What's your take? Do you think I'm letting Proton and Signal off the hook here? Leave your opinion here and let's discuss. Then make sure to watch my video on the 12 Privacy & Security tools I use EVERY DAY: kzfaq.info/get/bejne/jrR_dLKC0NqrZok.html
@TrggrWarning3 ай бұрын
4:48 yeah, a proponent of censorship, looks bad… Not sure what “apparent” intelligence connections means, but paired with supporting censorship, could be really bad. “Free service” has tended to mean we, (our data) is the product.
@jonathancorbett78823 ай бұрын
@@TrggrWarning Agreed. Sure, the code is the code, but Signal's leadership were the ones who decided that phone number are still required. Signal has a huge trust problem. Also, Durov has a valid point: Signal doesn't have reproducible builds on iOS. Telegram does. And Meredith Whittaker, who worked 10 years for Google before she realized that surveillance capitalism is a problem, lies about this and claims that Apple prevents Signal from having reproducible builds.
@DarkLink6063 ай бұрын
I agree that criticism from anyone regarding a widely used e2ee protocol ought to be corroborated by evidence. But then again, much of the criticism on Telegram relies on its protocol, mtproto, being "homebrew", or the company founder being Russian, or its creators not being world-famous cryptographers. A few minor flaws on Telegram have been proven in the past, they were acknowledged and readily patched by Telegram, and bounties paid. It's not as technically secure or private as Signal, to be sure, but I think Telegram has another paradigm and focuses on a different risk profile. It's much more like Discord, and way better in every respect.
@Yug_9y3 ай бұрын
What about the tutanota. Is it safe?
@Casey22623 ай бұрын
I'm more concerned about the NSA and Clearview AI, since they've collected the data of almost everyone in the world.
@donh88333 ай бұрын
There have been multiple* court cases where law enforcement agencies submitted a subpeona to signal. And signal replied "Sorry, we have no data" If it were a front for the US govt the result SHOULD be different. HOWEVER if enough people were made to believe that Signal was insecure, they might abandon an actual secure platform.
@AllThingsSecured3 ай бұрын
That makes sense.
@donh88333 ай бұрын
@@JohnTurner313 the fact it is open source says otherwise.
@beuman03 ай бұрын
Only the client unfortunately
@moetocafe3 ай бұрын
how about Signal handling messages of Tucker Carlson to the alphabet agencies? Signal is broken, they all are. Don't be naive.
@crogers20093 ай бұрын
And as it's said, the security is only as good as the user. If you're messaging someone on Signal and that person gets arrested and that person gives up their code to get into the app, then all your messages are there if they don't delete them or aren't on a timer. It's the same thing with iMessage; it's end to end encrypted, but once someone has the passcode to your phone, it doesn't really matter anymore.
@student_of_God3 ай бұрын
I've been using Proton services for a while now and I must say this is the only company which provides both anonymity and convenience at there highest levels.
@AllThingsSecured3 ай бұрын
But there's still need for personal OPSEC!
@BillAnt3 ай бұрын
@@AllThingsSecured - Best to delete the recovery email and store the encryption keys locally on an encrypted storage. imo
@edengate12 ай бұрын
@@ForAndroid101 Operational Security = everything you do or dont to maintain your anonimity including physical things besides online. And about paying, there's no other way i imagine. They dont accept crypto as far as i know.
@twelvedanunnaki2 ай бұрын
yes of course, they accept crypto
@jasongreen8092 ай бұрын
Whats your view on NPU that bypass E2E encryption? Watch Rob Braxman Tech new video.
@placeholder38533 ай бұрын
This is what so many people don't seem to understand, a company HAS to hand over data asked of them by law otherwise they will get shut down and possibly get employees jailed. You have to minimise what data you give to ANY service.
@AllThingsSecured3 ай бұрын
Exactly 👏
@matejkuka7973 ай бұрын
one of the things that can end this is, for example, a law that the EU wants to approve, which prohibits encrypted communication, so services like Proton and the like could have a serious problem :/ of course, there are a lot of other options, but every other option takes away "comfort"
@DarrylGold3 ай бұрын
Lavabit shut down their company rather than give out information
@everyhandletaken3 ай бұрын
@@matejkuka797are you serious? They got USB-C & now they want to HTTP all the things? 💀
@jst6012 ай бұрын
Not so
@LabelsAreMeaningless3 ай бұрын
I appreciate you talking about the big picture instead of being emotional and reactive like so many tend to be. I'm still going to use Proton. I'd also like to have people ask themselves one thing. If you're abandoning Proton due to fear of security, who exactly are you switching to? Proton is still the best available without making your own email server and making sure everything is encrypted with nothing overlooked in terms of security. Instead of freaking out and shooting yourself in the foot, think through what you're going to do, be reasonable and rational and then make your decisions.
@AllThingsSecured3 ай бұрын
Agreed 👍🏻
@SansaStarks3 ай бұрын
I love proton mail and tutanota
@dagoeliusАй бұрын
Tutanota.
@JohnArktor4 сағат бұрын
Well even if you self host a secure service. If the gov asks you to hand over data, you either comply or go to jail and get your servers taken by force. So.... yeah... let's be reasonable here.
@henrik21173 ай бұрын
Great video! Especially the last part where you state the obvious fact - something that most people in this always online world fail to realise - don't share every damn part of your life with the rest of the world.
