Oh also @Thisfox@sopuli.xyz

Instead of Telegram, consider one of these, it’s easier to switch to the good one now than to try and switch again later.

https://www.privacyguides.org/en/real-time-communication

Signal works great for my family

Corporations love to lie with almost truths, or incomplete truths. So sure it might be end-to-end encrypted between two users, and each message is also signed with a special key that the corporation can view, or that some trusted third party carnivore system could view. That means they didn’t lie, it is end to end encrypted, it’s just three-way encrypted instead of two-way encrypted.

Or it is end-to-end encrypted across the network, but the edge devices, ie the phones, have search capabilities built into them to deliver the messages back to the organization based on some match capability.

And as other people indicated, closed source you don’t know what’s happening, you don’t know what’s changing, you just don’t know

Interesting! Do you remember where you got this chart?

I do not consent to Signal knowing about my empty box

iMessage definitely has more hooks in than those listed. It’s an integral Apple service that’s hooked into your deeper iCloud account. And because of that, they know a lot more than just a mere “chat” app would get access to. Which likely makes it harder to quantify.

Moreover, Meta and Alphabet also cross reference a lot of data points from all the other sources they have (cookies, IP logs, etc.). Again making actual data points fuzzy or incomplete.

deleted by creator

Also WhatsApp requests access to the phone book and is very hard to use if you deny access. This is very likely done because Facebook wants access to the stored numbers to build a social graph. Even if you personally don’t mind, it is a gross privacy violation to share the phone number of other people with Facebook.

That’s clever about the pregnancy.

I would have thought it was about a case of herpes that you caught from your girlfriend and then gave to your mom.

Well said. I’m saving this comment in case I need to explain this to someone else.

the other important thing with all of this is that even if your girlfriend is taking care, THEY STILL KNOW

people around you (or “you”, in this case) using these services impacts your privacy

is there anything we can do about that? probably not

but it’s worth being aware of

Iunno if I would say that Signal can be trusted considering their ties to the US State Dept

Link previews however, are calculated server-side. So, yeah. They see any link posted.

If you login to another device with WhatsApp, does it show your chat history? If so, then the servers have your key.

I’ve never used any FB service, so I don’t know., and I don’t know anyone who uses WhatsApp.

deleted by creator

Content of the Tweet if you don’t want to click X links:

What #Telegram collects and stores:

1. Unencrypted messages, photos, videos, and files
2. Encrypted photos and videos from secret chats
3. Phone numbers and contacts
4. Metadata such as IP addresses

…

What #WireMin collects and stores:

1. None.

#Decentralization #privacy

By @WireMin

for clarity, i think that the worst thing anyone’s been able to decisively prove about telegrams encryption is that it’s vulnerable to replay attacks… which in the context of privacy rather than full security isn’t suuuuper problematic

that’s not to say that there aren’t other flaws; that’s kinda the point behind “rule number 1: DONT INVENT YOUR OWN CRYPTO”: you just don’t know what flaws there are… AES (etc) has had a LOT of eyes on it

but for the most part, the negativity with the crypto boils down to what-ifs

As I see it, the key advantage of Telegram is not technical, it is political.

Yes, Telegram is a slightly shady company with an ambiguous business model and a possibly-dodgy encryption algorithm (when it is even turned on).

But Telegram is based outside the reach of the West (in UAE, eastern Europe, maybe even Russia). Whatever its other problems, nobody thinks that Telegram is under the thumb of Western governments, as the Big Tech corporate messengers almost certainly are.

Personally I don’t care much if Russia or even China is spying on me. Because if we can be certain of anything in this world, it’s that Russia and China are not sharing their spyware data with Western intelligence agencies. And as Westerners we live outside the reach of the Russian and Chinese police states, fortunately. So for us it’s win-win for privacy. That’s the way I see it.

The ideal solution, of course, is a truly private messenger which protects everyone’s privacy, including Chinese and Russians.

But how can I virtue signal when using the mainstream app???

You are right, we don’t and can’t know if any of what Meta says is true, but at least on the surface it seems to check out. If they are stealing your private key and unlocking all your chats in secret, then they are doing a bloody good job, since no one has leaked anything yet.

