303 private links
Issues with Signal listed so far
- Tied to US for most of its funding
- The funding sources remains unclear
- Employees gets ~$440,000 annually
- Use GAFAM to work such as Amazon (AWS) or Goggle and Microsoft (hosting too)
- metadata can be spied by the U.S.. See https://lemmy.ml/comment/5882433 or the metadata provided https://signal.org/bigbrother/santa-clara-county/
- despite requests from many users, Signal hasn’t supported the inclusion of its app on F-Droid
- Signal logs information through the notifications, and audio calls (time, name of the account) on the device. See how to reduce data leak
- When the device is unlocked, Signals content can be read
Other critics are stated in https://nostr.band/note154hta9dt8k4mhleu4z20rwlqd85dxap20xtvcy4fq89uzcrwshpsdelk2t
Auprès de Next, elle déclarait en revanche : « la promesse est toujours la même : si vous nous donnez accès à tout, nous pourrons résoudre tous les problèmes du monde. Sauf qu’il n’y a aucune preuve de cela, pas plus que de démonstration que le chiffrement soit le coupable. »
La création d'une porte dérobée aux forces de l'ordre est aussi une porte exploitable un jour ou l'autre par des pirates.
L'ONG Access Now décrit à Wired 3 types d'attaques: la demande par des gouvernements d'obtenir un accès légal aux données chiffrés; la deuxième consiste à analyser les données du côté client; ou alors suspendre l'accès aux services de messageries chiffrées.
Cela dit, des voix importantes s’élèvent aussi en faveur du chiffrement. Aux États-Unis, à la suite de la cyberattaque Salt Typhoon, plusieurs représentants du FBI et de la CISA (US Cybersecurity and Infrastructure Security Agency) ont encouragé la population à largement utiliser des applications de messagerie chiffrées.
Session os a fork of Signal that aims to be decentralized.
The response of Session: https://web.archive.org/web/20250117085555/https://getsession.org/blog/a-response-to-recent-claims-about-sessions-security-architecture
and another blog post: https://soatok.blog/2025/01/20/session-round-2/
Loading a ressource can deanonymise a user:
- Cloudflare CDN shares the nearest airport in its HTTP header Cf-Ray
- A favicon cache works: "Since everytime you load their site, your browser automatically downloads this favicon, this means a user from each one of this locations has visited the Namecheap.com site within the 5 minutes with the last visit from Tokyo, Japan.". So if you lead a specific content created only to target one user, you can know from which data center the content is loaded (and its nearest airport).
- As Signal uses Cloudflare caching for the attachments, the same attack can be exploited.
With an innocent-looking attachment, an attacker can deanonymize users and find their location within an approximate radius (tens of miles, depending of the datacenters).
It works only if the user clicks to download the attachment in this case.
- Push notification of Signal with an image can trigger the cache... So a 0-click exploit can exist.
If the target has push notifications enabled (which it is by default), they don't even have to open the Signal conversation for their device to download the attachment. [...]
An attacker can run this deanonymization attack any time and grab a user's current location without a single interaction.
A similar exploit can be used on Discord with custom emojis: the custom emoji is a custom content downloaded by one user.
Conclusion:
his attack can be used to track Signal accounts, correlate identities, find employees meeting with journalists and much more.
Any app using a CDN for content delivery and caching can still be vulnerable if the proper precautions aren’t taken.
Definitely. I'm a big fan of Signal. Works at least as well as WhatsApp. The only excuse I've heard for not switching is "But my friends only use WhatsApp."
Don't be part of the problem. Create your account.
Signal seems to consume a lot of battery.
Using both encryption algorithm: one as usual and another quantum resistant.
C'est curieux de voir comment l'extrême-droite (et Telegram) tapent sur Signal.
Sachant que :
1) Telegram a fait le choix de ne pas activer le chiffrement par défaut, contrairement à Signal.
2) Conséquence : 99% des échanges sur Telegram sont écoutables.
3) Telegram est d'origine Russe (même si visiblement hostiles au pouvoir en place).
La critique a dit: "leurs messages Signal "privés" avaient été exploités contre eux dans les tribunaux ou les médias américains". On ne sais pas qui, ni quand, ni pourquoi...
Elon Musk répond: « Signal présente des vulnérabilités connues qui ne sont pas corrigées. Cela semble étrange... »
Lesquelles?
La suite des arguments est longue... à propos de Telegram:
vous avez pris la décision délibérée de ne pas ajouter de sécurité pour la plupart des utilisateurs, cela sort du domaine de la concurrence et commence à ressembler à de la malveillance.
Images, videos and icons are great. Signal comes with stickers with its proper format.
A great tool could convert such images into stickers, and bundle it into sticker packs.
A greater tool could export these stickers.
Oh wait there is already a website referencing them: https://signalstickers.org/.
A quick documentation about them is available on the dedicated signal webpage
We estimate that by 2025, Signal will require approximately $50 million dollars a year to operate — and this is very lean compared to other popular messaging apps that don’t respect your privacy.
When you send a message, the Signal service temporarily queues that message for delivery. As soon as your message is delivered, that small bundle of encrypted data (i.e. your message) can be dropped from the queue. The storage of end-to-end encrypted files is temporary too, and any undelivered end-to-end encrypted data is automatically purged after a period of inactivity.
It also shows different service costs and why they are like that. It shows the care Signal has to privacy in its different services.
Signal tends to have their incomes from their users. Users donating will be awarded of a badge on their profile. This will allow them to be consistent with their principles and to be independent, while giving reputation to their financial contributors.
We will see how this evolve :)
The response of Matrix to Moxie (Signal maintainer). And why a decentralized version is needed on the internet.
Alternatives: Matrix, Briar, Jitsi, XMPP