Calamitous ORTBO :mstdn:<p>I only have my <a href="https://mstdn.ca/tags/Instagram" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Instagram</span></a> account to lurk at other ppl's dogs & share post memes in DMs with friends & family. I don't post on there hardly anymore. <br>It's true what they're saying now that the "<a href="https://mstdn.ca/tags/socialmedia" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>socialmedia</span></a>" part of these platforms has moved to <a href="https://mstdn.ca/tags/messagingapps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>messagingapps</span></a> &/or the <a href="https://mstdn.ca/tags/messaging" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>messaging</span></a> tool of those platforms. It's only really influencers & parents really keeping up with the daily posts & sharing.</p>
mstdn.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A general-purpose Mastodon server with a 500 character limit. All languages are welcome.
Administered by:
Server stats:
12Kactive users
mstdn.social: About · Status · Profiles directory · Privacy policy · Terms of service
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.4.1
#messagingapps
0 posts · 0 participants · 0 posts today
Kyiv Independent Daily Headlines<p><strong>Monday, July 21, 2025</strong></p>
<p>Our goals are clear; Kremlin unwilling to compromise on demands ahead of proposed 3rd round of peace talks — Russian attacks against Ukraine kill 7, injure at least 28 over past day — Ukrainian drones attack Russia as Moscow hit for 5th night in a row, train station burns in Rostov Oblast — This is what Ukraine could do with US Tomahawk missiles … and more</p>
<p><a href="https://activitypub.writeworks.uk/2025/07/monday-july-21-2025/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">activitypub.writeworks.uk/2025</span><span class="invisible">/07/monday-july-21-2025/</span></a></p>
The-14<p>WhatsApp introducing advertising is a potentially lucrative but risky move<br><a href="https://mastodon.world/tags/Tech" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Tech</span></a> <a href="https://mastodon.world/tags/Business" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Business</span></a> <a href="https://mastodon.world/tags/WhatsApp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WhatsApp</span></a> <a href="https://mastodon.world/tags/Meta" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Meta</span></a> <a href="https://mastodon.world/tags/Privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Privacy</span></a> <a href="https://mastodon.world/tags/DigitalTrust" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DigitalTrust</span></a> <a href="https://mastodon.world/tags/TechNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TechNews</span></a> <a href="https://mastodon.world/tags/OnlinePrivacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OnlinePrivacy</span></a> <a href="https://mastodon.world/tags/SocialMedia" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SocialMedia</span></a> <a href="https://mastodon.world/tags/Advertising" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Advertising</span></a> <a href="https://mastodon.world/tags/MessagingApps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MessagingApps</span></a> <a href="https://mastodon.world/tags/DataSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DataSecurity</span></a> <a href="https://mastodon.world/tags/AdTech" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AdTech</span></a> <a href="https://mastodon.world/tags/DigitalCulture" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DigitalCulture</span></a> <a href="https://mastodon.world/tags/BigTech" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>BigTech</span></a> <a href="https://mastodon.world/tags/UserTrust" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>UserTrust</span></a><br><a href="https://the-14.com/whatsapp-introducing-advertising-is-a-potentially-lucrative-but-risky-move/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">the-14.com/whatsapp-introducin</span><span class="invisible">g-advertising-is-a-potentially-lucrative-but-risky-move/</span></a></p>
Blaze Trends<p>Signal Rejects AI and Ads, Distinguishing Itself from WhatsApp</p><p><a href="https://mastodon.social/tags/Advertising" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Advertising</span></a> <a href="https://mastodon.social/tags/artificialintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>artificialintelligence</span></a> <a href="https://mastodon.social/tags/messagingapps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>messagingapps</span></a> <a href="https://mastodon.social/tags/signal" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>signal</span></a> <a href="https://mastodon.social/tags/whatsapp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>whatsapp</span></a> <br><a href="https://blazetrends.com/signal-rejects-ai-and-ads-distinguishing-itself-from-whatsapp/?fsp_sid=53086" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">blazetrends.com/signal-rejects</span><span class="invisible">-ai-and-ads-distinguishing-itself-from-whatsapp/?fsp_sid=53086</span></a></p>
