mastodon - Link to source

"if you need a tool to communicate privately with your friends and family–even if your chats are boring, mundane, and totally legal–#Signal is the best damn choice I can recommend."

is the conclusion after 6 parts of detailed and well explained code review that starts at soatok.blog/2025/02/18/reviewi… by @soatok

(Yes, I read all 6 parts. No, I don't claim to understand more than the basics of cryptography, which is why yes, I have to and do trust the author on their conclusions)

Our Review Roadmap Given what we’ve covered above, the targets of interest are as follows: 1. The Rust implementations of cryptography in libsignal. - Libsignal uses curve25519-dalek under-the-hood. - For actual encryption, they use a lot of RustCrypto. - Key transparency is relatively new, and of particular interest to me. - The actual Signal protocol, which now uses post-quantum cryptography. - The zkgroup and zkcredential features, which involve zero-knowledge proofs and are paramount to Signal’s server software not being able to know who is in which group. - The account keys and usernames features, since the privacy surrounding phone numbers is important to most Signal users. - Secure Value Recovery v3. If we can find a vulnerability in a recovery system, that will definitely be high-impact. 2. The bridge code, which enables libsignal to be used in other programming languages. 3. Cryptography implemented in Signal for Android, where it doesn’t just punt to libsignal. 4. Cryptography implemented in Signal Desktop, ditto. 5. Cryptography implemented in Signal for iOS, as with the previous two.

Reviewing the Cryptography Used by Signal - Dhole Moments

Last year, I urged furries to stop using Telegram because it doesn’t actually provide them with any of the privacy guarantees they think it gives them. Instead of improving Telegram’s c…
Dhole Moments
#signal @Soatok Dreamseeker
This entry was edited (1 month ago)
in reply to Jan Wildeboer 😷

mastodon - Link to source

Nicoco

European #antifascist recommending to use a service running in a fascist-turning country on servers owned by a fascist-friendly billionaire? This is weird.

Focusing solely on the E2EE misses a lot of points, one of those being that with #signal the ends have to be Android or iOS ~spyphones~ smartphones, which is not really something you can have 100% trust into IMHO.

#signal #antifascist
This entry was edited (1 month ago)
⇧