If you have real operational security concerns, your provider shouldn't know anything about you; should in fact have bilateral shielding between themselves and you to prevent either counterparty from learning stuff. That's how Signal works.
If you have real operational security concerns, your provider shouldn't know anything about you; should in fact have bilateral shielding between themselves and you to prevent either counterparty from learning stuff. That's how Signal works.
But Signal requires a working phone number for registration and it knows the phone number. The backend could be modified at any time to store this somewhere else while maintaining end to end encryption between the two parties communicating on it. How can Signal prove continuously that it doesn’t store or disseminate the phone number? I know in past precedent it has told courts that it only has very limited information (date of account creation and the last time of account access).
I don't understand what you mean by all this. Obviously your phone number is tied to your Signal account and Signal knows that linkage at all times - no special action is necessary for them to know it. Signal does not provide anonymity beyond what a phone number provides, and isn't designed to.
Signal's design is "what if WhatsApp wasn't evil" which makes it good for the average user. If you actually want Session or SimpleX, which sacrifice usability for even more privacy, then you know where to find those services.
There's all sorts of things any service provider could do to sleuth out who its users are. The implication of this OFAC determination is that A/I didn't need to sleuth anything out; they are accused of knowingly and deliberately assisting the PKK.
Signal will allow traffic analysis. You send the message to signal, if they wish they can write down to whom they send it on.
It is impossible to make a secure system without the continuous transmission of dummy messages to large numbers of users.
They don't have to do that because accounts are associated one-to-one with phone numbers.
Again: in every system there's always some kind of sleuthing you could do to attempt to identify a user. That's not the legal standard. The complaint against A/I is that they knowingly and deliberately assisted the PKK.
No. With dummy messages you are guaranteed that traffic analysis will not be possible.
Because you connect to the network, then start sending messages to everybody continuously, a message every second, or every ten seconds, or every 100 seconds, you will, every second, or every ten seconds, or 100 seconds, be able to send a message to whoever you want, and you will not be distinguished in any way from the other network participants, even if an adversary controls all nodes but that of the person you want to communicate with. Without dummy messages, traffic analysis will always be possible.
If they knowingly and deliberately assisted the PKK in a forbidden way, there would likely have been an Italian prosecution. Since this hasn't happened, it probably isn't true.
The illegality of the PKK in the Europe is also something quite complicated. The commission have declared it a terrorist organization, but here in Sweden such declaration have no judicial meaning and we define terrorism by whether the organization satisfies objective criteria defined in our law, which the courts determine from case to case (which in Sweden means that if you send money the PKK and prosecutor brings the case and argues that they're terrorist organization, and you argue badly, and he wins, then you might be convicted, but when another guy does the same thing, and argues well, he wins); and the situation in Belgium is similarly complicated, with a legal dispute about whether PKK was a terrorist organization, which PKK won, and thus the PKK was, in Belgium, declared by a court to not be a terrorist organization.
I don't have an opinion about the PKK. My broad take is: if Europe doesn't care, there's no reason for the US to be leading a sanctions effort. I'm confident like everybody else that this is largely pretextual.
All I care about is the claim that if they can do this to A/I they'll come for Signal next. That doesn't follow.
Impossible for a public thing though, noblogs.org will always be traceable to where noblogs.org is hosted because that's how the packets get there.
You can maintain much better opsec in a two way communication than a broadcast.
Well, a fast broadcast at least. Of you're willing to wait for a pocket switched network to spread the signal, you can hide the source pretty well.
Right, I'm only moved to comment by the implications being drawn on this thread that Signal and WhatsApp are next. Different fact patterns and different legal standards.
Signal and WhatsApp are already required to give your communications to the government.
Signal and WhatsApp don't have the plaintext of your communications to begin with.
This is about finances. If the US declares you a terrorist organization, you cannot do any banking anymore, even outside the US, since most banks do not want to gamble on SWIFT access.
Since the US considers anything "antifa" as terrorism now, it already had most concerning distant effects last year. See GLS bank cancelling Rote Hilfe in Germany. 1933 was the last time Rote Hilfe was cancelled, btw. It's an antifa OG. Pretty good indicator about the status quo..
Anyway, look at e.g. GrapheneOS, which is already treated as probable cause by law enforcement. Encrypted messaging also super sus. Thing is, funding can't escape jurisdictions. Signal servers are not running on love and fellowship, but donations and public money. Opsec won't protect your software stack's foundation against US finance attacks.
This OFAC action isn't based on "antifa", though the press release predictably takes shots at it. It's based on three designated foreign terrorist organizations, notably the PKK.
PKK is the pretext, there is no evidence.
The US does not give a damn about PKK. They used the Kurdish sister organizations in Syria and Iran. They condemn PKK because Erdogan wants it.
The US would have zero issues with a Kurdish state comprising parts of Turkey and Iran that splinters the region even more.
I don't think US cares about the PKK either, but that's not my point.
> It's based on three designated foreign terrorist organizations, notably the PKK.
In this context, "designated foreign terrorist organizations" is not an explanation, but a tautology. The matter at hand is how and why something got onto that list.
The antifa remark relates to the Rote Hilfe situation. In my opinion, it's an example of how populist rhetoric became a major overreach with real consequences prior to the incident at hand. Rote Hilfe had a very weak relation to "Antifa Ost" (hardly worth US attention). That's how they got cancelled: https://www.state.gov/releases/office-of-the-spokesperson/20...
So the antifa moral panic is indeed very much relevant.
But decide for yourself, if "Antifa Ost" deserves US anti-terrorism attention to the extent of OFAC sanctions, or if it's maaaybe populist action... https://en.wikipedia.org/wiki/Dresden_left-wing_extremism_tr...
Incidentally, funny how the NSU isn't on that list, hm?
It's neither an explanation nor a tautology; it's an element of US law.
It was clearly written as an explanation. The alternative is that you didn't intend for the words you wrote to have any meaning, in which case why did you write them?
So if those prior sentences or yours are not related, your argument is part wrong, part irrelevant/nonsensical. Good talk.
[dead]