An official FBI document dated January 2021, obtained by the American association “Property of People” through the Freedom of Information Act.
This document summarizes the possibilities for legal access to data from nine instant messaging services: iMessage, Line, Signal, Telegram, Threema, Viber, WeChat, WhatsApp and Wickr. For each software, different judicial methods are explored, such as subpoena, search warrant, active collection of communications metadata (“Pen Register”) or connection data retention law (“18 USC§2703”). Here, in essence, is the information the FBI says it can retrieve:
Apple iMessage: basic subscriber data; in the case of an iPhone user, investigators may be able to get their hands on message content if the user uses iCloud to synchronize iMessage messages or to back up data on their phone.
Line: account data (image, username, e-mail address, phone number, Line ID, creation date, usage data, etc.); if the user has not activated end-to-end encryption, investigators can retrieve the texts of exchanges over a seven-day period, but not other data (audio, video, images, location).
Signal: date and time of account creation and date of last connection.
Telegram: IP address and phone number for investigations into confirmed terrorists, otherwise nothing.
Threema: cryptographic fingerprint of phone number and e-mail address, push service tokens if used, public key, account creation date, last connection date.
Viber: account data and IP address used to create the account; investigators can also access message history (date, time, source, destination).
WeChat: basic data such as name, phone number, e-mail and IP address, but only for non-Chinese users.
WhatsApp: the targeted person’s basic data, address book and contacts who have the targeted person in their address book; it is possible to collect message metadata in real time (“Pen Register”); message content can be retrieved via iCloud backups.
Wickr: Date and time of account creation, types of terminal on which the application is installed, date of last connection, number of messages exchanged, external identifiers associated with the account (e-mail addresses, telephone numbers), avatar image, data linked to adding or deleting.
TL;DR Signal is the messaging system that provides the least information to investigators.
It seems like Signal, Telegram, and Threema are the best for now. Signal provides the least information, but for the majority of people, the stuff from Telegram are things the government already know, and I’m not sure how useful the Threema information is.
I read it as Threema being about as secure as Signal if you don’t give them your phone number & email and use the Libre version without Google push notifications.
I believe Matrix has the same encryption as Signal. Though there are some things that leak metadata, like reactions for some reason. Would like an investigation into it as well, as I pretty frequently use it. Obviously this is assuming it’s an encrypted chat. Though would also like to see the comparison of an invite only encrypted room, vs a public joinable encrypted room.
This is such a bad take lacking any solidarity with people that have no choice in doing illegal stuff or who are trying their best to make the world a better place. What is legal or illegal is solely defined by governments. In the context of the US, it is now illegal in some parts to have an abortion, to be transgender, to be an immigrant, to be black, etc. So “don’t do illegal stuff” is a reminder of your privileged position to be able to lean back and have nothing to fear, while other people just by existing or by trying to survive automatically are considered illegal. And think of all the whistleblowers like Edward Snowden. We as peole are much better off because of them, yet they have to fear the state’s repressions.
Your response makes me really angry just by how inconsiderate and insulting it is :(
Saying “it’s 2023” has no bearing on what is possible, seeing as how our society just lost 50 years of federally protected health and privacy rights. It’s 1972 to half the population now, not 2023.
Your argument “don’t do anything illegal and you won’t have anything to hide” is worthless to the half the population that had their rights to make their own health decisions stripped away from them.
Your statements are the Mason guy of the 40s anti-fascist propaganda.
You’re now being intentionally obtuse, again look at all the anti-trans legislation, look at the repeal of Roe, look at all that and so much that is in the works, the fact that you’re in the privileged position to ignore it AND proceed to also ignore how damn many people don’t, leads me to believe you’d be the guy hiding the zombie bite in the team. Don’t be the guy hiding the zombie bite in the team, you can do better.
Telegram states at their site that: “To this day, we have disclosed 0 bytes of user data to third parties, including governments.”
But according to Spiegel this is false. I don’t know German, I read the article using google translate, correct me if I’m wrong.
