i’ve just seen a comment in a post, in this very community, saying people trust signal because of missinformation (from what i could undertand).

if this is true, then i have a few questions:

-what menssaging app should i use for secure communications? i need an app that balances simplicity and security.

-how to explain it to my friends who use signal because i recomended?

-what this means for other apps in general?

  • wildbus8979@sh.itjust.works
    4·
    20 hours ago

    Second is that it runs on AWS. This isn’t a problem in the sense that it’s possible for it to still retain privacy while running on AWS. Some people don’t like it because they view the dependence on the infrastructure of an American company to be a risk to availability. They also believe that it would exacerbate a security flaw if one were found.

    Let’s not pretend the hypervisor doesn’t have full access to the VMs memory and execution. The only thing protecting the Signal server is Intel SGX.

      • wildbus8979@sh.itjust.works
        9·
        18 hours ago

        I’m not claiming the contents of the messages are at risk here. You’re social graph and metadata though is another story.

          • wildbus8979@sh.itjust.works
            1·
            7 hours ago

            The thing if someone has memory access Signal doesn’t need to store anything, transiting data is now available. For example all of your contacts when doing contact discovery. It used to be a simple hash, something for which you could build a rainbow table in a few hours, at the worst. It’s lightly better now, but still.

            Don’t take it from me, take it from Moxie:

            https://signal.org/blog/private-contact-discovery/

            It also doesn’t really matter if the software itself can easily be tampered with in memory by the hypervisor. Like I said, they are putting a lot of trust in Intel SGX.

            And let’s not even get into the digital sovereignty issues, and financing of right wing billionaires. Yes, running on AWS is an issue. It’s multiple issues even.

            • Count042@lemmy.mlEnglish
              2·
              35 minutes ago

              I don’t take anything from someone I don’t trust that also explicitly doesn’t use warrant canaries because he says they don’t work in contradiction to every legal authority.

              It’s also an issue that they run the signal server on one single AWS region.

              It isn’t hard or even all that expensive to run on multiple regions.

            • pkjqpg1h@lemmy.zipEnglish
              2·
              6 hours ago

              https://signal.org/blog/private-contact-discovery/

              Since the enclave attests to the software that’s running remotely, and since the remote server and OS have no visibility into the enclave, the service learns nothing about the contents of the client request. It’s almost as if the client is executing the query locally on the client device.

              • wildbus8979@sh.itjust.works
                1·
                6 hours ago

                … Providing you trust Intel SGX (and AWS for giving them access to actual SGX and not just emulating a compromised instruction set)

                • pkjqpg1h@lemmy.zip
                  1·
                  6 hours ago

                  Providing you trust Intel SGX (and AWS for giving them access to actual SGX and not just emulating a compromised instruction set)

                  😃

                  conspiracy begins…

                  • wildbus8979@sh.itjust.works
                    2·
                    51 minutes ago

                    What conspiracy? CPU bugs aren’t a conspiracy, they are just a fact. Amazon’s involvement with American three letter agencies isn’t a conspiracy, it’s a fact.