@AllThingsSecured3 ай бұрын
ha! I know, right?
@henrik21173 ай бұрын
@@AllThingsSecured I don't remember where I read it but a while back I saw someone posting something like this: "the Internet is down at the moment so I went out into the real world. Here I'm shouting to everyone I see how I'm feeling, what I just did, what I got for breakfast and so on. So far it's going great - I've already got three followers, a doctor from a psych ward and two police officers".
@nopenotyeti3 ай бұрын
@@henrik2117hilarious and so true but I'm concerned that the US wouldn't be able to care for homeless influencers if the Internet ever really did break
@macbitz3 ай бұрын
It amuses me how people seem to be worried that Proton provided an email address in response to a court order and yet didn't seem to care about the subsequent apprehension of a terrorist 🤔 I also saw a KZfaqr recently bemoaning the fact that Proton do NOT mine and analyse your emails so that they can serve targetted ads 🤦🏻♂ Thank you Josh for being a voice of reason in an increasingly crazy world!
@AllThingsSecured3 ай бұрын
Thanks 🙏
@TrggrWarning3 ай бұрын
So Proton only provides email addresses of terrorists & draws the line on “for targeted ads” scanning. Folks pay for some of their products, which helps everyone bypass ads. Also, for a good percentage of users are “free” which tends to mean they, their data, is still the product. So, your phrasing leaves a lot to the imagination, providing email addressees, merely addresses? Sure seems pointless. If they are scanning, but NOT for ad placement, why? To find email addresses of terrorists? Lol wat?
@AllThingsSecured3 ай бұрын
Confusing comment. Please stay on one topic for goodness sake. What makes you say that Proton is scanning? Where are you getting this?
@robmcewen46213 ай бұрын
@AllThingsSecured read his comment again more carefully. You're misinterpreting what he said about scanning. He's not claiming that proton scans emails. He was referring to how crazy it was... that he saw somebody complaining about Proton not scanning emails.
@bnalive50773 ай бұрын
One groups “terrorist” is another groups freedom fighter. So yeah, privacy is privacy…….
@ThatGuy.753 ай бұрын
Personally I still use Proton and have for over a year now. In my case it is because I wanted a service with a good reputation and does not have any notable security issues. I also take into account that the level of security of my account is truly on me not Proton. Proton provides the service and Proton is a Swiss owned company. If you want something secure, it is YOUR job to make it secure over the provider.
@AllThingsSecured3 ай бұрын
💯🙌
@OH2023-cj9if2 ай бұрын
Being in Switzerland doesn't make it safe or immune! The main offices for Eurojust are there and have the power to inspect data and records.
@dienand_2 ай бұрын
If your goal is to hide from government then using any of these services is not enough because they are legally compelled to hand your data over. If your goal is to protect yourself from other kinds of threats then absolutely use these services.
@gerowen3 ай бұрын
Given the open source nature of Signal I have a feeling that IF somebody's Signal messages were compromised and used against them in court, it wasn't because of a flaw in Signal, but because they made some other mistake with their OPSEC. Perhaps their device, or the device of the person they were talking to, was infected with some sort of malware that could read the messages after they arrived on the device. End-to-end encryption only means from one end to the other, but the messages have to be decrypted once they arrive on a device or else they couldn't be read, so malware running locally on the device could potentially read them. It's also possible, though less likely that they managed to add a device to somebody's Signal account and they didn't notice it because they don't regularly check which devices are authorized to send/receive messages for that account. With how modern encryption works, it's much easier to trick somebody into installing a piece of malware than it is to break the encryption.
@AllThingsSecured3 ай бұрын
Very true.
@goraxe012 ай бұрын
It's not as opensource as you think some years back a fork called librasignal appeared which removed a dependency on some Google services components which some folks felt could reveal metadata. The client was banned from the signal servers due to 'load concerns' the authors of the fork offered to run and pay for their own servers if they could federated onto the signal network, federation was expressly denied as it would limit the speed of new features. This is documented in github issues on the signal client. Last time I looked certain backend components are not opensourced (admittedly several years ago) so I do not believe its possible to run a parallel network. I still use signal, as that's certain friends comm tool of choice. I'm just pointing out this wouldn't be the first 'smell' around signal, and as per the video practice opsec. One final thought how do we know the apk from the Google store is built from the public code?
@PeglegkickboxerАй бұрын
This was Tucker Carlson's issue, they got to his private signal messages through his phone's vulnerabilities (possibly deliberate) not through Signal itself.
@hhbadarin3 ай бұрын
Thank you so much, many people need to hear this and use their minds before making judgements!
@AllThingsSecured3 ай бұрын
Thanks 🙏
@henrik21173 ай бұрын
That would require actually thinking for themselves and making a personal opinion - not sure the majority of people are ready for that.
@Kirk-oj6qm3 ай бұрын
The reality is this: If you are online, there is no way to be completely secure from online threats. Proton and Signal give you better tools to safeguard your privacy than others, by a significant margin. They are still however online. It took a multi-national government order with proof of terrorism to just get the recovery email address. If that isn't secure, then what is? Well created video, thanks for sharing.
@snowingfate61003 ай бұрын
Signal is open source and has gone through several law suits. Proton is very similar in that the law suits it is gone though proves that they will only give over what they keep, which is nothing. This is very similar to Private internet access.
