Telegram

Let's talk security of telegram. If you look at the protocol itself it doesn't seem obviously insecure to the casual eye, but the way they mix and match crypto primitives in such a convoluted way is reason enough for concern, and there's not really a motivation for doing it that way either. As anyone could tell you, more complex almost always means less secure. The only possible motivation I could think of for doing all the complex string shifting they do is that it might speed up the server side or make it easier to parallelize? Either way, the protocol was obviously designed by amateurs like you and me. It's been broken and mended multiple times in the past(https://habrahabr.ru/post/206900/ claims to have broken the protocol, but I can't read it) Additionally, you have to trust the server for multi-party chats, so the 'end-to-end' guarantee is not preserved. Good goin telegram. And most importantly: If you want strong cryptography for talking to normals, what's the matter with signal?

They reinvented OTR for no reason. "We rolled our own crypto, breh" = security through obscurity. It is not enabled by default for all chats. You give someone's your id or number and done, no fingerprints or public keys whatsoever. They didn't adopt Signal's Double Ratchet, or OMEMO for XMPP, if they did, all their problems would have been solved instantly as no one would need Signal after this. Since it is OTR and not OMEMO, you can't log in from multiple devices. You have to register through phone number and phone only (normals find it more convenient than e-mail somehow, I really regret whole world didn't take path of Japan in this case) There were precedents of hijacking passwords from text messages in Iran and Russia, again cell phone is the weakest point. Burner phones only create illusion of "anonymity". Telegram scraps all your address book, and asks for other permissions too. If you have enough patience, you can bruteforce all Telegram users from your town by adding contacts (5000 limit per account) within certain city code. That's a lot of sim cards/virtual numbers to register, but if you have access to SS7, is not a real problem. There are no encrypted group chats, they are stored in plain text like in IRC or XMPP servers, but you can't host Telegram chats under your bed and ensure their privacy. If system somehow doesn't like you, they'll boot you off their mainframe. Lurk for "Telegram derezzed terrorists". Who will be next? Nazis, pedophiles, druggies, liberals, joos then anarchists and commies? IIRC, all group chats in Signal are sender-recievers encrypted and have limited maximum capacity because of that overhead, but Telegram's model is more about becoming new VK with mass-public channels, porn, music and stickers distribution. These public channels fall under "mass media" category and can be tampered by governments on request. Client builds are not reproducible. Telegram is "open source", not free software. Their Github repo is outdated. Reproducible builds mean you can take published sources, build them and get identical binary they distribute to ensure no backdoors were added in version accessible by masses, this is not the case with Telegram. Wouldn't even argue on how Pavel (Jobs) and his brother Nikolai (Wozniak) are both FSB plants, that's a very old meme since establishment of Vkontakte. >https://habrahabr.ru/post/206900/ Not everyone on lainchan reads slav runes, but I'll try to highlight some points, although this article is a bit outdated, 2013 ffs, lots of things were fixed. First the author tries to find out, whether the client-server communication is MITMable, it isn't. Telegram uses Diffie-Hellman with root certificates, just like TLS. Secure enough. Then he installs the app and receives an SMS with 5-digit pass. Normals can't into passwords, we already know it. Anyone with enough power (power to log in to skiddie forum on tor and a few grand euros, nothing more really) can reissue this code to his cloned sim, catch your code live via IMSI catcher or come to telcom's office and politely ask them to wiretap this suspicious citizen. But as far as I know, Telegram now offers some 2-factor auth with locally generated passwords. Still, most people won't bother because it is not enabled by default. This is how most accounts get stolen. Next, author explains how end-to-end works. Basically, key exchange goes through the same Telegram server, with magic on their side. That's not what secure means. Public keys must be exchanged at person or through third-party channels if done properly. tl;dr Telegram's slogan is "taking back our right to privacy", but all privacy they offer is by policy and it isn't even turned on by default. Signal is "better", if your contacts are too much mouthbreathers and you need voicecalls. If you heed real security, use XMPP. Conversations app (downloadable for free from F-droid) dumbs everything down to WatsApp/Telegram/Signal level even offering their own server and non-joke e2e algorithm. As far as I know, there are not much solutions if you need private multi-user chats, use friend-to-friend networks like Retroshare, Tox or diy IRC/XMPP servers. Further reading: https://www.fredericjacobs.com/blog/2016/01/14/sms-login/ https://www.fredericjacobs.com/blog/2016/04/30/more-on-sms-logins/ https://www.theverge.com/2017/7/17/15980948/telegram-indonesia-isis-terrorism-moderation-ban https://www.ptsecurity.com/upload/ptcom/SS7_WP_A4.ENG.0036.01.DEC.28.2014.pdf https://habrahabr.ru/company/pt/blog/283052/ https://www.ptsecurity.com/ww-en/about/news/117350/

>>2684 >It's been broken and mended multiple times in the past(https://habrahabr.ru/post/206900/ claims to have broken the protocol, but I can't read it) If it is so badly broken, why do you post only a single link in a language you don't even understand? Looks like your confirmation bias is really scraping the bottom of the barrel here.