Here is a quote from the article: “Contrary to what has been publicly stated so far, the operators of the messenger app Telegram have released user data to the Federal Criminal Police Office (BKA) in several cases.”
If this is true, the fact that they are lying is very worrying…
I distinctly remember Telegram having given a phone number and account creation date for someone to a government, they didn’t have anything else to provide allegedly.
I don’t think this is what they mean. If you read the whole paragraph they also talk about “[…]the data that is not covered by end-to-end encryption”…
It says that they have nothing to give on Secret chats, and then: “To protect the data that is not covered by end-to-end encryption[…]” … “Thanks to this structure, we can ensure[…]” … “To this day, we have disclosed 0 bytes of user data to third parties, including governments.”
I mean, I would consider phone numbers, IPs, metadata, non-secret chats (I don’t know if that’s a thing, never used Telegram), to be “user data”.
I agree with you here, I’m simply playing devils advocate as to how Telegram can get away with this claim. I trust secret chats on Telegram and use them with my more… spicy acquaintances.
I’ve been using session as my family chat. The only thing I dislike is its connection to Oxen. But it makes an interesting case for resistance to Sybil attacks. But that’s not really in my threat model for family messages lol. I’m mostly happy we moved the fuck away from messenger. I’ll probably move them to matrix, but I gotta wait a bit before switching them again lol
In terms of usability, it’s not hard to set up and has been very stable for the 1.5 years we’ve been using it. Even getting my less tech savvy family on it was pretty easy.
iMessage is now fully secure like Signal and Telegram, if you’ve enabled advanced data protection in your Apple ID. This also protects your photos and other personal information from snooping and data breaches. Apple users should turn on this great feature in Settings -> iCloud.
Even if you turn that on, they’re still scanning your content for, supposedly, child porn.
I very seriously doubt that their scanning is actually limited to child porn. And even if it is, if you take nude selfies and some AI thinks you look like a child, then some Apple employee will have to look at them to confirm…
They are no longer referencing a CSAM database to scan your images against, in the Cloud, or on your phone. They do however scan for nudity, if you have enabled the feature, and it only gives a warning that there might be nudity.
Right? The data they can collect there is pretty much entirely useless unless they can also gather the location of last connection. But even then, not terribly helpful.
How are IP address and phone number less info than dates and times? Unless you’re talking file size and Signal is using full timestamps, but that doesn’t seem very important here. I highly doubt the limitation that it’s only for confirmed terrorist investigations is used sparingly.
Sure that is something debatable. It’s just that if we take these information on face value, providing information just for “confirmed terrorists” could be considered lesser of the them. But if you take that out of the equation Signal provides less
I thought that at first too based on the icons, but if you read the text it reveals Telegram has the ability to provide IP address (if they can be convinced to).
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !technology@beehaw.org
A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.
Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.
It seems like Signal, Telegram, and Threema are the best for now. Signal provides the least information, but for the majority of people, the stuff from Telegram are things the government already know, and I’m not sure how useful the Threema information is.
Just BC tele doesn’t share data with FBI… Does mean they don’t share with fsb.
I read it as Threema being about as secure as Signal if you don’t give them your phone number & email and use the Libre version without Google push notifications.
I’m curious what/if any info can be retrieved from Matrix servers?
AFAIK homeservers retain complete metadata for all your conversations.
That depends on whether the communication channel is encrypted.
I believe Matrix has the same encryption as Signal. Though there are some things that leak metadata, like reactions for some reason. Would like an investigation into it as well, as I pretty frequently use it. Obviously this is assuming it’s an encrypted chat. Though would also like to see the comparison of an invite only encrypted room, vs a public joinable encrypted room.
Nope. They are similar, but not the same: Comparison
Here’s my foolproof method of not having any issue with the FBI: Don’t do illegal stuff.
:mindblown: Holy crap! You just completely solved the problem in one take didn’t you?
Tell that to Fred Hampton.
Dude, that was literally 54 years ago.
And everyone knows that the FBI was never involved in the extrajudicial killing of an innocent dissident besides that one time.
