Unclassified FBI Document: Ability to legally access Secure Messaging App Content and Metadata (January 2021)

bbbhltz@beehaw.org to Technology@beehaw.org – 459 points –

An official FBI document dated January 2021, obtained by the American association "Property of People" through the Freedom of Information Act.

This document summarizes the possibilities for legal access to data from nine instant messaging services: iMessage, Line, Signal, Telegram, Threema, Viber, WeChat, WhatsApp and Wickr. For each software, different judicial methods are explored, such as subpoena, search warrant, active collection of communications metadata ("Pen Register") or connection data retention law ("18 USC§2703"). Here, in essence, is the information the FBI says it can retrieve:

  • Apple iMessage: basic subscriber data; in the case of an iPhone user, investigators may be able to get their hands on message content if the user uses iCloud to synchronize iMessage messages or to back up data on their phone.

  • Line: account data (image, username, e-mail address, phone number, Line ID, creation date, usage data, etc.); if the user has not activated end-to-end encryption, investigators can retrieve the texts of exchanges over a seven-day period, but not other data (audio, video, images, location).

  • Signal: date and time of account creation and date of last connection.

  • Telegram: IP address and phone number for investigations into confirmed terrorists, otherwise nothing.

  • Threema: cryptographic fingerprint of phone number and e-mail address, push service tokens if used, public key, account creation date, last connection date.

  • Viber: account data and IP address used to create the account; investigators can also access message history (date, time, source, destination).

  • WeChat: basic data such as name, phone number, e-mail and IP address, but only for non-Chinese users.

  • WhatsApp: the targeted person's basic data, address book and contacts who have the targeted person in their address book; it is possible to collect message metadata in real time ("Pen Register"); message content can be retrieved via iCloud backups.

  • Wickr: Date and time of account creation, types of terminal on which the application is installed, date of last connection, number of messages exchanged, external identifiers associated with the account (e-mail addresses, telephone numbers), avatar image, data linked to adding or deleting.

TL;DR Signal is the messaging system that provides the least information to investigators.

176

Takeaways:

  • End-to-end encryption works.
  • The only trustworthy computer is your computer. Don't use cloud storage.
  • The only trustworthy software is open-source software. Proprietary software serves the interests of the proprietor, not the user.

All of this was already well-known, of course, but it's always nice to get confirmation.

Also remember this is useless without complementary security measures:

  1. Encrypt the storage on any device where these are installed (including your desktop/laptop drives if you install e.g. the desktop version of Signal).
  2. Lock your devices with pin or password, and store that pin/password only in your head (there's no such thing as telepathy at this point in time so they can't physically force it out of you, unlike biometric data like your fingerprints).

If you are relying on "Legally they're not allowed to," instead of, "They simply can't, despite all they might try," then you're not doing it right.

signal ftw ✊

The really nice part about this is that this is exactly what Signal says they can share, and have been forced to share in the past. It's a tested history of complete policy transparency.

Yeah but I'm still mad about their decision to drop SMS/MMS.

Wonderful app, great handling of signal to signal messaging, but it really took away my ability to sell end to encryption to friends and family.

it really took away my ability to sell end to encryption to friends and family

As I understand it, SMS and MMS aren't encrypted (and that's why support was dropped. Unfortunately, you were never selling your friends e2e as long as they kept using SMS, even if they used it through Signal. In fact, it's arguable that the false perception of security in "now I'm texting through Signal, and that means it's secure!" was even more damaging than never having switched in the first place. (Unless they went all the way and stopped using SMS, of course.)

So, nothing is lost from that perspective. Now you can more accurately recommend ppl to use Signal messages instead of SMS and know that you are more accurately selling e2e with every convert because they can't keep using insecure messaging through Signal.

That's fair, though personally I'm kindof glad they did. "Signal is a secure messaging app" is a lot easier to explain to non-tech-savvy people than "Signal is a secure messaging app, as long as you are messaging someone who is using Signal too. It can also send regular texts but they can't be encrypted." Leaving that nuance out would have left people texting with a false assumption of security, but I lost several people explaining it because it "sounds complicated".

