i’ve just seen a comment in a post, in this very community, saying people trust signal because of missinformation (from what i could undertand).

if this is true, then i have a few questions:

-what menssaging app should i use for secure communications? i need an app that balances simplicity and security.

-how to explain it to my friends who use signal because i recomended?

-what this means for other apps in general?

    • wildbus8979@sh.itjust.works
      9·
      21 hours ago

      I’m not claiming the contents of the messages are at risk here. You’re social graph and metadata though is another story.

        • wildbus8979@sh.itjust.works
          1·
          10 hours ago

          The thing if someone has memory access Signal doesn’t need to store anything, transiting data is now available. For example all of your contacts when doing contact discovery. It used to be a simple hash, something for which you could build a rainbow table in a few hours, at the worst. It’s lightly better now, but still.

          Don’t take it from me, take it from Moxie:

          https://signal.org/blog/private-contact-discovery/

          It also doesn’t really matter if the software itself can easily be tampered with in memory by the hypervisor. Like I said, they are putting a lot of trust in Intel SGX.

          And let’s not even get into the digital sovereignty issues, and financing of right wing billionaires. Yes, running on AWS is an issue. It’s multiple issues even.

          • pkjqpg1h@lemmy.zipEnglish
            3·
            9 hours ago

            https://signal.org/blog/private-contact-discovery/

            Since the enclave attests to the software that’s running remotely, and since the remote server and OS have no visibility into the enclave, the service learns nothing about the contents of the client request. It’s almost as if the client is executing the query locally on the client device.

            • wildbus8979@sh.itjust.works
              1·
              9 hours ago

              … Providing you trust Intel SGX (and AWS for giving them access to actual SGX and not just emulating a compromised instruction set)

              • pkjqpg1h@lemmy.zip
                2·
                9 hours ago

                Providing you trust Intel SGX (and AWS for giving them access to actual SGX and not just emulating a compromised instruction set)

                😃

                conspiracy begins…

                • wildbus8979@sh.itjust.works
                  2·
                  4 hours ago

                  What conspiracy? CPU bugs aren’t a conspiracy, they are just a fact. Amazon’s involvement with American three letter agencies isn’t a conspiracy, it’s a fact.

                  • Ontimp@feddit.org
                    2·
                    2 hours ago

                    Yea but if you worry about CPU bugs there is no such thing as trust, no matter who owns the infrastructure. Any software can have critical bugs and any system that can be accessed remotely can be compromised. Personally I’d trust the people at Signal that they have made a reasonable architecture section to balance availability and privacy

          • Count042@lemmy.mlEnglish
            2·
            4 hours ago

            I don’t take anything from someone I don’t trust that also explicitly doesn’t use warrant canaries because he says they don’t work in contradiction to every legal authority.

            It’s also an issue that they run the signal server on one single AWS region.

            It isn’t hard or even all that expensive to run on multiple regions.