>>2687 Some slav text. https://sohabr.net/gt/post/291495/

>>2694 Another "feature" of both Android and Telegram. Scrapes contacts from your phone, every SIM you accidentally put in, other apps like Skype and so on. Seriously, you'll need to find English-speaking technology blogging site like habr without corporate puppets everywhere (corps have their dedicated blogs there and sometimes post interesting stuff tho), I won't be in this thread translating for you forever.

>>2693 >If it is so badly broken, why do you post only a single link in a language you don't even understand? Because that's the first thing that came up when I went looking. Do you want me to drop everything and look more for you, master?

>>2703 >Because that's the first thing that came up when I went looking. Kind of suggests Telegram is actually more secure than you think in that case.

>>2710 how so? You can find blog posts a-plenty from top security professionals about how insecure it seems, but that was the only place I found after 5 minutes of investigation that actually claimed to have broken it. The fact that nobody has very publicly found a huge flaw is not surprising. Nobody has actually recovered a 1024-bit RSA key, but it's still widely regarded as insecure because it's no longer in the realm of infeasibility. Same goes for SHA-1, it's being phased out because of a single tiny flaw that doesn't apply in 99.999% of situations. Same applies to Telegram. It pays to be cautious about this stuff, because most of the time if someone finds a flaw they won't publish it publicly.

https://www.newsru.com/russia/18sep2017/rozenberg.html Former employee of Telegram accused Durov of unlawful dismissal and was sued for 100 million rubles https://medium.com/@anton.rozenberg/friendship-betrayal-claims-3f395bcc95fa

https://roem.ru/19-09-2017/259242/durov-vs-rosenberg/ >Durov promised employees that he would sell Telegram >Pavel Durov, during a job interview, told me that in the long term Telegram could be sold to him, and in this case, employees will receive substantial premiums of tens of millions of dollars, "the proposal for an amicable agreement, which Rosenberg sent to LLC" Telegraph ", which he is now suing.

>>2684 The author of the blog post did not crack or break Telegram, it just claimed that it is possible for the Telegram server to reuse a nonce or to use a deterministic one, potentially allowing decryption of messages in case Telegram server or the company is compromised. Thus debunked the claim that there's no way for Telegram to intercept all the messages.

If you're trusting anything people who own systems says you don't understand modern security. If you trust anything Durov says you are a complete moron.

>>2754 There is much more interesting details than that. Seems like Durov's brother managed to delete chat history from "fired" employee, but he managed to recover it because everything was cached

New information (Oct 5). https://medium.com/@anton.rozenberg/telegram-telegraph-durov-short-history-750a26f9cb42

>>2911 can a Russian lain give us a summary?

>>2913 Durov claimed that he was now an outcast, making Telegram, traveling the world. But all these were only public statements. In legal terms and in terms of development, nothing has changed. Telegram was still being developed at Telegraf OOO in Zinger's House, Pavel Durov quietly returned to Russia in October 2014 and since then regularly travels back and forth. But all continue to believe Pavel Durov that something has changed. Although the only real change that occurred, in July-August 2017, the employees of Telegraf LLC were transferred to contracts with some offshore company, writes Rosenberg. De jure Telegram development happen in Russia. Probably Durov have good relationship with Russian goverment.

How is signal these days? I'm thinking of trying to move my friend group over to it, but I'm concerned about usability. Could non-technical people use it and still be relatively secure?

>>3467 >requires phone number 100% easy to use honeypot for normals.

Telegram is just another mobile trash.

>>3467 >Could non-technical people use it and still be relatively secure? It's more secure than any other chat app you're likely to get a non-techie to use. My rationale for my friends is that sometimes we talk about drugs and you can get busted from SMS logs. >>3468 How, exactly, is it a honeypot?