Priceless Planet<p><a href="https://todon.eu/tags/WhatsApp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WhatsApp</span></a> has introduced channels, music in status etc. and has made WhatsApp into another social media and less of a mainstream <a href="https://todon.eu/tags/messenger" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>messenger</span></a>.</p><p>👿 The bad:</p><p>• It is targeting people who are not on social media to be hooked.</p><p>• I feel there's a possibility of WhatsApp removing encryption in future , now that its even less serious form of messenger.</p><p>😈 The good:</p><p>• It seems to be so distractive and cluttered that it makes <a href="https://todon.eu/tags/signal" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>signal</span></a> , <a href="https://todon.eu/tags/simplex" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>simplex</span></a> and other <a href="https://todon.eu/tags/floss" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>floss</span></a> options more attractive.</p><p><a href="https://todon.eu/tags/messagingapps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>messagingapps</span></a> <a href="https://todon.eu/tags/briar" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>briar</span></a> <a href="https://todon.eu/tags/foss" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>foss</span></a> <a href="https://todon.eu/tags/switchtosignal" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>switchtosignal</span></a> <a href="https://todon.eu/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>privacy</span></a> <span class="h-card" translate="no"><a href="https://mastodon.world/@signalapp" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>signalapp</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.social/@simplex" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>simplex</span></a></span></p>
Blaze Trends<p>WhatsApp Introduces AI-Powered Message Summaries Feature</p><p><a href="https://mastodon.social/tags/AIinnovation" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AIinnovation</span></a> <a href="https://mastodon.social/tags/artificialintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>artificialintelligence</span></a> <a href="https://mastodon.social/tags/chatsummaries" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>chatsummaries</span></a> <a href="https://mastodon.social/tags/messagingapps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>messagingapps</span></a> <a href="https://mastodon.social/tags/whatsapp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>whatsapp</span></a> <br><a href="https://blazetrends.com/whatsapp-introduces-ai-powered-message-summaries-feature/?fsp_sid=49920" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">blazetrends.com/whatsapp-intro</span><span class="invisible">duces-ai-powered-message-summaries-feature/?fsp_sid=49920</span></a></p>
Brian Greenberg :verified:<p>⚠️ App security alert: TM SGNL — a custom Signal fork used by high-level U.S. officials — was reportedly hacked 📱🔓</p><p>Key findings via researchers:<br>🛠️ Hardcoded credentials found in the app’s source code<br>📥 Hacker claims to have breached TeleMessage (creator of TM SGNL) in minutes<br>📁 Archive server may store unencrypted copies of sensitive messages<br>📇 Leaked data includes government contacts, messages, and backend access</p><p>🚨 Why it matters:<br>🔐 TM SGNL modifies Signal to support message archiving — possibly before encryption<br>⚠️ That’s a potential plaintext vulnerability — even if E2EE is in place<br>💬 Raises urgent questions about how U.S. officials handle sensitive digital comms</p><p>🛡️ Security leaders should:<br>📱 Vet third-party forks of secure messaging apps rigorously<br>🚫 Avoid using unofficial tools for sensitive communication<br>🧾 Align secure messaging practices with compliance and cybersecurity</p><p>This incident isn’t just a breach — it’s a wake-up call about assuming encryption = security.</p><p><a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/MessagingApps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MessagingApps</span></a> <a href="https://infosec.exchange/tags/Signal" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Signal</span></a> <a href="https://infosec.exchange/tags/DataBreach" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DataBreach</span></a> <a href="https://infosec.exchange/tags/GovernmentSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>GovernmentSecurity</span></a> <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatIntel</span></a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://infosec.exchange/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>privacy</span></a> <a href="https://infosec.exchange/tags/cloud" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cloud</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> </p><p><a href="https://www.csoonline.com/article/3977385/company-behind-modified-signal-app-used-by-mike-walz-allegedly-hacked.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">csoonline.com/article/3977385/</span><span class="invisible">company-behind-modified-signal-app-used-by-mike-walz-allegedly-hacked.html</span></a></p>
PUPUWEB Blog<p>WhatsApp is rolling out cloud-based AI features like message summarization and composition, powered by Private Processing to keep your chats secure and private. AI tools, privacy-first. <a href="https://mastodon.social/tags/WhatsApp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WhatsApp</span></a> <a href="https://mastodon.social/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AI</span></a> <a href="https://mastodon.social/tags/Privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Privacy</span></a> <a href="https://mastodon.social/tags/DataSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DataSecurity</span></a> <a href="https://mastodon.social/tags/CloudAI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CloudAI</span></a> <a href="https://mastodon.social/tags/TechNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TechNews</span></a> <a href="https://mastodon.social/tags/EndToEndEncryption" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EndToEndEncryption</span></a> <a href="https://mastodon.social/tags/MessagingApps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MessagingApps</span></a></p>
