STOP Using Proton & Signal? Here’s the TRUTH

[@AllThingsSecured]

What's your take? Do you think I'm letting Proton and Signal off the hook here? Leave your opinion here and let's discuss. Then make sure to watch my video on the 12 Privacy & Security tools I use EVERY DAY: kzbin.info/www/bejne/jn-ycoKHoNl6bLc

[@TrggrWarning]

4:48 yeah, a proponent of censorship, looks bad… Not sure what “apparent” intelligence connections means, but paired with supporting censorship, could be really bad. “Free service” has tended to mean we, (our data) is the product.

[@jonathancorbett7882]

@@TrggrWarning Agreed. Sure, the code is the code, but Signal's leadership were the ones who decided that phone number are still required. Signal has a huge trust problem. Also, Durov has a valid point: Signal doesn't have reproducible builds on iOS. Telegram does. And Meredith Whittaker, who worked 10 years for Google before she realized that surveillance capitalism is a problem, lies about this and claims that Apple prevents Signal from having reproducible builds.

[@DarkLink606]

I agree that criticism from anyone regarding a widely used e2ee protocol ought to be corroborated by evidence. But then again, much of the criticism on Telegram relies on its protocol, mtproto, being "homebrew", or the company founder being Russian, or its creators not being world-famous cryptographers. A few minor flaws on Telegram have been proven in the past, they were acknowledged and readily patched by Telegram, and bounties paid. It's not as technically secure or private as Signal, to be sure, but I think Telegram has another paradigm and focuses on a different risk profile. It's much more like Discord, and way better in every respect.

[@Casey2262]

I'm more concerned about the NSA and Clearview AI, since they've collected the data of almost everyone in the world.

[@EIRE55]

The rumours that fly around online about supposedly dodgy applications can sometimes be instigated by the government whenever it decides it doesn't fit in with their agenda for control......no privacy allowed. I think we need to do some research of our own before deciding which applications are safe to use, and not rely too much on hearsay, as well as ensuring that we set up and use our systems with the best possible security and privacy.

[@donh8833]

There have been multiple* court cases where law enforcement agencies submitted a subpeona to signal. And signal replied "Sorry, we have no data" If it were a front for the US govt the result SHOULD be different. HOWEVER if enough people were made to believe that Signal was insecure, they might abandon an actual secure platform.

[@AllThingsSecured]

That makes sense.

[@donh8833]

@@JohnTurner313 the fact it is open source says otherwise.

[@beuman0]

Only the client unfortunately

[@moetocafe]

how about Signal handling messages of Tucker Carlson to the alphabet agencies? Signal is broken, they all are. Don't be naive.

[@crogers2009]

And as it's said, the security is only as good as the user. If you're messaging someone on Signal and that person gets arrested and that person gives up their code to get into the app, then all your messages are there if they don't delete them or aren't on a timer. It's the same thing with iMessage; it's end to end encrypted, but once someone has the passcode to your phone, it doesn't really matter anymore.

[@student_of_God]

I've been using Proton services for a while now and I must say this is the only company which provides both anonymity and convenience at there highest levels.

[@AllThingsSecured]

But there's still need for personal OPSEC!

[@BillAnt]

​@@AllThingsSecured - Best to delete the recovery email and store the encryption keys locally on an encrypted storage. imo

[@edengate1]

@@ForAndroid101 Operational Security = everything you do or dont to maintain your anonimity including physical things besides online. And about paying, there's no other way i imagine. They dont accept crypto as far as i know.

[@twelvedanunnaki]

yes of course, they accept crypto

[@jasongreen809]

Whats your view on NPU that bypass E2E encryption? Watch Rob Braxman Tech new video.

[@cryingwater]

Hello, I studied the protocol behind Signal, and it's ignorant to say that Signal is insecure. It uses edge technology when it comes to cryptography. It will be BIG BIG news if it's broken by someone.

[@placeholder3853]

This is what so many people don't seem to understand, a company HAS to hand over data asked of them by law otherwise they will get shut down and possibly get employees jailed. You have to minimise what data you give to ANY service.

[@AllThingsSecured]

Exactly 👏

[@matejkuka797]

one of the things that can end this is, for example, a law that the EU wants to approve, which prohibits encrypted communication, so services like Proton and the like could have a serious problem :/ of course, there are a lot of other options, but every other option takes away "comfort"

[@DarrylGold]

Lavabit shut down their company rather than give out information

[@everyhandletaken]

@@matejkuka797are you serious? They got USB-C & now they want to HTTP all the things? 💀

[@jst601]

Not so

[@LabelsAreMeaningless]

I appreciate you talking about the big picture instead of being emotional and reactive like so many tend to be. I'm still going to use Proton. I'd also like to have people ask themselves one thing. If you're abandoning Proton due to fear of security, who exactly are you switching to? Proton is still the best available without making your own email server and making sure everything is encrypted with nothing overlooked in terms of security. Instead of freaking out and shooting yourself in the foot, think through what you're going to do, be reasonable and rational and then make your decisions.

[@AllThingsSecured]

Agreed 👍🏻

[@SansaStarks]

I love proton mail and tutanota

[@dagoelius]

Tutanota.

[@JohnArktor]

Well even if you self host a secure service. If the gov asks you to hand over data, you either comply or go to jail and get your servers taken by force. So.... yeah... let's be reasonable here.

[@henrik2117]

Great video! Especially the last part where you state the obvious fact - something that most people in this always online world fail to realise - don't share every damn part of your life with the rest of the world.

[@AllThingsSecured]

ha! I know, right?

[@henrik2117]

@@AllThingsSecured I don't remember where I read it but a while back I saw someone posting something like this: "the Internet is down at the moment so I went out into the real world. Here I'm shouting to everyone I see how I'm feeling, what I just did, what I got for breakfast and so on. So far it's going great - I've already got three followers, a doctor from a psych ward and two police officers".

