Does that mean that other apps like signal for example have back doors?
Do criminals have a knowledge of exploits in the recommended messaging apps?
Because they’re not stupid and understand that government agencies could have a finger in the pie for any publicly available software in some way/shape/form? Paranoia keeps them in business longer.
No, but by making their own they can ensure there isn’t one. Or something like that.
Your average criminal is not making their own and have to trust some third party regardless. Law enforcement agencies have been known to have wide spread honey pot secure messaging apps before.
The average criminal is no dumber or smarter than the average non-criminal. As such they’re every bit as subject to marketing ploys and mis/disinformation. so if their criminal buddies are using BaddieApp Pro, they probably will too. Or if they hear that Bill Gates is using the Signal app for mind control, there’s a good chance they’ll believe it.
You’re missing the #1 reason organized criminals prefer their own service. To have trusted staff who control everything — the servers, code development & deployment — whom can’t be ordered by a court to shut off access to individuals at any time, or provide metadata, eavesdrop, etc.
The weakest link with legal services like Signal is that they can be compelled by law enforcement, the judicial system, and government… That’s an enormous risk for any organized crime operation. Even a minimal amount of metadata collection can do a lot of damage, especially if it’s analyzed over months/years, and especially when performed by an advanced persistent threat actor like a nation state.
I’ve definitely also thought about, if our government gets taken over by fascists, how do you organize a rebellion?
And yeah, Signal definitely has some weird fucking shit going on. As far as I’m aware, they don’t allow you to use their centralized servers, if you don’t use their provided build of the app. They don’t seem to have a mechanism to enforce that, so you could still use a self-compiled build, but if all your friends are on a compromised client, you can’t talk to anyone anyways.
Well, and then there’s also the great stupidity that Signal requires a phone number. In my country, you can’t sign up to a mobile phone plan without revealing your full identity. If the fascist government realizes that I’m part of the rebellion, they can make my phone number disappear in unfortunate circumstances.
So, yeah, I’d at least want to self-host the communication platform. I’d probably use an existing open-source solution, but would try to audit at least part of it…
Pretty sure Signal supports usernames now.
I thought I heard so, too, but when I tried to research it, all that came up is that you can publicly hide your phone number and instead give people your username, but you still need the phone number for sign-up. I really do not know, though, if search engines are failing me again…
That’s correct, you still need a phone number for sign up. between contacts you can use usernames.
So Signal has your phone number, your contacts only have it if you use your number instead ofgiving them a username.
Just use a XMPP client, instead of signal
I think that simply knowing about PGP and using it with traditional platforms will go a long way. If you add some steganography to the mix, it can go a long way.
Lets put it this way: There are criminals that use whatsup, twitter, and the like for communication. They don’t really last for some reason. Then there are those who use a special, commercial system. They might fail if they fall for traps like EncroChat (or however that was spelled). Then there are those who try to set up their own system, but lack the capabilities and talent for that. And last but not least are those groups you have not heard from in the news. They do have proper infosec.
I’ve heard of criminals using MMORPG DM’s to communicate back in the day, not sure what happened to those guys.
Another way to stay under the radar. IIRC there was a case where information was passed on an image board by means of using random-looking filenames that actually encoded messages.