>>3484 >sometimes we talk about drugs and you can get busted from SMS logs. You must be damn stupid to talk about drugs over SMS. Main thing is that Telegram won't save you if one time comrade Durov's left toefinger considers to wipe all druggies from Telegram because "uh we're private company duh, we do want we want durr". They already derezzed few pirate music bots and few wrong-thinkers because some islamic soykafole called them ISIS terrorists (doesn't matter even if they really were, a tool not secure for terrorists is not secure for anyone). Then, your dumb friends will be busted after discussing drugs with undercover cop, and since Telegram has no technical plausible deniability, nothing will save them. >It's more secure than any other chat app you're likely to get a non-techie to use. Not really, If you are a dumb normal user, you'd use Whatsapp of Signal, they at least have non-joke cryptography backend and encrypt groups. >How, exactly, is it a honeypot? Run by a FSB dog and his schizo brother. A guy who's basically Russia's Zuckerberg with all consequences implied. Would you trust a "privacy respecting messenger" when Zuckerberg decides to make one after retirement? Shady ownership schemes. They claim the company is registered in UK and has no ties to Russia, but all main staff including Pavel still resides in St. Petersburg. Who pays for all their servers and bandwidth if they don't datamine users, have no ads and not sponsored by big government? Because they do datamine you and are sponsored by FSB. Weak cryptography that was broken in first year, and still is not fixed. "SHA-1 is secure for our needs, breh" Chats are not encrypted by default, weak twitter virtue signalling attacks instead of actual problem solving. Durov says it's impossible to perform asymmetric off-the-record cryptography on multiple devices therefore he won't do it. When Axolotl exists, yeah. They won't even try to use it because "Moxie is a gobidalist big and brobably NSA sby doo :DDDDD" type of twitter arguments. Fun fact: Snowden recommends Signal, not Telegram. No group chat encryption. There is no way of exchanging keys before initiating secret chat. Blue QR codes are poorly readable by both humans and machines. Secret chat key generation involves central server. No reproducible builds. You can't pick their sources and compile latest client yourself, then they can easily include some backdoors in it selectively. Phone verification. They don't need your content if they have metadata. NSA kills people because metadata is enough for them. I mean, the police or whatever is implied too. They know your phone number, they know who you are 99% of the time unless you get this number through certain means which is not really necessary when you need full privacy, you chat with OTR XMPP over Tor. No federation, everything relies on central server and it's authority. lots of people in different countries were busted/spied on because Telegram uses SMS passwords by default and phone network is highly insecure. It literally costs nothing to get OTP via phone number spoofing for this one suspect druggo and read all his messages neatly arranged in the cloud. Some popular youtube celebrity glitterboy can steal your nickname if he claims it as his own.

>>3486 uhh, we were talking about signal, not telegram. I don't recommend telegram to anybody, for most of the reasons you already gave. >They don't need your content if they have metadata. not really, since 95% of the time there will already be metadata that two people are in contact, for physical acquaintances/friends. >NSA kills people because metadata is enough for them. NSA doesn't kill people, that's the CIA. This is a good point though, for activity that's likely to get you in deep trouble(anti-state activity, moving large quantities of contraband), signal is by no means good enough.

>>3486 moxie is a mossad asset and snowden is still working for the CIA. look into it.

>>4439 >look into it. >i actually dont have any sources at all to back up my contrarian bullsoykaf

>>3467 It's open source, the protocol is open source. Seems good to me. I'm glad it's ditched GSM as a dependency and you can now run it without GApps or MicroG. Been using it for a while no problems but the phone number part is quite unnecessary IMO considering Wire uses Signal's protocol but allows signing up via Email. I think the reasoning for using phone numbers is it's users friendliness with normal people.

>>3488 >signal is by no means good enough Hmm and what is? I think we're all asking ourselves that question.

>>4604 Not him but in a perfect world I think XMPP + OMEMO would be good (Correct me if I'm wrong I don't know much about OMEMO). Opens source protocol and encryption, doesn't require phone number to register, and has the possibility to run your own server. But the main reason I don't use it is that it isn't as friendly to 'normal' people as Signal is. You'll probably ask: >well who cares whether its normal friendly? Well that's the thing. We should try and actually get 'normal' people, the majority to actually care about their privacy as ultimately they decide whether something is popular or not. And I'd like to be able to chat with my non-privacy aware friends while still being secure myself. >who cares if it's popular? If it's popular, while still holding onto it's core beliefs of open source and security then its harder for a corporation/government to undermine or ban it. A starting point to make it 'normal' friendly is by making it simple: services like WhatsApp™ and Facebook don't require a lot of information or work to set up. XMPP for example does, you have to: 1. Create an email account if you want it to be separated from your physical identity 2. Choose an XMPP server and sign up, entering: username, display name and password. It doesn't sound like much effort but you've got to remember the general public is lazy and uninitiated, they'd rather just punch in their phone number and be done.