@AllThingsSecured3 ай бұрын
True.
@viktoreisfeld94703 ай бұрын
This only applies to VPN. Everything on there web servers, mail servers, and database servers is logged. You can access Proton's website through tor. But, you can no longer create a proton account through tor which means the account is linked to you. Personally, the only VPN I trust is Mullvad.
@imFruzzy3 ай бұрын
Maybe, but Proton was funded by the EU and are funding nefarious projects. The company you keep says a lot about you...
@Its-Just-Zip3 ай бұрын
@@imFruzzythis argument holds very little water. The tour project used to get DOD funding but they are very clearly not a Honeypot. There has been plenty of actual court cases that have proved that the US government cannot abuse that Network in fact, the US government uses Tor and I'm pretty certain the same situation exists with the EU and proton. The EU probably pays proton a little bit of money because the EU uses proton. Also saying that proton is funded by the EU is a little bit stupid because proton is not a donation-driven company. They are funded by their users. They may have gotten a few EU grants, but that's very different from being funded by the EU
@CapitanGreenhat3 ай бұрын
PIA was purchased buy some mossad bros
@MidianNiles3 ай бұрын
Thank you for making this video. The message here isn't letting these vendors off the hook; it's a reality check for the digital frontier as a whole. More specifically "due process". It's the only 'real' sense of security we need to focus on, "did an agency use due process?" But also (and more importantly) are software vendors 'only' providing information under circumstances of due process? As a systems administrator, I applaud the message of User responsibilities and as a personal privacy advocate, I salute the message of due process. Fear mongering and baseless accusations run rampant over social media outlets as it is. Thank you for providing a voice of reason and a means of laying a basic framework of the legal challenges.
@mahirjan19843 ай бұрын
Thanks Josh. I’m glad you speak with a voice of reason!
@AllThingsSecured3 ай бұрын
Thanks! 🙏
@7heMech3 ай бұрын
Proton yeah, but Signal is open source I've looked at the code myself, your data is 100% safe, because Signal by design is made so that the company (even if it wanted) can't access any of your data except for your number (which the person requesting your data already needs) and account creation date.
@testingtesting90463 ай бұрын
Github code may be secure but if you take closer look in 0:18, it says Signal doesn't allow researchers to verify the app deployed in iPhone is the same as the code in Github 😅
@AllThingsSecured3 ай бұрын
Thanks for sharing.
@NomadKev3 ай бұрын
Telegram CEO is referring to Tucker Carlson, TC interviewed Pavel Durov last month, Tucker claims his Signal was compromised
@7heMech3 ай бұрын
@@NomadKev it's a claim based on no evidence, I also say the US bank was compromised. People seem to forget Signal is competition to Telegram, he has everything to win by saying that baseless claim.
@7heMech3 ай бұрын
@@NomadKev it's a baseless claim.
@asiliria3 ай бұрын
I keep seeing not only news but messages from friends and other acquaintances in Linux and privacy communities that keep propagating a lot of these conspiracies. I agree most of the time that people are not just doing their jobs in the security field right. Thanks for going over them in such a manner! 🤩
@AllThingsSecured3 ай бұрын
Thanks for watching and commenting 🙏
@steve-yq7sb3 ай бұрын
People should always be finding sources and verifying. Seems like if people even see something at all that they just share it without validity as a thought at all even afterthought. I mean its ridiculous. On the other end not everything can be verified so i dont believe only speaking about verified stuff especially with the ACT checkers... People need to look at who would benefit from each thing... Possible motives... Credibility... Then it could be clearly seen when people are being put in a situation to discredit themselves and others in the long term by not considering these things. The long term is more important.
@tlmweather3 ай бұрын
Well reporeted, Josh! I can’t count on my fingers, toes, and other appendages how many people I have to educate that software is not a cure-all. It takes human intervention and understanding for it to work 99.9999% of the time.
@AllThingsSecured3 ай бұрын
Thanks 🙏
@xavhow3 ай бұрын
Couldn’t agree with you more. There are a lot false information on the internet creating FUD. Be smart, question everything and do the research if you have to!
@AllThingsSecured3 ай бұрын
Absolutely 👍🏻
@Mic-Mak3 ай бұрын
7:03 Excellent video! I'm glad you included that second part, _don't _*_send_*_ comprising pictures,_ because people shouldn't be shamed for taking compromising pictures of themselves. Don't get me wrong, I advise my friends and family against it, especially women, but I wouldn't shame them for it. On a related note, I have personally always wanted to journal. I've always wanted to have a place where I could write my most intimate thoughts. Preferably on a secure digital journal, because I've had bad experiences as a kid with the security of physical journals. But most journaling apps don't have end-to-end encryption, which is why I have never done it. I don't want to keep everything in my head because writing can be really cathartic. It can help people heal.
@AllThingsSecured3 ай бұрын
Very interesting thought on the journaling. Thanks for sharing.
@Ck87JF3 ай бұрын
You could just write your journal using a local app on your laptop and make sure the drive is encrypted. Or there are ways to create encrypted "files" which can contain multiple files, folders, etc. You decrypt it, update your journal, and re-encrypt it.
