Is Signal Still Secure?
ฝัง
- เผยแพร่เมื่อ 28 ก.ค. 2024
- Signal Search warrant
signal.org/bigbrother/santacl...
Why Signal Is My Favorite Secure Messaging App
• Why Signal Is My Favor...
Connecting With Us
---------------------------------------------------
+ Hire Us For A Project: lawrencesystems.com/hire-us/
+ Tom Twitter 🐦 / tomlawrencetech
+ Our Web Site www.lawrencesystems.com/
+ Our Forums forums.lawrencesystems.com/
+ Instagram / lawrencesystems
+ Facebook / lawrencesystems
+ GitHub github.com/lawrencesystems/
+ Discord / discord
Lawrence Systems Shirts and Swag
---------------------------------------------------
►👕 lawrence.video/swag
AFFILIATES & REFERRAL LINKS
---------------------------------------------------
Amazon Affiliate Store
🛒 www.amazon.com/shop/lawrences...
UniFi Affiliate Link
🛒 store.ui.com?a_aid=LTS
All Of Our Affiliates that help us out and can get you discounts!
🛒 lawrencesystems.com/partners-...
Gear we use on Kit
🛒 kit.co/lawrencesystems
Use OfferCode LTSERVICES to get 5% off your order at
🛒 lawrence.video/techsupplydirect
Digital Ocean Offer Code
🛒 m.do.co/c/85de8d181725
HostiFi UniFi Cloud Hosting Service
🛒 hostifi.net/?via=lawrencesystems
Protect you privacy with a VPN from Private Internet Access
🛒 www.privateinternetaccess.com...
Patreon
💰 / lawrencesystems
#Signal #Privacy #EndToEndEcryption - วิทยาศาสตร์และเทคโนโลยี
The simple thing is that Signal is secure, but your phone is not.
So, the Israeli company that claimed that they had broken Signal had to admit that it was not true. They had broken phones like Apple and because of that they could see Signal messages.
And that's the issue here. No app is more secure that the OS it runs on, and the Israeli company showed us that Android and Apple is both unsecure to some extent.
The take home message is that nothing is inherently secure except the secrets only you know and that’s true only as long as „they“ don’t habeas corpus (to torture them out of). The baseline assumption when faced with state actors must be that they have the means to defeat any security mechanism given sufficient time and interest.
Lucky for most of us, we don’t have to deal with state actors (with sufficient interest).
Fly Safe, as someone frequently says.
The Israeli company is not a state actor, but a private company that sells its spy software to whoever that wants to pay.
And a lot of people around the world had there phone hacked. In Apple phone cases the victims didn't even have to say yes to have something installed. The just went straight in via bugs in iMessage. 😐
@@SuperElkjer That isn't true. They are a mobile forensic software that sell forensic software. Its not a spy software, hence why you need physical accesses to the phone. Cellebrite is not a private company but traded under CLBT. Most "news" and article written on Cellebrite are misinformation and its just a game of telephone.
@@Revoc Well, you can call it what you like to, but it is used as spy software. It's like when Putin call an invasion a special millitary operstion. You can call it what ever you want, but all knows what it is🙂
It's created and sold by a company that it well aware what it is used fore, but when calling it something else there are no need to have any moral.
They where the one that where out telling that they had broken signal and they had to withdraw that statement because what they had broken was iPhone. And now they are facing lawsuits in big scale as far as I know.
So I should buy a pinephone?
Life Pro Tip: DO NOT use the voice to text feature of your phone keyboard while typing things you might want to keep secret. That audio and the resulting text DOES get outside of Signal before Signal even gets a chance to encrypt it.
At some point, it is even possible that the Phone's keyboard itself could be compromised, dispite what the manufacturers say. So, next we need open-source, secure keyboard apps that encrypt the data between themselves and the app they are sending the text to.
Phone keyboard apps are the most comprehensive, and I believe most-overlooked security invasion on smartphones. They have access to internet usually (Microsoft Swype, Google Keyboard, all the big names), and access to literally everything you type, and they even know the context as well - the OS will inform them 'this is a password field' so the keyboard can switch to password mode and disable the dictionary - but this of course enables very simple keylogging of sensitive account logins. Even without the password concerns, everything you type can be (and most likely is) reported back to Microsoft/Google/etc at their whim. The good news is that (at least on Android) there are already open source secure keyboards. There's the AOSP basic default keyboard, which is open source and doesn't need internet access, and there's the more advanced 'AnySoftKeyboard' which is open source (available on F-Droid) and also doesn't request/need internet access.