Yeah, but now a lot of people I convinced to use it, no longer use it because they just want to use one app.

sms through signal was not encrypted, how would that even work? how would the signal app even know your contacts were using an app that supports encryption?

Signal accounts are based on your phone number, so if you're messaging a number that has an account with Signal, the app could see that and would send the message through Signal's protocols to that Signal account instead of with the SMS protocol which is not encrypted.

You're correct I should have better worded my point: Signal used to be a single app that someone could install that could handle sending out their regular unencrypted SMS messages and Signal encrypted messages.

Signal also did exactly what you've described - auto-enabled encryption when it detected another signal user by phone number.

The net result was more people using encrypted messaging.

So basically use signal because they can get the least amount of data.

Matrix isn't on the list at all.

I don’t think the list could have everything

Discord as well though

Discord is not a secure chat app so it's not listed. Basically, they can get everything from Discord.

matrix doesnt encrypt any metadata at all pretty much, only message content and files uploaded to encrypted rooms are encrypted

Or Telegram, unless you're a confirmed terrorist.

Terrorist can be a very broad term. In France the government is using anti terrorism laws against ecologist organisation.

They also incarcerated people from another organisation 3 years ago using the same antiterrorism law, they haven't found anything against them so now they are accusing them of using signal for their communication and encryption on their phone and laptop.

Thanks for the great summary! Also a good reminder to people that storing your backups on a "as secure as we decide it is" service like iCloud isn't ideal if you want to protect your data from government snooping.

Edited to remove pre-coffee salt and lack of nuance.

This perspective lacks nuance.

a service like iCloud is a bad idea if you care about your privacy

Like all security and privacy measures, you have to consider your threat profile. From whom are you trying to maintain privacy from? If it’s other people or companies, then using a service like this is perfectly okay. If you’re worried about state actors or governmental agencies coming after you, then you have a very different set of requirements and considerations than most people, and you should plan accordingly.

But saying that services like this aren’t for people who care about their privacy is a little disingenuous. As with all things, it’s a matter of degrees.

Fair point... and I'll edit the comment to reflect that. Thanks for catching the lack of nuance... guess fasting for 24 hours has me both tired and salty.

Learn from Reddit, don't give corporations the power to do so and they can't inevitably abuse that power.

I feel a lot of people get ‘dragnet surveillance against everyone on the internet’ mixed up with ‘being actively under pressure from a state-level actor’. If the likes of MI5 or the FBI were genuinely after someone they’d need a lot more than an encrypted messaging service and a VPN to avoid them.

I like my current setup but I’m under no illusion it would do much at all against the ‘electric cattle prod and water-boarding’ school of decryption exploits.

Excellent reply to the classic “apple = bad” comment

It's not so much Apple is bad as "commercial providers, including Apple, aren't great at privacy."

I (and many others) would argue Apple is great at privacy, unless you are trying to hide from subpoenas

Generally agree, but this document is also from January 2021. Apple brought E2EE to almost all aspects of iCloud in December 2022 including iCloud Backups. It's opt-in, so theoretically, if you were having a conversation with a contact who didn't opt-in to E2EE but backed up their iMessages to iCloud, the government could still access your messages via that contact even if you opted-in to E2EE, but still.

Also depends on if the backup is properly encrypted. If it is, security of whatever storage you use is pretty irrelevant.

iMessage is now fully secure like Signal and Telegram, if you’ve enabled advanced data protection in your Apple ID. This also protects your photos and other personal information from snooping and data breaches. Apple users should turn on this great feature in Settings -> iCloud.

Even if you turn that on, they're still scanning your content for, supposedly, child porn.

I very seriously doubt the their scanning is actually limited to child porn. And even if it is, if you take nude selfies and some AI thinks you look like a child, then some Apple employee will have to look at them to confirm…

They cancelled CSAM scanning as of last year. It never actually rolled out, due to backlash.

https://www.wired.com/story/apple-photo-scanning-csam-communication-safety-messages/

I thought they just recently started doing it on your personal device?

