Notices by Eric K3FNB (they/them) (k3fnb@mastodon.radio)

@feld @Avitus @VeroniqueB99 @adbenitez @SrRochardBunson

Now, if the cops got ahold of my phone's DeltaChat messages, they would be able to build a graph of what email addresses I've been talking to, but they'd have a hard time mapping those to real world identities, especially if they're pseudonymous chatmail addresses.

@feld @Avitus @VeroniqueB99 @adbenitez @SrRochardBunson

Looking at the server side code, Signal stores the phone number with the account id.

So if the cops were able to decrypt my phone app's database, enumerate all the account ids in my Signal's contacts/messages, they could submit a warrent to Signal a gain access to all the phone numbers associated with those account ids.

The phone number has been my biggest complaint about Signal.

https://github.com/signalapp/Signal-Server/blob/09b50383d77b8b8ec56ab1b74b022db8019cfec6/service/src/main/java/org/whispersystems/textsecuregcm/storage/Accounts.java#L120

@SrRochardBunson @VeroniqueB99 Delta Chat is based on email which leaks metadata like a sieve.

I would not use it for any kind of activivism. You're one warrant away from having your entire social graph mapped out.

The contents might be end to end encrypted but who you're talking to isn't and all those people are susceptible to rubber hose decryption.