Conversation

Notices

1. Embed this notice
   Micah Lee (micahflee@infosec.exchange)'s status on Tuesday, 17-Jun-2025 17:20:48 JST Micah Lee

   I wrote about how to turn in-person meetings into Signal groups, how to manage large semi-public Signal groups while vetting new members, and how to use announcement-only Signal groups, perfect for rapidly responding to ICE raids https://micahflee.com/using-signal-groups-for-activism/

   • Rich Felker repeated this.
   • Embed this notice
     Cody Casterline 🏳️‍🌈 (nfnitloop@mastodon.social)'s status on Tuesday, 17-Jun-2025 22:17:45 JST Cody Casterline 🏳️‍🌈

     in reply to

     @micahflee Good article -- I learned some things.

     But, right after talking about being in a group with 500 members, you say:

     > […] a Signal group [is] all private, and it can't be shared with law enforcement.

     A conversation with 500 people isn't private. Any one of their (possibly multiple) devices might be hacked, or confiscated by law enforcement. Some of the members may BE law enforcement.

     It's important not to oversell the security of the protocol w/ such a big attack surface area.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Tuesday, 17-Jun-2025 22:24:13 JST Rich Felker

     in reply to

     • Andy Mouse
     • Cody Casterline 🏳️‍🌈

     @micahflee @andymouse @NfNitLoop This. 👆

     The misinformation about Signal comes from the fans of nazi honeypots like SimpleX. Folks need to stop falling for that this.

     The concept that a group with N members, for N larger than 2 and especially N>500, is not really "private" regardless of technological capabilities, is correct tho. There are always informants. Confidential information or information which puts people at legal risk needs to be shared only with the precise set of people who need to know.

     Large groups are ok for keeping folks informed, but there's also a risk of "making friends" with someone who actually turns out to be an informant in large groups, so the whole concept of large groups should be treated with extreme caution & skepticism. Personally I think "private" "group chat" is a really bad model for this, in that it exacerbates these risks. Mastodon follows are a much safer way to spread information that doesn't need confidentiality & controlled access because everyone decides organically who to follow rather than having a centrally agreed-upon "group membership".

   • Embed this notice
     Micah Lee (micahflee@infosec.exchange)'s status on Tuesday, 17-Jun-2025 22:24:14 JST Micah Lee

     in reply to

     • Andy Mouse
     • Cody Casterline 🏳️‍🌈

     @andymouse @NfNitLoop

     Yeah, that's not true. Read up on how Signal is engineered to cryptographically prevent themselves from having access to group metadata and message sender metadata that you're claiming they could share with law enforcement:

     https://signal.org/blog/sealed-sender/

     https://signal.org/blog/signal-private-group-system/

     There's plenty of real things you could criticize about Signal, so maybe stick to those and not the misinformation?

   • Embed this notice
     Andy Mouse (andymouse@todon.eu)'s status on Tuesday, 17-Jun-2025 22:24:15 JST Andy Mouse

     in reply to

     • Cody Casterline 🏳️‍🌈

     @NfNitLoop This. Not to mention each of those 500 members are identified with their phone numbers, and there is no real indication (except "we promise") that Signal isn't passing along group memberships to law enforcement to begin with.

     Just use email or whatever texting app you already have. Or use an actually secure alternative, i.e. one where you do not have to provide your phone number to use the service and there is not a single US-based company hosting all the communications.

     @micahflee