The problem is, if someone can install a keylogger on your phone, they could also install spyware that tracks the coordinates of the screen where you touched it, without needing to compromise the keyboard.
@@nikomitk8091 Eh, since a software keyboard takes place at a much higher level than the touch device, it would require more permission for the spyware to track touches.
GraheneOS and it's super annoying but secure keyboard.
@@m0rthaus I've never considered to turn off internet access for Gboard so I just tried it and uhm, I can disable it for mobile data, roaming and background, but not for wi-fi which is usually an option for every other app. And then I saw the data usage. Gboard exchanged data over my wifi in an interval of about one week, each time with around 28 MB. Of course I don't know what is actually being sent there or if it's just harmless stuff but... it's kinda scary.
Thanks for this. Yes, the discrepancy between anonymously scream random lie and explaining the true state of things is punishing, so every time someone makes the extra step, they deserve my respect and gratitude. Here's one for you. 👏🖖
Well said. Thanks for the updates, Tom!
I trust Tom more than anyone on MSM or Twitter
You dont know.
you should never trust twitter
@@morzinbo yup, twitter is 100% bs garbage nonsense with some virtue signaling on top
@@morzinbo So true, but for too many years, Twitter is used by the MSM as their main source.
@@matldn2697 MSM's primary source is the government itself. Talking points direct from political party operatives. "The White House". "Retired" generals. Intelligence "analysts". The FBI directly.
"World War III is a guerrilla information war with no division between military and civilian participation."
Marshall McLuhan, "Culture Is Our Business", 1970, p. 66
@by9798 wtf then ure blind
Thank You so much I really loved it Telegram and Signal.
I got a title - I think you should do a video called "Ciphers, Keys, and Cryptography Oh My". People need to understand it. You are a great "teacher". I am just grumpy.
It's possible that the anti-Signal FUD isn't aimed at those in Ukraine, but against those in Russia who are protesting the war. There's been quite a crackdown on any dissent over the last week or so, even beyond what's sadly commonplace over there.
Why not both?
Thank you Tom.
What they show law enforcement is your last login time and your account creation time.
yup there are court papers that prove how that's all they know and can give
GAG ORDER pleaseee!!!
Phone numbers and other metadata?
In the Utopia (uMail) ecosystem, you send and receive mail in p2p mode, using a new type of encryption and fragmentation. Such a scheme is the most secure today.
My family and I are just using Nextcloud (server in my house), so we are secure :)...Getting my business transitioned over to my own self hosting as well.
is it possible use both signal and whatsapp on your phone? I myself use only signal but my mother use whatsapp and the excuse is bc all her friends use it (obviously). But since i will never install whatsapp on my phone was wondering if my mom had both apps on her phone and when i call her using signal she receives the call through signal and her friends calls go through whatsapp. Is this possible or does whatsapp block signal (or vice versa)?
I got a question - does the device we use can spy on microphone and camera using their OS even if we use Signal? Like we use Signal to make a private call but Apple simultaneously listening the conversation using the OS to access microphone? I strongly feel like this is the case.
Princely that is the issue. Why do you think Signal does not let you use the Linux app without first installing the app in your Google or Apple device. It is because they want their users to be available for hacking by Google or Microsoft. If you really care for privacy and you are not an idiot, you should be using IRC, XMPP, or Matrix.
I deleted Signal a month ago and now use Threema@@DelfinaKS
A year on, Kit Klarenberg's work tells us this will not last - partly because of local legislation demanding access and mainly because security services no longer see use in it.
Does it still require a traditional cellular number? I don't like it.
If I remember there was questions about auditing the running server code. The other question I have is are the private keys being cloned from the device and used in a network replay.
private key means this is a private-public key encryption setup
Thanks. People spreading rumors just dont understand how security works and Yes, the gullible get latched on to these rumors and carry it on to others 🙂
Does Signal track location? If so, how do I turn the feature off on iOS.
Most of people that want to use telegram they know already how to enable the end to end encryption. That is the reason they want to use it.