Ha-ha. Lol. New api.

No soykaf. Lol.

>>4644 nice screenshots. Care to link us to where you got them?

>>4645 Nope. Not mine and privacy api probably, but in public soon. Looks likely after https://geektimes.com/post/300741/ (yep, some slav text) https://roem.ru/10-05-2018/270823/telegram-passport-test/

Telegram is probably good enough for the majority of people on this site. Everyone forgets the balance between security and efficiency. What is your risk level? What are you trying to accomplish? What kind of adversaries do you expect to be targeting you? Really, none of us on here are worth much effort. Telegram is probably overkill for most of you. If you aren't actually operational then you need to skew in the direction of efficiency. Like majority efficiency, minority security. If you are operational but your adversaries are local law enforcement and other criminals, you want to strive for a 50/50 balance of efficiency and security. If you are actually covert and operating in a very hostile environment (clandestine intelligence, freelance intelligence, pedophiles, high-profile hacktivists, whistleblowers, journalists on a very hot story) then you need to bite the bullet and put all points in security. But let's be honest, we are all small fry. None of you are important.

>>4650 >None of you are important. Wrong. I am the most important person in the world.

>>4661 My Dog, my Cat is more important than you, Lainon.

>>4606 >1. Create an email account if you want it to be separated from your physical identity Damn great logic. It's much harder to obtain a phone number not attached to your identity, but if you're going to use Internet-based service on a smartphone, you as an absolutely normal user already have internet connection and email address (from google or apple) with email client set up for it automatically, receiving confirmation emails is much better than receiving plaintext sms. Second, literally few servers ask your email address, all signup is done through client software completely. Also who the fuarrrk on Earth thinks that 18945793621 is a better alternative to andrew@xmpp.de? Don't you remember mnemonic phone numbers people had to come up with in 20th century, 1-800-FUСK-YOU? Smartphone contact books had support for vCard for ages, it is literally a no-brain operation to exchange your email-style address and a public key via QR-code or NFC. Well, then there's Tox that has user's public key only. Similar to phone number, you can call them any way you wish in your contact list. >>4643 >Internal Passport Gee Bill, totally not FSB honeypot. >>4650 >nothing to hide nothing to fear Day of the rope is coming, comrade major.

https://sohabr.net/habr/post/412755/ >telegram proxy >local statistic api >"Promoted" channels >only for telegram? web?

>>4758 >set a proxy >harvest IPs >promote your channel >post geo-targeted ads DUDE PRIVATE MESSAGING APP ALL COOL KIDS BUY AND SELL DRUGS THERE

https://github.com/TelegramMessenger/MTProxy/issues/35 > Proxies being derezzed in Iran. CHANGE TO TLS PLZ #35

https://core.telegram.org/passport NOW

>>2684 You can use TG any way you want if you don't care about your privacy. First of all use your phone number as identificator is bloody bad idea. Second TG is a proprietary software witch makes its untrusted thing. Third your messages in chats or with pals directly stores on TG servers as long as you don't use end-to-end encryption. By the way you can not trust me as long as you don't know TG still has no independent security audit.

http://premium.lefigaro.fr/secteur/high-tech/2018/09/07/32001-20180907ARTFIG00007-pavel-durov-l-homme-des-messages-chiffres.php PORTRAIT - Le créateur de la messagerie cryptée Telegram, prisée par les djihadistes autant que par les politiques, vient d'autoriser la divulgation de l'identité des utilisateurs dans les affaires de terrorisme. Un revirement inattendu !