[@nopenotyeti]

​@@henrik2117hilarious and so true but I'm concerned that the US wouldn't be able to care for homeless influencers if the Internet ever really did break

[@ThatGuy.75]

Personally I still use Proton and have for over a year now. In my case it is because I wanted a service with a good reputation and does not have any notable security issues. I also take into account that the level of security of my account is truly on me not Proton. Proton provides the service and Proton is a Swiss owned company. If you want something secure, it is YOUR job to make it secure over the provider.

[@AllThingsSecured]

💯🙌

[@OH2023-cj9if]

Being in Switzerland doesn't make it safe or immune! The main offices for Eurojust are there and have the power to inspect data and records.

[@StolenJoker84]

@@OH2023-cj9ifBeing headquartered in Switzerland means they are protected by Swiss laws, and Switzerland has some of the most privacy focused consumer protection laws in the world.

[@hhbadarin]

Thank you so much, many people need to hear this and use their minds before making judgements!

[@AllThingsSecured]

Thanks 🙏

[@henrik2117]

That would require actually thinking for themselves and making a personal opinion - not sure the majority of people are ready for that.

[@macbitz]

It amuses me how people seem to be worried that Proton provided an email address in response to a court order and yet didn't seem to care about the subsequent apprehension of a terrorist 🤔 I also saw a KZbinr recently bemoaning the fact that Proton do NOT mine and analyse your emails so that they can serve targetted ads 🤦🏻‍♂ Thank you Josh for being a voice of reason in an increasingly crazy world!

[@AllThingsSecured]

Thanks 🙏

[@TrggrWarning]

So Proton only provides email addresses of terrorists & draws the line on “for targeted ads” scanning. Folks pay for some of their products, which helps everyone bypass ads. Also, for a good percentage of users are “free” which tends to mean they, their data, is still the product. So, your phrasing leaves a lot to the imagination, providing email addressees, merely addresses? Sure seems pointless. If they are scanning, but NOT for ad placement, why? To find email addresses of terrorists? Lol wat?

[@AllThingsSecured]

Confusing comment. Please stay on one topic for goodness sake. What makes you say that Proton is scanning? Where are you getting this?

[@robmcewen4621]

@AllThingsSecured read his comment again more carefully. You're misinterpreting what he said about scanning. He's not claiming that proton scans emails. He was referring to how crazy it was... that he saw somebody complaining about Proton not scanning emails.

[@bnalive5077]

One groups “terrorist” is another groups freedom fighter. So yeah, privacy is privacy…….

[@gerowen]

Given the open source nature of Signal I have a feeling that IF somebody's Signal messages were compromised and used against them in court, it wasn't because of a flaw in Signal, but because they made some other mistake with their OPSEC. Perhaps their device, or the device of the person they were talking to, was infected with some sort of malware that could read the messages after they arrived on the device. End-to-end encryption only means from one end to the other, but the messages have to be decrypted once they arrive on a device or else they couldn't be read, so malware running locally on the device could potentially read them. It's also possible, though less likely that they managed to add a device to somebody's Signal account and they didn't notice it because they don't regularly check which devices are authorized to send/receive messages for that account. With how modern encryption works, it's much easier to trick somebody into installing a piece of malware than it is to break the encryption.

[@AllThingsSecured]

Very true.

[@goraxe01]

It's not as opensource as you think some years back a fork called librasignal appeared which removed a dependency on some Google services components which some folks felt could reveal metadata. The client was banned from the signal servers due to 'load concerns' the authors of the fork offered to run and pay for their own servers if they could federated onto the signal network, federation was expressly denied as it would limit the speed of new features. This is documented in github issues on the signal client. Last time I looked certain backend components are not opensourced (admittedly several years ago) so I do not believe its possible to run a parallel network. I still use signal, as that's certain friends comm tool of choice. I'm just pointing out this wouldn't be the first 'smell' around signal, and as per the video practice opsec. One final thought how do we know the apk from the Google store is built from the public code?

[@Peglegkickboxer]

This was Tucker Carlson's issue, they got to his private signal messages through his phone's vulnerabilities (possibly deliberate) not through Signal itself.

[@dienand_]

If your goal is to hide from government then using any of these services is not enough because they are legally compelled to hand your data over. If your goal is to protect yourself from other kinds of threats then absolutely use these services.

[@Kirk-oj6qm]

The reality is this: If you are online, there is no way to be completely secure from online threats. Proton and Signal give you better tools to safeguard your privacy than others, by a significant margin. They are still however online. It took a multi-national government order with proof of terrorism to just get the recovery email address. If that isn't secure, then what is? Well created video, thanks for sharing.

[@snowingfate6100]

Signal is open source and has gone through several law suits. Proton is very similar in that the law suits it is gone though proves that they will only give over what they keep, which is nothing. This is very similar to Private internet access.

[@AllThingsSecured]

True.

[@viktoreisfeld9470]

This only applies to VPN. Everything on there web servers, mail servers, and database servers is logged. You can access Proton's website through tor. But, you can no longer create a proton account through tor which means the account is linked to you. Personally, the only VPN I trust is Mullvad.

[@imFruzzy]

Maybe, but Proton was funded by the EU and are funding nefarious projects. The company you keep says a lot about you...