It's very safe but I do wish they'd allow you to run it without a phone number and run it from a computer too. All 100% anonymous.
I love that it uses a phone number because it makes it easy to contact friends and makes it really hard for spam bots to setup accounts.
Well, you can run it from a computer if you allready have it on a phone
@@LAWRENCESYSTEMS Using a phone and requiring its phone number are two different things. I suppose I hang out in a different technical world as I've never once had a spam bot contact me on any encrypted messenger. Again, I'm not saying it's a threat just an undesirable feature. I look for security, not a friend in my contacts being made easy. There just isn't a good financial model to support it though if it's not as you say "easy" to get others to use it and I understand that.
A feature signal despertley needs is when u delete a contact they should not appear in ur list anymore all other apps have this feature to permantly delete them i dont want to see old contacts i no longer talk to
Thank you
3:00 the only information Signal stores about you, is when your Account was created and when you last connected to their servers
Hitchen's Razor - "What can be asserted without evidence can also be dismissed without evidence".
Hello Tom, could you also talk about the App Threema. This is also used more and more in EU.
BRIAR was also recommended for Ukraine citizens, in case of Internet access outage. This app can make conversation using BT or Wifi Direct ;)
I don't have any plans to start using Threema so I don't plan on doing a video about it. I am not aware of any issues with it other than none of my friends use it.
@@LAWRENCESYSTEMS Oke I understand, a honest response thanks! On our side (EU) it may be used a little more. 😆
@@RK-ly5qj Berty is an option for iOS.
@@w1z4rd9 one of the recent blog posts on berty says, it isn't war-ready yet
I saw the other day that the “Signal” app is only end to end encrypted when communicating with another “Signal” user. So if a “Signal” user sends a text message to a non-Signal user, the message will be sent as a SMS text message, unencrypted.
Signal does not offer text messaging anymore.
Signal has closed server-side source code. They claim it relates to spam filtering, but since it's closed source no one can know it isn't functioning as a full MITM, meaning it's no longer end-to-end.
That's not true, because you can see the source code of the client. You can understand that no one in the middle can see the traffic.
@@LAWRENCESYSTEMS as the server is responsible for pubkey distribution, I still see potential for compromise here. It would be easily detectable by the two users verifying each other's keys, though. Mind you, people should be doing this anyway, but we both know 99% of users won't, as the entire purpose of things like signal, keybase, etc. is NOT needing to worry about such things.
Of course then we're also left with the question of whether the server code they show us is what's really running on the server, and not something else; end of the day, there's always going to be some degree of trust and faith with any system that isn't self-hosted.
You're not understanding how their cryptography works.
@@LAWRENCESYSTEMS Not sure why it keeps nuking the post, but in any case, yes, the server handles key distribution and relays the messages. This means that it can act as a MITM by storing an extra set of keys for each user and giving the fake pubkey to users the first time they communicate. In my previous two attempts to post this, I included a link to source breaking down what the different components in Signal's infrastructure do and it lays this out. Users would be able to detect this, however it would require out-of-band key validation (users would see that the key their device reports doesn't match the other device, but rather the fake one that server handed out).
I do not think Signal has been compromised, only that it is possible that it can be. There's no justification for closing the source code for what they claim, and no one can verify, is simply spam filtering.
If you still think I'm not understanding how their system works, please do explain. Simply saying "you're wrong" is neither an argument nor does it help correct the alleged misunderstanding.
@@sporkwitch So with the right OpSec it still is secure. Right, no problem. The better take on this is to spread the word on what to do. Even though federation and decentralization are good, UI simplicity are very important to a lot of people in general.
everything is pwned, the only thing you can rely on is secret handshakes.
Does anyone know of any other phone companies/networks that are private
So is this safe to use?
Nobody can steal your information?
The person you are talking to can not steal your info or contacts pics or whatever?
Yes signal is still safe to use here in 2023
cool video - very nice.
Thanks
This video was a year ago. Is Signal still safe? Can people I'm chatting with on Signal get to my personal info?
Can people who have my number on signal get to my personal info?
Signal is still safe
@@LAWRENCESYSTEMS thanks!🤪
I will try its app
Thanks random person on the internet... 😉
how about using threema - i really like it ...it has a price but at least my privacy is secured without a doubt ;D the userbase is a bit smaller tho'
Never used it and because the circle of people I engage with do not use it I am not likely to start using it.
