this post was submitted on 17 Jun 2025
93 points (100.0% liked)

Privacy

2802 readers
495 users here now

Welcome! This is a community for all those who are interested in protecting their privacy.

Rules

PS: Don't be a smartass and try to game the system, we'll know if you're breaking the rules when we see it!

  1. Be civil and no prejudice
  2. Don't promote big-tech software
  3. No apathy and defeatism for privacy (i.e. "They already have my data, why bother?")
  4. No reposting of news that was already posted
  5. No crypto, blockchain, NFTs
  6. No Xitter links (if absolutely necessary, use xcancel)

Related communities:

Some of these are only vaguely related, but great communities.

founded 7 months ago
MODERATORS
top 39 comments
sorted by: hot top controversial new old
[–] [email protected] 5 points 1 day ago* (last edited 1 day ago) (1 children)

Use Walkie talkies with a voice changer and coded phrases

No Imeis, no way to track you. Just don't transmit near your house.

[–] [email protected] 3 points 18 hours ago (1 children)

Very insecure. Vulnerable to MITM, jamming, etc.

[–] [email protected] 1 points 16 hours ago* (last edited 16 hours ago) (1 children)

Airgapped Android phones (with radios removed) and use Rattlegram + OpenKeychain to encrypt and sign messages.

As for jamming... well they can just turn off mobile networks and the internet too.

[–] [email protected] 1 points 4 hours ago (1 children)

What you mentioned doesn't have PFS nor break-in recovery, plus it uses PGP... a significant security downgrade compared to Signal or SimpleX.

[–] [email protected] 1 points 3 hours ago

That's the dilemma with modern commucations. If you use signal or similar apps, your device can get hacked with pegasus or similar malware. AFIAK, walkie talkies and ham radios don't really have "backdoors" (unless they messed with the supply chain), you hold the button and it transmits, let go and it doesn't transmit. Dead simple. If you do encryption using a separate non-internet-connected device, then transmit it over the old-school radio, its virtually unhackable.

So you really have to weigh the risks.

Are you trying to have Perfect Forward Secrecy and is Pegasus not a risk to you?

Or do you prefer to be secured against pegasus, but use a clunky non PFS encryption?

Are you doing all your communications before the protest? (in which case you can use a phone with signal)

Or do you also want to have comms during the protest? (in which case, radios have no IMEI and cannot really be "hacked" and encryption is done on a separate device)

[–] [email protected] 22 points 1 day ago (6 children)

Signal still centrally collects metadata and requires a phone number to participate.

If you're serious about privacy, ESPECIALLY if you're part of a group looking to organize in a clandestine fashion, you should look into the vastly superior SimpleX Chat.

[–] [email protected] 19 points 1 day ago* (last edited 1 day ago) (3 children)
[–] [email protected] 4 points 1 day ago

Can all of this compromise the SimpleX protocol in any way?

[–] [email protected] 4 points 1 day ago

I kind of figured with the X in the name. (I'm only half joking... But yikes)

[–] [email protected] 2 points 1 day ago
[–] [email protected] 20 points 1 day ago (1 children)

per the article

Signal can't access user metadata. It's not just that Signal promises not to keep logs. They've literally engineered their service to cryptographically prevent themselves from having access to metadata, even if they wanted to. Signal doesn't know what groups you're in, or even what Signal groups exist on the platform. They don't know the names or membership of any Signal group. They can't even access your profile picture or name. All of this is stored on user devices and shared directly from user to user. On the other hand, if WhatsApp gets a data request, Meta will turn over details about everyone in your group, exactly who sends messages to who, and when, because WhatsApp collects all of this.

[–] [email protected] 1 points 22 hours ago

They’ve literally engineered their service to cryptographically prevent themselves from having access to metadata, even if they wanted to.

So, its all done by the user client? Meaning: If you check the source code, and compiled it yourself, it's safe? Even against a malicious server?

[–] [email protected] 14 points 1 day ago (1 children)

Signal collects your IP address and the last IP address you sent a message to. They store that info to maintain their services. They also store your phone number, either of which can be tied back to your identity (in the US, don't @ me, friends from across the pond).

The only thing these reveal is that you use Signal, which is currently still legal. Also, even if a judge ordered Signal to collect outgoing messages for your user, the content of your messages would already be encrypted. So unless your use of the service could be construed as illegal (or perhaps who you're talking to), then it's probably still safe to use.

