pending anonymous user

  • 31 Posts
  • 634 Comments
Joined 2 years ago
cake
Cake day: August 7th, 2023

help-circle



  • This is a reality of any software. Those requirements exists by themselves or in some combinations, but once you want them all, the difficulty grows exponentially.

    The Sunbird model works. Their model isn’t that hard to replicate, and have the steps laidout for you to copy. However, it doesn’t offer some perks you want with limitations. For example, you can only have 5 devices linked to 1 Signal account. There is no 2FA, fine grained access control, nor audit log. The search functionality is not particularly good.

    There are ways to overcome those limitations but you will need some tech savvy dude with proper security backgroud/training to design, implement, and manage that. It steps into semi-custom developement and integration, and be warned, it is hard to done right, especially anything with security.


  • Say your organization is doing something like Amnesty International (at least sounds awlful lot similar to me), you want a solution that

    • encryption
    • shared inbox between trusted members
    • minimal meta-data leak to providers (service providers and network node operators)
      • hide who is sending/receiving
    • easy to search/indexed
    • fine grained access control
    • audit log of who responed to who
    • multi-device
    • single stable address/contact point (how “stable” you need it to be?)
    • 2fa?
    • easy to use

    Am I correct? To be honest, it is quite a tall order. I can’t really think of a solution right now. Email is definitely out of the question because you can’t hide who is sending and receiving the email.




  • I don’t understand why you need encryption. It seems you are concerned about access control and metadata on the security side. If that’s the case, it is more advisable to host your own email server. However, be aware that once the email is sent, your recipient email system may be hosted by other email providers that you might not desire. You can reduce the metadata leaks by using encryption, but as you are aware, not everybody kin to use it. And to be effective, it must be used by both sides.














  • it can. I’m not saying it does, but it absolutely can

    WhatsApp? It can by piggybacking the content on the client itself. It can’t read on the server if it’s as advertised as following the Signal Protocol.

    But that kind of functionality either need targeted deployment, or have that built-in to the client in public channel. It doesn’t matter if they does it or if they can do it, the logic of that functionality still have to exist somewhere. I would believe some nerds would pickup some indicators and had that reversed engineered long ago.

    Without a solid proof, I would on the err side and refrain from claiming such.