this post was submitted on 26 Feb 2025
27 points (90.9% liked)
Asklemmy
45342 readers
822 users here now
A loosely moderated place to ask open-ended questions
Search asklemmy π
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- [email protected]: a community for finding communities
~Icon~ ~by~ ~@Double_[email protected]~
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Of the three, Signal is the most secure. Now in about 2.5 seconds, someone is going to start screaming about the phone number requirement. This is used so that you can go from desktop to mobile with the same profile. You can set Signal to hide your phone number from everyone else but you. It's a non-issue.
There is a reason why Elon Musk doesn't let people post about Signal on his Nazi social network. Because it works.
It's an issue.
You can't create an account on desktop. You can't create multiple accounts. You can't create an account at all if you don't have a phone number. You can't create an account if your phone number's previous owner created an account. Signal can be subpoenaed for your phone number.
Is it possible to use a number different to the one on the device you use? Seems like a simple workaround to use a throwaway SIM to set up, and then use it with that number moving forwards.
That sounds like an awful lot of work to workaround a problem that shouldn't have existed in the first place.
You say this like username logins donβt exist
No, we know that, but people will still come scream here that you need a phone to register anyway. It's all the time the same people. Not realizing that is the easiest onboard that all the normies are used to and an easy way to control spam accounts.
I mean if you acknowledge that user names can be used like any other website then your point doesnβt work. They donβt need my phone number. Most applications donβt need it but they do? Come on.
[citation needed]
citation
EVERYTHING in Signal follows an encryption or tokenization chain. Not like crypto coins but real actual chain-of-custody type encryption workflows. It uses elliptical curve cryptography where the key for each message moves forward along an elliptic curve, which are excessively difficult to guess the factors for once it is selected if you are not the key holder. This means that even if someone cracks the key for a single message you sent, they are going to have to crack the key for every other message still as each one is different. Even the metadata is encrypted by the user's keys.
Signal doesnt have usernames in the traditional sense. It's phone number+6 digit pin hashed into an encrypted signature.
The signal company can't see anything you do besides account create date and last login date, even if they wanted to due to how their platform is set up.
Meanwhile, Matrix literally clones the metadata between servers when a user connects to and starts talking to users on another server, in plaintext (maybe encrypted at rest but not E2EE).
OK, and how is that different from the other chats?
You do know that at least Signal and Matrix use pretty much the same crypto, right?
And Matrix can be self-hosted, so I don't need to worry about what they can see anyway.
On this point alone Matrix appears more secure than Signal...
And Threema is Switzerland-based, so by default it's more trustful than a USA-based company.
The metadata is really important especially if you or anyone you talk to ends up being targeted. 95% of intelligence work is mapping out adversaries' communications networks..if you have that, you don't need to decrypt the contents because you already know who is talking to who. The federation of metadata alone is reason to avoid matrix for anything important.
Thank you for being one person in this thread that actually read and understood my comment.
A bunch of comments repeating "Signal is the most secure because I said so" was not helpful.
I just saw your reply to me and was about to say the same thing, but they worded it perfectly. And I did mention metadata as a key point in my original post.
All the fucking people that actually know cryptography and are experts in their areas.
It's good to be inquisitive but at some point if a person is not qualified to understand either you gotta belief some authorative figure or pay someone you trust to go review the code if you still don't trust it.
Multiple experts have said for years that it's solid. There's audits out there. It's used in the most extreme places where people need to survive and commucate securely and governments keep screaming they need backdoors because they can't fo anything about it.
At some point the whole questioning it has to stop.
Continuing to eat garbage opinions from the internet and growing conspiracy theories eventually has a limit.
Sure, buddy.
Maybe you should read the comments you're replying to first.
If you can't do that much then maybe you just shouldn't comment at all.
I'll simplify it for you:
Discussion quality on Lemmy starts looking like Reddit now.
Almost feels like home...