Like the title states looking for E2EE apps (Android and iOS) without going into much details or needs to be robust enough and easy to use for anyone and stable for operations that are susceptible to constant electronic warfare. I did some research and thought about replacing Signal with Molly and wondering if it will still work if Signal leaves the EU, but am also worried about its updates to patch vulnerabilities in a timely manner. I appreciate the help I am a “Jack of all trades and master of none” when it comes to these types of programs, but am also the go to currently in my unit since I am somewhat knowledgeable about exploits and attacks that can compromise systems would be great if there was an desktop as well (like Signal) and would also be nice if it was FOSS and auditable ( I know that’s kind of redundant ) I know it’s a tall order to ask but figured I would try. I really appreciate the help so much and hope I did things by the rules here and don’t get flamed if this has already been covered ( I searched but my skills with searching the fediverse is low
Much has been said about the idea of ‘signal leaving UK or EU’. Little has been said about how exactly that would happen.
AFAIK, Signal has no business presence in the UK or EU. IE, no offices, no registered corporate entities. Thus, they (arguably) have no more requirement to comply with UK’s or EU’s regulations than, say, Iran’s or China’s or any other jurisdiction where they do not do business and have no presence.
Signal’s leadership has a record of giving any regional restrictions the middle finger, so I doubt Signal would voluntarily block EU countries. So that means the EU would either pressure Google and Apple to delist Signal (easily worked around, at least on Android, and soon on Apple too as EU is trying to force sideloading) or they’d pressure ISPs to block connections to Signal (more or less impossible).
If EU tried to do that, it’d just create a giant game of whack-a-mole. And people doing real CSAM shit would just move to even more private distributed systems.
expired
The only alternative that’s FOSS and not centrally controlled is Matrix. By being decentralized, anyone can run their own server and good luck stopping that.
There may be 200 other “alternatives”, but they’re irrelevant to the point where I consider then non-existent. Nobody has heard of them. Nobody is using them. Trying to push them on normal people will most likely result in them no longer talking to you as often or at all, and none of the other ones has any chance of reaching a critical mass. Matrix at least has some recognition among nerds and some, tiny amount of adoption outside.
Stop pushing random niche shit, it does privacy a disservice.
The only alternative that’s FOSS and not centrally controlled is Matrix
That’s not true, there is also XMPP which is lighter and far more decentralized than Matrix
I don’t understand why people think downloading s fucking app is so arduous. I truly don’t. Their stalwart refusal. To do it puzzles tf out of me.
If I installed a different app for every friend I had, I’d have a homescreen full just of chat apps. What’s worse, those niche privacy friendly apps go under or out of favor often.
You might be able to convince some of your friends to install an app just for you once, but by the time you’re telling them “this one now sucks, I’m on other app now” for the second time, they’ll just stop chatting with you, and if you ask them repeatedly, likely shun you even IRL because most people want to live their lives, not chase chat apps for their friends’ weird interests.
And even if they do that, they’ll have one app that they use every day, and one that sits in the bottom of their app drawer. Guess who gets invited to do something on the weekend, the person who shows up on their main contact list, or the person that would show up if they dug out that dusty app? And guess what the phone is gonna do with that app once it hasn’t been opened for a week… it’s going to deprioritize it so it won’t even work properly, while their main daily-opened app always gets push notifications immediately.
You don’t have to like it. You can pretend it’s not happening. But it will happen.
Pretty sure signal won’t be forced to do anything:
Encryption plays an essential role in securing communications. The international human rights law test of legality, necessity and proportionality should be applied to any measures that would affect encryption. Both the UN Commissioner for Human Rights[1]and the European Data Protection Supervisor[2]have concluded that the EU’s proposal for a regulation on child sexual abuse material fails this test[3].
this is from May this year, when Spain proposed this. How in the everliving fuck the EU can get away with violating human rights?
So yeah I’ll eat my hat unsalted if this actually will break encryption
If they actually ban E2EE, I’d like to see all banks, for a start, and most web sites, downgrade https to http. See how long the ban will last then.
“I was just following the law!”
It’s ok the banks have a “too essential to be punished” card
I give it a month before either the ECJ steps in or they quietly change the law/interpretation (Article 13/17 says hi)
Well, they don’t need to break encryption, since the scanning of messages is supposed to happen client-side.
And by defenition breaks e2ee. https://en.wikipedia.org/wiki/End-to-end_encryption
Technically not touching your valuable encryption would still be an excuse they’d make, wouldn’t it
Even though it functionally does break encryption
It’s not encryption, all goes end-to-end. They will force app clients to add a “leak” request that sends the hash of each image you send to compare if it matches with child porn. It’s explained on another post on Lemmy and it looks so hard and so impossible to be implemented that I doubt it will actually work. The chat is still end-to-end.
They want to also check them with ai. Hash alone would be bad. But ai is worse. Ya got/are young looking gf. Well if ya send nudes some cop will most likely see your nudes if chat controll really comes.
Source: the new law proposal
They want to also check them with ai.
Do you have the source link of this pls? thx!
Here. On page 52, Article 10 3.a
The technologies shall be: (a) effective in detecting the dissemination of known or new child sexual abuse material or the solicitation of children, as applicable;
They are explicitly talking about known or new material. Even though they don’t state the technology, AI is the only possible one (maybe there are more but they WILL have the same issue, ai has)
They also go indepth in a centralized db, where all this shit will be stored, to retrain this model.