TrueTech Technology Magazine<p>Want more privacy for your WhatsApp conversations? 🔒 A new built-in security feature lets you lock specific chats with biometrics or a secret code. Learn how to secure your private messages and keep them hidden from prying eyes 👀 Read our step-by-step guide to enhance your chat privacy.</p><p><a href="https://mastodon.social/tags/WhatsApp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WhatsApp</span></a> <a href="https://mastodon.social/tags/Privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Privacy</span></a> <a href="https://mastodon.social/tags/ChatSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ChatSecurity</span></a> <a href="https://mastodon.social/tags/MessagingApps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MessagingApps</span></a> <a href="https://mastodon.social/tags/MetaPlatforms" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MetaPlatforms</span></a></p><p><a href="https://true-tech.net/how-to-lock-whatsapp-chats-guide/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">true-tech.net/how-to-lock-what</span><span class="invisible">sapp-chats-guide/</span></a></p>
TrueTech Technology Magazine<p>Keep your WhatsApp conversations private with new Chat Lock feature 🔒 Now you can secure specific chats using biometrics or a secret code for enhanced privacy 🔐 Read our step-by-step guide to learn how to protect your private conversations.</p><p><a href="https://mastodon.social/tags/WhatsApp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WhatsApp</span></a> <a href="https://mastodon.social/tags/Privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Privacy</span></a> <a href="https://mastodon.social/tags/ChatLock" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ChatLock</span></a> <a href="https://mastodon.social/tags/MessagingApps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MessagingApps</span></a> <a href="https://mastodon.social/tags/DigitalSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DigitalSecurity</span></a></p><p><a href="https://true-tech.net/how-to-lock-whatsapp-chats-guide/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">true-tech.net/how-to-lock-what</span><span class="invisible">sapp-chats-guide/</span></a></p>
Winbuzzer<p>Google Messages Activates AI Powered Nudity Blurring with On-Device Warnings</p><p><a href="https://mastodon.social/tags/GoogleMessages" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>GoogleMessages</span></a> <a href="https://mastodon.social/tags/Android" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Android</span></a> <a href="https://mastodon.social/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AI</span></a> <a href="https://mastodon.social/tags/ContentWarning" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ContentWarning</span></a> <a href="https://mastodon.social/tags/Privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Privacy</span></a> <a href="https://mastodon.social/tags/SafetyCore" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SafetyCore</span></a> <a href="https://mastodon.social/tags/NudityDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NudityDetection</span></a> <a href="https://mastodon.social/tags/MessagingApps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MessagingApps</span></a> <a href="https://mastodon.social/tags/Mobile" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Mobile</span></a> <a href="https://mastodon.social/tags/Google" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Google</span></a> <a href="https://mastodon.social/tags/Alphabet" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Alphabet</span></a> <a href="https://mastodon.social/tags/CyberSafety" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSafety</span></a> <a href="https://mastodon.social/tags/OnDeviceAI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OnDeviceAI</span></a> <a href="https://mastodon.social/tags/RCS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RCS</span></a> </p><p><a href="https://winbuzzer.com/2025/04/22/google-messages-activates-ai-powered-nudity-blurring-with-on-device-warnings-xcxwbn/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">winbuzzer.com/2025/04/22/googl</span><span class="invisible">e-messages-activates-ai-powered-nudity-blurring-with-on-device-warnings-xcxwbn/</span></a></p>
