signal advocates, with zero backup other than signal’s own claims. Signal is not self-hostable, and all the data lives on a centralized, US-domiciled server, subject to NSL requests (the US issues ~ 60 of them per day).
Unfortunately you can’t verify what their server stores, nor the metadata that they are legally required to share with the US government (which includes phone numbers, and your name and address).
BTW if signal is secure, can you give us your phone number, so we can use it with you?
Signal is end to end encrypted. Everything related to encryption happens inside the app. It doesn’t matter if the server is in mainland China it would still be secure. However, that doesn’t mean it is anonymous. Signal is pretty bad from that perspective.
Signal might be one of the most audited pieces of software in existence. Any criticism is likely either coming from or is supported by countries that fear encryption such as China, Russia and Iran.
The big downsides of Signal are that it requires a phone number and that is depends on Signals servers. That is it. You messages are completely safe as all messagers use the same underlying cryptography.
The audits mean nothing for a server domiciled in a Five-Eyes country. Signal has your phone number, and the other phone numbers you talk to (social connection graphs), and it is 100% illegal for them to tell you that they’ve been issued a national security letter divulging that information.
The entire protocol is build under the assumption that you do not need to trust the servers. Let the NSA have then, it doesnt matter. On the other hand 95% of Matrix users are hosted on Matrix.org which was not only hacked several times, but would be an ideal target for any agency to compromise. Its naiive to belive the big Matrix hosts arent compromised. The only effective defense is to build your system around the assumption that the server is compromised, which is what Signal did.
You shouldn’t trust a server to do your computing for you. Assume any data the server has about you to be available to all.
Why countries that do not prosecute political dissent bock apps used by political dissenters? /s
blocks appear to be part of a crackdown on internal dissent in both countries.
Or… you know… at least for Venezuela, the USA constantly fucking around with their elections and politics and local assets using Signal or something. Maybe, I dunno?
Yeah. Telegram, should be next, there’s a huge risk with it too. And email! Social networks too, just in case. And postal mail, we can’t forget that. We should crack down any form of uncensored communication.
All for the benefit of the people, of course. \s
I mean signal was funded in part by the US intelligence community up until last year.
The current president of Signal is also still happy to do interviews with US-defense-oriented think tanks like Lawfare.
They probably still are funded by USIntel, considering how interested RFA was in pushing Signal in privacy-oriented spaces.
I’m pretty sure Venezuela was unstable before the US started getting involved.
Anyway Signal is secure so that shouldn’t be the problem. It has more to do with the government working to crush civil liberties and independent thought.
Same story in all authoritarian countries
First no Venezuela was stable before US medeling.
Second, “is secure” is quite a leap, it is funded to a sickening extent by the United States government, has gone about a year before opening up its source code, and is in the US where there is a law that says if the US government says show us everything and keep quiet, they have to do that. There are real concerns
Or you can uncriticaly say “Athoritarian Country” with no defineing term there, or real understanding of Athoritarianism and disreguard all concerns from these countries.
The US government funds it because they use it heavily. I think you should pay for software you use.
Also Venezuela has never really been stable. You could argue that the US made it worse but honesty the problem is everyone getting involved.
Would peer to peer apps be resistant to this sort of thing?
It depends. Somehow it has to discover the peers. Other than that, they could block traffic between residential IP addresses and there goes large part of the P2P network
Russia and Venezuela are huge hotbeds of piracy from populations without access or capital to access most forms of entertainment.
Breaking P2P in this manner would basically be getting rid of the circus part of bread and circuses. Not a good move for an authoritarian.
Yes, but you’ll have to install them from sources other than what governments deem official. Like F-droid.
Now, if they block p2p traffic that’s a different story
I am totally cool with F-droid.
Unless you click the “unblock” button.
Gotta love Verge.
could matrix.org be as easily blocked, since it’s decentralized I’m wondering?
At least it means that Signal is working as intended if they are blocking it, I guess that they don’t have back doors.
