Kevin Karhan :verified:<p><span class="h-card" translate="no"><a href="https://mastodon.social/@derekmorr" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>derekmorr</span></a></span> </p><blockquote><p>Let it go, already. No one uses MobileCoin. You can’t even find an exchange to buy it.</p></blockquote><p>Then why does <span class="h-card" translate="no"><a href="https://mastodon.world/@signalapp" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>signalapp</span></a></span> still have that shit in it? <span class="h-card" translate="no"><a href="https://mastodon.world/@Mer__edith" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>Mer__edith</span></a></span> could've pulled that <a href="https://infosec.space/tags/Shitcoin" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Shitcoin</span></a> yet refuses to do do!</p><blockquote><p>The Cloud Act is a non-issue. Signal doesn’t have data on users, so they can’t be forced to disclose it.</p></blockquote><p>That's literally wrong!</p><ul><li><a href="https://infosec.space/tags/Signal" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Signal</span></a> not only collects <a href="https://infosec.space/tags/PII" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PII</span></a> in the form of a <a href="https://infosec.space/tags/PhoneNumher" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PhoneNumher</span></a> but explicitly is <em>able and willing</em> to use that to dsicriminate against users and restrict app functionality based off their presumed juristiction. There is no <em>"legitimate interest"</em> for.doing so nor any legal mandate to do so (unless we excuse the ehole <a href="https://infosec.space/tags/MobileCoin" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MobileCoin</span></a>-<a href="https://infosec.space/tags/Scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Scam</span></a>!)</li></ul><blockquote><p>It’s been 30 years, and no one uses xmpp. Let it go.</p></blockquote><p>Wrong again. Otherwise there wouldn't be thriving ecosystems and Apps to this day. It's just that corporate shills refuse to acknowledge that Signal - like all centralized, proprietary, <a href="https://infosec.space/tags/SingleVendor" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SingleVendor</span></a> and/or <a href="https://infosec.space/tags/SingleProvider" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SingleProvider</span></a> kessengers before and after - will inevitably die as their business model is not sustainable. Sake with <a href="https://infosec.space/tags/ICQ" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ICQ</span></a> really. The only exceptions are those that abolish <a href="https://infosec.space/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>privacy</span></a> for <a href="https://infosec.space/tags/profit" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>profit</span></a>, integrate <em>actually working payments</em> or sellout to a <a href="https://infosec.space/tags/cyberfacist" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cyberfacist</span></a> <a href="https://infosec.space/tags/government" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>government</span></a> (all those apply to <a href="https://infosec.space/tags/WeChat" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WeChat</span></a>!)</p><blockquote><p>It’s shocking that people who claim to care about security and privacy push niche apps with terrible UX and no PFS like Delta or XMPP instead of the only private messenger with any real market share, Signal.</p></blockquote><p>You know what's shocking to me: People who are unable or rather unwilling.to acknowledge that Signal is garbage and it's requirement for a <a href="https://infosec.space/tags/PhoneNumber" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PhoneNumber</span></a> kills any <a href="https://infosec.space/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>privacy</span></a> benefits it may have on paper by virtue of being at best pseudonymous (assuming the userd don't live in a juristiction that demands <em>"<a href="https://infosec.space/tags/KYC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>KYC</span></a>"</em> for even prepaid <a href="https://infosec.space/tags/SIM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SIM</span></a> cards (ime. <a href="https://infosec.space/tags/Germany" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Germany</span></a>) or god forbid even <a href="https://infosec.space/tags/IMEI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IMEI</span></a>|s (i.e. <a href="https://infosec.space/tags/Turkey" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Turkey</span></a> has a literal allowlist that'll kick any device off it's MNOs after 90 days within 365 days.</p><ul><li>The <a href="https://infosec.space/tags/UScentric" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>UScentric</span></a> approach to <a href="https://infosec.space/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>privacy</span></a> and <a href="https://infosec.space/tags/threats" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threats</span></a> makes Signal absolutely useless in many cases, and I do speak here from experience. </li></ul><p>I'd rather help people onboard <a href="https://infosec.space/tags/XMPP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>XMPP</span></a>+<a href="https://infosec.space/tags/OMEMO" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OMEMO</span></a> like <span class="h-card" translate="no"><a href="https://monocles.social/@monocles" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>monocles</span></a></span> and/or <span class="h-card" translate="no"><a href="https://fosstodon.org/@gajim" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>gajim</span></a></span> or <a href="https://infosec.space/tags/PGP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PGP</span></a>/MIME like <span class="h-card" translate="no"><a href="https://chaos.social/@delta" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>delta</span></a></span> & <span class="h-card" translate="no"><a href="https://mastodon.online/@thunderbird" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>thunderbird</span></a></span> (incl. setting them up with <a href="https://infosec.space/tags/Orbot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Orbot</span></a> / <a href="https://infosec.space/tags/TorBrowserBundle" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TorBrowserBundle</span></a> / <span class="h-card" translate="no"><a href="https://venera.social/profile/tails_live" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>tails_live</span></a></span> so their traffic gets through <span class="h-card" translate="no"><a href="https://mastodon.social/@torproject" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>torproject</span></a></span> and doesn't provide any useable IP addresses. </p><ul><li><em>I've literally been there and done that!</em></li></ul><p>As for <a href="https://infosec.space/tags/Sustainability" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Sustainability</span></a>, providers like <a href="https://monocles.eu" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">monocles.eu</span><span class="invisible"></span></a> finance themselves by subscriptions (starting at €2 p.m.) which people can pay <em>fully anonymous</em> using <a href="https://infosec.space/tags/CashByMail" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CashByMail</span></a> and <a href="https://infosec.space/tags/Monero" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Monero</span></a> on top of common payment methods (i.e. SEPA wire transfer)...</p><ul><li>So even if you think <em>"<a href="https://infosec.space/tags/monocles" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>monocles</span></a> is a <a href="https://infosec.space/tags/honeypot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>honeypot</span></a>"</em> that is mitigateable ciz unlike with Signal you can <em>choose your own client, choose a different provider & exervise self-custody of all tue keys!</em></li></ul>