What's your take? Do you think I'm letting Proton and Signal off the hook here? Leave your opinion here and let's discuss. Then make sure to watch my video on the 12 Privacy & Security tools I use EVERY DAY: kzfaq.info/get/bejne/jrR_dLKC0NqrZok.html

There have been multiple* court cases where law enforcement agencies submitted a subpeona to signal. And signal replied "Sorry, we have no data" If it were a front for the US govt the result SHOULD be different. HOWEVER if enough people were made to believe that Signal was insecure, they might abandon an actual secure platform.

I've been using Proton services for a while now and I must say this is the only company which provides both anonymity and convenience at there highest levels.

This is what so many people don't seem to understand, a company HAS to hand over data asked of them by law otherwise they will get shut down and possibly get employees jailed. You have to minimise what data you give to ANY service.

I appreciate you talking about the big picture instead of being emotional and reactive like so many tend to be. I'm still going to use Proton. I'd also like to have people ask themselves one thing. If you're abandoning Proton due to fear of security, who exactly are you switching to? Proton is still the best available without making your own email server and making sure everything is encrypted with nothing overlooked in terms of security. Instead of freaking out and shooting yourself in the foot, think through what you're going to do, be reasonable and rational and then make your decisions.

Great video! Especially the last part where you state the obvious fact - something that most people in this always online world fail to realise - don't share every damn part of your life with the rest of the world.

It amuses me how people seem to be worried that Proton provided an email address in response to a court order and yet didn't seem to care about the subsequent apprehension of a terrorist 🤔 I also saw a KZfaqr recently bemoaning the fact that Proton do NOT mine and analyse your emails so that they can serve targetted ads 🤦🏻‍♂ Thank you Josh for being a voice of reason in an increasingly crazy world!

Personally I still use Proton and have for over a year now. In my case it is because I wanted a service with a good reputation and does not have any notable security issues. I also take into account that the level of security of my account is truly on me not Proton. Proton provides the service and Proton is a Swiss owned company. If you want something secure, it is YOUR job to make it secure over the provider.

If your goal is to hide from government then using any of these services is not enough because they are legally compelled to hand your data over. If your goal is to protect yourself from other kinds of threats then absolutely use these services.

Given the open source nature of Signal I have a feeling that IF somebody's Signal messages were compromised and used against them in court, it wasn't because of a flaw in Signal, but because they made some other mistake with their OPSEC. Perhaps their device, or the device of the person they were talking to, was infected with some sort of malware that could read the messages after they arrived on the device. End-to-end encryption only means from one end to the other, but the messages have to be decrypted once they arrive on a device or else they couldn't be read, so malware running locally on the device could potentially read them. It's also possible, though less likely that they managed to add a device to somebody's Signal account and they didn't notice it because they don't regularly check which devices are authorized to send/receive messages for that account. With how modern encryption works, it's much easier to trick somebody into installing a piece of malware than it is to break the encryption.

Thank you so much, many people need to hear this and use their minds before making judgements!

The reality is this: If you are online, there is no way to be completely secure from online threats. Proton and Signal give you better tools to safeguard your privacy than others, by a significant margin. They are still however online. It took a multi-national government order with proof of terrorism to just get the recovery email address. If that isn't secure, then what is? Well created video, thanks for sharing.

Signal is open source and has gone through several law suits. Proton is very similar in that the law suits it is gone though proves that they will only give over what they keep, which is nothing. This is very similar to Private internet access.

Thank you for making this video. The message here isn't letting these vendors off the hook; it's a reality check for the digital frontier as a whole. More specifically "due process". It's the only 'real' sense of security we need to focus on, "did an agency use due process?" But also (and more importantly) are software vendors 'only' providing information under circumstances of due process? As a systems administrator, I applaud the message of User responsibilities and as a personal privacy advocate, I salute the message of due process. Fear mongering and baseless accusations run rampant over social media outlets as it is. Thank you for providing a voice of reason and a means of laying a basic framework of the legal challenges.

Thanks Josh. I’m glad you speak with a voice of reason!

Proton yeah, but Signal is open source I've looked at the code myself, your data is 100% safe, because Signal by design is made so that the company (even if it wanted) can't access any of your data except for your number (which the person requesting your data already needs) and account creation date.