[@Its-Just-Zip]

​@@imFruzzythis argument holds very little water. The tour project used to get DOD funding but they are very clearly not a Honeypot. There has been plenty of actual court cases that have proved that the US government cannot abuse that Network in fact, the US government uses Tor and I'm pretty certain the same situation exists with the EU and proton. The EU probably pays proton a little bit of money because the EU uses proton. Also saying that proton is funded by the EU is a little bit stupid because proton is not a donation-driven company. They are funded by their users. They may have gotten a few EU grants, but that's very different from being funded by the EU

[@CapitanGreenhat]

PIA was purchased buy some mossad bros

[@MidianNiles]

Thank you for making this video. The message here isn't letting these vendors off the hook; it's a reality check for the digital frontier as a whole. More specifically "due process". It's the only 'real' sense of security we need to focus on, "did an agency use due process?" But also (and more importantly) are software vendors 'only' providing information under circumstances of due process? As a systems administrator, I applaud the message of User responsibilities and as a personal privacy advocate, I salute the message of due process. Fear mongering and baseless accusations run rampant over social media outlets as it is. Thank you for providing a voice of reason and a means of laying a basic framework of the legal challenges.

[@7heMech]

Proton yeah, but Signal is open source I've looked at the code myself, your data is 100% safe, because Signal by design is made so that the company (even if it wanted) can't access any of your data except for your number (which the person requesting your data already needs) and account creation date.

[@testingtesting9046]

Github code may be secure but if you take closer look in 0:18, it says Signal doesn't allow researchers to verify the app deployed in iPhone is the same as the code in Github 😅

[@AllThingsSecured]

Thanks for sharing.

[@NomadKev]

Telegram CEO is referring to Tucker Carlson, TC interviewed Pavel Durov last month, Tucker claims his Signal was compromised

[@7heMech]

@@NomadKev it's a claim based on no evidence, I also say the US bank was compromised. People seem to forget Signal is competition to Telegram, he has everything to win by saying that baseless claim.

[@7heMech]

@@NomadKev it's a baseless claim.

[@mahirjan1984]

Thanks Josh. I’m glad you speak with a voice of reason!

[@AllThingsSecured]

Thanks! 🙏

[@asiliria]

I keep seeing not only news but messages from friends and other acquaintances in Linux and privacy communities that keep propagating a lot of these conspiracies. I agree most of the time that people are not just doing their jobs in the security field right. Thanks for going over them in such a manner! 🤩

[@AllThingsSecured]

Thanks for watching and commenting 🙏

[@steve-yq7sb]

People should always be finding sources and verifying. Seems like if people even see something at all that they just share it without validity as a thought at all even afterthought. I mean its ridiculous. On the other end not everything can be verified so i dont believe only speaking about verified stuff especially with the ACT checkers... People need to look at who would benefit from each thing... Possible motives... Credibility... Then it could be clearly seen when people are being put in a situation to discredit themselves and others in the long term by not considering these things. The long term is more important.

[@xavhow]

Couldn’t agree with you more. There are a lot false information on the internet creating FUD. Be smart, question everything and do the research if you have to!

[@AllThingsSecured]

Absolutely 👍🏻

[@prxsii]

Well reporeted, Josh! I can’t count on my fingers, toes, and other appendages how many people I have to educate that software is not a cure-all. It takes human intervention and understanding for it to work 99.9999% of the time.

[@AllThingsSecured]

Thanks 🙏

[@Mic-Mak]

7:03 Excellent video! I'm glad you included that second part, _don't _*_send_*_ comprising pictures,_ because people shouldn't be shamed for taking compromising pictures of themselves. Don't get me wrong, I advise my friends and family against it, especially women, but I wouldn't shame them for it. On a related note, I have personally always wanted to journal. I've always wanted to have a place where I could write my most intimate thoughts. Preferably on a secure digital journal, because I've had bad experiences as a kid with the security of physical journals. But most journaling apps don't have end-to-end encryption, which is why I have never done it. I don't want to keep everything in my head because writing can be really cathartic. It can help people heal.

[@AllThingsSecured]

Very interesting thought on the journaling. Thanks for sharing.

[@Ck87JF]

You could just write your journal using a local app on your laptop and make sure the drive is encrypted. Or there are ways to create encrypted "files" which can contain multiple files, folders, etc. You decrypt it, update your journal, and re-encrypt it.

[@Mic-Mak]

@@Ck87JF I hear you, but in terms of UI & UX it's not practical. I want a specific app designed for journaling. And those exist, but they're not end-to-end encrypted (E2EE). I have heard of DayOne, which is a promising E2EE journaling app, but they are not natively E2EE so I have some reservations. That said, the biggest hurdle for this magnificent app is that it's only available for Mac and I use Windows. They said they are working on a Windows app though, but I suspect that will take forever as they seem more dedicated to Mac users.

[@WaturDzn]

One thing that I feel like people never mention is the extensive list of terms and conditions for iOS & Android, considering that’s where proton and signal appear to be used the most. Although signal and proton themselves may never store any information, how are we suppose to feel secure in the fact that the operating system we’re running these apps off of aren’t spying on us equally as bad as people would fear one of these messaging apps would? I’m curious for your take on that

[@PvtAnonymous]

well, that's exactly the point. If your threat model includes big govt/big tech, using a proprietary mainstream OS already invalidates every action you take further - which was more or less confirmed in 2013 by Ed and hasn't changed since, more or less gotten worse. Everything you do in that OS can and is being recorded, the OS can take and does make screenshots for example. Some people don't realize this, but as long as you don't know what the OS underneath is doing, no E2EE, Signal or Protonmail is gonna help. These solutions only make sense if the threat model is 3rd parties and ad companies.

[@tonydarcy7475]

If you are concerned about that you can always use a privacy-respecting fork of Android like GraphineOS or CalyxOS.

