Discussing encryption with other people

Okay, so after just shrugging and not giving a fuarrrk about privacy for a while, mostly because of the insane amount of apathy I see in other people, I realized I shouldn't be so quick to give up. So I started using Signal again, I briefly used it but then gave up without really trying because that meant talking to people about encrypting their discussions. I've gotten three out of the six people in my house to use Signal (the other three have either no phone or a Windows Phone) and have had discussions with an uncle with an interest in tech about it too. I would like to spread the word as much as I can, I think the biggest hurdle is to explain WHY it's important to have discussions encrypted and how you aren't a bad guy if you don't want people to listen in on your discussions. So I was thinking about taking advantage of the little social media I do use and also spread the word through making a ton of friends and just occasionally talking about Signal as a gateway app into thinking about how they use tech. I think people value what I have to say enough to at least hear me out once on the matter. So, I really want to try. How have you guys talked about things like encryption to other people? Pic not really related, unless you want to have Signal chats with Noire or something.

>How have you guys talked about things like encryption to other people? The first step is to get people realizing the privacy is important. Most people don't know the scale or believe that because they haven't worth spying on they shouldn't worry. second step is to get people to talk to....

>>6111 That's the thing, I have plenty of people to talk to, and I'm willing to play the good Facebook userr if it means getting more people interested. So I was thinking, with anti-Trump sentiment at an all time high, I could tell people about Trump's stance on encryption and how that could effect them in the long run, even if they just talk about trivial stuff everyday.

>How have you guys talked about things like encryption to other people? With friends it has been easy, I simply told them that if they wish to communicate with me and we aren't face-to-face they have to use $application and I will walk them through how to use it. They are all pretty tech-savvy or at least willing to learn, so from there I just send them links to stuff I stumble across from time to time. With family on the other hand it is much harder. So far I have more or less just mentioned what I have heard/read about whenever it is appropriate since none are particularly tech-savvy (although at least one thinks he is simply because he knows how to turn a computer off properly). Most of them just use Facebook so its kinda pointless to discuss with them anything beyond the bare basics anyway. If they want to talk to me, I tell them to meet IRL instead of trying to train them on $application. I had one try to tell me that they have nothing to fear because of the "mountain" of data generated by millions of users obscuring their personal data. Trying to explain to them that this sort of thing can be easily sifted through with the average modern computer was way over their head. Man-in-the-middle attacks that inject malware are equally over their head unfortunately despite being a major reason for encryption. >>6111 Unfortunately just discussing the sheer scale of it takes longer than the average attention span of someone who's tech-illiterate. I lose people in 30 seconds let alone the 5 minutes or so it would take. Then again I am a pretty terrible speaker too. >>6112 Depends on the person and circumstances really. With some people it is exceedingly bad to discuss politics with, as it will lead to months of not talking even if you pretend to agree with them. Pandering to their personal beliefs is generally not a good idea either, especially when the truth is both sides want to eliminate encryption. For me it has been more effective to mention that $bad_people can do things with your data, which includes the "hacker boogeyman" and world governments (not just your own).

>>6110 Signal is the worst thing you can migrate to for "muh privaceeeeeeeeeeeeeeeeeeeeeeeeeee". This isn't just coincidence, when someone starts talking about secure communications, a bunch of obviously show up and start advertising their corporate spyware. Why Signal is bad? Well, first it's not an open server federation. Central server is located somewhere in US, so basically it doesn't suite any US citizen or people afraid of US secret agencies. Second, Signal is not free software, but "open source", this is a major issue, since putting your code on github and calling it "open" does not equalize it to having 0% of proprietary code. Signal ships with several proprietary binaries within. Third, it relies on Google push. Basically, every time you receive a message, A-corp gets a piece of metadata on you. Yes, you can opt-out, but it is turned on by default. Third, Signal uses phone number for registration. Why should it? Guess it your selves, because: a) users are tech-illiterate mongrels without e-mail, b) it's even easier to collect metadata since most people won't bother on getting burner phone number c) both DO NOT LISTEN TO SIGNAL S H I L L S. DO NOT. Use XMPP with OTR, an open protocol with federation of servers. There is also new replacement for XMPP, Matrix, but it has no good clients yet. >>6113 The worst problem with humans is that they would rather trust some authority, than an encryption algorithm. The government will save us from bad guys, comrade Durov, Mr Cloud, Mr. Kikeberg will sure keep our private data private for free and we should take their word for it because so. I think one should comprehend certain things about technology and encryption and understand that security is trustless, not trusted. Then it goes on and on, to free software ideologies and a bit of anarchist worldview. It's easier to make "bad guy" start using encryption, because he certainly "has something to hide", and ordinary people don't really know the full scale of system and what the system already knows of them, and if they do, they go full pessimist and say they have nothing to hide, since it is already pointless to hide. What's the silver bullet for convincing people? Do they deserve to be saved? Do they want to be saved? Once someone starts getting interest in, he may stop on "windows 10 telemetry removal tool 2018 edition by epikrussianhaxor99", ghostery as browser "privacy extension" and Signal as "secure messenger".

