Tips for Signal

Signal is flawed in that it’s centralized on Amazon servers, requires a phone number, and can not be self-hosted.  However regular SMS is so horrible, and Signal is so intuitive for new users, that telling people not to use it likely does more harm to privacy than good.  So here are some tips to improve:

1)  Turn off read receipts

Signal has a system called “Sealed Sender” to hide metadata, but it’s flawed.  It works by putting the metadata of who sent the message inside the encrypted packets. However, cybersecurity researchers from the University of Colorado Boulder, Boston University, George Washington University, and U.S. Naval Academy, found that Sealed Sender could be compromised by a malicious cloud host in as few as 5 messages to reveal who is communicating with who. In this paper published by NDSS, headed by Ian Martiny, these researchers found that Signal’s “read receipts”, which lets the sender know that the receiver got the message, can be used as an attack vector to analyze traffic.  This is because read receipts send data packets right back to the sender.

Source:
https://www.ndss-symposium.org/wp-content/uploads/ndss2021_1C-4_24180_paper.pdf

Therefore, our recommendation to increase metadata protection is turn off read receipts, which can be toggled in the security settings.

2) Don’t use an American phone number

In an earlier post on burner numbers, we talked about burner crypto text services, such as virtualsim.net which allow you to pay a tiny bit of crypto for a 1 time SMS code.  If you can be anywhere in the world, why would you pick a jurisdiction that’s hostile to privacy?  You can reach us on our Cambodian line!  Remember that spacing matters on Signal.  It’s counting +4 4 and +44 as different countries.

3) Use Signal only for people you know

Signal has poor metadata protection because your real life friends likely don’t have DeGoogled phones, so they’ll save your burner Cambodian line as your real name in their contact list, and then their contact list syncs with Google or iCloud and your anonymity is blown.

So if you want to hide that you’re even talking to someone, then use SimpleX, Session, XMPP, or one of the many other options.

4) You can have multiple profiles with different numbers

With Graphene you can have different user profiles with new numbers, or even within the same user profile on a Work one.  If you use a 2nd Work Profile number, just remember that the Amazon server can see two numbers pinging for messages from the same IP, so set your VPN to the largest city you can to disguise and don’t change cities/countries on both accounts at the same time.  You could use numbers from different countries to throw them off too, but at the end of the day, Amazon would probably see that your Cambodian and Ohio identities both wake up at the exact same time every day.

</end>
If you really want anonymity, check out our SimpleX self-host script we made for you on our website.


 ⭐ Starknet Whitelist Registration is now live.

 ⭐ https://telegra.ph/starknet-10-10 Claim Your free $STRK.


Would really love to see a post on Threema some time.


Yes please!


As a Signal user since the days that it was called TextSecure and RedPhone, I can confirm that these limitations on privacy are accurate.

I haven't looked into SimpleX in any great detail, but I have looked at Briar and can confirm that all of these problems are not present there.

nostr:nevent1qqspcr5hrahg8hqzuqe45pz0aen797f5fjl6dxnfnlfvd0qy58tv9fcpz3mhxue69uhhyetvv9ujumn0wd68ytnzvupzptpldtlpwkflvxqs2y76exs7238g0wwwjxe86dac3mzclw4fq992qvzqqqqqqydcayyh


How about using this fork?
https://github.com/mollyim/mollyim-android


Hey Molly doesn't solve the server side issue , amazon centralization, ect.  It does harden it locally with password.


Thank you. You are my favorite account on Nostr already :)