[@WaturDzn]

@@PvtAnonymous makes sense, but in that case signal shouldn’t make itself seem “encrypted” because if the operating system can and does use the info you type then it may as well not be encrypted, I personally don’t give a damn about ad traffic or anything along those lines, the entire point of using signal is for encrypted messaging, which if that’s undoable via a normal Android/iphone shouldn’t be available on the App Store/play store

[@ultimate9056]

​@@WaturDzn for an app to work like that you'd never be able to read anything except the encrypted data and would have to manually run the decryption math by hand to get the message. If you want anything other than a long hash string to appear on your device screen it needs to be decrypted and stored somewhere on your device to do so

[@breakfastattwilight]

Do people not read the TOS and Privacy Policy? I recently read Proton's, and this is not new information to me.

[@AllThingsSecured]

No, most don’t.

[@MochaZilla]

Why even pst this comment? Of course, most people dont.

[@Physis_88]

In general, the TOS is full of legal jargon that is difficult for the average user to decipher, and it is also usually as long as the LOTR.

[@MochaZilla]

​@@Physis_88exactly the TOS can take literally hours to comb through. Who actually has time to read through it?

[@BrazenNL]

Ignorance or sarcasm?

[@haariger_wookie5646]

If you are in Europe and have doubt about the data collected just use your right under GDPR to get a copy of the data a company holds from you.

[@Falcon3579-ew6yu]

Proton might still be able to support recovery email without storing it in plain text - same what's done for passwords, i.e. just to hash it and store the hash. Then when you need to recover, you'd have to provide the same recovery mail address and it would only be allowed if the hashes match.

[@CaptZenPetabyte]

With what is currently happening in the UK and the EU, I think we *all* should be concerned about our online security

[@feylights166]

Unless I suddenly need to run from the law, these particular things don't really worry me too much. Yes, if Proton was hacked, they could see my recovery email, but I have a strong password and use security keys to sign in to my account. I am still learning how to become better at cyber security (my anxiety suddnely made me hyper aware of it). While I am very concerned about privacy, I would want law enforcement to be able to find a dangerous criminal.

[@AllThingsSecured]

I don't think your privacy has to connect in any way to law enforcement finding a dangerous criminal. It's simply how we handle our own data, not expecting a company to do everything for us.

[@El.Bubba.2-2]

@@AllThingsSecured👍🏼

[@matthewnirenberg]

The main problem that's just starting at the moment is govts being truly tyrannical. Currently most of the CANZUK & CUNA govts are rolling out laws to require all services that have encryption to have a "master key" or to scrape the E2E keys so that govts can easily monitor everyone. Also, and more disturbingly, the Australian govt (sorry... regime) are now trying to declare that their laws apply globally and that if an Australian citizen can access a website/service/business in any manner, then it must comply with Australian laws. This means that they don't care that social media companies are only required to comply with the laws where they're run from and hosted, Australia now requires / demands / expects / will force full compliance with Australian law. If this BS isn't stopped, then basically CANZUK & CUNA will rule the world by force and only their tyrannical laws will matter. We're truly living in a sick, twisted and demented dystopia.

[@xastronix]

I think there's a difference between privacy and anonymity....you can use this services for privacy and not for anonymity

[@AllThingsSecured]

Great point 🫡

[@MarigoldAW]

Exactly my take away. If you are using Protonmail for "anonymity" there is a flaw in your threat model long before email services come into play.

[@unklebonehead]

I agree with ya on nearly everything. Except the (Im paraphrasing you here) "its safe cause it's open source". Open source is awesome for that kind of thing. But it means nothing if no one is actually looking at the code in an auditing sense. I am an open source zealot personally, but we need to stop using this point in our arguments unless we can form a security group that is actively doing audits of code. Maybe it could give these projects a "seal of approval" or "security audit passed on..." type of badge of honor.

[@Hazarth]

I don't know about Proton, but as far as I can tell, Signals protocol is sound. I spent some time developing my own XMPP Server and Signal afaik is based on XMPP with an extension that enables encryption. They made that extension themselves and published an extensive paper on it and it was analyzed by experts many times and it seems to hold really well. It's a really nice double ratchet encryption scheme with a chain of keys, so even cracking one key doesn't give you the entire conversation, just one little piece of it before the key got rotated. So unless AES-256 in CBC and #7 padding is actually cracked completely, it's practically impossible to crack any conversation using this mechanism

[@asadon1950]

The same people complaining about companies legally being required to hand over data they have are here in a KZbin channels comment section… a Google app.

[@AllThingsSecured]

Feel free to jump over to Odysee for those who don’t want to use a Google app!

[@bnalive5077]

Odysee and rumble are good alternatives to this.

[@adcraziness1501]

I use signal, and for its intended purpose. Only problem I have with "look it is open source" is... well yes I see that, but how can I know that what I have on my device is THAT code? Apple or Google doesn't just have a convenient "verify checksum against github repository" feature. The sole basis of my trust is "Apple said it was okay" :(

[@gregmurdoch3264]

Operational security is what 99.999X% people don't care about. Everyone expects the next person to take care of them, or the next company, but doesn't do anything to make sure they're practising active security.

[@AllThingsSecured]

Sad but true.

[@RhoeferCA]

Good job on this video! You eliminated all the diagrams or explanations for HOW these 2 companies encrypt your data, reducing or eliminating unnecessary confusion in order to make your larger points. You made the whole video accessible to a consumer level audience, The exact group who do not know how to evaluate the accusatory assaults made by telegram or by privacy advocates objecting to there being any form of legal compliance with the country you're operating in. Good choices, resulting in very easy to understand video about something very important and critical.

[@iAPX432]

There are 2 majors problem, the error 18 aka between keyboard and chair, and the platform used to access websites or run applications. And in case of anything related to messaging, the same problems on the other counterparts of these exchanges. Put differently one might be the problem, no end-to-end encryption tools.

[@TonyCrenshawsLatte]

Never have illusions about the tools you use. It's a lesson I've learned (sometimes in hard ways) over the years.

