this post was submitted on 09 Dec 2023
613 points (93.7% liked)

Technology

60070 readers
4195 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] Cocodapuf@lemmy.world 47 points 1 year ago (4 children)

This doesn't matter because everyone should be using signal.

[–] smileyhead@discuss.tchncs.de 7 points 1 year ago (1 children)

It is a great app, but you cannot fit everyone into a single app.

Examples why I personally sometimes don't want to use Signal:

  • no native desktop app, just a half-baked Electron based thing
  • no versions for systems other than Android and iOS
  • requires phone number (common argument)
  • hard to integrate bots, notifications and automatic services for the future use
  • when Signal foundation do something stupid, it would mean me having to migrate all friends yet another time

Signal is super giga great, the cons list is short, but if we want everyone to use something it has to be an universal protocol, not one app.

[–] Cocodapuf@lemmy.world 1 points 1 year ago (1 children)

no versions for systems other than Android and iOS

requires phone number (common argument)

Ok, those are legitimate complaints, and I suspect they're related too. It would be nice to have a web client.

hard to integrate bots, notifications and automatic services for the future use

Personally, I'd say that's a feature.

Signal is super giga great, the cons list is short, but if we want everyone to use something it has to be an universal protocol, not one app.

To be fair, signal is an open source protocol that anyone is free to implement. Signal protocol

[–] smileyhead@discuss.tchncs.de 1 points 1 year ago

To be fair, signal is an open source protocol that anyone is free to implement.

"The Signal Protocol (formerly known as the TextSecure Protocol) is a non-federated cryptographic protocol that provides end-to-end encryption for voice and instant messaging conversations[...]"

Signal is an encryption protocol, not messaging protocol. My comment was about a messaging one like XMPP or Matrix.

[–] Prater@lemmy.world 2 points 1 year ago
[–] iAmNotorious@lemmy.world 1 points 1 year ago (3 children)

With notifications turned off

[–] Reddfugee42@lemmy.world 22 points 1 year ago

Seriously. Who wants to know when people are talking to them? GO AWAY, PEOPLE. GOSH.

[–] nixcamic@lemmy.world 10 points 1 year ago (1 children)

Honestly for most people this is a crazy level of paranoia. The US government can know the metadata of my friends birthday party organization group.

[–] Cocodapuf@lemmy.world 1 points 1 year ago (2 children)
[–] jimbo@lemmy.world 2 points 1 year ago (1 children)

Because it's a significant inconvenience to disable those notifications over the very unlikely possibility that some bad actor will hoover that data up, much less do something nefarious with it.

[–] Cocodapuf@lemmy.world 1 points 1 year ago

Ah, fair enough.

I realize now that I misunderstood the objection, I thought you were saying that using signal was an unreasonable level of paranoia, but I can totally see why turning off notifications seems that way.

[–] nixcamic@lemmy.world 0 points 1 year ago* (last edited 1 year ago) (2 children)

Honestly I don't care if the government knows who's all going to the party. Someone's gonna post pictures of it anyhow. My garbage data is just more stuff for them to sort through.

And I'm not gonna bother missing out on everything out of fear that the government will do what exactly with my data? The risk is so low for your average person.

[–] Cocodapuf@lemmy.world 1 points 1 year ago

I realize now that I misunderstood the objection, I thought you were saying that using signal was an unreasonable level of paranoia, but I can totally see why turning off notifications seems that way.

[–] PersnickityPenguin@lemm.ee 1 points 1 year ago

You say that, but what if one of them had a friend who is a communist? Could make for some awkward conversation with the authorities at some undisclosed location in the future.

[–] Chobbes@lemmy.world 7 points 1 year ago (1 children)
[–] iAmNotorious@lemmy.world 9 points 1 year ago (1 children)

https://www.macrumors.com/2023/12/06/apple-governments-surveil-push-notifications/

The US government is forcing Google and Apple to share push notification data with them. Even if the content is not sent, the metadata alone can let them know who you are talking to and when using metadata correlation.

