| ▲ | tptacek 2 days ago |
| If you have real operational security concerns, your provider shouldn't know anything about you; should in fact have bilateral shielding between themselves and you to prevent either counterparty from learning stuff. That's how Signal works. |
|
| ▲ | AnonC 2 days ago | parent | next [-] |
| But Signal requires a working phone number for registration and it knows the phone number. The backend could be modified at any time to store this somewhere else while maintaining end to end encryption between the two parties communicating on it. How can Signal prove continuously that it doesn’t store or disseminate the phone number? I know in past precedent it has told courts that it only has very limited information (date of account creation and the last time of account access). |
| |
| ▲ | inigyou a day ago | parent | next [-] | | I don't understand what you mean by all this. Obviously your phone number is tied to your Signal account and Signal knows that linkage at all times - no special action is necessary for them to know it. Signal does not provide anonymity beyond what a phone number provides, and isn't designed to. Signal's design is "what if WhatsApp wasn't evil" which makes it good for the average user. If you actually want Session or SimpleX, which sacrifice usability for even more privacy, then you know where to find those services. | |
| ▲ | tptacek 2 days ago | parent | prev [-] | | There's all sorts of things any service provider could do to sleuth out who its users are. The implication of this OFAC determination is that A/I didn't need to sleuth anything out; they are accused of knowingly and deliberately assisting the PKK. |
|
|
| ▲ | impossiblefork a day ago | parent | prev | next [-] |
| Signal will allow traffic analysis. You send the message to signal, if they wish they can write down to whom they send it on. It is impossible to make a secure system without the continuous transmission of dummy messages to large numbers of users. |
| |
| ▲ | TheqO 21 hours ago | parent | next [-] | | I noticed that more are using Session now and not Signal (no phone number or email required) https://getsession.org | | |
| ▲ | impossiblefork 20 hours ago | parent [-] | | Ah, blockchain-based. Maybe it's fine. I prefer my idea with dummy messages and no ledgers or anything. |
| |
| ▲ | inigyou a day ago | parent | prev | next [-] | | They don't have to do that because accounts are associated one-to-one with phone numbers. | | |
| ▲ | impossiblefork 21 hours ago | parent [-] | | I don't understand your comment. | | |
| ▲ | inigyou 17 hours ago | parent [-] | | Signal doesn't need traffic analysis because it knows the phone numbers of who is communicating. | | |
| ▲ | echoangle 9 hours ago | parent [-] | | Traffic analysis isn’t just to identify the peers but also to find patterns in communication (they are telling each other good morning and good night every day, they communicated before a terrorist attack, …) |
|
|
| |
| ▲ | tptacek a day ago | parent | prev [-] | | Again: in every system there's always some kind of sleuthing you could do to attempt to identify a user. That's not the legal standard. The complaint against A/I is that they knowingly and deliberately assisted the PKK. | | |
| ▲ | impossiblefork a day ago | parent [-] | | No. With dummy messages you are guaranteed that traffic analysis will not be possible. Because you connect to the network, then start sending messages to everybody continuously, a message every second, or every ten seconds, or every 100 seconds, you will, every second, or every ten seconds, or 100 seconds, be able to send a message to whoever you want, and you will not be distinguished in any way from the other network participants, even if an adversary controls all nodes but that of the person you want to communicate with. Without dummy messages, traffic analysis will always be possible. If they knowingly and deliberately assisted the PKK in a forbidden way, there would likely have been an Italian prosecution. Since this hasn't happened, it probably isn't true. The illegality of the PKK in the Europe is also something quite complicated. The commission have declared it a terrorist organization, but here in Sweden such declaration have no judicial meaning and we define terrorism by whether the organization satisfies objective criteria defined in our law, which the courts determine from case to case (which in Sweden means that if you send money the PKK and prosecutor brings the case and argues that they're terrorist organization, and you argue badly, and he wins, then you might be convicted, but when another guy does the same thing, and argues well, he wins); and the situation in Belgium is similarly complicated, with a legal dispute about whether PKK was a terrorist organization, which PKK won, and thus the PKK was, in Belgium, declared by a court to not be a terrorist organization. | | |
| ▲ | tptacek a day ago | parent | next [-] | | I don't have an opinion about the PKK. My broad take is: if Europe doesn't care, there's no reason for the US to be leading a sanctions effort. I'm confident like everybody else that this is largely pretextual. All I care about is the claim that if they can do this to A/I they'll come for Signal next. That doesn't follow. | | |
| ▲ | impossiblefork 21 hours ago | parent [-] | | The issue is complicated. Many EU governments care, because Turkey cares, but the problem is that Turkey's position that they're terrorists is legally iffy, so a lot of European courts disagree, and this creates a schizophrenic situation where politicians hold that they're terrorist and will claim that it's the government position, while the actual government position in the courts is that they mostly aren't and that it's a case-by-case question. | | |
| |
| ▲ | A1kmm a day ago | parent | prev | next [-] | | > No. With dummy messages you are guaranteed that traffic analysis will not be possible. I don't think that's true. There are two possibilities: If you're proposing that dummy messages are in addition to normal messages, then dummy messages add noise to the signal, but over a long enough time, for known noise distribution, it is possible for the signal to be statistically significant. That depends on there being enough signal, but then things depend on signal traffic patterns, there are no guarantees. The second possible design is that the node-to-node communication volumes for any pair of nodes is truly independent of the signal - i.e. the statistical model decides how much traffic flows from a node to another node, and that fixed amount of flow is either used for signal or for noise, and if there is more signal, it's dropped or waits. Encryption makes it impossible to distinguish signal from noise without the key known between the pair of nodes. That is secure against a passive adversary who doesn't participate in the network. However, if network users are anonymous and mutually untrusting, then the adversary can use active methods without much risk (i.e. lots of users and nodes can actually be the adversary). Every packet/message delayed or dropped also allows inference about network traffic by other users. These methods can harden a network and make analysis harder, but they don't guarantee it is not possible. | | |
