PlasmaGuardian

Rob Braxman's content is highly inaccurate and mixes talking about real things with large amounts of his fabrications and promotion for his insecure products/services. Strongly recommend not listening to him. He's taking advantage of people who want privacy and scamming them.

2024-10-19 16:03:24 UTC

- reply

So it gets 0 points for avoiding potential privacy/security issues (N/A) but Threema gets 3? Sounds fair

2024-10-15 20:54:25 UTC

- reply

Telegram hardly qualifies as an encrypted messaging app since it doesn't have end-to-end encryption enabled by default, and there's not even an option for group chats.

2024-10-15 20:23:07 UTC

- reply

Do you mean for https://attestation.app?

2024-10-13 21:55:25 UTC

Why do people want to charge money for WiFi access?

2024-10-12 05:35:48 UTC

- reply

What would be the advantage of distributing packages built and signed by F-Droid elsewhere when the apps are functionally the same?

2024-10-12 03:16:43 UTC

- reply

Signal specifically doesn't want to be decentralized as they don't think it's possible to compete in this market while being decentralized: https://signal.org/blog/the-ecosystem-is-moving/
I don't think Nostr needs to solve the secure chat problem as SimpleX is already doing that. Should just add a filed in profile for SimpleX address as is done with Lightning, and then phase out the current unsafe DM systems. It's a massive waste of developer resources for something that is being done better already + most devs aren't qualified to audit their own creations and security audits are expensive, so if we have lots of Nostr clients implementing a theoretical private and secure DM spec (yet to exist) then we need all of those to get audited, and having lots of implementations also delays progress/adoption of new features, which is especially important when it comes to privacy security, but is not really a problem for a public social media protocol that can easily be implemented by anybody regardless of their skills.

2024-10-12 03:11:50 UTC

- reply

f-droid.org and Play Store release should have a difference package name to avoid conflicts though

2024-10-12 03:11:03 UTC

- reply

There is no difference (other than the signature of the f-droid.org version) in the case of SimpleX as it doesn't use FCM or any push provider, so there is no closed source libraries contained in any releases of the app and therefore no need for a separate variant

2024-10-09 10:31:18 UTC

- reply

He's got a new account @nprofile…0md0

2024-10-09 10:28:29 UTC

- reply

https://discuss.grapheneos.org/d/16338-highly-misleading-and-inaccurate-article-from-cybernews-about-the-pixel-9

2024-10-09 10:25:56 UTC

- reply

https://xcancel.com/GrapheneOS/status/1843894076632121547

2024-10-02 23:38:41 UTC

- reply

#cashapp #grapheneos

2024-10-02 23:13:51 UTC

@nprofile…e63u please allow GrapheneOS users to run your app.
https://grapheneos.org/articles/attestation-compatibility-guide
Thank you!

2024-10-02 20:56:16 UTC

- reply

Android 17? 15 isn't even out yet!

2024-10-02 16:39:46 UTC

- reply

And why does 🟩 = 3 points instead of 2? It just makes the difference seem larger and has no real value.

2024-10-02 16:37:54 UTC

- reply

SimpleX wins at 88 points if you stop punishing it for dodgingpossible privacy/security issues such as:
Do you get notified if a contact's fingerprint changes?
Is personal information (mobile number, contact list, etc.) hashed?
Are messages encrypted when backed up to the cloud?
All of which are N/A therefore are given a white background and not green. This site wasn't setup for an arbitrary points system.
Also
Directory service could be modified to enable a MITM attack?
There is no directory service for discovering contacts, SimpleX hosts a public group directory and it could MITK those, but that's a separate service not included in the app.. in my opinion it should get another 3 points.
I disagree that Google Messages doesn't use a directory service as phone numbers are the directory service, and the carriers could definitely MITM as they control the phone numbers.

2024-09-28 05:53:03 UTC

- reply

Web of trust

2024-09-26 07:38:59 UTC

- reply

Replicant is a dead project based on an ancient fork of LineageOS. Doesn't have anything close to the current privacy/security patches and removes firmware updates since they're ideologically against distributing them. Not at all safe to use an OS with years of missing patches. FSF recommending it is a reason to not use it.

2024-09-26 07:32:58 UTC

- reply

Cure53 wouldn't audit charlatans. Do a search for 'Cure53 CalyxOs audit' or 'Cure53 PureOS audit' and you'll see the AI is just mixing up the other things mentioned in the same paragraph/Reddit thread. It was Bazaar and Bitwarden audited, not CalyxOS and PureOS.

2024-09-26 07:24:40 UTC

- reply

> Calyx also has a great built in Firewall app to cut off apps from the internet
Datura Firewall is a fancy frontend for the leaky LineageOS network toggles. They don't block indirect network access like the GrapheneOS network permission toggles. Can be bypassed by apps using DownloadManager. It also has other features it claims to provide which it can't.
We could have an endless debate about theoretical hardware backdors, but what I wrote above can be proven.

2024-09-26 07:05:48 UTC

- reply

I can also tag @nprofile…0md0 to give a better response than I can.