[–] Chobbes@lemmy.world 11 points 1 year ago* (last edited 1 year ago) (2 children)

Signal push notifications don’t contain any useful plain text data (no content, no information about who sent you a message). AFAIK the only thing you would be leaking is that you received a message on signal, and frankly that metadata is probably going to be leaked to the US government regardless of your use of push notifications.

[–] notenoughbutter@lemmy.ml 1 points 1 year ago (1 children)

frankly that metadata is probably going to be leaked to the US government regardless of your use of push notifications.

How?

[–] Chobbes@lemmy.world 6 points 1 year ago (1 children)

Because your ISP and cell phone provider can tell you’re connecting to signal.

[–] Natanael@slrpnk.net 3 points 1 year ago (1 children)

They can tell you connect to AWS when the Signal app fetches messages after a notification, they need to be able to peek into Amazon's servers to see you're connecting specifically to Signal

[–] Chobbes@lemmy.world 3 points 1 year ago* (last edited 1 year ago) (1 children)

AWS is not a black box from the outside. The signal servers will have their own external IP addresses that you will connect with, your ISP could keep track of those connections. Furthermore, if you are worried that the government is using your ISP to spy, what makes you think that AWS wouldn’t be subject to that as well? Signal is absolutely a target in this respect too.

Of course you can do various things to potentially hide your connection to signal, for instance by using tor, but in some sense there’s no guarantee if you don’t trust anything external to you. I’m personally not too worried about the “this person uses signal” metadata, though.

[–] Natanael@slrpnk.net 1 points 1 year ago* (last edited 1 year ago) (1 children)

There's not enough unique IP addresses to distinguish Signal servers, if you don't explicitly set up static IP addresses you're going to share an IP pool

https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-ranges.html#aws-ip-download

Sure they could tap into AWS (but it would be even easier to try to get data from Google Play Store on who has it installed).

Signal has native support for proxying via Tor in that case.

[–] Chobbes@lemmy.world 1 points 1 year ago (1 children)

The signal servers will absolutely have public and static IP addresses. You would not be able to connect to them reliably if they could change at any time and you had to rely upon DNS updates to find the server. AWS is not magic.

And yes, AWS has IP ranges allocated to it that they pull their public IPs from, that's all that link is talking about


this page even provides the context that the IP ranges are available in order to identify which traffic is coming from AWS in order to allow / disallow it. Of course the AWS IP allocations won't tell you which IP is associated with which service (and indeed many IPs, particularly in the IPv6 space, are probably not in use at all).

There’s not enough unique IP addresses to distinguish Signal servers

Why? Yes, IPv4 address exhaustion is a thing, and yes AWS only has a slice of IPv4 addresses to give, but you absolutely can get static public facing IPs from AWS that will be unique to your server. You can even pay for an elastic IP so you can hold a particular address and move it between instances. There is no way Signal does not do this.

Signal has native support for proxying via Tor in that case.

Yes, though the use case is mostly for getting around censorship. Realistically if you don't want the government to know you're using Signal... Do you want them to know you use Tor?

[–] Natanael@slrpnk.net 1 points 1 year ago

FYI, SNI is a thing (included encrypted SNI these days) and you absolutely can share an IP among many many unrelated domains.

Domain lookups have a TTL (time to live) and they stop advertising IPs which they'll stop using a little bit before those IP addresses are taken out of rotation. That's why it doesn't break even when addresses keep changing.

Signal have an active incentive NOT to use static IP addresses!

https://support.signal.org/hc/en-us/articles/360007320291-Firewall-and-Internet-settings

The underlying IPs are constantly changing, so it'd be hard to define accurate firewall rules.

Realistically if you don't want the government to know you're using Signal... Do you want them to know you use Tor?

Probably not, but you don't need to run the Tor client on the phone, you can run an anonymous proxy and point your phone at it.

[–] Still@programming.dev 0 points 1 year ago (2 children)

it's not the content in the noti, it's where your phone was connected when it received it

[–] Natanael@slrpnk.net 14 points 1 year ago

They get that from the carrier already

[–] Chobbes@lemmy.world 13 points 1 year ago

I mean… if you need to be worried about that, you really shouldn’t have a phone on you.