Telegram is soykaf pretty much, but still it keeps some level of privacy, as was said above, so normal people and wannabe hackermans like it pretty much. I also love it because of how easy it is to create a bot and harvest data from all popular chats. I also like how desktop app can take 3-4 GB of RAM eventually although that's not related to the security side. Issue of this exists since 2016 and no one gives a fuarrrk. The big red flag is the use of a phone number instead of email, the bigger red flag is the closed-source server side. I am sure they closed it so that no one will ever see that student tier spaghetti code. The bigger bigger red flag is that many security (and not only) related bugs was released on the websites like habrahabr only because telegram team didn't react for bug reports for months, if not for years. Even so, some bugs and vulnerabilities still keep to exist because telegram team didn't react even this way. Like you waste some time to investigate the problem, write a report, send it to the telegram team and wait for several months, but they didn't even bother to write a simple reply, total disregard. Even telegram secure chats (which are still not available for the desktop app for some reason) are not secure, since they are not end to end. If you have an access for a target device, if you can copy some data from it, you can easily break telegram hashes, steal the keys, use stolen cache to login from your own device and therefore listen to a """secure""" conversation. Usually secure conversation is intended to exist only between 2 devices, but telegram does not give a fuarrrk there is a third device listening, idk. Finally, the total soykafness of telegram is revealed after the release of Telegram Passport, which was proved as being not secure at all right after release. Can you imagine this level of privacy they give to you when all your data can be stolen by a simple bruteforce?

>Additionally, you have to trust the server for multi-party chats, so the 'end-to-end' guarantee is not preserved. Good goin telegram. When you come up with something like the joux protocol for N parties, let us know.

>>5894 OMEMO already exists lad

>>5894 >neurosuggesting you couldn't just end to end token ring it And that is just me winging the idea about multi user encryption But when you come to bare bone maths behind encryption , the maths doesn't stop you to add linearly add more people

>>5896 Token ring or onion-layered encryption doesn't work well when people you talk to are in Delhi and servers are in Frankfurt. The whole premise of these new messaging applications is to provide hacks for metered mobile network connections and battery operated pocket devices, they can't afford all this overhead, sans purposefully weak cryptographic protocols and heavy server centralization with reliance on mother corporation (Apple or Google) to deliver message receipts.

>>5895 >double ratchet >Google summer of code pozzed crypto based on Moxie Marlinspike's work no thanks

>>5900 Is any any worse than "pozzed" (actually weak reimplementation of 14 year old OTR algorithm without secure fingerprint exchange) crypto from authors of Russian Facebook who also happen to have ties with state mafia and FSB? Yes, much worse.

>>5900 do you have a real criticism or just vague accusations?

>>5907 >homeless bum squatting on abandon island >vagrant moving around country jumping trains >suddenly crypto gary stu >"don't use old trusted crypto" >"my nu crypto has le features" >Wow, this crypto looks flawless, like a team of CIA wrote it or something -- Bruce Schneier nope, I don't have anything solid If I did, alphabet agency wouldn't be doing their job right you can trust him if you like I don't

>>5910 what old trusted crypto does everything that the double ratchet does? genuinely curious. Also, re "le CIA": yeah, because nobody has ever been good at anything and not been a three letter agency. Also no bum has ever been good at anything. Ever. Kevin Mitnick? not a real person. psyop. lizards,. seriously fuarrrk off

>>5911 >le features See, there it is. No need to get upset. Why does it bother you that I don't trust it? Got something riding on it? The funny thing to me is how easily MM gained so much trust with the lefties in Silicon Valley. He could be FSB and the reason why 2016 happened. It's nearly always an insider.

>>5910 >>5913 Moxie Marlinspike has been around for a long fuarrrking time, and has been producing solid cryptography work for the last 15-20 years. Seriously, the guy has basically dedicated his life to fixing some of the mess that is SSL/TLS, which I personally feel is like yelling at the sea, but one has to admire his moxie (I'll see myself out). The Double Ratchet is LITERALLY based on old, trusted crypto techniques. It's been HEAVILY audited by multiple independent experts, and found to be sound. See https://eprint.iacr.org/2016/1013.pdf (useful commentary, although not necessarily authoritative, can be found at https://github.com/ipfs/notes/issues/188 for anyone who wants some context for what is a relatively dense paper) This doesn't mean that it's GUARANTEED to be sound; TLS has been repeatedly found to be "secure", and yet we still find interesting fundamental bugs in TLS (3shake is my personal favourite; a vulnerability introduced by a fix for another vulnerability) The source code is available for everyone to audit if they want: https://github.com/signalapp/libsignal-protocol-java (there are also implementations in C and Objective C in that github if Java isn't to your liking). Whether or not the various implementations of double ratchet are secure is an entirely different problem, especially with regards to things like phone numbers being used as identities etc, but I'm confident that the underlying cryptography lacks any obvious vulnerabilities. I question the whole fuarrrking point of your posts. You make some grand statements, but they lack any substance. You've got no evidence for criticising the algorithm. As I said, the code is available for you to audit yourself. If you're unable to do that, then you aren't qualified to comment on the security of the application. Stop trying to be a big boy on the internet. Quite frankly, you aren't qualified for that, either.