| ▲ | impossiblefork 20 hours ago | parent [-] | | No, you always send a dummy message the appointed time. If you have a real message, or a network maintenance message, that substitutes for a dummy message. You never send messages other than at the appointed time. Delayed or dropped messages won't matter, since you only send a message at the appointed time. So the network is literally indistinguishable from one where you have sent no messages to all participants and to even someone with complete control of the network. | | |
| ▲ | mafuy 19 hours ago | parent [-] | | Do messages have a visible receiver address of any kind? In that case, you're out of luck. The only way to do make this statistically sound would involve an insane amount of messages, rendering it impossible. | | |
| ▲ | impossiblefork 8 hours ago | parent [-] | | No, of course there isn't a visible receiver address. You have a list of peers, P1,...,PN, every second, at a specific pre-decided time, slightly fuzzed to avoid timing stuff, you send a message to each of them. If you don't put one in, it's a dummy message chosen at random and encrypted. But if you have a message, you send that at the appointed time. Consequently, from the outside of the system, from the PoV of someone who does not have the keys, its behaviour is indistinguishable from a system where no one is sending any messagess at all. |
|
|
| |
| ▲ | VorpalWay 19 hours ago | parent | prev [-] | | A problem with sending dummy messages on something like Signal, is that waking up phones unnecessarily is really bad for battery life. It also doesn't work for the voice/video call feature, since that needs to be realtime. |
|
|
|
|
| ▲ | inigyou 2 days ago | parent | prev | next [-] |
| Impossible for a public thing though, noblogs.org will always be traceable to where noblogs.org is hosted because that's how the packets get there. You can maintain much better opsec in a two way communication than a broadcast. |
| |
| ▲ | tptacek 2 days ago | parent | next [-] | | Right, I'm only moved to comment by the implications being drawn on this thread that Signal and WhatsApp are next. Different fact patterns and different legal standards. | | |
| ▲ | inigyou a day ago | parent [-] | | Signal and WhatsApp are already required to give your communications to the government. | | |
| ▲ | tptacek a day ago | parent [-] | | Signal and WhatsApp don't have the plaintext of your communications to begin with. | | |
|
| |
| ▲ | __MatrixMan__ a day ago | parent | prev [-] | | Well, a fast broadcast at least. Of you're willing to wait for a pocket switched network to spread the signal, you can hide the source pretty well. |
|
|
| ▲ | jijijijij 2 days ago | parent | prev | next [-] |
| This is about finances. If the US declares you a terrorist organization, you cannot do any banking anymore, even outside the US, since most banks do not want to gamble on SWIFT access. Since the US considers anything "antifa" as terrorism now, it already had most concerning distant effects last year. See GLS bank cancelling Rote Hilfe in Germany. 1933 was the last time Rote Hilfe was cancelled, btw. It's an antifa OG. Pretty good indicator about the status quo.. Anyway, look at e.g. GrapheneOS, which is already treated as probable cause by law enforcement. Encrypted messaging also super sus. Thing is, funding can't escape jurisdictions. Signal servers are not running on love and fellowship, but donations and public money. Opsec won't protect your software stack's foundation against US finance attacks. |
| |
| ▲ | tptacek a day ago | parent [-] | | This OFAC action isn't based on "antifa", though the press release predictably takes shots at it. It's based on three designated foreign terrorist organizations, notably the PKK. | | |
| ▲ | qahst1 a day ago | parent | next [-] | | PKK is the pretext, there is no evidence. The US does not give a damn about PKK. They used the Kurdish sister organizations in Syria and Iran. They condemn PKK because Erdogan wants it. The US would have zero issues with a Kurdish state comprising parts of Turkey and Iran that splinters the region even more. | | |
| ▲ | tptacek a day ago | parent [-] | | I don't think US cares about the PKK either, but that's not my point. |
| |
| ▲ | jijijijij a day ago | parent | prev [-] | | > It's based on three designated foreign terrorist organizations, notably the PKK. In this context, "designated foreign terrorist organizations" is not an explanation, but a tautology. The matter at hand is how and why something got onto that list. The antifa remark relates to the Rote Hilfe situation. In my opinion, it's an example of how populist rhetoric became a major overreach with real consequences prior to the incident at hand. Rote Hilfe had a very weak relation to "Antifa Ost" (hardly worth US attention). That's how they got cancelled: https://www.state.gov/releases/office-of-the-spokesperson/20... So the antifa moral panic is indeed very much relevant. But decide for yourself, if "Antifa Ost" deserves US anti-terrorism attention to the extent of OFAC sanctions, or if it's maaaybe populist action... https://en.wikipedia.org/wiki/Dresden_left-wing_extremism_tr... Incidentally, funny how the NSU isn't on that list, hm? | | |
| ▲ | tptacek a day ago | parent [-] | | It's neither an explanation nor a tautology; it's an element of US law. | | |
| ▲ | inigyou a day ago | parent | next [-] | | It was clearly written as an explanation. The alternative is that you didn't intend for the words you wrote to have any meaning, in which case why did you write them? | |
| ▲ | jijijijij a day ago | parent | prev [-] | | So if those prior sentences or yours are not related, your argument is part wrong, part irrelevant/nonsensical. Good talk. |
|
|
|
|
|
| ▲ | redsocksfan45 a day ago | parent | prev [-] |
| [dead] |