I keep seeing not only news but messages from friends and other acquaintances in Linux and privacy communities that keep propagating a lot of these conspiracies. I agree most of the time that people are not just doing their jobs in the security field right. Thanks for going over them in such a manner! 🤩

Well reporeted, Josh! I can’t count on my fingers, toes, and other appendages how many people I have to educate that software is not a cure-all. It takes human intervention and understanding for it to work 99.9999% of the time.

Couldn’t agree with you more. There are a lot false information on the internet creating FUD. Be smart, question everything and do the research if you have to!

7:03 Excellent video! I'm glad you included that second part, _don't _*_send_*_ comprising pictures,_ because people shouldn't be shamed for taking compromising pictures of themselves. Don't get me wrong, I advise my friends and family against it, especially women, but I wouldn't shame them for it. On a related note, I have personally always wanted to journal. I've always wanted to have a place where I could write my most intimate thoughts. Preferably on a secure digital journal, because I've had bad experiences as a kid with the security of physical journals. But most journaling apps don't have end-to-end encryption, which is why I have never done it. I don't want to keep everything in my head because writing can be really cathartic. It can help people heal.

Proton might still be able to support recovery email without storing it in plain text - same what's done for passwords, i.e. just to hash it and store the hash. Then when you need to recover, you'd have to provide the same recovery mail address and it would only be allowed if the hashes match.

I love that Telegram tries to shit on Signal but doesn't really support end-to-end encryption apart from maybe direct chats... but even that encryption gets shit on by security research regularly

Unless I suddenly need to run from the law, these particular things don't really worry me too much. Yes, if Proton was hacked, they could see my recovery email, but I have a strong password and use security keys to sign in to my account. I am still learning how to become better at cyber security (my anxiety suddnely made me hyper aware of it). While I am very concerned about privacy, I would want law enforcement to be able to find a dangerous criminal.

I agree with ya on nearly everything. Except the (Im paraphrasing you here) "its safe cause it's open source". Open source is awesome for that kind of thing. But it means nothing if no one is actually looking at the code in an auditing sense. I am an open source zealot personally, but we need to stop using this point in our arguments unless we can form a security group that is actively doing audits of code. Maybe it could give these projects a "seal of approval" or "security audit passed on..." type of badge of honor.

Do people not read the TOS and Privacy Policy? I recently read Proton's, and this is not new information to me.

One thing that I feel like people never mention is the extensive list of terms and conditions for iOS & Android, considering that’s where proton and signal appear to be used the most. Although signal and proton themselves may never store any information, how are we suppose to feel secure in the fact that the operating system we’re running these apps off of aren’t spying on us equally as bad as people would fear one of these messaging apps would? I’m curious for your take on that

The same people complaining about companies legally being required to hand over data they have are here in a KZfaq channels comment section… a Google app.

I think there's a difference between privacy and anonymity....you can use this services for privacy and not for anonymity

Good job on this video! You eliminated all the diagrams or explanations for HOW these 2 companies encrypt your data, reducing or eliminating unnecessary confusion in order to make your larger points. You made the whole video accessible to a consumer level audience, The exact group who do not know how to evaluate the accusatory assaults made by telegram or by privacy advocates objecting to there being any form of legal compliance with the country you're operating in. Good choices, resulting in very easy to understand video about something very important and critical.

Hello, I studied the protocol behind Signal, and it's ignorant to say that Signal is insecure. It uses edge technology when it comes to cryptography. It will be BIG BIG news if it's broken by someone.

Never have illusions about the tools you use. It's a lesson I've learned (sometimes in hard ways) over the years.

Looks like some people here in the comments think privacy and anonymity are same banana. Unfortunately Josh even with the great clarification you gave there are people that are stubborn with their beliefs where no one can change them

Thank you for thorough clarification. Keep up the good work, you just earned a new subscriber for the amazing content!

I believe in the case of Signal, it was an OS level zero-day that allowed the attacker to add a hidden member to a chat, turning it into a "group" chat. Encryption wasn't broken or backdoored, the chat key was just shared with a hidden third party.