The Internet is Crack<p>A conversation with Prof. Alberto Segre, Chair of CS at University of Iowa.</p><p>This clip dives into encrypted messaging — how tools like WhatsApp protect your privacy (or don’t), and why understanding the tech matters more than ever.</p><p>We also talk AI, quantum computing, and internet history. It’s deep, but accessible.</p><p>🎧 Listen wherever you get your podcasts.<br><a href="https://youtu.be/RqSkKahvlPA" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">youtu.be/RqSkKahvlPA</span><span class="invisible"></span></a><br><a href="https://mastodon.social/tags/theinternetiscrack" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>theinternetiscrack</span></a> <a href="https://mastodon.social/tags/podcast" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>podcast</span></a> <a href="https://mastodon.social/tags/Encryption" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Encryption</span></a> <a href="https://mastodon.social/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cybersecurity</span></a> <a href="https://mastodon.social/tags/TechPodcast" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TechPodcast</span></a> <a href="https://mastodon.social/tags/InternetEthics" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InternetEthics</span></a> <a href="https://mastodon.social/tags/MessagingApps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MessagingApps</span></a></p>
nemo™ 🇺🇦<p>Experts say Signal is as secure as messaging gets, but is it safe for national security? 🤔🔒 Read more about why it's not recommended for sensitive government communications: <a href="https://www.abc.net.au/news/2025-03-26/signal-safe-as-messaging-gets-but-not-for-national-security/105093006" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">abc.net.au/news/2025-03-26/sig</span><span class="invisible">nal-safe-as-messaging-gets-but-not-for-national-security/105093006</span></a> <a href="https://mas.to/tags/SignalSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SignalSecurity</span></a> <a href="https://mas.to/tags/MessagingApps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MessagingApps</span></a> <a href="https://mas.to/tags/NationalSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NationalSecurity</span></a> <a href="https://mas.to/tags/newz" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>newz</span></a></p>
Linux G. Fossman<p><span class="h-card" translate="no"><a href="https://mastodon.world/@Mer__edith" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>Mer__edith</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.world/@signalapp" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>signalapp</span></a></span> <span class="h-card" translate="no"><a href="https://social.librem.one/@purism" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>purism</span></a></span> <span class="h-card" translate="no"><a href="https://fosstodon.org/@PINE64" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>PINE64</span></a></span> <span class="h-card" translate="no"><a href="https://fosstodon.org/@furilabs" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>furilabs</span></a></span> <span class="h-card" translate="no"><a href="https://fosstodon.org/@postmarketOS" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>postmarketOS</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.social/@volla" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>volla</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.social/@ubports" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>ubports</span></a></span> <span class="h-card" translate="no"><a href="https://fosstodon.org/@mobian" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>mobian</span></a></span> I understand that addition of linked desktop devices can be a security concern from Signal's point of view. However, please allow us the option (after registering/activating on Signal Android) to completely move to the <a href="https://social.vivaldi.net/tags/SignalDesktop" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SignalDesktop</span></a> and deactivate/deregister the mobile version altogether. You can even make this dependent on the mobile user granting permission.</p><p>Thank you for the great work you all are doing for <a href="https://social.vivaldi.net/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>privacy</span></a> and secure communication. Although we do not like the phone number requirement, we still consider Signal one of the best communication apps and have on-boarded countless numbers of users.</p><p>(2/2)</p><p><a href="https://social.vivaldi.net/tags/FOSS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FOSS</span></a> <a href="https://social.vivaldi.net/tags/FLOSS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FLOSS</span></a> <a href="https://social.vivaldi.net/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenSource</span></a> <a href="https://social.vivaldi.net/tags/dataprivacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>dataprivacy</span></a> <a href="https://social.vivaldi.net/tags/messagingapps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>messagingapps</span></a></p>
Stephen Hayes<p><span class="h-card" translate="no"><a href="https://mastodon.africa/@GrahamDowns" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>GrahamDowns</span></a></span> <span class="h-card" translate="no"><a href="https://mastodon.world/@signalapp" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>signalapp</span></a></span> </p><p>Yes, Signal is the messaging app of choice for government people who want to hide what they're doing. They know the other apps are insecure because they themselves can spy on people using them. And they won't use official secure channels because they want to avoid accountability</p><p><a href="https://www.theguardian.com/australia-news/2025/mar/27/stephanie-foster-signal-australian-home-affairs-secretary-trump-scandal?CMP=share_btn_url" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">theguardian.com/australia-news</span><span class="invisible">/2025/mar/27/stephanie-foster-signal-australian-home-affairs-secretary-trump-scandal?CMP=share_btn_url</span></a></p><p><a href="https://c.im/tags/Signal" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Signal</span></a> <a href="https://c.im/tags/messagingapps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>messagingapps</span></a></p>