However, all that said, I still agree that SimpleX is a better choice for activism. No phone numbers or other useful identifiers, uses a series of nodes rather than a central server, expiring contact-adding codes, etc... it's simply better, if you need privacy against external threats.

And there's no reason you can't have both on your phone for different kinds of groups!

[–] [email protected] 6 points 1 day ago (3 children)

can you show evidence for this?

The best choice for activism right now is signal and has been for years. The best choice isn't necessarily the most hardened app or messaging system, it's the most hardened balanced against ease of use and access, along with features.

[–] [email protected] 5 points 1 day ago (1 children)

It's been proven in court several times. The only information they keep is your phone number, unix timestamp of your account creation, and the unix timestamp of when you were last online.

[–] [email protected] 5 points 1 day ago (1 children)

Which is not the claim OP made.

[–] [email protected] 1 points 1 day ago (1 children)

Which claim are you referring to?

[–] [email protected] 5 points 1 day ago (1 children)

Signal collects your IP address and the last IP address you sent a message to.

[–] [email protected] 2 points 1 day ago (1 children)

Yeah, they likely misremembered that it was timestamps instead of IPs.

[–] [email protected] 4 points 1 day ago (1 children)

I mean its the principal claim.

[–] [email protected] 1 points 18 hours ago (1 children)

I'd say that the principal claim is that they can't see your messages and that they have no incriminating data on you. No judge can order them to hand over your data and incriminate you because they don't have that data. What exactly is the very little data they have is less important.

[–] [email protected] 2 points 12 hours ago (1 children)

Thats re-interpreting what they said to be something defensible; but it isn't what they said. What they said was specific, and isn't, afaik, supported by any evidence. Its also the very first thing they said. Their main point. The primary point. Not some other thing they didn't say, but the very first, and very specific thing they said first.

Re-interpreting what people say to support our bias is both de-constructive when real security concerns are on the line, disingenuous, and shows a lack of reading comprehension.

[–] [email protected] 1 points 5 hours ago
[–] [email protected] 2 points 1 day ago

Usability of Simplex is very similar to Signal.

[–] [email protected] 1 points 1 day ago (1 children)
[–] [email protected] 3 points 1 day ago (1 children)
[–] [email protected] 1 points 1 day ago

I promise I'm not being pedantic. Which claim? I made at least two.

[–] [email protected] 4 points 1 day ago* (last edited 1 day ago)

Or if you want to have a federated platform that's closer to something like Discord, Matrix.

[–] [email protected] 9 points 1 day ago (3 children)

i switched my family over to signal. i cant do a seitch again xD

[–] [email protected] 6 points 1 day ago

Signal is likely fine for a use case like that. Don't feel like you need to switch if you don't have a good reason. Signal is a great balance between stupid-easy useability and E2EE messaging, and people who actually need that extra mile of privacy should know better than to use Signal.

[–] [email protected] 3 points 1 day ago

i cant do a seitch again

On a serious note, sticking to Signal for family group chats is fine. No need to move them over to another platform.

[–] [email protected] 2 points 1 day ago

I feel you.

[–] [email protected] 3 points 1 day ago (2 children)

They dropped the phone number requirement a while ago

[–] [email protected] 12 points 1 day ago (1 children)

No, you still need a phone number to sign up. You can now optionally have a username as well, but a phone number remains a hard requirement.

[–] [email protected] 2 points 22 hours ago (1 children)

What's more, they require you to periodically log in on your phone. If you exclusively use the desktop client, you will get a message that access will be blocked if you don't sign in on your phone.

[–] [email protected] 2 points 21 hours ago

Sometimes, it feels like a surveillance loophole is left for the OS (remember when they had plain text backups on windows). And Apple, Microsoft, and Google would happily turn over data, while Signal always will have plausible deniability.

And you will always need a smartphone OS built by one of the US companies above to start and continue using signal.

[–] [email protected] 4 points 1 day ago

Yeah I thought they had too, but it's the case that for a new account you still have to have a phone #. You can then use a chosen account for everything else.

[–] [email protected] 7 points 1 day ago

Also beware that the target entry is always people. Any group you don't know extremely well is going to "leak" and so it's best, in general, whenever it involves electronics, to not do things you wouldn't want to be found out doing.

[–] [email protected] 1 points 1 day ago

If anyone wants Internet friends on Signal, here's a group that you can join.