No, they recieved such massive backlash for it, that they changed what they were doing.

https://www.wired.com/story/apple-communication-safety-nude-detection/

They are no longer referencing a CSAM database to scan your images against, in the Cloud, or on your phone. They do however scan for nudity, if you have enabled the feature, and it only gives a warning that there might be nudity.

Thank you very much for that, I had heard about that setting before but forgot to do it. Enabled now.

If you and your correspondant has — it takes two to secure a messaging session

Thanks for posting this. I thought I had it on, but guess it never was. Glad I checked.

As expected, Signal is still the best.

Session is better in my opinion.....

I'm curious what/if any info can be retrieved from Matrix servers?

I believe Matrix has the same encryption as Signal. Though there are some things that leak metadata, like reactions for some reason. Would like an investigation into it as well, as I pretty frequently use it. Obviously this is assuming it's an encrypted chat. Though would also like to see the comparison of an invite only encrypted room, vs a public joinable encrypted room.

That depends on whether the communication channel is encrypted.

i love how telegram isn't even encrypted or anything but they just ghost the authorities

To clarify because this is always a point of confusion whenever the topic comes up. Telegram is, of course, transport encrypted. Someone listening on the wire cannot read your data. It is not end-to-end encrypted, meaning Telegram can always read your messages and can, in principle, give anyone access.

That's not entirely true. Telegram's one on one secret chat is end to end encrypted. As well as one on one voice and video calls. Group chats are not end to end encrypted.

Additionally Telegram does have an auto delete features built in for all of its chat types. So while I can't entirely rule out that Telegram could have a backup of a chat somewhere, you have a bit more piece of mind if you turn on the auto delete feature.

Thanks for the clarification I should have mentioned this. Especially for calls it is actually relevant but I feel like very few people actually use secret chats.

It's worrying how Telegram says "all your chats are protected with strong encryption" while this is just standard stuff nowadays (wasn't when Telegram came out, to be fair). While it's technically true, it's almost sure to be misinterpreted and have it sound like it's equal to actual e2ee software

This is why I prefer cloud services outside US jurisdiction, and refuse to use anything based in the USA - like iCloud. National Security Letters are a thing, and even massive companies like Apple can't fight them.

Telegram states at their site that: "To this day, we have disclosed 0 bytes of user data to third parties, including governments."

But according to Spiegel this is false. I don't know German, I read the article using google translate, correct me if I'm wrong.

Here is a quote from the article: "Contrary to what has been publicly stated so far, the operators of the messenger app Telegram have released user data to the Federal Criminal Police Office (BKA) in several cases."

If this is true, the fact that they are lying is very worrying...

I distinctly remember Telegram having given a phone number and account creation date for someone to a government, they didn't have anything else to provide allegedly.

0 bytes of user data meaning message content, I suppose.

I don't think this is what they mean. If you read the whole paragraph they also talk about "[...]the data that is not covered by end-to-end encryption"...

It says that they have nothing to give on Secret chats, and then: "To protect the data that is not covered by end-to-end encryption[...]" ... "Thanks to this structure, we can ensure[...]" ... "To this day, we have disclosed 0 bytes of user data to third parties, including governments."

I mean, I would consider phone numbers, IPs, metadata, non-secret chats (I don't know if that's a thing, never used Telegram), to be "user data".

I agree with you here, I'm simply playing devils advocate as to how Telegram can get away with this claim. I trust secret chats on Telegram and use them with my more... spicy acquaintances.

Ahhhh, that's why furries use Telegram!

I mean when I say "spicy" I'm referring to the "throwing molotovs at cop cars" kind of spicy, and keeping that info dissociated from my public identity helps keep me from getting implicated in lawsuits and such. But also, yeah, some people wanna keep the kinky stuff private haha

Here's my foolproof method of not having any issue with the FBI: Don't do illegal stuff.

You'd be surprised at how many things you do today that has been illegal or will be illegal in the future. The last part is the real scary one.