@Mic-Mak3 ай бұрын
@@Ck87JF I hear you, but in terms of UI & UX it's not practical. I want a specific app designed for journaling. And those exist, but they're not end-to-end encrypted (E2EE). I have heard of DayOne, which is a promising E2EE journaling app, but they are not natively E2EE so I have some reservations. That said, the biggest hurdle for this magnificent app is that it's only available for Mac and I use Windows. They said they are working on a Windows app though, but I suspect that will take forever as they seem more dedicated to Mac users.
@Falcon3579-ew6yuАй бұрын
Proton might still be able to support recovery email without storing it in plain text - same what's done for passwords, i.e. just to hash it and store the hash. Then when you need to recover, you'd have to provide the same recovery mail address and it would only be allowed if the hashes match.
@NVRRLКүн бұрын
I love that Telegram tries to shit on Signal but doesn't really support end-to-end encryption apart from maybe direct chats... but even that encryption gets shit on by security research regularly
@feylights1663 ай бұрын
Unless I suddenly need to run from the law, these particular things don't really worry me too much. Yes, if Proton was hacked, they could see my recovery email, but I have a strong password and use security keys to sign in to my account. I am still learning how to become better at cyber security (my anxiety suddnely made me hyper aware of it). While I am very concerned about privacy, I would want law enforcement to be able to find a dangerous criminal.
@AllThingsSecured3 ай бұрын
I don't think your privacy has to connect in any way to law enforcement finding a dangerous criminal. It's simply how we handle our own data, not expecting a company to do everything for us.
@El.Bubba.2-228 күн бұрын
@@AllThingsSecured👍🏼
@unkleboneheadАй бұрын
I agree with ya on nearly everything. Except the (Im paraphrasing you here) "its safe cause it's open source". Open source is awesome for that kind of thing. But it means nothing if no one is actually looking at the code in an auditing sense. I am an open source zealot personally, but we need to stop using this point in our arguments unless we can form a security group that is actively doing audits of code. Maybe it could give these projects a "seal of approval" or "security audit passed on..." type of badge of honor.
@breakfastattwilight3 ай бұрын
Do people not read the TOS and Privacy Policy? I recently read Proton's, and this is not new information to me.
@AllThingsSecured3 ай бұрын
No, most don’t.
@MochaZilla3 ай бұрын
Why even pst this comment? Of course, most people dont.
@Physis_883 ай бұрын
In general, the TOS is full of legal jargon that is difficult for the average user to decipher, and it is also usually as long as the LOTR.
@MochaZilla3 ай бұрын
@@Physis_88exactly the TOS can take literally hours to comb through. Who actually has time to read through it?
@BrazenNL3 ай бұрын
Ignorance or sarcasm?
@WaturDzn3 ай бұрын
One thing that I feel like people never mention is the extensive list of terms and conditions for iOS & Android, considering that’s where proton and signal appear to be used the most. Although signal and proton themselves may never store any information, how are we suppose to feel secure in the fact that the operating system we’re running these apps off of aren’t spying on us equally as bad as people would fear one of these messaging apps would? I’m curious for your take on that
@PvtAnonymous3 ай бұрын
well, that's exactly the point. If your threat model includes big govt/big tech, using a proprietary mainstream OS already invalidates every action you take further - which was more or less confirmed in 2013 by Ed and hasn't changed since, more or less gotten worse. Everything you do in that OS can and is being recorded, the OS can take and does make screenshots for example. Some people don't realize this, but as long as you don't know what the OS underneath is doing, no E2EE, Signal or Protonmail is gonna help. These solutions only make sense if the threat model is 3rd parties and ad companies.
@tonydarcy74753 ай бұрын
If you are concerned about that you can always use a privacy-respecting fork of Android like GraphineOS or CalyxOS.
@WaturDzn3 ай бұрын
@@PvtAnonymous makes sense, but in that case signal shouldn’t make itself seem “encrypted” because if the operating system can and does use the info you type then it may as well not be encrypted, I personally don’t give a damn about ad traffic or anything along those lines, the entire point of using signal is for encrypted messaging, which if that’s undoable via a normal Android/iphone shouldn’t be available on the App Store/play store
@asadon19503 ай бұрын
The same people complaining about companies legally being required to hand over data they have are here in a KZfaq channels comment section… a Google app.
@AllThingsSecured3 ай бұрын
Feel free to jump over to Odysee for those who don’t want to use a Google app!
@bnalive50773 ай бұрын
Odysee and rumble are good alternatives to this.
@xastronix3 ай бұрын
I think there's a difference between privacy and anonymity....you can use this services for privacy and not for anonymity
@AllThingsSecured3 ай бұрын
Great point 🫡
@MarigoldAW3 ай бұрын
Exactly my take away. If you are using Protonmail for "anonymity" there is a flaw in your threat model long before email services come into play.
@RhoeferCA3 ай бұрын
Good job on this video! You eliminated all the diagrams or explanations for HOW these 2 companies encrypt your data, reducing or eliminating unnecessary confusion in order to make your larger points. You made the whole video accessible to a consumer level audience, The exact group who do not know how to evaluate the accusatory assaults made by telegram or by privacy advocates objecting to there being any form of legal compliance with the country you're operating in. Good choices, resulting in very easy to understand video about something very important and critical.
@cryingwater7 сағат бұрын
Hello, I studied the protocol behind Signal, and it's ignorant to say that Signal is insecure. It uses edge technology when it comes to cryptography. It will be BIG BIG news if it's broken by someone.