[@lukasbruderlin2723]

There are 2 fundamental points on Proton: (1) Even if you use a VPN or TOR whenever you access Proton's website to configure or read emails ... as soon as you run one of their apps, e.g. ProtonVPN or Proton Drive as local app on your machine ... Proton will automatically get your IP address (unless you additionally use TOR or onion service) Isn't it? (2) Most people think, that Proton or Signal have no possibility to get your private key, which is used for their end-to-end encryption, but it could be easily sent encrypted... and whether this actually is done or not... fully relies on how well their Open Source code is audited in this regard, isn't it?

[@Mikein203]

I love that you made another great informative video. But what concerns me about 2024 into 2025 is what are we going to about TPU being implemented? I truly hope you have a chance to see these comments and either reply or think about wanting to make a video on this subject. It will absolutely affect E2E. Thanks so much in advance ☺️ 😊

[@sigi9669]

Signal required me to expose my phone number for it to function. Which seems to be a clear nick in it's security. Not for my personal usecase, but for a journalist or human rights advocate in a more shady part of the world this might be problematic. I remember back in the day you could compile your own Signal app, and physically meet someone to exchange keys. Is this still possible? I know it's still open source, so surely a build without it could be made. But can the backend function without the phone number "address"?

[@ralphm6901]

I read recently that Signal now allows a username instead of the phone number. I haven't tried it,so I don't know how it works.

[@MikefromMinsk]

I launched Signal the other day, and it offered me a brand new feature: that I create a username, so it could be used in addition to the phone I'd provided. Done. Then went to the settings and switched the toggles to not show my number to anyone. Only the contacts that have already added me still can see it. Plus, you can buy a virtual phone number, like Google Voice or Vyke, and attach your Signal to it.

[@pmjeterjr]

Thank you for this! I was just thinking along those lines, you confirmed them for me!

[@AllThingsSecured]

I’m glad it was helpful!

[@TheHagamanstube]

Searching for privacy while using third-party networks, devices, or operating systems is essentially wishful thinking. Consider three neighbors living side by side. The first and third neighbors want to have a conversation in their backyards. As they start talking from their respective gardens, the second neighbor, situated in the middle, can always hear their conversation. This analogy illustrates the basic principle: you can build a temporary communication channel (like a pipe) for the neighbors to talk privately, but this pipe must be entirely your own construction, not provided by services like NordVPN or OpenVPN. Once people grasp this concept, the issue becomes clearer. As long as you rely on third-party systems, true privacy is unattainable, which is the case for 99% of users. Genuine privacy is nearly impossible in these scenarios. If you truly desire privacy, consider having face-to-face conversations, perhaps during a walk in nature or while swimming.

[@AlfaWAR]

Ever since I saw the video from Computerphile about: Elliptic Curve Back Door, I had my doubts about a lot of the encryption we've been using and about how secure they really are.

[@OH2023-cj9if]

Why do you think Proton also wants a phone number! Proton is safe internally, but it is not when messages are decrypted to send out to others or encrypted to store. This is where security services sit. They don't need Proton to hand much over. Datacenters are also forced to allow data inspection. The recovery emails are all stored, including history.

[@nickcardwell]

I believe in the case of Signal, it was an OS level zero-day that allowed the attacker to add a hidden member to a chat, turning it into a "group" chat. Encryption wasn't broken or backdoored, the chat key was just shared with a hidden third party.

[@mohdasaa]

Thank you for thorough clarification. Keep up the good work, you just earned a new subscriber for the amazing content!

[@AllThingsSecured]

Awesome, thank you!

[@Tuxon86]

The thing about them being open source is that while we do have access to a source code, we don’t necessarily know that’s the exact same code that was compiled and is being run on the servers. This is just one of the many flaw that makes people over trust open source for security reasons. Unless they let people do on the spot disassembly of the running process to see if those binaries are a match to the source code you can’t be sure. You may believe they’re running vanilla while they are actually running version b that doesn’t really encrypt stuff.

[@steponmeirene]

Naomi Wu did a very good breakdown of why Signal isn't a secure app, before she got vanned by the Chinese government for talking too much. In fact it was probably her discovering and making public those vulnerabilities that led directly to her vanning.

[@Ciborium]

Why are we banning TikTok for giving users' personal information to the Chinese government, why are we not banning *every other app* that resides in a country, e.g, US or EU, that have the same requirement? We should not use ANY app, including Proton and Signal, that is beholden to the government to hand over users' information for any reason at any time?

[@AllThingsSecured]

You seem to be colossally confused. You’re mixing up two different issues here. And if you watched the video, you know that EVERY company must live under the rules of the country in which it is based. I’m curious what you expect the companies to do?

[@apocalypse487]

I don't understand how your final statement is a question. 😂

[@RhoeferCA]

All I know is they should be banned for cultural pollution and dumbing down a whole nation

[@mp7161]

You don't understand the message of the video. There are companies like Proton Mail, who don't have the content of your emails (un encrypted) , so they can't give them. But is up to you to use an Email address or recovery method that protects your anonymity. And about TikTok, the USA politicians don't care about your data being taken by China. They want to censor you, want to have total control over the app, don't care for its users information, they want to exploit and totally control them

[@maits18]

Looks like some people here in the comments think privacy and anonymity are same banana. Unfortunately Josh even with the great clarification you gave there are people that are stubborn with their beliefs where no one can change them

[@AllThingsSecured]

As always. Thanks for watching and commenting.

[@BorgOvermind]

Well explained. The biggest security vulnerability of all time is the user.

[@blackpurple9163]

Pavel criticising Signal is pretty ironic when he's turning his own platform into a Facebook-like nightmare

[@APIAlchemist]

And also not using encryption by default, giving people a false sense of security because they "have" end-to-end encryption... But the so called "Secret Chat" function only works mobile-to-mobile.