Yea it is fucked up.
But AI is too expensive to use it on any text sent by any European citizen/bot.
I would guess it rather refers to images. But it doesn’t matter if it is too expensive. Ai is the only thing that can do the stuff they want.
Are you sure? Using AI for any text and image that any European citizen (742,083,786 people if I’m not wrong) is pretty heavy… They will need to spend too much money for AI usage if this is the stuff they want or the only thing they can do.
EDIT: Sorry, if you mean only about images is still very heavy, no AI needed here, they said it’s a client side implementation and still sending random hashes… any hacker can just send random hashes and block database request with a DoS… and they will get many false positives… Not viable.
deleted by creator
Yes.
They will check their own images and police themselves lol (actually there will be an extra committee for this so just joking)
O God, the hash one isn’t bad, just stop there for the sake of all that is holy
The hash one has the one issue of you could simply put political shit in the db and find out your political opponents, but the hash one is debatebal.
I would still use Signal. By ignoring bad laws you are turning the EU government into a laughing stock
You can just continue using Signal. All the alternatives will disappear from the app stores too unless they spy on you.
A recent alternative with even better privacy is SimpleX: https://simplex.chat/
the author has a lemmy community about it too: !simplex@lemmy.ml
deleted by creator
I’d just like to point out that if Signal leaves the EU, it will most likely just mean that it’s not available through the official app stores. With Signal updating itself, it’s just a little inconvenient to install it on a new device, though, they even said that they’ll try to make it as easy as possible.
Yup. At most, Signal gets removed from the Play Store. There’s no meaningful way to block Signal, especially now that big CDN providers are starting to rollout Encrypted Client Hello.
“If it’s not allowed in the play store and we need to click away a Google warning or 2, maybe it’s dangerous and we shouldn’t use it” - average Joe. Next step: “… suspect was using signal, so we decided to …” yada yada yada same as it already is perceived in general for tor and even with VPN in some countries. Just the fact you’re not using the thing most other people use makes you stand out.
MollyMoxie will need to go back to F-Droid 😂Molly has its own F-Droid repo, it’s one of the default available in Droid-ify.
Yes, I wanted to mean Moxie, sorry. The one that said “NO SIGNAL ON F-DROID REPOS”… hahaha blaming f-droid was insecure and that’s why we should use Google services.
He didn’t want Signal on FDroid because surprise surprise he just wanted to roll their own crypto coin with insiders knowledge. You can’t do that with open source so easily. There’s a reason they didn’t publish code for years. That people still support those crooks, who have lost all credibility, for a privacy app, baffles me.
Thank god we have Matrix now.
There are over 200 alternatives to Signal, Open Source and encrypted, out there. The attempt by governments to ban them all seems a little far from reality to me. https://alternativeto.net/category/social/encrypted-chat/?feature=end-to-end-encryption&license=opensource
Pardon my ignorance but is EU really truly considering this colossaly stupid move to ban E2EE?
Just a whole lot of ignorant hype, I believe.
Take a look at the matrix network. Its decentralized like lemmy and the cryptography is on point. And it cant really be cencored due to this reason.
Unfortunately its possible to send messages on Matrix that are not encrypted
Yes its possible, but you are free not to send unencrypted matrix messanges.
Human error is possible. Happens to our users PGP emails all the time.
As an org we dont allow any software where its possible to send unencrypted messages. It too much risk.
I completely agree. Though pgp emails usually have to be set up. At least when using element nothing has to be set up and it is enabled by default. But this doesnt change the point.
As an org self hosting a matrix server would be an option. But the issue would still remain. So its a tradof
this seems easily fixable by choice of end user app, Element surely defaults to sending encrypted messages, if a user goes out of their way to figure out how to send clear text good on 'em
Yes, because for large public rooms it makes no sense as anyone can leak the message contents anyway and e2ee is expensive for large rooms.
Also DMs
Matrix
deleted by creator
Signal. Any restriction can be bypassed
deleted by creator
AFAIK in Iran, the issue is that the real local phone numbers could not be accepted for registration due to sanctions, so it only ever worked for existing accounts. Another problem of such a system.
deleted by creator
Not just a phone number, but a non-sanctioned phone number.
They could. If they wanted to. But they don’t want to. They could charge a little bit of money to initiate contact with somebody if you don’t have your phone number registered. To keep the spam down. They already have their own mobile coin, they could just ask initial contacts to send a penny for that contact. Something not too intrusive. They could do that, if they want to, but they don’t want to.
Yeah, Signal should work on its reliance over phone
It depends on what you want. I encourage people to use Jami (distributed, so might be a thing, if not self-hosting your own service, since what is said decentralized in reality is a set of centralized services). If too hard, then XMPP + OMemo. And only then, Matrix (by design it gives up more meta data than XMPP).
XMPP, the internet standard for federated instant messaging.
https://www.privacyguides.org/en/real-time-communication/
If signal is banned all of these other apps will be banned, but maybe they’ll not enforce it completely
Your best bet is to start using a privacy respecting VPN today, always on on your phone. Like Mullvad
VPNs won’t fix all of your issues. In fact, I don’t think it will do much in this situation