Can you point to any in the last 20 years?
This is such a bad take lacking any solidarity with people that have no choice in doing illegal stuff or who are trying their best to make the world a better place. What is legal or illegal is solely defined by governments. In the context of the US, it is now illegal in some parts to have an abortion, to be transgender, to be an immigrant, to be black, etc. So “don’t do illegal stuff” is a reminder of your privileged position to be able to lean back and have nothing to fear, while other people just by existing or by trying to survive automatically are considered illegal. And think of all the whistleblowers like Edward Snowden. We as peole are much better off because of them, yet they have to fear the state’s repressions.
Your response makes me really angry just by how inconsiderate and insulting it is :(
Agreed entirely–privacy is and will always remain an essential human right.
Are you Big Brother?
Yes. Aren’t you?
You’d be surprised at how many things you do today that has been illegal or will be illegal in the future. The last part is the real scary one.
Inb4 lemmy categorized as illegal in 2030
No matter what side on the political spectrum you’re on, you should be afraid.
“If you’ve got nothing to hide, you’ve got nothing to fear!” 😉
Tell that to trans people in Florida, or people seeking abortion healthcare on Texas
It’s not illegal to be trans anywhere in the us.
The FBI deals with federal matters, not state matters.
While Don’t break the law, asshole is solid advice for staying off the FBI’s radar, it’s not really a guarantee.
And sometimes, justice requires breaking the law. Remember that the Holocaust was legal and Stonewall was not.
Again, I think I need to remind people that it’s 2023.
You’re right, it’s 2023 and Roe v. Wade was recently repealed, what do you think about that?
I think it sucks and that the entire Supreme Court ought to be disbarred.
Saying “it’s 2023” has no bearing on what is possible, seeing as how our society just lost 50 years of federally protected health and privacy rights. It’s 1972 to half the population now, not 2023.
Your argument “don’t do anything illegal and you won’t have anything to hide” is worthless to the half the population that had their rights to make their own health decisions stripped away from them.
Your statements are the Mason guy of the 40s anti-fascist propaganda.
https://www.youtube.com/watch?v=rJriMuVEPMY&pp=ygUQRG9udCBiZSBhIHN1Y2tlcg%3D%3D
You guys are talking specifically about the FBI, which has no jurisdiction over abortion law enforcement.
You’re now being intentionally obtuse, again look at all the anti-trans legislation, look at the repeal of Roe, look at all that and so much that is in the works, the fact that you’re in the privileged position to ignore it AND proceed to also ignore how damn many people don’t, leads me to believe you’d be the guy hiding the zombie bite in the team. Don’t be the guy hiding the zombie bite in the team, you can do better.
There is no place in America where it is illegal to be trans.
And you’re talking about just state issues. The FBI only deals with federal issues.
There are no guarantees in life. Who’s to say that the FBI didn’t write this article specifically to direct people to use Signal?
And FYI, the info about Signal was confirmed as they received a subpoena a couple years back, and their response was part of the public court records.
Yeah, Signals response pointing to how their service works and than all the data consisting of only these two things war hilarious.
damn this is pretty interesting. thanks for sharing.
Well this made me download signal, thanks fbi
This is very useful information. People should be free to discuss ideas without the FBI glaring over their shoulder.
Takeaways:
All of this was already well-known, of course, but it’s always nice to get confirmation.
well this isn’t as eye opening as I thought it would be. But thank you for the summary, really!
Telegram states at their site that: “To this day, we have disclosed 0 bytes of user data to third parties, including governments.”
But according to Spiegel this is false. I don’t know German, I read the article using google translate, correct me if I’m wrong.
Here is a quote from the article: “Contrary to what has been publicly stated so far, the operators of the messenger app Telegram have released user data to the Federal Criminal Police Office (BKA) in several cases.”
If this is true, the fact that they are lying is very worrying…
I distinctly remember Telegram having given a phone number and account creation date for someone to a government, they didn’t have anything else to provide allegedly.
0 bytes of user data meaning message content, I suppose.
