Should I sign up for Telegram? As much as I have concerns about having to use my phone number to sign up and their hand-rolled encryption, I do feel a bit of FOMO not being on it...
@inference @norm Which one (if any) of the messengers is considered to be secure at the moment? I signed up for Signal a while ago
@inference @norm Thanks! I saw some articles questioning certain things behind-the-scenes with Signal a few months back (can't find them now, maybe a red herring)
That's an issue of its own, but it doesn't affect the messenger use case of Signal. A lot of other protocols are based on Signal protocol, including Wire and WhatsApp.
Signal protocol gives cryptographic deniability, perfect forward secrecy via regenerating keys every message/every few messages, verifiability, and uses gold standard ciphers and authentication (AES etc), as well as using a double ratchet algorithm.
Side note: Signal is planning on switching to usernames instead of phone numbers.
@inference @norm Sounds good. Nah it wasn't crypto, I just dug out the article that worried me:
https://securityaffairs.co/wordpress/114551/mobile-2/fbi-access-private-signal-messages.html
Signal messages are encrypted on-device.
This article has been around for a while and doesn't know what it's talking about. It's the same as saying you've broken encryption because someone left their phone unlocked and walked away.
Nothing has been broken, I assure you.
@inference @norm OK thanks that's good to know.
Yes, reading messages off the phone's screen doesn't count as breaking encryption 😀
A video on the matter:
https://www.youtube.com/watch?v=GYGwd-mVwko
If you do security correctly, you shouldn't have an issue.
@[email protected] @[email protected]
Side note: Signal is planning on switching to usernames instead of phone numbers.
Awesome if they do, the phone number thin has been the biggest thing that has shied me away from Signal until now.The only thing keeping me from switching to a data-only SIM and using a cheap burner feature phone for standard calls and SMS is Signal's phone number requirement.
The following have sound and provably secure (and reasonably private) protocols:
- Signal
- Matrix
- XMPP
The following also hide all metadata:
- Briar
- Session
Unless you *need* the metadata privacy, you may want to consider using messengers in the first section, because they have verify abilities to reduce the chance of a MITM.
Best one, by far, if you don't mind the phone number issue, is Signal; it's the gold standard.