@TonyCrenshawsLatte3 ай бұрын
Never have illusions about the tools you use. It's a lesson I've learned (sometimes in hard ways) over the years.
@maits183 ай бұрын
Looks like some people here in the comments think privacy and anonymity are same banana. Unfortunately Josh even with the great clarification you gave there are people that are stubborn with their beliefs where no one can change them
@AllThingsSecured3 ай бұрын
As always. Thanks for watching and commenting.
@mohdasaa3 ай бұрын
Thank you for thorough clarification. Keep up the good work, you just earned a new subscriber for the amazing content!
@AllThingsSecured3 ай бұрын
Awesome, thank you!
@nickcardwellАй бұрын
I believe in the case of Signal, it was an OS level zero-day that allowed the attacker to add a hidden member to a chat, turning it into a "group" chat. Encryption wasn't broken or backdoored, the chat key was just shared with a hidden third party.
@Mikein2032 ай бұрын
I love that you made another great informative video. But what concerns me about 2024 into 2025 is what are we going to about TPU being implemented? I truly hope you have a chance to see these comments and either reply or think about wanting to make a video on this subject. It will absolutely affect E2E. Thanks so much in advance ☺️ 😊
@adcraziness150129 күн бұрын
I use signal, and for its intended purpose. Only problem I have with "look it is open source" is... well yes I see that, but how can I know that what I have on my device is THAT code? Apple or Google doesn't just have a convenient "verify checksum against github repository" feature. The sole basis of my trust is "Apple said it was okay" :(
@steponmeirene3 ай бұрын
Naomi Wu did a very good breakdown of why Signal isn't a secure app, before she got vanned by the Chinese government for talking too much. In fact it was probably her discovering and making public those vulnerabilities that led directly to her vanning.
@AlfaWAR2 ай бұрын
Ever since I saw the video from Computerphile about: Elliptic Curve Back Door, I had my doubts about a lot of the encryption we've been using and about how secure they really are.
@hypothebai46343 ай бұрын
The biggest problem with Signal is that you need a real phone number to register. A phone number is registered to a person. Use Session. This gets around this problem.
@AllThingsSecured3 ай бұрын
Yea, I get that. But now I have to get all my friends and family to use Session too. Not going to happen.
@hypothebai46343 ай бұрын
@@AllThingsSecured Yes, it is a problem. But the point I was trying to make is that Using Signal instead of ProtonMail gains nothing with respect to hiding a person's identity from government.
@vpctech3 ай бұрын
@@hypothebai4634 : Why compare Signal and Proton? Proton doesn’t offer a standalone messaging app.
@stephanhuebner49313 ай бұрын
Convincing regular people to use some obscure solution, no matter how secure it is, is absolutely unrealistic. And there's another viewpoint to this: The fact that you are one of potentially very few people who use said obscure solution makes you and those people an easier approachable target, as you stand out from the countless numbers of people using some other, widely more popular solution.
@hypothebai46343 ай бұрын
@@stephanhuebner4931 My starting point is that all new solutions initially come from the pool of obscure solutions. And initially convincing regular people to use Solution A rather than solution B is just as hard as convincing them to use solution C rather than solution B. I agree that using, for instance, Session over Signal does not allow a user to hide in the long grass. But the thing about systems such as Session is that it is very hard to determine that anybody is using it at all. And Session leaks so little info that who cares if somebody is watching.
@haariger_wookie564615 күн бұрын
If you are in Europe and have doubt about the data collected just use your right under GDPR to get a copy of the data a company holds from you.
@PowPowPixie3 ай бұрын
Well said, and thank you for your rational explanation
@AllThingsSecured3 ай бұрын
My pleasure!
@PyroRob693 ай бұрын
The primary message you should be taking away from this is if have something private to say, do it face to face, in an appropriate place.
@RightUpYT2 күн бұрын
I have a question. How can I know if the open source app on my Android phone from the Google store has the same code as the one published?
@pmjeterjr3 ай бұрын
Thank you for this! I was just thinking along those lines, you confirmed them for me!
@AllThingsSecured3 ай бұрын
I’m glad it was helpful!
@Ciborium3 ай бұрын
Why are we banning TikTok for giving users' personal information to the Chinese government, why are we not banning *every other app* that resides in a country, e.g, US or EU, that have the same requirement? We should not use ANY app, including Proton and Signal, that is beholden to the government to hand over users' information for any reason at any time?
@AllThingsSecured3 ай бұрын
You seem to be colossally confused. You’re mixing up two different issues here. And if you watched the video, you know that EVERY company must live under the rules of the country in which it is based. I’m curious what you expect the companies to do?
@apocalypse4873 ай бұрын
I don't understand how your final statement is a question. 😂
@RhoeferCA3 ай бұрын
All I know is they should be banned for cultural pollution and dumbing down a whole nation
@mp71613 ай бұрын
You don't understand the message of the video. There are companies like Proton Mail, who don't have the content of your emails (un encrypted) , so they can't give them. But is up to you to use an Email address or recovery method that protects your anonymity. And about TikTok, the USA politicians don't care about your data being taken by China. They want to censor you, want to have total control over the app, don't care for its users information, they want to exploit and totally control them
@uncrunch3982 ай бұрын
The send and deliver info can be encrypted if both accounts work with the same protocols. It probably requires each account to run its own instance of decryptors and receive larger chunks than what's meant for them and process with its own decryption keys then discard what is still cyphered.