This is such a bad take lacking any solidarity with people that have no choice in doing illegal stuff or who are trying their best to make the world a better place. What is legal or illegal is solely defined by governments. In the context of the US, it is now illegal in some parts to have an abortion, to be transgender, to be an immigrant, to be black, etc. So "don't do illegal stuff" is a reminder of your privileged position to be able to lean back and have nothing to fear, while other people just by existing or by trying to survive automatically are considered illegal. And think of all the whistleblowers like Edward Snowden. We as peole are much better off because of them, yet they have to fear the state's repressions.

Your response makes me really angry just by how inconsiderate and insulting it is :(

Agreed entirely--privacy is and will always remain an essential human right.

Edward Snowden immediately fled to a fascist kleptocracy. Dude doesn’t care about anything. He just wanted his fame and glory and to save his own ass.

Where in the US is it “illegal” to be trans or black? C’mon.

And even then, it’s not a federal issue. The FBI doesn’t give a shit whether or not someone travels to another state to get an abortion.

While Don't break the law, asshole is solid advice for staying off the FBI's radar, it's not really a guarantee.

And sometimes, justice requires breaking the law. Remember that the Holocaust was legal and Stonewall was not.

Again, I think I need to remind people that it’s 2023.

You're now being intentionally obtuse, again look at all the anti-trans legislation, look at the repeal of Roe, look at all that and so much that is in the works, the fact that you're in the privileged position to ignore it AND proceed to also ignore how damn many people don't, leads me to believe you'd be the guy hiding the zombie bite in the team. Don't be the guy hiding the zombie bite in the team, you can do better.

There is no place in America where it is illegal to be trans.

And you’re talking about just state issues. The FBI only deals with federal issues.

You're right, it's 2023 and Roe v. Wade was recently repealed, what do you think about that?

I think it sucks and that the entire Supreme Court ought to be disbarred.

Saying "it's 2023" has no bearing on what is possible, seeing as how our society just lost 50 years of federally protected health and privacy rights. It's 1972 to half the population now, not 2023.

Your argument "don't do anything illegal and you won't have anything to hide" is worthless to the half the population that had their rights to make their own health decisions stripped away from them.

Your statements are the Mason guy of the 40s anti-fascist propaganda.

https://www.youtube.com/watch?v=rJriMuVEPMY&pp=ygUQRG9udCBiZSBhIHN1Y2tlcg%3D%3D

You guys are talking specifically about the FBI, which has no jurisdiction over abortion law enforcement.

"If you've got nothing to hide, you've got nothing to fear!" 😉

Tell that to Fred Hampton.

Dude, that was literally 54 years ago.

And everyone knows that the FBI was never involved in the extrajudicial killing of an innocent dissident besides that one time.

Can you point to any in the last 20 years?

Can you name all of the actors that played Putties in the original English run of Power Rangers from the 90s?

See, I can set arbitrary, movable goal posts, too.

It doesn't work that way. FBI documents remain classified for 50 years before being accessible to FOIA. That means that we don't have the means to confirm culpability outside that 50-year window.

I can throw names at you. But here's what I know will happen in response. You will either;

A) Claim the person was not innocent. Despite conflicting claims, they either had a weapon, attempted violence, whatever. So they deserved to be murdered.

Or

B) The situation is not clear. Nobody was outright blamed. Details are fuzzy. Investigations were inconclusive.

Regardless of what I post, the outcome will never be "Wow, you're right. I guess law enforcement does kill innocent people without impetus sometimes." You will always move the goal posts and claim that I did not meet your burden of proof. Because you're arguing ideologically in bad faith. And since I'm not a fucking idiot, I'm not going to waste my time.

And if you want to say that you are, in fact, arguing in good faith, then my rebuttal is simple;

I'm not doing your fucking homework for you, Billy.

Tell that to trans people in Florida, or people seeking abortion healthcare on Texas

It’s not illegal to be trans anywhere in the us.

The FBI deals with federal matters, not state matters.

:mindblown: Holy crap! You just completely solved the problem in one take didn't you?

It's like a promotional flyer for Signal.

Right? The data they can collect there is pretty much entirely useless unless they can also gather the location of last connection. But even then, not terribly helpful.

And FYI, the info about Signal was confirmed as they received a subpoena a couple years back, and their response was part of the public court records.