Just to clear things a bit, in your analogy you don’t hand the courier both the chest and the key. The chest has a special keypad that accepts two keys, one is your key, the other is the recipient’s key. What you do is you lock the chest with your key and then give it to the courier, which will deliver the chest to the other party, which will then open the chest with his key. In theory the courier never had access to the key.

Now the issues are that you are indeed writing your message from within the Whatsapp building and you can never know if there cameras watching you or not. You also cannot know if Whatsapp has made a copy of your key, or the recipient’s key without your knowledge.

As for how can you recover all your chat history even after you destroy your phone, it’s quite easy and Whatsapp doesn’t need to know anything in particular. The functionality allows you to make a backup and store it on Google Drive. That backup gets encrypted with your password and it’s probably the most secure thing of all, if nothing else because Meta would gain nothing from the backup having poor security (as it would already have all the data if they wanted it) while it would only make them loose face, plus would allow anyone else to gain access to all ~~your ~~their data. After you restore the backup on a new device a new key+padlock pair gets created and the lock gets shared to all your contacts (which will see the yellow box telling them your padlock has changed).

I’m not claiming it doesn’t have privacy issues mind you, I’m just saying that you can’t be sure either way, unfortunately. Still, better than Telegram that doesn’t even encrypt most of your chats.

i’ve seen the bullet points from that article riffed in different ways, but i think that’s the most important part:

• They know you rang a phone sex line at 2:24 am and spoke for 18 minutes. But they don’t know what you talked about.
• They know you called the suicide prevention hotline from the Golden Gate Bridge. But the topic of the call remains a secret.
• They know you got an email from an HIV testing service, then called your doctor, then visited an HIV support group website in the same hour. But they don’t know what was in the email or what you talked about on the phone.
• They know you received an email from a digital rights activist group with the subject line “Let’s Tell Congress: Stop SESTA/FOSTA” and then called your elected representative immediately after. But the content of those communications remains safe from government intrusion.
• They know you called a gynecologist, spoke for a half hour, and then called the local abortion clinic’s number later that day.

I’ve wondered if they don’t know the data. They can perfectly read the convo on your device, assign a category what you’re talking about and keeping that category. They don’t store, read, know the conversation, they only ‘analyze’ it. F.e. if you talk about planes they may assign a category travel and sell your profile to holiday companies?

I don’t know about this, I’m just thinking that’s how I’d do it if I ran an evil corp.

Does it though when they control both ends. It is encrypted between each end which I guess secures against things like a man in the middle attack from outside parties but their app encrypts it on one end and decrypts it on the other. I have a very hard time believing that they don’t “read” your messages at some point in that process.

You can actually use it without giving it contacts permission, but you’ll have to add people via short links, like wa.me/(number).

With the new European regulations Whatapp will soon be forced to offer some compatibility towards 3rd party apps, so there are chances that perhaps bridging in this way will become easier in the near future, or at least have some level of official support. But we won’t know for certain how will it work until it happens. All we know is that Whatsapp is currently working on a way for 3rd parties to connect with them.

Personally, I’d hold for a bit to see where does that go and then decide what method to use.

That’s true in the sense that if a very sophisticated organization directly targets your family chat for surveillance, they’re going to find a way to access its content no matter what communication method you use.

Threat modeling is core to security, and that kind of threat probably isn’t the issue here. Mass surveillance, both government and corporate is, and neither is likely to secretly install malware on a family-members phone that can access the contents of the group chat. Doing that to large numbers of people would get them caught; they save it for valuable targets.

Governments openly forcing the install of spyware, as I’ve read China does in some cases would be an exception; you cannot have a secure conversation involving a device so compromised.

The contents of the chat messages are e2e encrypted, so meta can’t see what you are sending.

Even if we assume correct e2ee is used (which we have no way of knowing), Meta can still see what you are sending and receiving, because they control the endpoints. It’s their app, after all.

Due to a lack of any reliable way of backing that up, I cannot convince anyone else using the opinions of a random on the internet. I was looking for a place I can show them with evidence, so I don’t look like a conspiracy theorist with a pinboard full of string and coloured paper.