[@blackpurple9163]

@@APIAlchemist and it's not even advertised as much, considering that's the only encrypted chat

[@APIAlchemist]

@@blackpurple9163 Besides, isn't Telegram closed source? How can we even verify it's end-to-end? If we try to sniff for the packages sent, they will all be encrypted in transit so it would be very hard to decode to try and find out, especially since they use a proprietary encryption algorithm called MTProto that they won't open source even if they do give a detailed description of how it works (and it was analised by a few people, it has several security flaws too). And the same encryption is used to send regular messages and end-to-end to their servers. We should just assume that they don't have the key to decrypt the secret chats too?

[@uncrunch398]

The send and deliver info can be encrypted if both accounts work with the same protocols. It probably requires each account to run its own instance of decryptors and receive larger chunks than what's meant for them and process with its own decryption keys then discard what is still cyphered.

[@sdkjl5984]

How many people review the open source code, and then compile it themselves? If not, how do you know the installed code matches the open source version?

[@AllThingsSecured]

Most people don't, but you can be sure that it is being reviewed by people who are looking for bug bounties at the very least.

[@RightUpYT]

I have a question. How can I know if the open source app on my Android phone from the Google store has the same code as the one published?

[@TCKRDefense]

Have you compiled the Signal Android app source code by source? to verify for yourself? Some Apps have PGP keys to verify if the compiled application is Signed to verify if the file is correct.

[@bipin_pariyar]

Hi I keep getting this message in my Google authenticator "Syncing will continue when your device is online and you refresh your Authenticator codes" I just can't figure out what is the issue. It would be great if you make a video addressing this issue.

[@t2ken]

I suggest that the next episode be about the best artificial intelligence services (such as GPT chat and...) that respect user privacy (alternatives to Google Bard)

[@DarrylGold]

I usually turn off videos when they say 'watch till the end' . Why are they all saying that? Did youtube change how they pay? If the information is so important put it at the beginning. Or make the video worth watching. That way it doesn't sound like clickbait.

[@Joseph-xt2qg]

Great video and you bring up a lot of good points. FWIW, Tucker Carlson said the US gov found out about his trip to Russia via Signal...

[@privateagent]

Interesting

[@kleanzed]

Hey Josh, I can't afford a security key, however i have a usb flash drive. Is there's any way I can turn my usb flash drive into a security key? If you can then please make a video on that.

[@uncoverdatruth6634]

Why and How should always be asked. It's just part of critical thinking. Thanks Josh for being a critical thinker!

[@AllThingsSecured]

My pleasure! Thanks for watching and commenting.

[@Catinkss]

2 Things: 1. The people who had their "Private Signal Messages" compromised probably had it all on their phone and either the phone was compromised and swiped or the authorities gained physical access to the phone when they arrested the person in question, none of which are signals fault - good OPSEC here would be to not leave signal logged in on your phone. 2. FUD is interesting, I treat FUD as a means and reason to look deeper into claims - false or not, and learn more about the issues they have. FUD has such negative connotations, but really is a great means of criticism and a good reason to improve something - yours or not. Ignoring FUD just proves that a person is both Arrogant and Ignorant.

[@jytou]

About encryption, there are sometimes backdoors built-in, so even if the software itself open-source the choice of some parameters that are supposed to be random on the site where the software is running can heavily jeopardize the encryption strength. So in here we have to trust that Signal and Proton have not allowed external agents to push them to leave some holes that we may not even know about (Crypto AG being the most iconic example, Tetra is another one).

[@stephanhuebner4931]

That is correct, but we have to use the tools we are provided, and we have to trust those that are more knowledgeable than us. Simply because building our own secure tools is mostly a braindead idea. No homegrown solution will be as secure and as foolproof as tools created by professionals. I am using both Proton and Signal and I would much rather trust these two companies with minimal (if any) security problems in the past than most other apps that are out there somewhere. And having said that, if there are security problems, they'll most likely stem from my own stupidness or the people I communicate with.

[@jytou]

@@stephanhuebner4931 Indeed, I was just reminding that even with open-source software, when it is hosted somewhere there is always uncertainty and one can never be sure 100% of the full confidentiality of the data.

[@TCKRDefense]

I prefer open-source software over Proprietary software

[@salapolivalenta77]

No surprise for me, for privacy I have my own ejabberd server and also a matrix server. Both work like a charm if you know how to proper configure them. Cheers!

[@AllThingsSecured]

That’s impressive, but beyond the ability of most people to set up.

[@salapolivalenta77]

@@AllThingsSecured I agree, indeed....

[@brony_in_the_sticks]

Basically if I understand the video correctly. Media: crying wolf, signal isn't safe and neither is proton. Reality, people are reckless and apple isn't secure. Moral of the story, update your privacy features, and if you're going to have a recovery email make sure that it is also a proton email😂. And don't do anything online that you're not willing to lose in an instant. Just in case you lose the access to the recovery email.

[@jonathanmgoodman]

Being open source doesn’t mean anything without a guarantee that the code submitted by signal or protonmail to the Apple App Store or Google Play Store is the same exact code that they show the sources code for.

[@RT-fb6ty]

Signal does have Phone Numbers of users so if you sign up with your real number that maybe an issue.

[@AllThingsSecured]

Correct, but you can also use a virtual number for that.

[@kchulkacz7082]

When i saw one of the articles claiming proton shares info with law enforcement, i was kinda skeptical. Than i read that they only handed out the recovery email. It was the persons stupidity to use apple id as recovery. Proton can protect contents of your emails with encryption, but they cant protect you from your stupidity...

[@michaeloosthuizen2383]

Recovery email addresses CAN be encrypted, the exact same way passwords are encrypted: by hashing them and then only using them when the user provides the clear text.

