@Mer__edith I can't enforce your promises against @signalapp , thus they are #MarketingLies of the "#TrustMeBro!"-kind thus and worth diddly-piss!

https://infosec.space/@kkarhan/114695916503728029

@renardboy @derekmorr depends...

Did you have to remotely onboard someone onto a secure communication stack whilst they are on the run from the authorities and blood relatives due to "living while trans" with a literal "dead or alive" bounty on their head whilst stuck in a besieged city that's being shelled?

• Cuz I did...

@signalapp is evidently a solution appealing to #TechIlliterates with dangerous 'semi-knowledge' who are willing to accept a "#TrustMeBro!" by @Mer__edith and #MoxieMarlinspike before her.

• Using #Signal would've gotten said person tracked down and killed by the de-facto aithorities for merely having their phone # linked to that shite!

@derekmorr

Parroting the same #propaganda doesn't make it any less wrong.

• Please go #TouchGrass and think about it.

Once you've calmed down you can come back and apologize.

• Cuz you've disproven nor evidenced any of your claims whatsoever!

Meanwhile @signalapp's @Mer__edith can blast all the #Advertising #lies they want, that doesn't make their #Security better than the "#TrustMeBro!" claims of #NSAbook's #WhatsApp!

https://www.youtube.com/watch?v=8PW3O2mqTn8

• You may laugh at this, but my instincts and insights have kept me alive so far without failing so obviously it's kinda hard to consider some #copaganda and random dude splaining as valid arguments!

Consider the #timeout an olive branch.

@silhouette @richi @signalapp @torproject

1. You completely miss the points! There is no "#TechnicalNecessity" to demand #PII like a #PhoneNumber - espechally for a "#privacy"-focussed messenger!

2. & 3. #Signal is able and willing to comply with #Cyberfacism and pushing a #Shitcoin (#MobileCoin) makes it trivial to criminalize the App for "illegal & unregilated banking". If #Moxie or @Mer__edith cared they'd yeet that thing (or didn't even integrate it to begin with!) to avoid the attention. And yes Signal does restrict the App functionality when using a phone number from #Russia & #Iran (among other nations), thus affecting not only those in need of safe comms but by sending a verification code to them, earmarking them for police & intelligence. Which bings.me to the 1st agrument.

4. #Tor has a stellar record in terms of stability, integrity and censorship circumvention. DIY'ing something instead if following almost two decades of solid progress is absurd and violates "don't roll your own crypto" as a rule!

5. Only with #SelfCustody can you protect your own data. Or do you really expect Staff from Signal to not talk when facing lifetime in jail? If they have the keys, they can decrypt it, thus their #E2EE is just a "#TrustMeBro!" concept. I mean, what prevents them from being forced into backdooring all comms to @icij as per #NSL? Any "guarantee" without self-custody is worthless by virtue of being unenforceable!

Signal pushing #TechPopulism instead of teaching folks that their #ComSec is worth diddly-piss wothout.#OpSec, #InfoSec & #ITsec is dangerous!

• And yes claiming "JuSt UsE sIgNaL!" is dangerous in the era of #Trump's #cyberfacist regime acting as it does (like with the #ICC)!

Not to mention there are better options that don't do that shite (i.e. demand PII) and just work. @monocles / #monoclesChat & @delta / #deltaChat for example can adapt way better to said risks and ain't run by a #VCmoneyBurningParty!

@dazo @MarionDonnelly @murena @e_mydata @red_rooster @georgetakei not to mention #Apple is not only capable but willing to shove in #Govware #Backdoors.

• Otherwise they would've left the "P.R." China like #Google.

So their claims re: #privacy and #security are "#TrustMeBro!" at best if not blatant lies.

Remember: #AllGAFAMsAreBad and #KerckhoffsPrinciple demands #transparency!

@europesays why would anyone want #Shitcoins that combine the #disadvantages of #fiat and #cryptocurrencies without any redeeming qualities?

• As a matter if fact, #Tether is merely pegged by a "#TrustMeBro!" promise and also has means to steal said #shitcoin from wallets under the pretense if #Embargo / #Samctions #compliance.

So why would anyone want that instead of #Monero???

@phreaknerd @melsdung @nocci bis darauf dass #Signal auch unter #CloudAct fällt und genauso zentralisiert ist wie #Telegram und genauso #TrustMeBro in Sachen Nicht-Kooperation agiert...

• Geb' dir lieber #XMPP+#OMEMO, denn das geht über @torproject / #Tor und selbst wenn bspw. @monocles na Anfrage bekämen könnten die faktisch nichts brauchbares abgeben selbst wenn all deren Hardware beschlagnahmt würde.

@pixelcode @taylan that is simply not true.

@signalapp is #centralized and there's no way one can verify the code released for the servers is what they actually run.

Unlike your replies my criticisms ain't founded based off "#TrustMeBro!" but systemic issues I highlight which #Signal refuses to address or take seriously!

@Catwoman69y2k @dragonfriend most importantly:

Only with #SelfCustody of all the keys, #SelfHosting of the entire infrastructure and everything being #OpenSource, one can assure (and [let it be] audit[ed] independently) that the #advertised #promises are in fact true.

• All #centralized, #SingleVendor and/or #SingleProvider solutions - and yes that includes @signalapp as well (!!!) - are inherently insecure because they can be forced into "cooperation" - may it be with #Cyberfacism like #CloudAct or listeally a gun to their head...

Cuz not expecting @Mer__edith to break is the same level of "#TrustMeBro!" assurances as #ANØM, #EncroChat, #SkyECC, #WhatsApp etc. do in their #advetising #lies!