Yeah, Signals response pointing to how their service works and than all the data consisting of only these two things war hilarious.

Whilst enlightening, it's kinda also useless. Let's be honest the majority of endusers use a particular app, in the main, because its most likely what everyone else in their friend group uses.

In my case WhatsApp, I'd struggle to get all my friends and family to change at this point.

Took me a moment, but I converted most close contacts to Telegram. Not Meta-infested and solid apps including desktop.

It gets easier the more you already have.

I just do it the easy way: I'm using Signal. If you want to text me or receives texts from me then use it.

Now it's not just my friends but my neighbors now. SMS is straight garbage, I won't use it.

You don’t “have to” use apps that compromise your security. If you really want to switch to better practices you can and can still thrive. I got and persuaded my whole company and friend groups off of bad apps. It’s possible.

In my case, I was running phone apps on an iPod Touch, and it couldn't run WhatsApp. So I convinced a core group of friends to get on Signal back Snowden rec'd it. And the way networks operate, it spread out from there.

I feel very lucky and still somewhat skeptical that I was able to get friends and family onboard with Signal. Then I remember (1) most people don't think twice about installing random apps and (2) most people are best suited for an easy onboarding experience like Signal offers.

This makes me suspicious though, surely if they've declassified this that means they want people to see it, so isn't there a very real chance it's intentionally misleading?

I think that today, in 2023, some of the information here is outdated. We know that different messages can be intercepted and decrypted. It is labelled as unclassified, which I think might be different from declassified?

Correct it's labeled as unclassed sensitive info for law enforcement. That just means "don't share this shit on facebook if you want to keep your job"

Basically it's what they have decided to disclose to law enforcement. So at best it tells you the baseline capabilities of law enforcement.

No mention of Matrix. Wonder if it's not on their radar, or they have nothing, or just wasn't important to put it on there?

I think it is because it is a bit nuanced. I used to host a matrix server and if the FBI was like hey, give us the data to something.

I’d just give them anything they wanted. I did not allow signups, I only gave access to one friend and only had it setup as a learning project.

I’m sure my friend wouldn’t do anything shady on it, I’ve been close friends with him for about 30 years. But I’m not going to fight the fbi on their behalf. Plus, if they were using the server for something that the fbi needed to get involved with, I’d be pissed they used my server to do it.

tl:dr anyone can host a matrix instance and each host could have different levels of access.

Also important to note it's been well known the CIA uses Matrix internally for communications. If they're using it for communication it's probably pretty sturdy.

I'm wondering the same thing.

I am a long time signal user but I just started using Matrix yesterday and now I'm very curious about whether Signal or Matrix is better somehow in terms of security/privacy.

I stopped using Signal after they said no alternate clients, then got into crypto, then introduce a proprietary shim to their stack.

I plan on someday actually running my own Matrix server for myself and family, right now I'm on Matrix.org though. At this point I don't know how folks recommend Signal over Matrix. There are a lot of clients, so maybe the choice of clients is too confusing? IDK.

But anyone saying Matrix isn't easy enough for non-tech folks to understand, my sister, niece, even wife set up Element themselves on their phones without issue. My father and step-mother both use Element with us. I configured it but they know how to message and do video chat and things.

Thanks for sharing! I really want to get my family on Matrix now.

We have not been able to find a solid chat/video call app that the entire family (various ages and tech aptitude) can effectively use. We've been bouncing around to various apps since COVID lockdowns started. We had been using Slack for a while but the video calling in Slack is unusable now.

We do voice and video chat every week with my family and it seems to work incredibly well. No real issues with any of it.

