Kevin Karhan :verified:<p><span class="h-card" translate="no"><a href="https://gruene.social/@max" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>max</span></a></span> <br>To <a href="https://gruene.social/@max/113872018769294131" rel="nofollow noopener" target="_blank">quote you directly</a>:</p><blockquote><p>"[...] easy to use solutions that are at the same time private and secure. [...]"</p></blockquote><ul><li>The fact that <span class="h-card" translate="no"><a href="https://mastodon.world/@signalapp" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>signalapp</span></a></span> requires <a href="https://infosec.space/tags/PII" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PII</span></a> like a <a href="https://infosec.space/tags/PhoneNumber" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PhoneNumber</span></a> which more often than not <em>cannot be legally acquired anonymously</em> makes it not <a href="https://infosec.space/tags/private" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>private</span></a>. </li></ul><p>It is easier, faster, cheaper and overall simpler to get someone setup with <a href="https://infosec.space/tags/XMPP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>XMPP</span></a> + <a href="https://infosec.space/tags/OMEMO" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OMEMO</span></a> espechally if they don't have a <a href="https://infosec.space/tags/PhoneNumber" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PhoneNumber</span></a> and/or <a href="https://infosec.space/tags/ID" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ID</span></a> to acquire a <a href="https://infosec.space/tags/SIM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SIM</span></a>. </p><p>And if you go and say, <em>"Just buy a [insert country here] [e]SIM!"</em> and expect <a href="https://infosec.space/tags/TechIlliterates" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TechIlliterates</span></a> without a <a href="https://infosec.space/tags/CreditCard" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CreditCard</span></a>, <a href="https://infosec.space/tags/PayPal" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PayPal</span></a> or other means of <a href="https://infosec.space/tags/OnlinePayment" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OnlinePayment</span></a> to fiddle around with some <a href="https://infosec.space/tags/eSIM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>eSIM</span></a> if not having to get some <a href="https://infosec.space/tags/eSIMcard" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>eSIMcard</span></a> because they can only afford to maintain one SIM and can't spend triple-digits on a new devices then you <em>completely missed the point</em>!</p><ul><li>I can much faster and easier get TechIlliterates setup show them around - either in a <span class="h-card" translate="no"><a href="https://mastodon.earth/@cryptoparty" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>cryptoparty@mastodon.earth</span></a></span> / <span class="h-card" translate="no"><a href="https://chaos.social/@cryptoparty" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>cryptoparty@chaos.social</span></a></span> / <a href="https://infosec.space/tags/CryptoParty" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CryptoParty</span></a> - style <a href="https://infosec.space/tags/classroom" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>classroom</span></a> / <a href="https://infosec.space/tags/seminar" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>seminar</span></a> or 1:1 tutoring than I can <em>legally acquire and activate a new SIM in <a href="https://infosec.space/tags/Germany" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Germany</span></a></em> [since 07/2017]...</li></ul><p>It's not that I expect anyone to get <a href="https://infosec.space/tags/TechLiterate" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TechLiterate</span></a> within minutes, but similar to setting up a cordless DECT phone it's something one has to do once in 5 years and just have them put the password in a safe spot to retain...</p> <p>Point is that <a href="https://infosec.space/tags/Signal" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Signal</span></a> <a href="https://infosec.space/tags/WontFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WontFix</span></a> their setup and that was evidently clear even before <span class="h-card" translate="no"><a href="https://mastodon.world/@Mer__edith" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>Mer__edith</span></a></span> succeeded <a href="https://infosec.space/tags/MoxieMarlinspike" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MoxieMarlinspike</span></a>: Their entire operation has a <em>distinct <a href="https://infosec.space/tags/CryptoAG" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CryptoAG</span></a> stench</em> as it's an <a href="https://infosec.space/tags/unsustainable" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>unsustainable</span></a> <a href="https://infosec.space/tags/VCmoneyBurning" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>VCmoneyBurning</span></a> party!</p><ul><li><a href="https://infosec.space/tags/CloudAct" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CloudAct</span></a> and the <a href="https://infosec.space/tags/NOBUS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NOBUS</span></a> <a href="https://en.wikipedia.org/wiki/NOBUS#Criticism" rel="nofollow noopener" target="_blank">hegemony</a> ain't something that just got executed now (neither was <a href="https://infosec.space/tags/GDPR" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>GDPR</span></a> &amp; <a href="https://infosec.space/tags/BDSG" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>BDSG</span></a>!)... </li></ul><p>A counterexample on how this could've been done are <a href="https://infosec.space/tags/Tor" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Tor</span></a>, <a href="https://infosec.space/tags/eMail" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>eMail</span></a> and other <em>truly <a href="https://infosec.space/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenSource</span></a></em> as in <a href="https://infosec.space/tags/MultiVendor" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MultiVendor</span></a> &amp; <a href="https://infosec.space/tags/MultiProvider" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MultiProvider</span></a> standards. </p><ul><li><p><em>NOTHING</em> compells Signal to <a href="https://en.wikipedia.org/wiki/Signal_(software)" rel="nofollow noopener" target="_blank">demand PII</a>, run a <a href="https://infosec.space/tags/Shitcoin" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Shitcoin</span></a> <a href="https://infosec.space/tags/Scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Scam</span></a> <a href="https://en.wikipedia.org/wiki/Signal_(software)#In-app_payments" rel="nofollow noopener" target="_blank">aka.