@@LAWRENCESYSTEMS hi thanks for the reply, the circle of ppl using a product is what makes these things so difficult to change. if there was no "oh no facebook is buying what's app and stealing your dataz!!" in the public media (outside of nerd media) we wouldn't even know what signal is ;D and that's a shame in my book.
the good thing is that there are youtubers aka influencers like you talking about it - so keep it up long time fan but never commented tbh ;D
As far as we know Threema a) costs b) gives data out to authorities, even to third party countries without any legal circumstance.
Would love to see you do a review of Wickr if you could.
I don't use it or know anyone who does.
I'm interested in learning more about Wickr. Would be great if a security minded person looked into it and did a review. 😁
@@_Thoughtful_Aquarius_ Not really worth reviewing something very few people use.
@@LAWRENCESYSTEMS I know a ton of people that use Wickr...
ya. its completely encrypted.
all the bots sending me spam? fully encrypted. can I block them, so they cant send me spam? sure, but only AFTER they already sent me spam. i get enough spam without adding a whole new attack vector for them....
maybe it got better, and maybe ill get around to trying it again, but that was so off putting that i just.....eh.
Yeah. Signal is compromised exactly at the time when Whatsapp is advertising it's super amazing E2E encryption and Russia started a war. The effort it took to refute this was about one hop over to my "BS meter" neuron.
The Russian Intel Services and the Hacker Kids did not compromise anything close to Signal. But Telegram is actually heavily compromised by everyone lmao
I recently found that a lot of my feeds have disinformation
Wasn't aware of the EARN IT Bill.
Christ.
act.eff.org/action/stop-the-earn-it-act-to-save-our-privacy
@@LAWRENCESYSTEMS won’t someone think of the children! 🙄😂
There's a lot of problem with bots. There's also problems with app updates and meta data. How difficult is it to lay over a fake app icon over the real thing? It's not secure. Try the carrier pigeon.
Those are phone / device issues, not signal issues.
@@LAWRENCESYSTEMS GayAnalDildo
Signal should add 'status update' feature like WhatsApp.
Now it has story feature
What I wan't to know is my UDM Pro is
secure because it could have a CCP backdoor and certainly has an NSA one. That is if they are doing a proper job of blackmail and extortion of code writers.
Made in China you stooge
@@Crazy--Clown that is what CCP stands for genius. Go troll your Nana, you cannot defeat this keyboard warrior.
Just FOUND YA TOO!
Hey just briefly browsed merch and did not see merch for your company with original logo...LAWRENCE ....??
WANT 2 PROMOTE U NOT CATS... no pun
You can find all there here lawrence.video/swag and there are both with and without logo
Session is even better: First, No need to register. Second, No phone number is required, n no expiration date if u don’t use it like other apps; it’s there for ever.
Session doesn't even have forward secrecy. Signal is not perfect, but it is more secure than Session.
Also using a phone number is a feature not a bug. Having a phone number to identify my friends as much easier and keeps the spammers and scammers away.
Yes.
Actually there's a attack vector for Signal Desktop that a few people and I have found. It's still not fixed lmao. I provided a patch but they rejected it. LMAO2
Why is it saying its ending soon
They are ending offering to be the text message app on Android.
Signal is more secure than WhatsApp
What about giving your phone number when you sign up?
Requiring a phone number is not about security. It reduces the spam and makes it easier to find my friends and communicate with them securely.
@@LAWRENCESYSTEMS Thank you!
@@LAWRENCESYSTEMS so why do have to give your number why can't they give you a fake number
@@LAWRENCESYSTEMS exactly. The phone number is about privacy. Which is often confused by many.
sounds like most (all) govt entities..... give us Everything, which is Nothing! .... perfect!
:(
I only use signals while talk😅
signal is fucking awesome
Use Molly
I'm sure it's secure, it's the fact that it doesn't interoperate with other clients using the same protocol. I should have a choice of open source clients, and a choice of how I create an account.
Yes, it is still secure. next video.
For Android there is the Briar app, there are no servers.
Corona = Zoom
War = Signal
Brandolini's law, also known as the bullshit asymmetry principle.