̷W̷̶̷h̷̶̷i̷̶̷l̷̶̷e̷̶̷ ̷̶̷F̷̶̷r̷̶̷a̷̶̷n̷̶̷c̷̶̷e̷̶̷ ̷̶̷i̷̶̷s̷̶̷n̷̶̷'̷̶̷t̷̶̷ ̷̶̷a̷̶̷ ̷̶̷p̷̶̷a̷̶̷r̷̶̷t̷̶̷ ̷̶̷o̷̶̷f̷̶̷ ̷̶̷F̷̶̷V̷̶̷E̷̶̷Y̷̶̷ ̷̶̷"̷̶̷t̷̶̷h̷̶̷e̷̶̷ ̷̶̷f̷̶̷i̷̶̷v̷̶̷e̷̶̷ ̷̶̷e̷̶̷y̷̶̷e̷̶̷s̷̶̷ ̷̶̷a̷̶̷l̷̶̷l̷̶̷i̷̶̷a̷̶̷n̷̶̷c̷̶̷e̷̶̷"̷̶̷,̷̶̷ ̷̶̷i̷̶̷t̷̶̷ ̷̶̷i̷̶̷s̷̶̷ ̷̶̷e̷̶̷x̷̶̷t̷̶̷r̷̶̷e̷̶̷m̷̶̷e̷̶̷l̷̶̷y̷̶̷ ̷̶̷l̷̶̷i̷̶̷k̷̶̷e̷̶̷l̷̶̷y̷̶̷ ̷̶̷t̷̶̷h̷̶̷a̷̶̷t̷̶̷ ̷̶̷i̷̶̷t̷̶̷ ̷̶̷i̷̶̷s̷̶̷ ̷̶̷c̷̶̷o̷̶̷m̷̶̷p̷̶̷r̷̶̷o̷̶̷m̷̶̷i̷̶̷s̷̶̷e̷̶̷d̷̶̷ ̷̶̷b̷̶̷e̷̶̷c̷̶̷a̷̶̷u̷̶̷s̷̶̷e̷̶̷ ̷̶̷M̷̶̷a̷̶̷t̷̶̷r̷̶̷i̷̶̷x̷̶̷ ̷̶̷w̷̶̷a̷̶̷s̷̶̷ ̷̶̷c̷̶̷r̷̶̷e̷̶̷a̷̶̷t̷̶̷e̷̶̷d̷̶̷ ̷̶̷b̷̶̷y̷̶̷ ̷̶̷t̷̶̷h̷̶̷e̷̶̷ ̷̶̷F̷̶̷r̷̶̷e̷̶̷n̷̶̷c̷̶̷h̷̶̷ ̷̶̷g̷̶̷o̷̶̷v̷̶̷e̷̶̷r̷̶̷n̷̶̷m̷̶̷e̷̶̷n̷̶̷t̷̶̷ ̷̶̷i̷̶̷n̷̶̷ ̷̶̷2̷̶̷0̷̶̷1̷̶̷8̷̶̷.̷̶̷ ̷̶̷ ̷̶̷

Keep in mind that op's foia request is from 2021.

Edit - I'm misremembering. Disregard.

https://en.wikipedia.org/wiki/Matrix\_(protocol)

The initial project was created inside Amdocs, while building a chat tool called "Amdocs Unified Communications",[4] by Matthew Hodgson and Amandine Le Pape [fr]. Amdocs then funded most of the development work from 2014 to October 2017.[5] Matrix was the winner of the Innovation award at WebRTC 2014 Conference & Expo,[6] and of the "Best in Show" award at WebRTC World in 2015.[7]

Fact check: the French govt did not create Matrix.

Matrix is an open protocol created in 2014, for an Israel-based private company.

In 2018 the french govt decided to use a verson of that protocol in their own chatting network.

Thanks, and apologies. I've edited out my idiocy. Misremembered, and was thinking of something else.

Signal and Matrix both implement the same encryption protocol -- the double-ratchet algorithm from Whisper Systems.

Well, there are a few leakage issues with Matrix, but there’s also the benefit that you can stand up your own server or use one based in a country you’re comfortable having access to your basic connection data.

So unlike Signal where the hashes are all stored in one place, with Matrix no single government has control over the entire network.

I think it is because it is a bit nuanced. I used to host a matrix server and if the FBI was like hey, give us the data to something.

I’d just give them anything they wanted. I did not allow signups, I only gave access to one friend and only had it setup as a learning project.

I’m sure my friend wouldn’t do anything shady on it, I’ve been close friends with him for about 30 years. But I’m not going to fight the fbi on their behalf. Plus, if they were using the server for something that the fbi needed to get involved with, I’d be pissed they used my server to do it.

tl:dr anyone can host a matrix instance and each host could have different levels of access.