@lukasbruderlin27233 ай бұрын
There are 2 fundamental points on Proton: (1) Even if you use a VPN or TOR whenever you access Proton's website to configure or read emails ... as soon as you run one of their apps, e.g. ProtonVPN or Proton Drive as local app on your machine ... Proton will automatically get your IP address (unless you additionally use TOR or onion service) Isn't it? (2) Most people think, that Proton or Signal have no possibility to get your private key, which is used for their end-to-end encryption, but it could be easily sent encrypted... and whether this actually is done or not... fully relies on how well their Open Source code is audited in this regard, isn't it?
@uncoverdatruth66343 ай бұрын
Why and How should always be asked. It's just part of critical thinking. Thanks Josh for being a critical thinker!
@AllThingsSecured3 ай бұрын
My pleasure! Thanks for watching and commenting.
@BorgOvermind3 ай бұрын
Well explained. The biggest security vulnerability of all time is the user.
@joesatchton21218 күн бұрын
Extremely well presented, discussed and dissected, with zero drama, only reasonable facts well-explained. SUBBED
@Hazarth2 ай бұрын
I don't know about Proton, but as far as I can tell, Signals protocol is sound. I spent some time developing my own XMPP Server and Signal afaik is based on XMPP with an extension that enables encryption. They made that extension themselves and published an extensive paper on it and it was analyzed by experts many times and it seems to hold really well. It's a really nice double ratchet encryption scheme with a chain of keys, so even cracking one key doesn't give you the entire conversation, just one little piece of it before the key got rotated. So unless AES-256 in CBC and #7 padding is actually cracked completely, it's practically impossible to crack any conversation using this mechanism
@salapolivalenta773 ай бұрын
No surprise for me, for privacy I have my own ejabberd server and also a matrix server. Both work like a charm if you know how to proper configure them. Cheers!
@AllThingsSecured3 ай бұрын
That’s impressive, but beyond the ability of most people to set up.
@salapolivalenta773 ай бұрын
@@AllThingsSecured I agree, indeed....
@claudiotassani40164 күн бұрын
I've opened this video thinking "another video to scare people and make views" but i was wrong. Really good video. You have a new follower
@AllThingsSecured4 күн бұрын
Thanks 🙏
@t2ken3 ай бұрын
I suggest that the next episode be about the best artificial intelligence services (such as GPT chat and...) that respect user privacy (alternatives to Google Bard)
@Catinkss3 ай бұрын
2 Things: 1. The people who had their "Private Signal Messages" compromised probably had it all on their phone and either the phone was compromised and swiped or the authorities gained physical access to the phone when they arrested the person in question, none of which are signals fault - good OPSEC here would be to not leave signal logged in on your phone. 2. FUD is interesting, I treat FUD as a means and reason to look deeper into claims - false or not, and learn more about the issues they have. FUD has such negative connotations, but really is a great means of criticism and a good reason to improve something - yours or not. Ignoring FUD just proves that a person is both Arrogant and Ignorant.
@TheHagamanstube3 ай бұрын
Searching for privacy while using third-party networks, devices, or operating systems is essentially wishful thinking. Consider three neighbors living side by side. The first and third neighbors want to have a conversation in their backyards. As they start talking from their respective gardens, the second neighbor, situated in the middle, can always hear their conversation. This analogy illustrates the basic principle: you can build a temporary communication channel (like a pipe) for the neighbors to talk privately, but this pipe must be entirely your own construction, not provided by services like NordVPN or OpenVPN. Once people grasp this concept, the issue becomes clearer. As long as you rely on third-party systems, true privacy is unattainable, which is the case for 99% of users. Genuine privacy is nearly impossible in these scenarios. If you truly desire privacy, consider having face-to-face conversations, perhaps during a walk in nature or while swimming.
@Joseph-xt2qg3 ай бұрын
Great video and you bring up a lot of good points. FWIW, Tucker Carlson said the US gov found out about his trip to Russia via Signal...
@privateagent3 ай бұрын
Interesting
@AndyJHiscock2 ай бұрын
Encryption may be useless with the looming push for client side scanning, MS Recall is a perfect example. Logging keystrokes and taking screenshots being sold as AI, or a convenience utility. I understand it's target on all devices from desktops to mobiles. See Rob Braxman
@kleanzed3 ай бұрын
Hey Josh, I can't afford a security key, however i have a usb flash drive. Is there's any way I can turn my usb flash drive into a security key? If you can then please make a video on that.
@RT-fb6tyСағат бұрын
Signal does have Phone Numbers of users so if you sign up with your real number that maybe an issue.
@belalhamdeh6135Ай бұрын
Great video! I would love to see a video on how we can develop habits for using the internet and social media in a safe and responsible way. It would be really helpful to get some tips on protecting our privacy and avoiding common online risks. Thanks for all your awesome content!
@RightUpYT2 ай бұрын
With Signal is might be more complicated. The sensors on our phone collect so much data. It's really not that sci-fi to think that they could use those sensors information they got from Google etc and put that data through some kind of algorithm that just spits out where you were hitting your screen while writing and that's how they got the massages. They really don't need to get anything from Signal, they can collect it on time of input to Signal.
