Re: Is Telegram or Signal acceptable for harm reduction?

[Jean Louis]

* Jorge P. de Morais Neto via libreplanet-discuss 
<libreplanet-discuss@libreplanet.org> [2021-08-06 18:50]:
> As I had it installed and active on my smartphone (for the work
> room), I ended up joining three other chat rooms about civil service
> public exams.  These three are big, so I have no hope of convincing
> everyone to switch to an ethical network.  I then intend to join
> these rooms from my wife’s account, on her smartphone, which I would
> consult weekly for new chat messages¹.  The other room (the work
> one) has only seven members (including me), so I hope to convince
> them to switch to a better platform.  If they don’t want to switch,
> then I’ll ask them to forward me the rare important messages via an
> ethical technology like SMS or e-mail.

SMS is network system, please note that many network proiders are free
to retain SMS messages, read it, spy on it, provide it to
governments. I do not recommend using SMS unless it is encrypted.

Use Silence to encrypt SMS:
https://f-droid.org/en/packages/org.smssecure.smssecure

E-mail is same, it is decentralized system but open and prone to
government scrutiny, use GnuPG to encrypt emails:
https://www.gnupg.org 

> Now, what if my six work colleagues accept switching to another chat
> network but refuse both XMPP and Matrix because "no one uses that",
> accepting only Telegram or Signal?  I do currently have Telegram and
> Signal accounts, but I worry about their ethics.

That is vendor lock-in. I find it alright to advertise and find new
people, not alright to bring present people to such networks. 

If somebody invites you to group session, I would not say it is bad to
participate in group sessions.

What is bad is that they will take all your contacts, I suggest you
use it without contacts on the phone.

> Telegram /does/ have free clients on GNU Guix and PureOS repositories,
> which is great, but it is a centralized network, the server code is
> hidden, and it doesn’t even have end-to-end encryption!  So is it a real
> improvement over the fully proprietary---but allegedly end-to-end
> encrypted---status quo?

I think it is not end to end encrypted. And did you verify encryption? How?

> What about Signal?  Compared to Telegram, it has the big advantage of
> end-to-end encryption, but the disadvantage of obstructing the
> distribution of modified versions of its client; it is not even
> available on F-Droid, Guix or Debian (let alone PureOS).

Look I could say it is end to end encrypted, but that is not enough,
it is marketing term. Companies use that term to attract customers,
some of them did not have such encryption, and some have backdoors.

Unless you have found some independent report of strength of that
encryption that it is end to end encrypted means nothing.

But if you are participating in public forum on such network what is
the point if it is end to end encrypted, it is public forum. It does
not matter in that case.

> So, should I insist on a really ethical network---XMPP or maybe
> Matrix---despite the big likelihood that they will refuse, or should I
> swallow Telegram or Signal?

I would say YES. I always do. 

IMHO, such applications like Telegram should not be included in free
software distributions, but their maintainers disagree. Only Hyperbola
GNU/Linux-libre is highle freedom motivated. 

Other FSF endorsed distributions are opportunists, popularity is more
important than ethics.

> 1. I would not be discoverable in the network, so people who want to
>    reach me (outside those three remaining rooms) would send an email or
>    SMS instead.

Exactly. Think about it, those applications are asking for all of your
contacts and thus making profile about you. They know who is connected
to who. Telegram is now US company, not Russian, and we know that US
companeis are bound to US laws, now we know they have PRISM
surveillance and Telegram is most probably part of it as well. 

> 2. I would be able to delete my account, thus reducing the unethical
>    network’s market value.

Do you think that your profile with company is really deleted? There
are no evidences.

> 3. The surveillance AI would be confused with two people using the same
>    account.

Quite contrary, they need no people's names to pinpoint who is who.


Jean

Take action in Free Software Foundation campaigns:
https://www.fsf.org/campaigns

In support of Richard M. Stallman
https://stallmansupport.org/