techi<p>Automattic’s Beeper Unveils Redesigned Desktop and iOS Messaging Apps Post-Merger</p><p><a href="https://mstdn.social/tags/Automattic" class="mention hashtag" rel="tag">#<span>Automattic</span></a> <a href="https://mstdn.social/tags/Beeper" class="mention hashtag" rel="tag">#<span>Beeper</span></a> <a href="https://mstdn.social/tags/TextsCom" class="mention hashtag" rel="tag">#<span>TextsCom</span></a> <a href="https://mstdn.social/tags/MessagingApps" class="mention hashtag" rel="tag">#<span>MessagingApps</span></a> <a href="https://mstdn.social/tags/TechNews" class="mention hashtag" rel="tag">#<span>TechNews</span></a> <a href="https://mstdn.social/tags/iOS" class="mention hashtag" rel="tag">#<span>iOS</span></a> <br /> <br /><a href="https://www.techi.com/automattic-beeper-redesigned-desktop-ios-apps-launch/" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://www.</span><span class="ellipsis">techi.com/automattic-beeper-re</span><span class="invisible">designed-desktop-ios-apps-launch/</span></a></p>
Adrian Morales<p>I have stopped using SMS. I stopped about a decade ago. It's only centralised banks and online shopping sites still using this technology that dates back to the 70s. Yeesh!</p><p><a href="https://ieji.de/tags/Tech" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Tech</span></a> <a href="https://ieji.de/tags/MessagingApps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MessagingApps</span></a> <a href="https://ieji.de/tags/SocialMedia" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SocialMedia</span></a> <a href="https://ieji.de/tags/Texting" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Texting</span></a> <a href="https://ieji.de/tags/Thursday" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Thursday</span></a> <a href="https://ieji.de/tags/SMS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SMS</span></a> <a href="https://ieji.de/tags/Signal" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Signal</span></a> </p><p><a href="https://www.makeuseof.com/still-using-sms-stop/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">makeuseof.com/still-using-sms-</span><span class="invisible">stop/</span></a></p>
Alan K. Martinez<p>There's a saying that if something is <a href="https://infosec.exchange/tags/free" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>free</span></a> then you're the commodity...</p><p>If <a href="https://infosec.exchange/tags/signal" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>signal</span></a> is free to use, what are they gaining or using you for? What is it about the customer they're gathering for their benefit to offer their messaging app for free?</p><p>Serious question... I'd like to know...</p><p><a href="https://infosec.exchange/tags/cybersecurty" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurty</span></a> <a href="https://infosec.exchange/tags/messaging" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>messaging</span></a> <a href="https://infosec.exchange/tags/messagingapps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>messagingapps</span></a></p>
TrueTech Technology Magazine<p>iPhone users, a game-changing WhatsApp update is in the works 📱 Meta is finally bringing multi-account support to iOS, catching up with Android. Want to know when this feature arrives and how it'll change your messaging experience? Read the full article ⬇️</p><p><a href="https://mastodon.social/tags/WhatsApp" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WhatsApp</span></a> <a href="https://mastodon.social/tags/iOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iOS</span></a> <a href="https://mastodon.social/tags/iPhone" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>iPhone</span></a> <a href="https://mastodon.social/tags/Meta" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Meta</span></a> <a href="https://mastodon.social/tags/MessagingApps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MessagingApps</span></a></p><p><a href="https://true-tech.net/whatsapp-multi-account-support-iphone-spotted-beta/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">true-tech.net/whatsapp-multi-a</span><span class="invisible">ccount-support-iphone-spotted-beta/</span></a></p>
Soatok<p><strong>Don’t Use Session (Signal Fork)</strong></p><p>Last year, I outlined the specific requirements that an app needs to have in order for me to <a href="https://soatok.blog/2024/07/31/what-does-it-mean-to-be-a-signal-competitor/" rel="nofollow noopener" target="_blank">consider it a Signal competitor</a>.</p><p>Afterwards, I had several people ask me what I think of a Signal fork called Session. My answer then is the same thing I’ll say today: </p><p><strong>Don’t use Session.</strong></p><p>The main reason I said to avoid Session, all those months ago, was simply due to <a href="https://web.archive.org/web/20241225131654/https://getsession.org/session-protocol-explained" rel="nofollow noopener" target="_blank">their decision to remove forward secrecy</a> (which is an important security protocol they inherited for free when they forked libsignal).