@RichardMcCulloch-fq9ks3 ай бұрын
And this will always be the case with centralised systems. If there is somebody to call, they can pressure/bully them into giving up the information.
@blackpurple91633 ай бұрын
Pavel criticising Signal is pretty ironic when he's turning his own platform into a Facebook-like nightmare
@APIAlchemist3 ай бұрын
And also not using encryption by default, giving people a false sense of security because they "have" end-to-end encryption... But the so called "Secret Chat" function only works mobile-to-mobile.
@blackpurple91633 ай бұрын
@@APIAlchemist and it's not even advertised as much, considering that's the only encrypted chat
@APIAlchemist3 ай бұрын
@@blackpurple9163 Besides, isn't Telegram closed source? How can we even verify it's end-to-end? If we try to sniff for the packages sent, they will all be encrypted in transit so it would be very hard to decode to try and find out, especially since they use a proprietary encryption algorithm called MTProto that they won't open source even if they do give a detailed description of how it works (and it was analised by a few people, it has several security flaws too). And the same encryption is used to send regular messages and end-to-end to their servers. We should just assume that they don't have the key to decrypt the secret chats too?
@sebastien79a3 ай бұрын
You could do a one way encryption or hash on a recovery e-mail address and then only 'check' when supplied rather than have the recovery e-mail in plain text. Could be enumerated obviously so a bit more complex but can be fixed if someone wanted to.
@MochaZilla3 ай бұрын
Never create text of any compromising information. Share that info in person without your phones around for maximum privacy.
@randysavage73513 ай бұрын
Enjoyed your take on this matter.
@all3w1s583 ай бұрын
In the video, you brought up the point about being careful of what recovery email you specify. If the recovery email is from iCloud or Microsoft or Google, then I understand the point that the authorities will have to hand any email id to the authorities. What if it was another Proton email account itself?
@FreedomIsNotGoingToBeFree3 ай бұрын
Open source won't help for the masses in this case as you can't check if the app from the store is running that code or a slightly modified version. Unless you compile it yourself of course.
@jytou3 ай бұрын
About encryption, there are sometimes backdoors built-in, so even if the software itself open-source the choice of some parameters that are supposed to be random on the site where the software is running can heavily jeopardize the encryption strength. So in here we have to trust that Signal and Proton have not allowed external agents to push them to leave some holes that we may not even know about (Crypto AG being the most iconic example, Tetra is another one).
@stephanhuebner49313 ай бұрын
That is correct, but we have to use the tools we are provided, and we have to trust those that are more knowledgeable than us. Simply because building our own secure tools is mostly a braindead idea. No homegrown solution will be as secure and as foolproof as tools created by professionals. I am using both Proton and Signal and I would much rather trust these two companies with minimal (if any) security problems in the past than most other apps that are out there somewhere. And having said that, if there are security problems, they'll most likely stem from my own stupidness or the people I communicate with.
@jytou3 ай бұрын
@@stephanhuebner4931 Indeed, I was just reminding that even with open-source software, when it is hosted somewhere there is always uncertainty and one can never be sure 100% of the full confidentiality of the data.
@readifdumb3 ай бұрын
Stories like these just let me know what I should avoid, and help me keep in the loop. It also lets me know the lengths authorities have to go if they need your recovery address and and a 3rd party to help them get your data. If anything that's ensuring, and just lets me know that recovery email is flawed to begin with, just like email is flawed and I should use E2EE messaging apps instead of email for sensitive data.
@skeetabombАй бұрын
All courts in Australia operate as corporations under Australian Business Numbers. Start with questioning that. No one is obligated to a corporation.
@losttownstreet34092 ай бұрын
Some company used to show a raw recovery key which was the raw encryption key. They moved to recovery email.
@jonathanmgoodman3 ай бұрын
Being open source doesn’t mean anything without a guarantee that the code submitted by signal or protonmail to the Apple App Store or Google Play Store is the same exact code that they show the sources code for.
@iAPX4323 ай бұрын
There are 2 majors problem, the error 18 aka between keyboard and chair, and the platform used to access websites or run applications. And in case of anything related to messaging, the same problems on the other counterparts of these exchanges. Put differently one might be the problem, no end-to-end encryption tools.
@TonyTheYouTuba2 ай бұрын
Very well said. These are all tools, but the way you wield them is what defines their effectiveness.
@sigi96692 ай бұрын
Signal required me to expose my phone number for it to function. Which seems to be a clear nick in it's security. Not for my personal usecase, but for a journalist or human rights advocate in a more shady part of the world this might be problematic. I remember back in the day you could compile your own Signal app, and physically meet someone to exchange keys. Is this still possible? I know it's still open source, so surely a build without it could be made. But can the backend function without the phone number "address"?
@ralphm690122 күн бұрын
I read recently that Signal now allows a username instead of the phone number. I haven't tried it,so I don't know how it works.
@MikefromMinsk14 күн бұрын
I launched Signal the other day, and it offered me a brand new feature: that I create a username, so it could be used in addition to the phone I'd provided. Done. Then went to the settings and switched the toggles to not show my number to anyone. Only the contacts that have already added me still can see it. Plus, you can buy a virtual phone number, like Google Voice or Vyke, and attach your Signal to it.
@gsxr1kmatt21 күн бұрын
But we have no way to be sure the open source code is actually used in the production app instance.