I love that you made another great informative video. But what concerns me about 2024 into 2025 is what are we going to about TPU being implemented? I truly hope you have a chance to see these comments and either reply or think about wanting to make a video on this subject. It will absolutely affect E2E. Thanks so much in advance ☺️ 😊

I use signal, and for its intended purpose. Only problem I have with "look it is open source" is... well yes I see that, but how can I know that what I have on my device is THAT code? Apple or Google doesn't just have a convenient "verify checksum against github repository" feature. The sole basis of my trust is "Apple said it was okay" :(

Naomi Wu did a very good breakdown of why Signal isn't a secure app, before she got vanned by the Chinese government for talking too much. In fact it was probably her discovering and making public those vulnerabilities that led directly to her vanning.

Ever since I saw the video from Computerphile about: Elliptic Curve Back Door, I had my doubts about a lot of the encryption we've been using and about how secure they really are.

The biggest problem with Signal is that you need a real phone number to register. A phone number is registered to a person. Use Session. This gets around this problem.

If you are in Europe and have doubt about the data collected just use your right under GDPR to get a copy of the data a company holds from you.

Well said, and thank you for your rational explanation

The primary message you should be taking away from this is if have something private to say, do it face to face, in an appropriate place.

I have a question. How can I know if the open source app on my Android phone from the Google store has the same code as the one published?

Thank you for this! I was just thinking along those lines, you confirmed them for me!

Why are we banning TikTok for giving users' personal information to the Chinese government, why are we not banning *every other app* that resides in a country, e.g, US or EU, that have the same requirement? We should not use ANY app, including Proton and Signal, that is beholden to the government to hand over users' information for any reason at any time?

The send and deliver info can be encrypted if both accounts work with the same protocols. It probably requires each account to run its own instance of decryptors and receive larger chunks than what's meant for them and process with its own decryption keys then discard what is still cyphered.

There are 2 fundamental points on Proton: (1) Even if you use a VPN or TOR whenever you access Proton's website to configure or read emails ... as soon as you run one of their apps, e.g. ProtonVPN or Proton Drive as local app on your machine ... Proton will automatically get your IP address (unless you additionally use TOR or onion service) Isn't it? (2) Most people think, that Proton or Signal have no possibility to get your private key, which is used for their end-to-end encryption, but it could be easily sent encrypted... and whether this actually is done or not... fully relies on how well their Open Source code is audited in this regard, isn't it?

Why and How should always be asked. It's just part of critical thinking. Thanks Josh for being a critical thinker!

Well explained. The biggest security vulnerability of all time is the user.

Extremely well presented, discussed and dissected, with zero drama, only reasonable facts well-explained. SUBBED

I don't know about Proton, but as far as I can tell, Signals protocol is sound. I spent some time developing my own XMPP Server and Signal afaik is based on XMPP with an extension that enables encryption. They made that extension themselves and published an extensive paper on it and it was analyzed by experts many times and it seems to hold really well. It's a really nice double ratchet encryption scheme with a chain of keys, so even cracking one key doesn't give you the entire conversation, just one little piece of it before the key got rotated. So unless AES-256 in CBC and #7 padding is actually cracked completely, it's practically impossible to crack any conversation using this mechanism

No surprise for me, for privacy I have my own ejabberd server and also a matrix server. Both work like a charm if you know how to proper configure them. Cheers!

I've opened this video thinking "another video to scare people and make views" but i was wrong. Really good video. You have a new follower

I suggest that the next episode be about the best artificial intelligence services (such as GPT chat and...) that respect user privacy (alternatives to Google Bard)

2 Things: 1. The people who had their "Private Signal Messages" compromised probably had it all on their phone and either the phone was compromised and swiped or the authorities gained physical access to the phone when they arrested the person in question, none of which are signals fault - good OPSEC here would be to not leave signal logged in on your phone. 2. FUD is interesting, I treat FUD as a means and reason to look deeper into claims - false or not, and learn more about the issues they have. FUD has such negative connotations, but really is a great means of criticism and a good reason to improve something - yours or not. Ignoring FUD just proves that a person is both Arrogant and Ignorant.