</p><p>Lack of forward secrecy puts you in the scope of <a href="https://www.cryptologie.net/article/372/key-compromise-impersonation-attacks-kci/" rel="nofollow noopener" target="_blank">Key Compromise Impersonation (KCI) attacks</a>, which serious end-to-end encryption apps should prevent if they want to sit at the adults table. This is <a href="https://github.com/TokTok/c-toxcore/issues/426" rel="nofollow noopener" target="_blank">why I don’t recommend Tox</a>.</p><p>And that observation alone should have been enough for anyone to <strong>run, screaming, in the other direction from Session</strong>. After all, removing important security properties from a cryptographic security protocol is exactly the sort of thing a malicious government would do (especially if the cover story for such a change involves the introduction of swarms and “onion routing”–which computer criminals might think sounds attractive due to their familiarity with the Tor network).</p><p>Unfortunately, some people love to dig their heels in about messaging apps. So let’s take a closer look at Session.</p><blockquote><p>I did not disclose this blog post privately to the Session developers before pressing publish.</p><p>I do not feel that cryptographic issues always require coordinated disclosure with the software vendor. <a href="https://www.schneier.com/essays/archives/2007/01/schneier_full_disclo.html" rel="nofollow noopener" target="_blank">As Bruce Schneier argues</a>, full disclosure of security vulnerabilities is a “damned good idea”.</p></blockquote><p>I have separated this blog post into two sections: Security Issues and Gripes.</p><p><strong>Security Issues</strong></p><ol><li>Insufficient Entropy in Ed25519 Keys</li><li>In-Band Negotiation for Message Signatures</li><li>Using Public Keys as AES-GCM Keys</li></ol><p><strong>Insufficient Entropy in Ed25519 Keys</strong></p><p>One of the departures of Session from Signal is the use of Ed25519 rather than X25519 for everything.</p><p>Ed25519 Keypairs generated from their <code>KeyPairUtilities</code> object <a href="https://github.com/session-foundation/session-android/blob/75e2b87278cc378e21b77b27fa1a2aa773d25520/app/src/main/java/org/thoughtcrime/securesms/crypto/KeyPairUtilities.kt#L15-L28" rel="nofollow noopener" target="_blank">only have 128 bits of entropy</a>, rather than the ~253 bits (after clamping) you’d expect from an Ed25519 seed.</p> <pre>fun generate(): KeyPairGenerationResult { val seed = sodium.randomBytesBuf(16) try { return generate(seed) } catch (exception: Exception) { return generate() }}fun generate(seed: ByteArray): KeyPairGenerationResult { val padding = ByteArray(16) { 0 } val ed25519KeyPair = sodium.cryptoSignSeedKeypair(seed + padding)</pre> <p>As an implementation detail, they encode a recovery key as a “mnemonic” (see also: a gripe about their mnemonic decoding).</p><p><strong>Does This Matter?</strong></p><p>You might think that clearing the highest 127 or so bits of the Ed25519 seed is fine for one of the following reasons:</p><ol><li>It’s hashed with SHA512 before clamping.</li><li>Ed25519 only offers 128 bits of security.</li><li>Some secret third (and possibly unreasonable) argument.</li></ol><p>It’s true that Ed25519 targets the 128-bit security level, if you’re focused on the security of the Elliptic Curve Discrete Logarithm Problem. Achieving 128 bits of security in this model requires 256-bit secrets. Having 256-bit secrets makes the multi-user security of the scheme easy to reason about.</p><p>When your secret only has possible values, your multi-user security is no longer as secure as Ed25519 expects.</p><p>Additionally, you can shove the SHA512 + clamping in your attack script (thus negating the first objection) and find the corresponding secret key in queries if you know the top 128 bits were initialized to 0, using a modified version of Pollard’s rho for discrete logarithms.</p><p>This means that Session’s <code>KeyPairUtilities</code> class only provides 64 bits of ECDLP security.</p> <a href="https://cmykat.carrd.co/" rel="nofollow noopener" target="_blank">CMYKat</a> <p><strong>What does 64 bits of ECDLP Security actually mean?</strong></p><p>I provided a technical definition already (ECDLP stands for “Elliptic Curve Discrete Logarithm Problem”), but that’s probably not meaningful to most people outside computer security.</p><p>What this means is that a distributed computing effort can find the secret key for a given Ed25519 public key generated from this algorithm in only queries.</p><p>For flavor, queries is approximately the attack cost to find a SHA1 collision, <a href="https://shattered.io/" rel="nofollow noopener" target="_blank">which we know is possible and economical</a>.</p><blockquote><p>Based on this attack, the authors projected that a collision attack on SHA-1 may cost between US$75K and US$120K by renting GPU computing time on Amazon EC2 using spot-instances, which is significantly lower than Schneier’s 2012 estimates.</p><p>— from the <a href="https://shattered.io/static/shattered.pdf" rel="nofollow noopener" target="_blank">Shattered paper</a>, page 2.</p></blockquote><p>I don’t know if this was mere stupidity or an intentional NOBUS backdoor that only well-resourced adversaries can crack. (I also don’t have hundreds of thousands of dollars lying around to test this myself.)