[@txreal2]

Click bait. Basically what's said here is "...most of this only applies to those who have reason to be 'highly' concerned about their privacy or security" So NO, you don't have to STOP using Proton or Signal.

[@PowPowPixie]

Well said, and thank you for your rational explanation

[@AllThingsSecured]

My pleasure!

[@omarlocke4351]

EVERYONE should be highly concerned about privacy. it is a human right.

[@NVRRL]

I love that Telegram tries to shit on Signal but doesn't really support end-to-end encryption apart from maybe direct chats... but even that encryption gets shit on by security research regularly

[@readifdumb]

Stories like these just let me know what I should avoid, and help me keep in the loop. It also lets me know the lengths authorities have to go if they need your recovery address and and a 3rd party to help them get your data. If anything that's ensuring, and just lets me know that recovery email is flawed to begin with, just like email is flawed and I should use E2EE messaging apps instead of email for sensitive data.

[@TCKRDefense]

Will you use Linux Instead of Windows?

[@readifdumb]

@@TCKRDefense I've been using Linux for months now actually. I made the change because a friend of mine helped me get initially into it, and I started dual booting. Then I stopped dual booting after hearing about Co Pilot and now am an 100% Linux user.

[@AndyJHiscock]

Encryption may be useless with the looming push for client side scanning, MS Recall is a perfect example. Logging keystrokes and taking screenshots being sold as AI, or a convenience utility. I understand it's target on all devices from desktops to mobiles. See Rob Braxman

[@all3w1s58]

In the video, you brought up the point about being careful of what recovery email you specify. If the recovery email is from iCloud or Microsoft or Google, then I understand the point that the authorities will have to hand any email id to the authorities. What if it was another Proton email account itself?

[@hypothebai4634]

The biggest problem with Signal is that you need a real phone number to register. A phone number is registered to a person. Use Session. This gets around this problem.

[@AllThingsSecured]

Yea, I get that. But now I have to get all my friends and family to use Session too. Not going to happen.

[@hypothebai4634]

@@AllThingsSecured Yes, it is a problem. But the point I was trying to make is that Using Signal instead of ProtonMail gains nothing with respect to hiding a person's identity from government.

[@vpctech]

@@hypothebai4634 : Why compare Signal and Proton? Proton doesn’t offer a standalone messaging app.

[@stephanhuebner4931]

Convincing regular people to use some obscure solution, no matter how secure it is, is absolutely unrealistic. And there's another viewpoint to this: The fact that you are one of potentially very few people who use said obscure solution makes you and those people an easier approachable target, as you stand out from the countless numbers of people using some other, widely more popular solution.

[@hypothebai4634]

@@stephanhuebner4931 My starting point is that all new solutions initially come from the pool of obscure solutions. And initially convincing regular people to use Solution A rather than solution B is just as hard as convincing them to use solution C rather than solution B. I agree that using, for instance, Session over Signal does not allow a user to hide in the long grass. But the thing about systems such as Session is that it is very hard to determine that anybody is using it at all. And Session leaks so little info that who cares if somebody is watching.

[@MrPir84free]

Not sure what Signal is; but Proton is more than one service.. I think you should be very specific about what is going on. Details matter.

[@AllThingsSecured]

I tried to explain it. Proton is a single company with multiple apps - the issue here is related to the base account, so talking about a particular Proton service or app isn't relevant.

[@1CelloOne]

I was on the beta version of proton and have been using it ever since!

[@meino6465]

So I have a question: Is there any reason to keep recovery email on if you know you won't lose the password? As in, are there other cases where you could get locked out of your account unless you use a recovery email?

[@H3cJP]

law is law and they must comply full privacy is impossible, i recommend you if you want to send private messages, to encrypt it with the public pgp key of the receiver

[@potors]

i don't use proton because it is secure or whatever bs people say, EMAIL ISN'T SECURE BY DESING, i use proton because IT DOESN'T ASK 300 AUTHENTICATION FACTORS FOR LOGGING IN, EVEN IF I DISABLED IT

[@potors]

desing lol

[@Simon-us4bn]

It amazes me how many ‘experts’ jump on the lack of metadata encryption when using Proton Mail….email simply doesn’t exist without it. If privacy is that important to you, why are you using a method of communication that is - by design - not private?

[@TheCrealkiller]

Seems like pidgeons will be the secure protocol of the future.

[@SuperM00b]

Pidgeon2Pidgeon

[@mauricioreyes3372]

​@@SuperM00bhahahahaha

[@PyroRob69]

The primary message you should be taking away from this is if have something private to say, do it face to face, in an appropriate place.

[@AllThingsSecured]

That's one way to look at it.

[@viktoreisfeld9470]

This video isn't quite accurate. Proton stores your private encryption key on their server a long with your encrypted contacts, calendar events, and encrypted email. Proton has to turn all this over to the government upon request. All the government then needs to do is guess your protonmail password to get access to your private key and everything in plaintext. When you have the encrypted secret key, this can be easily done with specialized hardware or software since there is no rate limiting on guessing attempts and since the format of the key is known (it is a partial known plaintext attack in cryptography terms). Also, proton is not opensource. While their client code is open all the server side code is all not shared or open. Signal has a similar problem with encryption keys and messages being centrally stored.

[@AllThingsSecured]

I love how you share this with such conviction despite it being completely false. This is why videos like this exist - people love to spout off “facts” without any proof to back them up.

