Kevin Karhan :verified:<p><span class="h-card" translate="no"><a href="https://mstdn.social/@rysiek" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>rysiek</span></a></span> also <a href="https://infosec.space/tags/Telegram" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Telegram</span></a> - like <span class="h-card" translate="no"><a href="https://mastodon.world/@signalapp" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>signalapp</span></a></span> - demand and collect <a href="https://infosec.space/tags/PII" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PII</span></a> like <a href="https://infosec.space/tags/PhoneNumbers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PhoneNumbers</span></a> which ain't possible to acquire anonymoisly in more and more juristictions.</p><ul><li>Plus, both are <a href="https://infosec.space/tags/centralized" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>centralized</span></a>, <a href="https://infosec.space/tags/SingleVendor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SingleVendor</span></a> &amp; <a href="https://infosec.space/tags/SingleProvider" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SingleProvider</span></a> solutions that don't allow for <a href="https://infosec.space/tags/SelfCustody" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SelfCustody</span></a> of all the keys nor <a href="https://infosec.space/tags/SelfHosting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SelfHosting</span></a> and thus violate <a href="https://infosec.space/tags/KerckhoffsPrinciple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>KerckhoffsPrinciple</span></a>, meaning they are inherently <a href="https://infosec.space/tags/insecure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>insecure</span></a>.</li></ul><p>Using <a href="https://infosec.space/tags/XMPP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>XMPP</span></a>+<a href="https://infosec.space/tags/OMEMO" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OMEMO</span></a> by contrast is secure and adding <span class="h-card" translate="no"><a href="https://mastodon.social/@torproject" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>torproject</span></a></span> / <a href="https://infosec.space/tags/Tor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Tor</span></a> to tunnel it makes it even more anonymous.</p><ul><li>So don't expect any messenger to cover your 6, but instead go out of your way so that <a href="https://web.archive.org/web/20220112020000/https://twitter.com/thegrugq/status/1085614812581715968" rel="nofollow noopener noreferrer" target="_blank">even when held at gunpoint</a>, they can't decrypt comms!</li></ul><p>Cnsider every <a href="https://infosec.space/tags/Messenger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Messenger</span></a> that doesn't <a href="https://infosec.space/tags/decentralize" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>decentralize</span></a> and support <a href="https://infosec.space/tags/Tor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Tor</span></a> oit of tue box to be insecure!</p>