Matrix is in fact decentralized but in reality it is not so much, I don’t know the number exactly but the majority of users use the matrix.org server
Those numbers only include instances that have telemetry enabled
could matrix.org be as easily blocked, since it’s decentralized I’m wondering?>
Or SimpleX?
It cannot be easily blocked especially if you use your own homeserver every homeserver replicates the channel and it can operate without the original server! That’s why signal and telegram are inherently flawed.
Being decentralized prevents DNS or IP blocks but not blocks through DPI.
Signal has an option to masquerade it’s traffic as regular HTTPS, I don’t know if Matrix can do such a thing.
I can answer this! All matrix calls are over https APIs. Ports and addresses are stored in a text file on the base domain or in DNS txt entry.
Signal honored!
Smart move, considering Signal is a US-hosted centralized service that has to comply with US NSL laws.
These comments below seem to be unaware of all the issues privacy advocates have of signal.
I don’t get it, are you really arguing that Russia and Venezuela are blocking Signal to protect their citizens from American snooping?
All countries should ban US-domiciled companies like signal, or any communication platform hosted in Five-eyes countries, and especially ones domiciled in the US, which has to adhere to National Security Letters.
Mass censorship is never good for civil liberties. Let people decide on there own.
Also Signal is cryptographically sound. Many other messagers use a similar protocol
As I commented below, US security forces aren’t that interested in message content anyway, since they don’t have time to parse through every message to construct meaning. Signal does require your phone number tho, as well as message timestamps, meaning they can build social graphs of real people. Tons of metadata living on a single US-based server.
It doesn’t matter if it is US based. You shouldn’t trust the server.
Signal has known issues. That doesn’t mean it is entirely bad though. Saying things like Signal is insecure is simply untrue. It has weaknesses but it also has the benefit of protecting your messages completely and being well established.
Isn’t the whole point of something like End-to-End Encryption so that not even the company themselves can read your messages?
In that case it wouldn’t matter even if they did turn the info over.
Edit: I read more into the page you linked. Looks like those NSLs can’t even be used to request the contents either way:
Can the FBI obtain content—like e-mails or the content of phone calls—with an NSL?
Not legally. While each type of NSL allows the FBI to obtain a different type of information, that information is limited to records—such as “subscriber information and toll billing records information” from telephone companies.
You can read my article, or Drew Devaults on why he doesn’t trust signal, which get more into this, but the short version is that US security forces don’t have time to read the content of everyone’s message anyway, they care more about the metadata: message timestamps and social graphs.
Signal stores all that data (via required phone numbers, meaning its linked to your real name and address), and via the US’s key disclosure laws, it would be illegal for them to tell you that the US government is hoovering up that data.
Most security experts who actually know what they are talking about do recommend Signal for most users, including [https://twitter.com/Snowden/status/661313394906161152](Edward Snowden), [https://www.schneier.com/blog/archives/2018/06/russian_censors.html] (Bruce Schneier) and [https://linktr.ee/glenngreenwald](Glenn Greenwald). Eveyone should consider whether they would rather follow the advise of people who have literally fought the NSA and read the entire Snowden documents or belive in the FUD spread by some people here.
My question was more about the motives in this case.
Well IMO all countries should have the motivation to prevent US spying on their country’s populations. You generally don’t know about honey pots before they get exposed.
matrix stays winning
Probably mostly because almost nobody uses it.
Matrix isn’t secure depending on how you use it. It also doesn’t protect individual identities terribly well.
Simplex Chat would be the better option however the main Simplex Chat server and matrix server could end up blocked as well.
Matrix is entirely self-hostable, and you can turn off both federation, and the requirements for any linkable identifiers.
Signal by contrast requires your phone number, isn’t self-hostable, and is based in a five-eyes country.
Matrix doesn’t protect metadata, which is arguably just as (if not more) important than message data. Signal by contrast does protect metadata and proper implements Perfect Forward Secrecy for all chats. I do think Signal’s centralized design and phone number requirements problematic, but Signal still has many merits. Such as its massive user base for a AGPL-only project.
they figured it out that it’s CIA :)
