• Ghazi@mastodon.tn
    link
    fedilink
    arrow-up
    1
    ·
    1 year ago

    @bastion Anonymity is useful, sure. But if you’re going to use an IM app like the majority of people do, you’re going to use it to contact friends and family, which means that the account isn’t anonymous.

    You should also know that Session lacks forward secrecy (a very important feature imo).

    • bastion@feddit.nl
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      True. And although perfect forward secrecy isn’t a huge deal, it is potentially useful, if (for example) you have the encrypted messages backed up, then deleted from your phone, and someone gets access to both your backup and secret key (somehow).

      If a hacker had access to the private long-term key, though, odds are extremely high that they have access to the message database of decrypted messages that signal keeps around to show your history - so kinda moot at that point. There are some useful niche cases for it, though.

      Not a dealbreaker for my by far.

      • Ghazi@mastodon.tn
        link
        fedilink
        arrow-up
        0
        ·
        1 year ago

        @bastion > message database of **decrypted** messages that signal keeps around to show your history

        What are you talking about ? Where did you get this from ?

        • bastion@feddit.nl
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          There’s a physical necessity to keep all of the information necessary to decrypt messages in the app’s folder.

          Anything the signal app shows you can also be seen by an app with access to Signal’s data on that device. This is true of any E2E encrypted messenger service.

          Of course, this is disallowed by the OS, but if you have physical access to that device, you have and can access that data. That includes the database of all of your messages on that device, and the key to decrypt them.

          PFS prevents someone using the key your device has on it from decrypting earlier cyphertexts. But if they have access to that key, they almost inevitably also have access to the database that signal keeps all of your messages in.

          Thus PFS only works in practice if you delete the data from both the sending and receiving devices. PFS is useful, but it’s usefulness is fairly limited in typical scenarios. But, if someone sniffed the cyphertext and then you read the message and deleted it/had disappearing messages on, and they later hacked your phone and got the key, you’d be safe and they couldn’t decrypt the cyphertext they’d sniffed earlier.

          It’s just… …it’s a really niche scenario, and most people (except the very paranoid) aren’t regularly deleting every message.