this post was submitted on 21 Mar 2026
150 points (86.1% liked)

Privacy

9380 readers
213 users here now

A community for Lemmy users interested in privacy

Rules:

  1. Be civil
  2. No spam posting
  3. Keep posts on-topic
  4. No trolling

founded 2 years ago
MODERATORS
 

Soon after I joined Lemmy a few years ago, I searched for communities based on my interests and subscribed to the ones with the highest numbers of users to ensure they are active. Sometimes I joined multiple, but then saw that some people post the same thing to more than one, cluttering my feed, so I left the smaller ones.

It's only after my community ban from !games@hexbear.net for disagreeing about Ukraine that I was told about MeanwhileOnGrad, learning exactly what "the tankie triad" means and why big Lemmy instances have defederated from those. Lemmy.ml, where the ML probably stands for Marxist-Leninist, seems to have been defederated by fewer, possibly because it's run by the creator of Lemmy, Dessalines. Nevertheless, there is evidence of Dessalines holding the same authoritarian communist views as the rest.

Recently, there were two posts on !privacy@lemmy.ml about Signal, but then in both cases, admin davel (who is known on MoG for seeing CIA's hand in running Ukraine, among other things) and Dessalines linked (1, 2, 3) the same article by Dessalines, which not only argues Signal could be a CIA honeypot (as if it matters when proper e2ee is used), but also manages to shoehorn China even into that, claiming its government "prefers autonomy". This sort of portrayal of totalitarianism as sovereignty is the reason I unsubscribed from the community. As it has been said by others, ML is not a neutral instance but a means of pushing authoritarian views onto unsuspecting users.

Edit: Made the post title clearer.

you are viewing a single comment's thread
view the rest of the comments
[–] jet@hackertalks.com 3 points 2 days ago (1 children)

Fwiw: signal is a honey pot, perhaps not by intent but by architecture.

Security postures are driven by capabilities not intentions.

Signal:

  • centralized
  • uses centralized push notifications
  • stores encryption keys in the cloud SVR

Thus a three letter agency has the capability of breaking signal, even if they don't intend to.

As a thought experiment imagine you run the intelligence service of a non-us ally country (nk, Iran, China, Russia, etc) - would you in good faith recommend using signal, as is, for your classified and sensitive government communications?

how to break signal

SVR stores master key backed by a trivial pin, but uses Intel sgx enclaves to prevent brute forcing... a TLA just gets Intel to sign new code for the sgx enclave that allows brute forcing, runs it against the cloud data extracts master keys, and ta da all communication revealed.

Signal allows people to store their master key using a random bip32 key, but even if you do this, none of your contacts will do this

[–] eugenevdebs@lemmy.dbzer0.com 2 points 1 day ago (1 children)

Don't forget that Signal has been funded by the alphabet soup spying agencies, so they have a reason to fork over keys. But saying that is somehow slander when it's public info.

[–] jet@hackertalks.com 1 points 1 day ago

The signal protocol is solid, so people argue there isn't a known fault with the protocol which is true.

SVR prevents signal from having access to the keys directly, you still need to compromise SGX (which happened two years ago) or access to intel signing keys.

So the signal foundation doesn't have a trivial way to access keys, but the TLAs do.