>>6114 Is Signal really that bad? If the messages are encrypted, then isn't that really good? https://en.wikipedia.org/wiki/Signal_(software) >From February 2014[26] to February 2017,[56] Signal's official Android client required the proprietary Google Play Services because the app was dependent on Google's GCM push messaging framework.[57][56] In March 2015, Open Whisper Systems moved to a model of handling Signal's message delivery themselves and only using GCM for a wakeup event.[58] In February 2017, Open Whisper Systems implemented WebSocket support into the client, making it possible for it to be used without Google Play Services.[56] It sounds usable enough, even if you have to use a phone number. I think it's way better than just texting like normal.

>>6114 >Use XMPP with OTR, an open protocol with federation of servers people who are technically minded know that already, we are talking about the majority of people who only know basic user software. For a vast majority of people apps like signal, wickr, and tox are plenty fine.

>>6116 Using XMPP with OTR is about as hard as using web browser with https, there are even foolproof mobile "apps" such as Conversations, ChatSecure that make it bloody simple and offer a sever for starters. It seems like most humans can't comprehend concept of username@servername, but are completely fine with app pulling phone numbers from their contact list. Just like vCard doesn't exist or something, right?

>>6117 Okay, I'll give XMPP with OTR a try. It's not like I've talked to a ton of people about this yet. I have to see if it's really easy for the general population for myself. I'm going to download a client and play around with it.

I went to a communist bookshop (to find a Babylonian/Syrian dictionary), and I demonstrated why its important. I did this by running airodump and only had to show them how easy it was to pick up there phones and where they have associated before. That was enough to get them really paranoid.

>>6110 It can be depressing how ignorant the general population is about this and related topics. My advice is to keep working on your "elevator pitch" for a while before acting. Find a few friends or anons who are interested in some of the software and test it well, figure out the core points new users need. I wouldn't make make your logos pathos egos "political" (eg trump-related). See if you can get your core arguments down to a couple of minutes, memorize talking points (ugh) for the main counterarguments, etc. And report back to us! :)

>>6119 That's awesome to be honest

>>6120 Yea, me and my family have enjoyed Signal. My own mom who likes the idea of video calling told me that it's way easier for her to actually video call people since all she has to do is hit the little camera button in the middle of a call. She really struggled with Skype back when I was a teen and likely would still struggle with it. I am glad I got some feedback in general about the political arguments, I mostly had that idea in my head because almost everyone I know is either completely against Trump or at least not completely positive about him. I personally don't like him but I really didn't like his reaction to the San Bernidino(?) encryption issue. Trust issues with Apple aside, Trump's reaction really bugged me. So I thought that while it's preaching to the choir, I thought it would help. I will be dropping politics from my discussions. Getting good points is important, yes. Delivery isn't as much of an issue, because my job deals with me discussing the pros and cons of various products for their house. I'm always honest about my biases and play a low pressure style to selling things with my friendly mannerisms. People respond very well to that. Now, I'm just trying to figure out how feasible XMPP with OTR is compared to Signal. I had little issues setting it up on my Windows laptop, but I also am the same kind of person who reads up on this stuff, has Linux experience, etc. I think maybe starting small community classes might help a lot more than just dumping people on a seemingly random program (from their point of view). I'm going to need some anons to work with XMPP with OTR. But there is no reason why a person couldn't just use both Signal and XMPP. Major hurdle is still getting people to join, even with Skype back in the day, I found it so hard to find people to talk with because most people use Facebook. Which isn't an issue, as I said, I'm going to take advantage of FB to at least raise awareness.

>>6114 signal is a replacement to texting. XMPP with OTR is not.

Wait.. mods, why is this considered a thread for /r/? I'm not going to argue with you but I'm very curious about the move. Is it because it's more of a social thread with the theme of encryption? I'll accept your judgement either way but I didn't expect this.

>>6123 >instant messaging with encryption is not a replacement for unencrypted instant messaging over phone lines

>>6127 >>6114 Obviously XMPP+OTR is better than signal, I don't think that was OP's point. That's how I talk to any of my friends who actually care about privacy. But I also use signal (well, technically the Noise fork). Why? Because "here download this: it's like whatsapp but you can read the source code and it isn't owned by facebook" is an easier sell than "You have to register an XMPP address somewhere if you want to talk to me. Your only basis of comparison is probably aol instant messenger, but I swear it's significantly better for reasons you won't understand or care about". I refuse to use discord, facebook messenger, whatsapp, etc. so the only way most people can talk to me is by texting. If I can at least get those text messages to be end-to-end encrypted, that's good enough. Of course I'd rather they use XMPP and PGP-encrypted emails (and I do try to push that with people who might actually listen), but like OP said, signal is a decent place to start for people who have never even considered digital privacy to be an issue before.