‘Safe’ until a screenshot. ;)
🤣🤣😭
You should change the title, makes it seem like signal is not secure to the passersby.
man i hate this soo much cause it took me forever to sign-up all my friends to signal and now because of this everyone is like "it's not secure brooo" .... "telegram is secure and not signal" facepalm.jpg
time to start making fake twitter accounts to post nonsense about telegram too
You should choose better friends, if they say because of someone who is spreading fake news on Twitter, that something is secure or not, instead of checking for themselves. The code is there, try, check, verify, hack the shit out of Signal.
@@marcogenovesi8570 Telegram is (verified by independent media) actually hacked by the FSB and other authorities. They give full access, if they're requested too. Even during the Ukraine conflict. Telegram was a nice idea, that got flawed by the Russian authorities.
The growing problem with signal is the lack of advancing features. Telegram functionality has literally blown signal out of the water in usability.
I care more about security than features.
@@LAWRENCESYSTEMS true I just need to send normal texts around securely
it's a messaging app, what features do you need
Telegram for the win ! BTW, side note, MAN the video quality is super clear !! NICE !!!
Thanks, finally getting the new studio dialed in.
@@LAWRENCESYSTEMS ITS really nice man !! good work !!
@@drewthor I like that I can turn on a secret chatt.
@@JasonsLabVideos Not on groups though.
Telegram's source code is not public, so no one really knows how secure it is. Also, a while back I read a story about how the NSA had broken Telegram encryption. Signal source code is public
I'll take Signal over just about anything else out there
Me too
Nice shirt
Thanks!
ok ok ok ok ok. If signal is compromised i don't need to continue watching the video. What i'm looking for is a perfectly secure encrypted messaging app that is not compromised.
Signal is still secure here in 2023
@@LAWRENCESYSTEMS Upgrade the term "secure" to "more secure", then we can agree. There's nothing "secure" out there. But "more secure" (compared to others). Or as we cal it over here: securer. Telegram is secure if you want to keep skids away. Signal is secure if you want to keep state actors away, in sense of not reading your messages from the servers. They will hijack your phone or computer and read all messages anyways. BUT they need more time to do so. If they can't use a 0day, they need to exploit a misconfig. If they exploit a misconfig that takes time. Time to annoy them and keep them away.
no one is going to prove they achieved quantum ai or computing until after they have exploited it
Signal not been intercepted however WhatsApp do not use at all 😂
Explain why it needs a real phone number
Minimize spam and I can better trust the person I'm talking to
@@LAWRENCESYSTEMS my friend, the point is real phone == real ID. It can achieve less-spam through anonymous ways (device fingerprint).
I don't like that they don't give you a fake number 😂
@@MichaelsExplorations NSA likes it, though :) "encrypted comms but plz give me your ID first"
@@jackanderson9258 You're heavily confusing "security" (or safety) and "privacy". Privacy is about your phone number or real id. Security is about hard- or software security. In sense of exploitability and encryption. Keep in mind there's the CIA (Confidentiality, Integrity, Authenticity) that can be used to measure "security" in categories. You won't see privacy in that. Of course there's a requirement that Signal has to collect a bit metadata. But it never claimed otherwise. They only say your messages are encrypted - that fact is true.
many want your info, like your own government not just russia
yup
the US government and other governments in democratic countries are restricted to law. Of course, they can try to circumvent but as long there's the independent media, they will fail over time. So you don't really have to fear your own government in a democratic country. You should be concerned about countries like China or Russia, which are indeed not democratic at all.
😂😂😂😂😂😂😂😂😂😂
Well said do not listen to anyone that has know idea about cryptography at all
If YOU did not write it, you do not know!
Mecen when you did write it, you may still not know 100%.
Questions?
By your logic If you did not make chips, design the chips, build the OS, then write it, you can't trust it either..🙄
do you even trust your own self when it's been shown over and over again that people can easily trick themselves? Nah fam
also you do know they have the source code on github lol
If you blindly trust your own stuff, you're not only stupid, you are living dangerous.
First
people actually think signal is secure? does no one watch Rob Braxman?
In laymans terms why is it not secure to you?
Signal is secure. There's no audit or attack that proves otherwise. Rob Braxman is a nobody.
session is killing all msg app.
If someone does get a hold of your phone and you keep messages for whatever reasons
Obviously all that information and all affiliates are compromised, I know everything can be infiltrated regardless of encryption