The server shouldnt be seeing anything of value if you're end to end encrypted

That is what I imagine as well. Either way, if they want files to try and decrypt then they can have them.

I'm actually surprised they can't get more WhatsApp data considering it's Facebook. I know WhatsApp's thing is encryption but... It's Facebook

There's a lot of misinformation about Facebook on Reddit. They absolutely deserve scrutiny, but their main problem has always been growing too big too fast and all regular capitalism stuff. If you actually look further into their scandals than Reddit comment sections it becomes apparent that most of their issues (Cambridge Analytica, general misinformation, hate speech, etc) comes from just regular ol corporate incompetence at a massive scale rather than maliciousness. I don't know if that makes anyone feel any better lol.

They are trying to turn it around though and they're investing a shit ton in privacy and trying to tackle "bad actors" and misinformation problems on their platforms (because I guess the scrutiny worked). They're pushing heavily for Messenger to be fully E2EE like WhatsApp, so it's pretty clear that they want to work with local law enforcement about as much as you want them to.

They should definitely be heavily scrutinized, but I think a lot of the Meta criticism goes past constructive conversation and into rage-fueled hate, especially on Reddit and other competing social medias.

Is there a link to this article or doc or anything?

It seems like Signal, Telegram, and Threema are the best for now. Signal provides the least information, but for the majority of people, the stuff from Telegram are things the government already know, and I'm not sure how useful the Threema information is.

Just BC tele doesn't share data with FBI... Does does mean they don't share with fsb.

I read it as Threema being about as secure as Signal if you don't give them your phone number & email and use the Libre version without Google push notifications.

Wonder what a difference it now makes with the iCloud “advanced Data protection” that provides end to end encryption for iCloud backups etc. in theory that should block the iCloud backup route.

Yeah this infographic is now out of date with the iCloud changes

I guess if you enable it on your device you are safe, but if your content is on another device that doesn't enable it (it's an opt in option), your content will be available.

Advanced data protection is across your entire account, not per device. According to Apple’s documentation they rotate the keys locally on your devices and then delete them from their services so they no longer have a key to give.

Telegram seem to provide the least info, not signal.

But Telegram also have access to more info about its users, considering that messages are not end to end encrypted by default, than Signal does of its. This means that Telegram can share any data it wants, its users are just hoping that it won't. In the case of Signal, they don't have access to any meaningful data in the first place. Also leaving these here:
https://www.wired.com/story/the-kremlin-has-entered-the-chat/
https://tech.hindustantimes.com/tech/news/russian-court-directs-telegram-to-share-encryption-keys-to-access-users-messaging-data-story-1ZhjHvyTQJ89RhhNnp4bGL.html

That's true. More info means more risk for more data sharing.

I thought that at first too based on the icons, but if you read the text it reveals Telegram has the ability to provide IP address (if they can be convinced to).

How are IP address and phone number less info than dates and times? Unless you're talking file size and Signal is using full timestamps, but that doesn't seem very important here. I highly doubt the limitation that it's only for confirmed terrorist investigations is used sparingly.

Sure that is something debatable. It's just that if we take these information on face value, providing information just for "confirmed terrorists" could be considered lesser of the them. But if you take that out of the equation Signal provides less

Anyone use Session messenger? It doesn't need a phone number unlike Signal.

I've been using session as my family chat. The only thing I dislike is its connection to Oxen. But it makes an interesting case for resistance to Sybil attacks. But that's not really in my threat model for family messages lol. I'm mostly happy we moved the fuck away from messenger. I'll probably move them to matrix, but I gotta wait a bit before switching them again lol

In terms of usability, it's not hard to set up and has been very stable for the 1.5 years we've been using it. Even getting my less tech savvy family on it was pretty easy.

Good on you

Yes love Session !

well this isn't as eye opening as I thought it would be. But thank you for the summary, really!

Ah the infamous wizardry of the backdoor in encryption discussion.

the "push service tokens" for threema is a fun one, i wonder what those get used for