</p><p><strong>In-Band Negotiation for Message Signatures</strong></p><p>If you thought the previous issue was mitigated by the use of Ed25519 signatures on each message, don’t worry, <a href="https://github.com/session-foundation/session-android/blob/75e2b87278cc378e21b77b27fa1a2aa773d25520/libsession/src/main/java/org/session/libsession/messaging/sending_receiving/MessageDecrypter.kt#L44-L56" rel="nofollow noopener" target="_blank">the Session developers screwed this up too</a>!</p> <pre>// 2. ) Get the message partsval signature = plaintextWithMetadata.sliceArray(plaintextWithMetadata.size - signatureSize until plaintextWithMetadata.size)val senderED25519PublicKey = plaintextWithMetadata.sliceArray(plaintextWithMetadata.size - (signatureSize + ed25519PublicKeySize) until plaintextWithMetadata.size - signatureSize)val plaintext = plaintextWithMetadata.sliceArray(0 until plaintextWithMetadata.size - (signatureSize + ed25519PublicKeySize))// 3. ) Verify the signatureval verificationData = (plaintext + senderED25519PublicKey + recipientX25519PublicKey)try { val isValid = sodium.cryptoSignVerifyDetached(signature, verificationData, verificationData.size, senderED25519PublicKey) if (!isValid) { throw Error.InvalidSignature }} catch (exception: Exception) { Log.d("Loki", "Couldn't verify message signature due to error: $exception.") throw Error.InvalidSignature}</pre> <p>What this code is doing (after decryption):</p><ol><li>Grab the public key from the payload.</li><li>Grab the signature from the payload.</li><li>Verify that the signature on the rest of the payload is valid… <strong>for the public key that was included in the payload</strong>.</li></ol><p>Congratulations, Session, you successfully reduced the utility of Ed25519 to that of a CRC32!</p> Art: <a href="https://bsky.app/profile/ajlovesdinos.bsky.social" rel="nofollow noopener" target="_blank">AJ</a> <p><strong>Using Public Keys As AES-GCM Keys</strong></p><p>I wasn’t entirely sure whether this belongs in the “gripes” section or not, because it’s so blatantly stupid that there’s basically no way <a href="https://web.archive.org/web/20250115034416/https://blog.quarkslab.com/resources/2021-05-04_audit-of-session-secure-messaging-application/20-08-Oxen-REP-v1.4.pdf" rel="nofollow noopener" target="_blank">Quarkslab would miss it if it mattered</a>.</p><p>When encrypting payloads <a href="https://github.com/session-foundation/session-android/blob/75e2b87278cc378e21b77b27fa1a2aa773d25520/libsession/src/main/java/org/session/libsession/snode/OnionRequestEncryption.kt#L56-L57" rel="nofollow noopener" target="_blank">for onion routing</a>, it uses the X25519 public key… as a symmetric key, for AES-GCM. See, <code>encryptPayloadForDestination()</code>.</p> <pre>val result = AESGCM.encrypt(plaintext, x25519PublicKey)deferred.resolve(result)</pre> <p>Session<a href="https://github.com/session-foundation/session-android/blob/75e2b87278cc378e21b77b27fa1a2aa773d25520/libsession/src/main/java/org/session/libsession/snode/OnionRequestEncryption.kt#L95-L96" rel="nofollow noopener" target="_blank"> also does</a> this inside of <code>encryptHop()</code>.</p> <pre>val plaintext = encode(previousEncryptionResult.ciphertext, payload)val result = AESGCM.encrypt(plaintext, x25519PublicKey)</pre> <p>In case you thought, maybe, that this is just a poorly named HPKE wrapper… <a href="https://github.com/session-foundation/session-android/blob/75e2b87278cc378e21b77b27fa1a2aa773d25520/libsession/src/main/java/org/session/libsession/utilities/AESGCM.kt#L48-L58" rel="nofollow noopener" target="_blank">nope</a>!</p> <pre> /** * Sync. Don't call from the main thread. */internal fun encrypt(plaintext: ByteArray, symmetricKey: ByteArray): ByteArray { val iv = Util.getSecretBytes(ivSize) synchronized(CIPHER_LOCK) { val cipher = Cipher.getInstance("AES/GCM/NoPadding") cipher.init(Cipher.ENCRYPT_MODE, SecretKeySpec(symmetricKey, "AES"), GCMParameterSpec(gcmTagSize, iv)) return ByteUtil.combine(iv, cipher.doFinal(plaintext)) }}</pre> <p>This obviously doesn’t encrypt it such that only the recipient (that owns the secret key corresponding to the public key) can decrypt the message. It makes it to where anyone that knows the public key can decrypt it.</p><p><em>I wonder if this impacts their onion routing assumptions?</em></p><blockquote><p><strong>Why should I trust session?</strong></p><p>(…)</p><p>When using Session, your messages are sent to their destinations through a decentralised onion routing network similar to Tor (with a few key differences) (…)</p><p><a href="https://web.archive.org/web/20250102225433/https://getsession.org/faq#trust-session" rel="nofollow noopener" target="_blank">Session FAQs</a></p></blockquote><p><strong>Gripes</strong></p><p>Some of these aren’t really security issues, but are things I found annoying as a security engineer that specializes in applied cryptography.</p><ol><li>Mnemonic Decoding Isn’t Constant-Time</li><li>Unsafe Use of SecureRandom on Android</li></ol><p><strong>Mnemonic Decoding Isn’t Constant-Time</strong></p><p><a href="https://github.com/session-foundation/session-android/blob/75e2b87278cc378e21b77b27fa1a2aa773d25520/libsignal/src/main/java/org/session/libsignal/crypto/MnemonicCodec.kt#L107-L112" rel="nofollow noopener" target="_blank">The way mnemonics are decoded involves the modulo operator</a>, which implicitly uses integer division (which neither Java nor Kotlin nor Swift implement in constant-time).