• Remember: Corporations/Foundations/non-profits/... don't have a right to be silent , only individuals, and even then there are certain juristictions that have #KeyEscrow laws (i.e. #France, #Russia, #KSA, #China, #India, #UK , ...) in the books!

@ckrypto if@signalapp@mastodon.world wasn't complying with #CloudAct, @Mer__edith would be in jail.

Not to mention even if Signal keeps their "#OpenSource" code updated - which is doubtful, NOONE can actually #verify that it's the code you actually use - regardless if #backend / #Server or #client / #App!

• #Signal is as secure as #ANØM, otherwise it would've been shutdown ages ago.

Also if Signal was designed for #security, it would've been #decentralized as #XMPP+#OMEMO and not demand #PII like #PhoneNumbers which oftentimes cannot be obtained anonymously in many juristictions at all!

• Only #MultiVendor & #MultiProvider standards can be secure, regardless if OMEMO or #PGP/MIME.

By comparison, @delta doesn't require any PII, only an #eMail account, and @monocles isn't a #VCmoneyBurningParty but sustainable due to #subscription and they don't even require any personal details for #payment: #CashByMail and #Monero are accepted.

• Not to mention neither #DeltaChat nor #monoclesChat are pandering #Shitcoin #Scams like #MobileCoin that don't work even for #TechLiterate #CryptoBros!

Again: It's Signal alone who have to evidence they are trustworthy, and all I get are "#TrustMeBro!" replies, which means they are not to be trusted.

• Not to mention, it's just not sustainable to run a #service without #revenue, even if it's run entirely by unpaid volunteers and gets all it's #hosting and #costs donated, someone has to pay for expenses due to #abuse of a service (which is an inevitability come mass adoption)...

Whereas with #XMPP I can completely setup my own server and client, even build my own if I don't trust anyone else and pay someone to audit the code.

• Signal as a #centralized, #SingleVendor & #SingleProvider service is inevitable vulnerable to #RubberhoseCryptoanalysis, and #Meredith will break if not doing so means jail for life until she does!

Whereas with XMPP & PGP/MIME #eMail I can layer @torproject / #Tor over it, make it an #OnionService and keep that thing under my bed with a literal killswitch...

@lorenzofb source: #trustmebro

@sparfindig @silvan @nakal @kuketzblog Dann habt ihr halt ne höhere Tolerabz zu "#TrustMeBro!" als es rational wäre..

• Aber okay, sind ja nur eure Kommunikation und eure Kontakte...

@compl4xx @Layer8 @nick @kuketzblog @marcel @mspro

• EXAKT DAS!

Meine Rede...

Oder um es einfach zu erklären: Warum gibt es #HTTP(S) & #HTML sowie #eMail ( #IMAP & #SMTP) bis heute und keiner nutzt mehr #AOL, #MSN, #ICQ?

• Weil nur #OffeneStandards als #MultiVendor & #MultiProvider - Lösung taugen und langfristig überleben können!!!

Wenn @signalapp / #Signal wegen #CloudAct geflipped wird wie #EncroChat, #ANØM & #SkyECC dann stehen Leute alternativlos in der shice ubd die ganzen "Sicherheitsversprechen" lösen sich in "#TrustMeBro!" und #Lügen auf.

• Wohingegen selbst wenn @monocles nen Front wäre, es mit #XMPP+#OMEMO & #PGP/MIME (bspw. @delta / #deltaChat) sie Sicherheit sank #SepfCustody gewahrt und mittels @torproject / #Tor zusätzliche Sicherheit implementiert werden kann!

Ich nutze meinen XMPP-Account seit Ewigkeiten und habe drölfzig Clients durch. Aber Kontakte erreichen mich darüber Problemlos!

@silvan @nakal @kuketzblog #Threema hat dieselben Probleme wie #EncroChat, #SkyECC & #ANØM:

• #zentralisiert
• #proprietär
• #SingleVendor & #SingleProvider
• #Sicherheit? "#TrustMeBro!"

https://infosec.space/@kkarhan/113938762230637543

@ck @lk108 @kuketzblog Ich halte die #Sicherheitsversprechen von #Signal für "#TrustMeBro"-#Werbelügen alla #WhatsApp!

• Kannst natürlich dies leugnen, aber das ändert nicht die Realität dass #Tepefonnummern #PersonenbezogeneDaten sind und es gem. TKG illegal ist eine [deutsche] Rufnummer ohne verifizierte Anschlussinhaberdaten zu aktivieren bzw. dauerhaft zuzuteilen.

Wer Leuten eine anonym registrierte (e)SIM [aus dem Ausland] beschaffen kann, kann Leuten auch nen @monocles / #MonoclesStarter - Account für €2 p.m. aufsetzen und betreiben: Ne ALDI TALK -#SIM aktiviert halten kostet mehr!

@ck @sven222 @kuketzblog problem is @signalapp is a #Centralized, #Proprietary, #SingleVendor & #SingleProvider solution that falls under #CloudAct and demands #PII in the form of #PhoneNumbers.

• So even if we'd agree that #XMPP+#OMEMO as implememented in @monocles / #monoclesChat & @gajim / #gajim is bad (and #PGP/MIME over XMPP isn't good either) there are still better options than #Signal (i.e. @delta / #deltaChat which uses PGP/MIME & #IMAP-Push aka. #eMail) that don't require a #PhoneNumber, allow #SelfHosting and are truly #OpenSource with an #OpebStandard that allows for real #E2EE as in #SelfCustody of all the #Keys.

Cuz all the #advertising of Signal is close to #TrustMeBro and I'd not trust in @Mer__edith to risk jail for users!

• But you do you...