Signal Blog: Keep your phone number private with Signal usernames
Signal Blog: Keep your phone number private with Signal usernames
Signal’s mission and sole focus is private communication. For years, Signal has kept your messages private, your profile information (like your name and profile photo) private, your contacts private, and your groups private – among much else. Now we’re taking that one step further, by making your...
Finally, we can have usernames in Signal instead of giving our phone number to everybody.
You're viewing a single thread.
Sign-up still requires a phone number.. -.-"
Checkout Matrix/Element
or Session,
there you can actually enjoy privacy by signing-up without a phone number/email:Edit: Due to Session's company residing in Australia,
which appareantly has bad privacy laws,
i don't feel comfortable with recommending it anymoreAh yes, Signal, known anti-privacy company
Permanently Deleted
You’re referring to anonymity, not privacy.
Anonymity is part of privacy; not a dichotomy.
Permanently Deleted
Been using matrix as my primary communication method (including bridges to other networks for things like Slack and WhatsApp) for over 3 years now, doesn't feel slow?
Permanently Deleted
Might need to check your setup. But, I will concede that after 2 years in - a point at which the DB grew into something massive, what with the massive Matrix rooms I was idling in - I started to notice slowdowns. The whole sliding sync proxy thing (with the new generation Element X clients) fixed everything.
You shouldn't be having 10-20 second syncs with a new deploy (and limiting the amount of massive rooms your users can join, depending on your hardware), might be something awry relating to your config. If you're absolutely certain it's not that, check out the sliding sync proxy until it gets merged into the main spec - it's great.
Permanently Deleted
Sorry man, I don't know what to tell you. I've got a pretty medium end VPS on which I host my Matrix instance - only had to add an extension for storage after the first few years when the DB got too big. Things were never as bad as you said early on, and as time passed I absolutely got to the point where it would take 10-20 seconds to sync - but this was after 2 years or so of constant use.
The reason why it takes long is because of the size of the sync payload - logically, for a new server/user, this really shouldn't be that big (unless you're in rooms like Matrix HQ). So, genuinely, look into optimization: postgres, your web server (nginx, apache, caddy), and limiting your users from accessing "problematic" rooms.
Barring that just deploy the sliding sync proxy and be done with it. It's not really a problem that requires you to attempt it a thousand times.
So either you put some fancy wizardry into your system or you’re just in denial.
It's called pure Debian, baby. Also, you'll need a decent chunk of RAM if you don't have that yet. Avoid a pagefile if you can.
Permanently Deleted
Well, at least you gave it your best!
Is Session actually secure though? I know they're based in Australia, and as an Aussie myself, holy fuck would I not trust this country for even a fraction of a picosecond with anything private or sensitive. We have some of the world's most draconian and far-reaching digital privacy and surveillance laws, and I'm not ready to accept that Session hasn't been secretly compromised by the AFP, given the law against revealing government backdoors.
Happy to be proven wrong, but I always err on the side of extreme caution when it comes to Australia. Digitally, we're closer to the CCP than any of our fellow western nations.
Wasn't aware of that, would love to hear about it if someome could shine some more light onto the matter :)
If that's the case, I have to stop using/recommending Session
I'm not the person you responded to, but the Assistance and Access Act 2018 is probably a good place to start. Here is a page from the Aus Government about it, but the very short version is that the government can ask tech providers to assist them with building capabilities into their systems to allow the government to access data to help with the investigation of certain crimes. In some cases these will be voluntary requests, in other cases they will be requests that must be fulfilled, including asking providers to add capabilities that the government has developed.
There's a lot more detail about it, and the government insists that they won't ask providers to create systematic weaknesses or to decrypt communications entirely, but it's not clear to me exactly how those ideas are actually implemented. Unfortunately, much of the process (likely the entire process) is not made public, so as far as I'm aware there aren't any good examples of requests that the government has made and what sorts of things have or haven't been implemented.
Sign-up still requires a phone number… -.-"
Thanks for the warning -- that was my first question. It is my top reason (among many other reasons) for avoiding Signal.
Checkout Matrix/Element or Session,
All 3 of the sites you linked are Cloudflare sites (thus antithetical to privacy). Yes, I know you can use some of that tech without touching CF, but when they run CF websites it reveals hypocrisy & not understanding the goals of their audience.
If that's a concern you could also always use Threema, which has been built from the ground up to use anonymous random IDs and optionally lets you link a phone number or e-mail address to that ID. The company has also won important court cases against having to store metadata preemptively and responding to blanket requests by law enforcement.
I never heard about Threema before,
quickly glanced at it's Github repo,
but I think I prefer Matrix/Element over it.Threema seems to largely rely om GMS (Google Messaging Service),
meaning that most messages will go through Google's servers,
albeit end-to-end encrypted for now,
I would not be suprised if Google would participate in "Harvest now, Decrypt later".There's actually an option to turn GMS off entirely if that's a concern (Settings-->About-->Advanced). It comes at the cost of slightly increased battery usage. Sadly Google does have a bit of a monopoly on mainstream Android there.
Having said that, the messages themselves should never pass Google's servers, just a packet saying "check your Threema server, there's new stuff waiting for you."