</p> <pre>return wordIndexes.windowed(3, 3) { (w1, w2, w3) -> val x = w1 + n * ((n - w1 + w2) % n) + n * n * ((n - w2 + w3) % n) if (x % n != w1.toLong()) throw DecodingError.Generic val string = "0000000" + x.toString(16) swap(string.substring(string.length - 8 until string.length))}.joinToString(separator = "") { it }</pre> <p>This isn’t a real security problem, but I did find it <a href="https://soatok.blog/2020/08/27/soatoks-guide-to-side-channel-attacks/#integer-division" rel="nofollow noopener" target="_blank">annoying to see</a> in an app <a href="https://old.reddit.com/r/privacy/comments/jy3hjo/signal_vs_session_private_messenger/hgzef3y/" rel="nofollow noopener" target="_blank">evangelized as “better than Signal”</a> on privacy forums.</p><p><strong>Unsafe Use of SecureRandom on Android</strong></p><p><a href="https://stackoverflow.com/questions/27622625/securerandom-with-nativeprng-vs-sha1prng/27638413#27638413" rel="nofollow noopener" target="_blank">The recommended way to get secure random numbers on Android</a> (or any Java or Kotlin software, really) is simply <code>new SecureRandom()</code>. If you’re running a service in a high-demand environment, you can take extra care to make a <a href="https://stackoverflow.com/a/34340717" rel="nofollow noopener" target="_blank">thread-local instance of SecureRandom</a>. But a local RNG for a single user isn’t that.</p><p><strong>What does Session do?</strong> <a href="https://github.com/session-foundation/session-android/blob/75e2b87278cc378e21b77b27fa1a2aa773d25520/libsignal/src/main/java/org/session/libsignal/utilities/Util.java#L71-L79" rel="nofollow noopener" target="_blank">They use SHA1PRNG</a>, of course.</p> <pre>public static byte[] getSecretBytes(int size) { try { byte[] secret = new byte[size]; SecureRandom.getInstance("SHA1PRNG").nextBytes(secret); return secret; } catch (NoSuchAlgorithmException e) { throw new AssertionError(e); }}</pre> <p>And again <a href="https://github.com/session-foundation/session-android/blob/75e2b87278cc378e21b77b27fa1a2aa773d25520/libsignal/src/main/java/org/session/libsignal/utilities/KeyHelper.java#L32" rel="nofollow noopener" target="_blank">here</a>.</p> <pre>SecureRandom secureRandom = SecureRandom.getInstance("SHA1PRNG");</pre> <p><strong>Why would anyone care about this?</strong></p><p>On modern Android devices, this isn’t a major concern, but the use of SHA1PRNG <a href="https://web.archive.org/web/20240601000000*/https://blog.k3170makan.com/2013/08/more-details-on-android-jca-prng-flaw.html" rel="nofollow noopener" target="_blank">used to be a source of vulnerabilities in Android apps</a>. (See also:<a href="https://web.archive.org/web/20240301002810/https://www-fourier.ujf-grenoble.fr/JC2/exposes/ruhault.pdf" rel="nofollow noopener" target="_blank"> this slide deck</a>.)</p><p><strong>Closing Thoughts</strong></p><p>There are a lot of Signal that is poorly specified in their Whitepaper and I didn’t look at. For example, how group messaging keys are managed.</p><p>When I did try to skim that part of the code, I did find a component where you can coerce Android clients into running a moderately expensive Argon2 KDF <a href="https://github.com/session-foundation/session-android/blob/75e2b87278cc378e21b77b27fa1a2aa773d25520/libsession/src/main/java/org/session/libsession/snode/SnodeAPI.kt#L237-L264" rel="nofollow noopener" target="_blank">by simply deleting the <code>nonce</code> from the message</a>.</p> <pre>val isArgon2Based = (intermediate["nonce"] == null)if (isArgon2Based) { // Handle old Argon2-based encryption used before HF16</pre> <p><strong>That’s hilarious.</strong></p><p>Cryptography nerds should NOT be finding the software that activists trust with their privacy <em>hilarious</em>.</p> <a href="https://cmykat.carrd.co/" rel="nofollow noopener" target="_blank">CMYKat</a> <p>So if you were wondering what my opinion on Session is, now you know: <strong>Don’t use Session.</strong> Don’t let your friends use Session.</p><p><a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://soatok.blog/tag/aes-gcm/" target="_blank">#AESGCM</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://soatok.blog/tag/android/" target="_blank">#Android</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://soatok.blog/tag/asymmetric-cryptography/" target="_blank">#asymmetricCryptography</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://soatok.blog/tag/cryptography/" target="_blank">#cryptography</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://soatok.blog/tag/e2ee/" target="_blank">#E2EE</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://soatok.blog/tag/ed25519/" target="_blank">#Ed25519</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://soatok.blog/tag/java/" target="_blank">#Java</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://soatok.blog/tag/kotlin/" target="_blank">#Kotlin</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://soatok.blog/tag/messaging-apps/" target="_blank">#messagingApps</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://soatok.blog/tag/online-privacy/" target="_blank">#OnlinePrivacy</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://soatok.blog/tag/private-messaging/" target="_blank">#privateMessaging</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://soatok.blog/tag/session/" target="_blank">#Session</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://soatok.blog/tag/signal/" target="_blank">#Signal</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://soatok.blog/tag/signal-alternatives/" target="_blank">#SignalAlternatives</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://soatok.blog/tag/vulnerability/" target="_blank">#vuln</a></p>
TrendingLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLoginDrag & drop to upload