[@TCKRDefense]

ProtonMail and Encryption Encryption Keys on Servers: ProtonMail uses end-to-end encryption (E2EE) for emails, meaning that your emails are encrypted on your device before being sent to ProtonMail's servers. The private encryption key, used to decrypt your emails, is typically encrypted with your password and stored on their servers. This design is intended to balance usability and security. Vulnerability to Password Guessing: The comment mentions that if someone gains access to your ProtonMail account (e.g., through guessing your password), they could potentially decrypt your emails. While ProtonMail does have brute-force protection (rate-limiting attempts to guess passwords), if your password is weak, this could be a vulnerability. Server-Side Code: ProtonMail's server-side code is not open-source, which means users cannot independently verify that there are no backdoors or vulnerabilities in their servers. This is a valid concern for those who prioritize full transparency. Signal and Encryption Centrally Stored Keys: Signal stores the encryption keys used for message decryption on the user's device, not on a central server. However, Signal does use centralized servers to route messages, which some critics argue could be a potential point of surveillance or attack. Rate Limiting: Signal also has rate-limiting mechanisms to prevent brute-force attacks on encryption keys. However, if an attacker gains physical access to your device or your passphrase is compromised, they could potentially decrypt your messages.

[@sebastien79a]

You could do a one way encryption or hash on a recovery e-mail address and then only 'check' when supplied rather than have the recovery e-mail in plain text. Could be enumerated obviously so a bit more complex but can be fixed if someone wanted to.

[@davidswanson9269]

If you know you are going into nefarious activities, you must already understand your communications pathways are already compromised to various degrees thus you have to practice opsec, comsec and offline encryption one time pads. Nature of the old school operative game, tradecraft.

[@AllThingsSecured]

👍🏻👍🏻

[@TCKRDefense]

A one-time pad is an encryption mechanism consisting of combining a stream of key material with the data to encrypt, using a reversible operation; this combination can be very simple, and even doable by hand (without a computer), and still retain security as long as the key material (the "pad") is as long as the data ...Feb 8, 2016

[@skeetabomb]

All courts in Australia operate as corporations under Australian Business Numbers. Start with questioning that. No one is obligated to a corporation.

[@FreedomIsNotGoingToBeFree]

Open source won't help for the masses in this case as you can't check if the app from the store is running that code or a slightly modified version. Unless you compile it yourself of course.

[@matt79de]

A frustratingly number of times people miss the fact that someone ... nefarious, shall we say, may not *need* to have the encryption key if the endpoint is compromised.

[@LucTaylor]

In response to the claim that a recovery email address could not possibly have been stored in any form other than cleartext: while I acknowledge that storing it in cleartext might have been reasonable in this context, I disagree with the assertion that it was literally impossible to store it any other way. I would have hashed and peppered the recovery email address. Alternatively, if the recovery email is uniquely assigned to an account - which it seems to be in this case - a traditional salt could be used. Of course, this wouldn’t work if the recovery email needed to be compared against all known email addresses in the world, but it would at least add some protection. When I built the login system for my site, I hashed email addresses so I could confidently claim that I was not storing any personal data of my users.

[@musicindus1]

when making an email in proton, dont give your real name address and use vpn before creating an email. if something goes wrong, they wouldnt know who you are you are. even choose vpn company wisely

[@Darkk6969]

I am not concerned about it as they only have the IP. My e-mail contents are still encrypted with password, mfa and mailbox password. However, keep in mind this is ONLY protecting the content on your proton mail account. They can intercept and sniff any SMTP e-mails on the internet that don't utilize TLS between servers which is fairly small. Just treat your e-mails as if you sent a postcard.

[@maxdigiacomo4608]

1. When you disable proton recovery email does it actually remove it from their db? 2. Why do they even require a recovery email or sms to sign up? If they actually cared about freedom or privacy they would use a captcha and implement a PoW for activation like cockmail does. 3. Why do they block the use of their emails for registration on certain sites? Seems like they don’t actually care about it once again, all just marketing.

[@adamz1977]

Signal's servers are no longer open source though. In an announcement (Signal plog post called "Improving first impressions on Signal") in November 2021: "To prevent spam on Signal, we need to build this spam-battling logic in a separate server component. The interfaces to this code will be public, but the implementation will not be shared." If any component is closed-source, the whole thing might as well be closed.

[@sergiokneizl]

Disagree with several thinhs. World is not so simple. First of all one court in one country does not have power over another jurisdiction. And power could be misused, if China asks something about a Taiwan person, a Swiss employee really need to comply? And if the company will lose money, the management really need to comply?

[@linsqopiring6816]

4:01 I'm a little concerned that you didn't address the last point. "Unlike Telegram, Signal doesn't allow researchers to make sure that their GitHub code is the same code that is used in the Signal app run on users' iPhones. Signal refused to add reproducible builds " When they said that courts have exploited people's messages you talked about it only in terms of having "broken their encryption". But the bigger issue is the possibility of backdoors, which would be possible considering the quote I just mentioned that I took right from the video. *Why didn't you address this concern* ?

[@TCKRDefense]

Do you see any backdoors in Signal's source code?

[@linsqopiring6816]

@@TCKRDefense Apparently no one can see the source code in the Signal app running on their phones. At least that's what I got from the quote I shared. So if you can't see the code you can't check for back doors.

[@TCKRDefense]

@@linsqopiring6816 You can check the github and compile the source code into a APK I don't think the same can be done with Iphone as I don't have a MacBook and don't know how IOS applications are compiled. Have you ever Compiled a Android application from source code? next With the APK version of signal you can decompile it with Ghidar which is a Reverse engineering software and do something with that. My point is their are ways to solve your problem. I installed signal and yes it did require a number but they allow usernames and I can disallow the invisability of my number so People can only search for me using my username. Signal is better then Telegram I can even recommend other applications that you can install on Phone and computer that are open source. sorry for my grammar mistakes.

[@MrSongib]

No matter what we do, there is no such thing as 100% secure stuff, the first attack and last attack is always social engineering, either from a classic scam or intended or un-intended loophole in TOS. XD

[@RichardMcCulloch-fq9ks]

And this will always be the case with centralised systems. If there is somebody to call, they can pressure/bully them into giving up the information.