>>6124 >Is it because it's more of a social thread with the theme of encryption? Yes, that is the main reason why this thread has been moved. While encryption is most certainly a topic for /tech/ (or /Ω/ if you prefer that name), a thread for spreading awareness about encryption (and threads of similar vain) would be more suited for /r/ since they are not necessarily made for sharing technical details about encryption software.

Some useful things to show them: www.wired.com/2013/06/why-i-have-nothing-to-hide-is-the-wrong-way-to-think-about-surveillance/ https://youtu.be/XEVlyP4_11M

>>6131 >Obviously XMPP+OTR is better than signal, Why? How? Unless you're going to convince your friends and family to install a custom de-googled privacy-centric rom on their phones I don't get the point. Signal is more than "good enough" You need a computer for real security and privacy. Besides, many of the people you're talking about converting probably voluntarily allow google to store keylogs for their autocorrect, obliviously missing the point of using signal. Etc. Etc. I've long ago given up trying to teach people about privacy if they don't care enough to ask in the first place. And I've long ago given up having privacy on my phone anyway. I just consider anything I do on there not private.

>>6171 >Why? How? see >>6114 i don't understand what you are actually arguing. all i'm saying is that signal has flaws that make it a poor choice for people who have high standards for privacy. i use xmpp+otr to talk to these people. for everyone else, i try to at least get them on signal because i know i won't be able to get them to do better. are you sure you didn't misread my post? it seems like we're mostly in agreement.

>>6171 >eh it's just a 2-inch butt plug not a horse dildo, mmkay! First, if you want to regain you privacy from corporations, you need to obfuscate every layer of them spying on you. I personally don't own a smartphone or any kind of phone, therefore I have no phone number. What am I supposed to use to talk to other people? Email and XMPP. Registering Signal account requires getting a burner SIM or web GSM gate account, the devs obviously preventing users from using email for this purpose for (un)known reasons. A phone number and it's communication can be easily stolen/sniffed by a skid with SDR, or gate owners mining their data for profit. Anything that relies on plain old telephony networks in current year is insecure, and I refuse to touch it. An example: protocols like XMPP and email leak as less metadata as possible, to every party that maybe watching. Some misguided individual may start using Signal over VPN, but once he receives an SMS with password or some other soykaf, the phone carrier knows who, when and where uses Signal app, despite the person believing he is secure over VPN. With email or XMPP, there are less holes to leak. As people stated earlier in this thread, XMPP programs for smartphones are damn easy to use, I even tried them in android VM once. You register to server, check TLS and OTR, and start chatting with your contacts. Yes, Google may log something, yes some of them have stock bloatware ROMs, but at least they are safe from cell carriers which are required to store metadata for 2 years in my country and have a history of intercepting user's communications without permission of court or police investigations. >>6181 back to discord, low attention span nonfat-soykaf drinker

>>6181 I did, at least the "every post an essay" part. Every Frame a Painting quiting was a hard blow to my moral. >>6184 Long pieces by autists is my favorite thing to read online. (Interestingly, my browser wants to correct autists to artists.) To each his own, I'm fine if you don't like it, but I think the original spirit of lainchan was definitely geared toward long posts, slow threads.

Please, let's try to keep this on track and realistic too. Signal is fine in a world where most people already have smartphones you are in a tiny minority, >>6183 for not even having a cell phone of any kind. Although, I have to ask how do you communicate with distant cousins or your job without a phone if all you use is email and XMPP. Unless your family and job is just really awesome like that and uses XMPP for everything? Anyhow, Lain, I am very interested in XMPP, do you know of communities where people swap XMPP info? I know we have threads here but I'd like a variety of people.

I don't really make much of an effort to "convert" anyone to any particular app, but I do try to talk in a more general way about privacy issues when they come up (or I can bring them up) naturally in conversation. Usually I'll phrase it in such a way to remind them that they already know how bad this stuff [implied but unsaid: this stuff they use and participate in] is for themselves and their society. Little jibes like "Oh yeah but google already knew that, right? They read all your emails remember!" The hardest thing is treading the line between reminding them how important it is (by highlighting how deeply it's ingrained in their life) and not spooking them into the paralysis of guilt. (These people secretly want it to be hopeless, because then they get an excuse to just embrace the dystopia wholesale. Can't let them get off that easy.) I haven't found an ideal narrative yet, but lately it's been something like: "We all _know_ that Facebook is bad for us, not just because it spies on us and manipulates us, but because it's ruining the way we interact with each other. Literally all we need it for is simple communication, `what time will we meet?` that kind of thing. Probably no one actually likes to use it, and hasn't for a long time, but we're forced to because they control the whole market. They control the whole idea of communication right now! Isn't that crazy?" I guess I don't see myself as being able to have any big impact on adoption rates of alternatives here and now, not being at all central in the social graph. But if I can help spread general consciousness of how undesirable the status quo is, maybe when an alternative starts to peep into the mainstream they'll be a little more susceptible to switching (and thus causing their own network effects).