I have very strong feelings about people giving security advice online, especially generalized advice. My faith in you was built by validating what you said through research and my own experience multiple times. So far, you’ve been batting 1000.

I deeply appreciate that you take time to form context based on threat model of the individual, and explaining the tradeoffs between services honestly.

One size fits all cybersecurity is worse than no cybersecurity imo. There are very few things (2FA over SMS is bad) that apply to everyone equally.

Conspiracy theories are the worst though. That’s not even true information taken out of context - that’s just made up shit misleading people.

thx fren. unfortunately, i deal with people like this all the time. they give actual opsec/infosec professionals a bad name by spewing baseless fearmongering that really does nothing but scare people into apathy

Imagine calling one of the actually legitimate opsec experts on Nostr naïve.

🙄

and you don't understand how tech works. have fun calling every privacy-focused service a gov owned honeypot. oh, and i guess you also think ed snowden is naive too huh? you know, since he uses and recommends both tor and signal and all. later 🤙🏻

don't quote half a quote to make a point. here's the rest

"...are scanned for spam and viruses to pursue the legitimate interest of protecting the integrity of our Services and users. Such inbound messages are scanned for spam in MEMORY (i.e. it is not persistent), and then encrypted and written to disk. We do not possess the technical ability to scan the content of the messages after they have been encrypted."

mullvad has gone ram only for similar purposes as data stored in ram is temporary and not persistent.

using pgp or encrypted messages for private conversations is essential. if you don't anyone can read the contents of said messages. this is not a revelation, it's common sense and a problem proton solves as transparently as possible.

#Signal is not decentralized, nor do they want to be.

They don't allow using any other client to connect to the server except the one they wrote.

They block the completely open source edition of their app (Signal-FOSS) from being listed in F-Droid.

But everyone will cheer and forget all of this when they allow usernames, even if they are still collecting phone numbers and tying them to the usernames behind the scenes

Usernames will be good, but not sufficient for me to recommend Signal again.

#Matrix still wins

#Privacy #Security #infosec #SecureMessaging