I don’t think this is what they mean. If you read the whole paragraph they also talk about “[…]the data that is not covered by end-to-end encryption”…
It says that they have nothing to give on Secret chats, and then: “To protect the data that is not covered by end-to-end encryption[…]” … “Thanks to this structure, we can ensure[…]” … “To this day, we have disclosed 0 bytes of user data to third parties, including governments.”
I mean, I would consider phone numbers, IPs, metadata, non-secret chats (I don’t know if that’s a thing, never used Telegram), to be “user data”.
I agree with you here, I’m simply playing devils advocate as to how Telegram can get away with this claim. I trust secret chats on Telegram and use them with my more… spicy acquaintances.
Ahhhh, that’s why furries use Telegram!
Anyone use Session messenger? It doesn’t need a phone number unlike Signal.
I’ve been using session as my family chat. The only thing I dislike is its connection to Oxen. But it makes an interesting case for resistance to Sybil attacks. But that’s not really in my threat model for family messages lol. I’m mostly happy we moved the fuck away from messenger. I’ll probably move them to matrix, but I gotta wait a bit before switching them again lol
In terms of usability, it’s not hard to set up and has been very stable for the 1.5 years we’ve been using it. Even getting my less tech savvy family on it was pretty easy.
Good on you
Yes love Session !
iMessage is now fully secure like Signal and Telegram, if you’ve enabled advanced data protection in your Apple ID. This also protects your photos and other personal information from snooping and data breaches. Apple users should turn on this great feature in Settings -> iCloud.
If you and your correspondant has — it takes two to secure a messaging session
Even if you turn that on, they’re still scanning your content for, supposedly, child porn.
I very seriously doubt that their scanning is actually limited to child porn. And even if it is, if you take nude selfies and some AI thinks you look like a child, then some Apple employee will have to look at them to confirm…
They cancelled CSAM scanning as of last year. It never actually rolled out, due to backlash.
https://www.wired.com/story/apple-photo-scanning-csam-communication-safety-messages/
I thought they just recently started doing it on your personal device?
No, they recieved such massive backlash for it, that they changed what they were doing.
https://www.wired.com/story/apple-communication-safety-nude-detection/
They are no longer referencing a CSAM database to scan your images against, in the Cloud, or on your phone. They do however scan for nudity, if you have enabled the feature, and it only gives a warning that there might be nudity.
Thank you very much for that, I had heard about that setting before but forgot to do it. Enabled now.
It’s like a promotional flier for Signal.
Right? The data they can collect there is pretty much entirely useless unless they can also gather the location of last connection. But even then, not terribly helpful.
Does this document account for Apple’s recent Advanced Data Protection feature?
Not likely
It does not. Apple users should opt into this great feature in Settings -> iCloud
Telegram seem to provide the least info, not signal.
How are IP address and phone number less info than dates and times? Unless you’re talking file size and Signal is using full timestamps, but that doesn’t seem very important here. I highly doubt the limitation that it’s only for confirmed terrorist investigations is used sparingly.
Sure that is something debatable. It’s just that if we take these information on face value, providing information just for “confirmed terrorists” could be considered lesser of the them. But if you take that out of the equation Signal provides less
But Telegram also have access to more info about its users, considering that messages are not end to end encrypted by default, than Signal does of its. This means that Telegram can share any data it wants, its users are just hoping that it won’t. In the case of Signal, they don’t have access to any meaningful data in the first place. Also leaving these here:
https://www.wired.com/story/the-kremlin-has-entered-the-chat/
https://tech.hindustantimes.com/tech/news/russian-court-directs-telegram-to-share-encryption-keys-to-access-users-messaging-data-story-1ZhjHvyTQJ89RhhNnp4bGL.html
That’s true. More info means more risk for more data sharing.
I thought that at first too based on the icons, but if you read the text it reveals Telegram has the ability to provide IP address (if they can be convinced to).
As long as your not a terrorist. 😈
Define terrorist.
That’s a real issue. But still that makes a condition for data sharing.