@astrohrs3 ай бұрын
very well explained.
@AllThingsSecured3 ай бұрын
Glad you liked it.
@bipin_pariyar3 ай бұрын
Hi I keep getting this message in my Google authenticator "Syncing will continue when your device is online and you refresh your Authenticator codes" I just can't figure out what is the issue. It would be great if you make a video addressing this issue.
@sdkjl59843 ай бұрын
How many people review the open source code, and then compile it themselves? If not, how do you know the installed code matches the open source version?
@AllThingsSecured3 ай бұрын
Most people don't, but you can be sure that it is being reviewed by people who are looking for bug bounties at the very least.
@ftoftheX2 ай бұрын
Hi Rob: Do you have a secure phone one can use? I only know of ones like rob braxman has...are there others you could suggest please..much thanks.
@DarrylGold3 ай бұрын
I usually turn off videos when they say 'watch till the end' . Why are they all saying that? Did youtube change how they pay? If the information is so important put it at the beginning. Or make the video worth watching. That way it doesn't sound like clickbait.
@matt79de3 ай бұрын
A frustratingly number of times people miss the fact that someone ... nefarious, shall we say, may not *need* to have the encryption key if the endpoint is compromised.
@MarigoldAW3 ай бұрын
It's absolutely silly that people have this notion that private email services will provide you with total anonymity. In my opinion people fear monger when these companies get subpoenaed for information as if Google would not hand over every bit of data they have when asked. If your goal is complete and total anonymity then a subscription based email service clearly isn't going to be a part of your threat model. Or they fundamentally misunderstand what exactly a service like this is supposed to do for you. It's like some of these content creators forget who exactly these products are marketed toward and that's average everyday users who are simply looking for a slightly better alternative to the all seeing eye that is Google and it's web of tech. When you look at these services through that lens Protonmail is fantastic. I appreciate your level headed take about this. Too many fear mongers
@TheCrealkiller3 ай бұрын
Seems like pidgeons will be the secure protocol of the future.
@SuperM00b3 ай бұрын
Pidgeon2Pidgeon
@mauricioreyes33723 ай бұрын
@@SuperM00bhahahahaha
@Simon-us4bn3 ай бұрын
It amazes me how many ‘experts’ jump on the lack of metadata encryption when using Proton Mail….email simply doesn’t exist without it. If privacy is that important to you, why are you using a method of communication that is - by design - not private?
@MrSongib2 күн бұрын
No matter what we do, there is no such thing as 100% secure stuff, the first attack and last attack is always social engineering, either from a classic scam or intended or un-intended loophole in TOS. XD
@t3keen0ob3 ай бұрын
Thank you for sharing and breaking this down for the average users so many misconceptions and myths floating around out there.
@clockwork90112 ай бұрын
I 100% agree nothing is 100% safe Using Burner laptop on a Random WiFi with a VPN on tor can still be vulnerable. It’s all about layers of protection and ensure you have good OpSec.
@H3cJP3 ай бұрын
law is law and they must comply full privacy is impossible, i recommend you if you want to send private messages, to encrypt it with the public pgp key of the receiver
@Mr.NicholsАй бұрын
I will never stop using Proton. 💜
@TheITCornerbyJR3 ай бұрын
Great video. People now days react with the first thing they hear without looking at all aspects. Is mind boggling how the truth can be misconstructed these days.
@BenjaminHari8 күн бұрын
I'm alright with Proton because as you said the data is encrypted but Signal being funded by those guys and then having that chairman with dubious history....makes it hard to trust Signal 100%. And yes as you've said the code is out there to check but still it's very odd for those 2 things to be associated with Signal.
@musicindus18 күн бұрын
when making an email in proton, dont give your real name address and use vpn before creating an email. if something goes wrong, they wouldnt know who you are you are. even choose vpn company wisely
@itsmisterchris3 ай бұрын
I understand very lil lol but was questioning proton.
@AllThingsSecured3 ай бұрын
Do you still question them after watching this video?
@bonkmaykr3 ай бұрын
Best security related advice on KZfaq, period. Nothing is black and white, you should build threat models based on what your concerns are and be aware of what you are sharing and who potentially can see it. All this commotion about "proton bad" "telegram bad" "mullvad bad" only has meaning if you understand the weaknesses of each tool and how they apply to your situation. Thank you and have a sub
@bikeny23 күн бұрын
I was gonna jump out of the video when it started as I heard the music playing over your dialogue and I thought, oh great, another channel host that thinks playing music (any music) while they are talking to us is a great idea. Fortunately for me, I stuck around to see & hear that the music was only during the intro. So, thank you for not putting music on top of your dialogue track. I really do wish other YT hosts would understand how useless and annoying the habit actually is. As to the content, good stuff. There's a reason why essays are not headlines. Getting into the weeds of a story takes time to read and alas not every one is willing to get past the TL/DR summaries.
@actonnoel12842 ай бұрын
I seem to remember Tucker Carlson said his Signal account was compromised and his messages which he thought was secure wasn't.
@myria28343 ай бұрын
Seeing how much data is handed over due to a court order is essential in determining their trustworthiness. If all they can hand over is your IP address, recovery email, and payment details; they have already done everything they legally can to protect my privacy. Call me crazy, but I don't expect anyone to go to prison to reject court orders. I don't have nearly enough money to afford that level of protection.