>>5917 >you're not qualified to evaluate MMs work >you should just trust it blindly >stop using crypto that has a solid track record >use the new unproven thing oh, it's this argument again

>>5919 I can't tell if you're trolling or not, so I'll take these in good faith. >you're not qualified to evaluate MMs work Nothing to do with Marlinspike specifically. However, If you can't audit the crypto and find an actual bug to back your theory about it being some kind of government-backdoored cryptoscheme up, then you're basically just inventing it from thin air. Either you've audited it, found nothing, and you're being disingenuous for some other reason, which makes you a piece of soykaf, or you can't audit it, and you just like playing tacticool three-letter espionage: the imageboard game. That makes you unqualified. >you should just trust it blindly Nowhere did I say that. I literally say that the individual implementations may not be secure. I say "we can audit it ourselves", and provide a link to the source code. I provide people with a link to a paper of an audit, some context which discusses concerns about it, and comment that this doesn't mean it's guaranteed to be sound, because papers are a good starting point for understanding the security posture of a solution, but not the be-all and end-all. I do say, however, that there are no obvious vulnerabilities in the crypto. But it, like all crypto, is not a silver bullet. >stop using crypto that has a solid track record >use the new unproven thing At what point did I say stop using alternative crypto? I didn't even mention any other cryptography, except for SSL/TLS. I use clients which use Signal. I also use OTR, PGP, smime, and so on, depending on the situation. All of these have their own failings. Signal the app? Android and iOS are designed so that Google and Apple can harvest metadata about app usage, that's a recipe for A Bad Time. Most messaging clients that support OTR are pieces of soykaf - libpurple, for example, should be fuarrrking set on fire. Check out their bug reports; some of them have been open for six years. PGP is unwieldy, the keyserver concept has a whole fuarrrking host of issues, and email is garbage. You can literally google "problems with PGP". Smime? fuarrrking CAs. Centralised authorities are a single point of failure. Basically, stop doing security LARPING, dicksoykaf. If you've got a point to make, back it up with evidence. Floating vague assertions about three-letter agencies is little more than soykafting in the pool.

>>5913 it bothers me that you're spreading lies and FUD. I don't care that you're an idiot, but please do it in private where we don't have to be embarrassed for you.

>>5929 To be honest, I'm pretty sure it's the same borderline schizophrenic guy who was convinced the government was hiding evidence of ancient aliens or whatever the fuarrrk in another thread. If so, he's unlikely to fuarrrk off. But I figured it was best to provide some evidence contrary to his delusional theories so that if anyone with a functioning brain shows up, they'll at least be able to understand that it's bullsoykaf.

>>5913 >it bothers me that you're spreading lies and FUD I'm not asking you to trust me MM spreads lies and FUD about federated systems and package manager security More reasons for me not to trust him I don't care if you go use signal That's your security Your security doesn't matter to me I was merely responding to the suggestion that I should trust Signal any more than I should trust Telegram Both are utter trash as far as I'm concerned

>>5936 meant for (you) >>5929

>>5936 >I was merely responding to the suggestion that I should trust Signal any more than I should trust Telegram I think the suggestion was based on the assumption that your opinions had some grounding in reality and were capable of some degree of logical thinking. I'm sure everybody is very sorry.

>trusting signal see >>4543 You're going to get rekt

>>5992 IMO its the best we have to communicate with normal-folk. They won't understand nor care to set up XMPP, for example. I've got my friends and my old parents to switch to signal. The appeal is that it requires nothing but a PH number, which is pretty undesirable for many people actually concerned about anonymity AND privacy... They way I see it is: it's privacy, vs. Anonymity. If you want to be Anonymous AND private - don't use signal. But if you want just privacy, I say signal is fine. If you have already communicated with someone via their PH number, you aren't anonymously communicating anymore - now you're 'connected' to each other in a sense, so there's no point in using anything to hide who you really are - you already know and the Feds already know. This sort of validates why one would use their phone number for signal. The encryption has been proven to be strong. The sever and client are open. US funding isn't really a solid indicator of compromise as >>4641 Points out. Additionally, many anonymous services and protocols were funded by US agencies. Tor was created by the US military, as was the internet itself. However I do agree that Moxie's past and present are suspicious. Also the notion that "decentralisation is bad" is quite idiotic.