</a> <a href="https://infosec.space/tags/MobileCoin" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MobileCoin</span></a> that even seasoned <a href="https://infosec.space/tags/TechLiterates" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TechLiterates</span></a> and <a href="https://infosec.space/tags/CryptoBros" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CryptoBros</span></a> <a href="https://www.youtube.com/watch?v=0DSGq9FQKU4" rel="nofollow noopener" target="_blank">can't setup properly</a>, and in fact Signal using <a href="https://en.wikipedia.org/wiki/Signal_(software)#Controversial_use" rel="nofollow noopener" target="_blank">phone numbers makes it trivial to discriminate against users and easier for them to identify them</a>!</p></li><li><p>If <a href="https://infosec.space/@kkarhan/113869305765533809" rel="nofollow noopener" target="_blank">my reasoning</a> didn't resonate with you, then try helping i.e. undocumented migrants aka. <em>"<a href="https://infosec.space/tags/SansPapier" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SansPapier</span></a>|s"</em> to get setup with it without violating laws and/or ToS and/or needing an imported SIM which I'm shure most folks don't have on hand!</p></li></ul><p>Whereas it's trivial to get people setup on <a href="https://github.com/greyhat-academy/lists.d/blob/main/xmpp.servers.list.tsv" rel="nofollow noopener" target="_blank">one of many XMPP servers I've personally tested</a>!</p><ul><li>Not to mention clients like <span class="h-card" translate="no"><a href="https://monocles.social/@monocles" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>monocles</span></a></span> / <a href="https://infosec.space/tags/monoclesChat" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>monoclesChat</span></a> and <span class="h-card" translate="no"><a href="https://fosstodon.org/@gajim" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>gajim</span></a></span> / <a href="https://infosec.space/tags/gajim" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>gajim</span></a> are way more user-friendly and unlike Signal can also work perfectly fine over <a href="https://infosec.space/tags/Tor" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Tor</span></a>, including <a href="https://infosec.space/tags/OnionServices" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OnionServices</span></a> as endpoints. </li></ul><p>AFAIK Signal doesn't even have an <a href="https://infosec.space/tags/OnionService" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OnionService</span></a> / <a href="https://en.wikipedia.org/wiki/.onion" rel="nofollow noopener" target="_blank"><code>.onion</code></a> for their Website, much less any <a href="https://infosec.space/tags/API" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>API</span></a> enpoints to use it with!</p><ul><li>Them relying on <a href="https://infosec.space/tags/ClownFlare" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClownFlare</span></a> is just something that makes them even <em>more <a href="https://infosec.space/tags/sus" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>sus</span></a></em> as there is <em><a href="https://en.wikipedia.org/wiki/Cloudflare#Controversies" rel="nofollow noopener" target="_blank">no legitimate reason</a></em> to use a <a href="https://infosec.space/tags/RogueISP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RogueISP</span></a> like that.</li></ul> <p>You're free to also provide evidence and supporting data to your arguments, rather then <em>neighsaying</em> against <em>proven to be more secure and reliable [by virtue of decentralization]</em> options like XMPP+OMEMO and/or <a href="https://infosec.space/tags/PGP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PGP</span></a>/MIME. </p><ul><li>What gets my blood boiling is the constant <a href="https://infosec.space/tags/disinfo" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>disinfo</span></a> by <a href="https://mstdn.social/@rysiek/113868777937162686" rel="nofollow noopener" target="_blank">Signal</a> <a href="https://mstdn.social/@rysiek/113869169340313254" rel="nofollow noopener" target="_blank">Fanboys</a> like <span class="h-card" translate="no"><a href="https://mstdn.social/@rysiek" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>rysiek</span></a></span> who sell it like <a href="https://infosec.space/tags/DigitalSnakeoil" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DigitalSnakeoil</span></a> akin to <a href="https://infosec.space/tags/AntivirusSoftware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AntivirusSoftware</span></a>, because it's at best <em>"<a href="https://infosec.space/tags/TechPopulism" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TechPopulism</span></a>"</em> and at worst <a href="https://infosec.space/@agturcz@circumstances.run/113868748895262202" rel="nofollow noopener" target="_blank">will mislead "TechIlliterates"</a> with a <a href="https://infosec.space/@kkarhan/113868987217053362" rel="nofollow noopener" target="_blank">false sense of security</a>, which in turn puts more users at risk.</li></ul><p>The <em>proper fix</em> is to actually <em>assess the situation</em> and acknowledge the <em>risks and limitations</em> as well as the very nature of communications, which means <em>upgrading later</em> is exponentially more painful, thus getting people <em>properly setup once</em> is way easier.</p><ul><li>Just because <em>WE</em> [ or rather <span class="h-card" translate="no"><a href="https://mstdn.social/@rysiek" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>rysiek</span></a></span> in this case ] rather <em>privilegued enough</em> to not be <em>hatecrimed in their current location</em> doesn't mean this is the case for everyone. And having places like Signal rely on a <em>"<a href="https://infosec.space/tags/CDN" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CDN</span></a>"</em> is just another <em>red flag</em> to me because questions like <a href="https://circumstances.run/@agturcz/113866980398547492" rel="nofollow noopener" target="_blank">this one</a> just don't arise with <a href="http://monocles.chat" rel="nofollow noopener" target="_blank">monocles.chat</a> as people can just exercise proper <a href="https://infosec.space/tags/SelfCustody" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SelfCustody</span></a> and just use Tor!</li></ul><p>Speaking of <a href="https://infosec.space/tags/monocles" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>monocles</span></a>: That business is at least <a href="https://infosec.space/tags/sustainable" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>sustainable</span></a> because it's funded by users <a href="https://store.monocles.eu/produkt/monocles-starter-account/" rel="nofollow noopener" target="_blank">(€2 p.m.)</a> which they can <a href="https://monocles.eu/more/#payment-section" rel="nofollow noopener" target="_blank">pay anonymously</a></p>