Searching for privacy while using third-party networks, devices, or operating systems is essentially wishful thinking. Consider three neighbors living side by side. The first and third neighbors want to have a conversation in their backyards. As they start talking from their respective gardens, the second neighbor, situated in the middle, can always hear their conversation. This analogy illustrates the basic principle: you can build a temporary communication channel (like a pipe) for the neighbors to talk privately, but this pipe must be entirely your own construction, not provided by services like NordVPN or OpenVPN. Once people grasp this concept, the issue becomes clearer. As long as you rely on third-party systems, true privacy is unattainable, which is the case for 99% of users. Genuine privacy is nearly impossible in these scenarios. If you truly desire privacy, consider having face-to-face conversations, perhaps during a walk in nature or while swimming.

Great video and you bring up a lot of good points. FWIW, Tucker Carlson said the US gov found out about his trip to Russia via Signal...

Encryption may be useless with the looming push for client side scanning, MS Recall is a perfect example. Logging keystrokes and taking screenshots being sold as AI, or a convenience utility. I understand it's target on all devices from desktops to mobiles. See Rob Braxman

Hey Josh, I can't afford a security key, however i have a usb flash drive. Is there's any way I can turn my usb flash drive into a security key? If you can then please make a video on that.

Signal does have Phone Numbers of users so if you sign up with your real number that maybe an issue.

Great video! I would love to see a video on how we can develop habits for using the internet and social media in a safe and responsible way. It would be really helpful to get some tips on protecting our privacy and avoiding common online risks. Thanks for all your awesome content!

With Signal is might be more complicated. The sensors on our phone collect so much data. It's really not that sci-fi to think that they could use those sensors information they got from Google etc and put that data through some kind of algorithm that just spits out where you were hitting your screen while writing and that's how they got the massages. They really don't need to get anything from Signal, they can collect it on time of input to Signal.

And this will always be the case with centralised systems. If there is somebody to call, they can pressure/bully them into giving up the information.

Pavel criticising Signal is pretty ironic when he's turning his own platform into a Facebook-like nightmare

You could do a one way encryption or hash on a recovery e-mail address and then only 'check' when supplied rather than have the recovery e-mail in plain text. Could be enumerated obviously so a bit more complex but can be fixed if someone wanted to.

Never create text of any compromising information. Share that info in person without your phones around for maximum privacy.

Enjoyed your take on this matter.

In the video, you brought up the point about being careful of what recovery email you specify. If the recovery email is from iCloud or Microsoft or Google, then I understand the point that the authorities will have to hand any email id to the authorities. What if it was another Proton email account itself?

Open source won't help for the masses in this case as you can't check if the app from the store is running that code or a slightly modified version. Unless you compile it yourself of course.

About encryption, there are sometimes backdoors built-in, so even if the software itself open-source the choice of some parameters that are supposed to be random on the site where the software is running can heavily jeopardize the encryption strength. So in here we have to trust that Signal and Proton have not allowed external agents to push them to leave some holes that we may not even know about (Crypto AG being the most iconic example, Tetra is another one).

Stories like these just let me know what I should avoid, and help me keep in the loop. It also lets me know the lengths authorities have to go if they need your recovery address and and a 3rd party to help them get your data. If anything that's ensuring, and just lets me know that recovery email is flawed to begin with, just like email is flawed and I should use E2EE messaging apps instead of email for sensitive data.

All courts in Australia operate as corporations under Australian Business Numbers. Start with questioning that. No one is obligated to a corporation.

Some company used to show a raw recovery key which was the raw encryption key. They moved to recovery email.

Being open source doesn’t mean anything without a guarantee that the code submitted by signal or protonmail to the Apple App Store or Google Play Store is the same exact code that they show the sources code for.

There are 2 majors problem, the error 18 aka between keyboard and chair, and the platform used to access websites or run applications. And in case of anything related to messaging, the same problems on the other counterparts of these exchanges. Put differently one might be the problem, no end-to-end encryption tools.

Very well said. These are all tools, but the way you wield them is what defines their effectiveness.

Signal required me to expose my phone number for it to function. Which seems to be a clear nick in it's security. Not for my personal usecase, but for a journalist or human rights advocate in a more shady part of the world this might be problematic. I remember back in the day you could compile your own Signal app, and physically meet someone to exchange keys. Is this still possible? I know it's still open source, so surely a build without it could be made. But can the backend function without the phone number "address"?

But we have no way to be sure the open source code is actually used in the production app instance.

very well explained.

Hi I keep getting this message in my Google authenticator "Syncing will continue when your device is online and you refresh your Authenticator codes" I just can't figure out what is the issue. It would be great if you make a video addressing this issue.

How many people review the open source code, and then compile it themselves? If not, how do you know the installed code matches the open source version?

Hi Rob: Do you have a secure phone one can use? I only know of ones like rob braxman has...are there others you could suggest please..much thanks.

I usually turn off videos when they say 'watch till the end' . Why are they all saying that? Did youtube change how they pay? If the information is so important put it at the beginning. Or make the video worth watching. That way it doesn't sound like clickbait.

A frustratingly number of times people miss the fact that someone ... nefarious, shall we say, may not *need* to have the encryption key if the endpoint is compromised.

It's absolutely silly that people have this notion that private email services will provide you with total anonymity. In my opinion people fear monger when these companies get subpoenaed for information as if Google would not hand over every bit of data they have when asked. If your goal is complete and total anonymity then a subscription based email service clearly isn't going to be a part of your threat model. Or they fundamentally misunderstand what exactly a service like this is supposed to do for you. It's like some of these content creators forget who exactly these products are marketed toward and that's average everyday users who are simply looking for a slightly better alternative to the all seeing eye that is Google and it's web of tech. When you look at these services through that lens Protonmail is fantastic. I appreciate your level headed take about this. Too many fear mongers

Seems like pidgeons will be the secure protocol of the future.

It amazes me how many ‘experts’ jump on the lack of metadata encryption when using Proton Mail….email simply doesn’t exist without it. If privacy is that important to you, why are you using a method of communication that is - by design - not private?

No matter what we do, there is no such thing as 100% secure stuff, the first attack and last attack is always social engineering, either from a classic scam or intended or un-intended loophole in TOS. XD

Thank you for sharing and breaking this down for the average users so many misconceptions and myths floating around out there.

I 100% agree nothing is 100% safe Using Burner laptop on a Random WiFi with a VPN on tor can still be vulnerable. It’s all about layers of protection and ensure you have good OpSec.

law is law and they must comply full privacy is impossible, i recommend you if you want to send private messages, to encrypt it with the public pgp key of the receiver

I will never stop using Proton. 💜

Great video. People now days react with the first thing they hear without looking at all aspects. Is mind boggling how the truth can be misconstructed these days.

I'm alright with Proton because as you said the data is encrypted but Signal being funded by those guys and then having that chairman with dubious history....makes it hard to trust Signal 100%. And yes as you've said the code is out there to check but still it's very odd for those 2 things to be associated with Signal.

when making an email in proton, dont give your real name address and use vpn before creating an email. if something goes wrong, they wouldnt know who you are you are. even choose vpn company wisely

I understand very lil lol but was questioning proton.

Best security related advice on KZfaq, period. Nothing is black and white, you should build threat models based on what your concerns are and be aware of what you are sharing and who potentially can see it. All this commotion about "proton bad" "telegram bad" "mullvad bad" only has meaning if you understand the weaknesses of each tool and how they apply to your situation. Thank you and have a sub

I was gonna jump out of the video when it started as I heard the music playing over your dialogue and I thought, oh great, another channel host that thinks playing music (any music) while they are talking to us is a great idea. Fortunately for me, I stuck around to see & hear that the music was only during the intro. So, thank you for not putting music on top of your dialogue track. I really do wish other YT hosts would understand how useless and annoying the habit actually is. As to the content, good stuff. There's a reason why essays are not headlines. Getting into the weeds of a story takes time to read and alas not every one is willing to get past the TL/DR summaries.

I seem to remember Tucker Carlson said his Signal account was compromised and his messages which he thought was secure wasn't.

Seeing how much data is handed over due to a court order is essential in determining their trustworthiness. If all they can hand over is your IP address, recovery email, and payment details; they have already done everything they legally can to protect my privacy. Call me crazy, but I don't expect anyone to go to prison to reject court orders. I don't have nearly enough money to afford that level of protection.