2024-09-26 07:03:02 UTC

- reply

2024-09-26 07:01:06 UTC

- reply

AI is a nonsense generator.
GrapheneOS and CalyxOS are very different. GrapheneOS is a hardened OS with substantial privacy/security improvements:
https://grapheneos.org/features
CalyxOS is not a hardened OS. It greatly reduces security vs. AOSP via added attack surface, rolled back security and slow patches.
Compatibility with Android apps is also much different. GrapheneOS provides their sandboxed Google Play compatibility layer:
https://grapheneos.org/usage#sandboxed-google-play
Can run vast majority of Play Store apps on GrapheneOS, but not CalyxOS with the far more limited and less secure microG approach.
Https://eylenburg.github.io/android_comparison.htm is a third party comparison between different alternate mobile operating systems. It could include many more privacy/security features but it's a good starting point.
https://privsec.dev/posts/android/choosing-your-android-based-operating-system/ is an article with more long form comparisons between OSes.
GrapheneOS are the only ones developing a hardened OS. DivestOS is far more similar to GrapheneOS and uses some of their patches, but aims for broader device support by being based on LineageOS. DivestOS removed a lot of the mentions of GrapheneOS and even directly recommending it, due to the libel spread about GrapheneOS' developers. CalyxOS is putting users at risk by pretending to provide features it can't like it's firewall app which is just marketing fluff for the faulty LineageOS network toggles. It's on the same level as Freedom Phone. CalyxOS isn't similar at all and it's a misconception in the privacy-oriented Bitcoin and Monero community that they're making similar things. PureOS is just desktop Linux with a mobile UI. It comes along with all the issues of what it's based on.

2024-09-26 06:46:06 UTC

- reply

Hello 👋

2024-09-26 06:43:50 UTC

- reply

As long as the old npub never posts again before quantum computers are a threat, I trust you.

2024-09-23 23:13:11 UTC

- reply

Signal does not have access to messages as they are end-to-end encrypted. Signal servers could access metadata (who's talking to who and when) but historically they have a good track record: https://signal.org/bigbrother

2024-09-23 22:31:53 UTC

- reply

SimpleX also has separate sending and receiving addresses. That's why it's called simplex: https://www.geeksforgeeks.org/transmission-modes-computer-networks/

2024-09-20 19:11:11 UTC

- reply

I love Amethyst, although I'm really excited for Notedeck (Damus) to be released on Android. I managed to build the desktop version a while back and it's great.

2024-09-19 20:04:21 UTC

- reply

YES, YOU

2024-09-19 20:03:55 UTC

- reply

I wonder why the clients don't add automation detection of reply guy

2024-09-19 03:41:07 UTC

- reply

Yep, but this ones claimimg to fight off Pegasus spyware...

2024-09-19 03:28:01 UTC

- reply

On iOS it literally notifies you instantly when there's a system update rather than waiting longer due to staged rollouts. On Android it scans installed apps for known malicious APK hashes. I think you can also send DNS requests through it via VPN service. Not that useful at all and can be achieved for free via other means (Google Play has Play Protect so it does the same thing), definitely not fighting off Pegasus spyware.

2024-09-19 03:07:45 UTC

- reply

It's simply not possible with the way Android and iOS apps work (app sandbox). The author of that article is complaining about the fact that Apple/Google don't give security software special access (so they can't sell their scam as easily). The real attack surface comes from highly privleged EDR software like CrowdStrike (and iVerify if they gkt the access they wanted), not mobile phones.

2024-09-19 01:09:14 UTC

This is hilarious to read, they're claimimg to have detected Pegasus spyware via a mobile app 🤣 https://iverify.io/blog/why-i-joined-iverify

2024-09-18 21:16:02 UTC

- reply

Trail of Bits lost credibility since iVerify: https://xcancel.com/GrapheneOS/status/1828651999300124796
https://www.trailofbits.com/products/

2024-09-18 15:05:19 UTC

- reply

Switch to the simplex.apk (64 bit) GitHub release and keep it updated via Obtainium: https://github.com/ImranR98/Obtainium
If you were using f-droid.org release then you'll need to export database and uninstall the app first as they have different signing key, if you were using app.simplex.chat repo then it's the same and the GitHub release will install over it.

2024-09-17 15:43:30 UTC

- reply

Signal is end-to-end encrypted by default, Telegram only has optional secret chats for 1:1 chats. They can access most of the messages.

2024-09-17 15:42:29 UTC

- reply

Unplugged are scammers: https://x.com/GrapheneOS/status/1808161048194671006

2024-09-17 14:41:55 UTC

- reply

Carrier-based calls/texts that lack end-to-end encryption is at the wrong end of the spectrum.

2024-09-17 13:24:42 UTC

- reply

There's no secure messaging

2024-09-17 13:23:27 UTC

- reply

The goal is still to reduce trust in servers, and SimpleX does that better than any other private messaging network, but having anonymous node operators doesn't improve privacy, as they've got no incentive not to store the user data they can access.
You should use Tor if you require transport layer security, but that's not a solution for everyone.

2024-09-17 04:39:25 UTC

- reply

A direct P2P connection over the internet is not private, as both ISPs can see who you're connecting to. P2P over an overlay network like Tor or I2P is better, but still not perfect: https://discuss.privacyguides.net/t/simplex-vs-cwtch-who-is-right/19256/8
I think many of those same points apply to I2P?

2024-09-17 03:24:48 UTC

- reply

Nostr and SimpleX can coexist. One as a publishing, or "social media" network, the other as the most private and secure communication network.

2024-09-17 03:20:34 UTC

- reply

I completely agree, this is what I meant, I probably shouldn't write stuff when I'm tired. I don't think Nostr private messaging and SimpleX can coexist without users' safety being harmed. The ones who already are aware go out of their way to avoid Nostr DMs, and a lot even put links in their Nostr profiles. This means the only people who are using Nostr DMs are people who don't understand the lack of privacy and security, which is very dangerous.

2024-09-17 03:08:27 UTC

- reply

If you're talking about the Session messahing app, then not really.
https://x.com/SimpleXChat/status/1754455524068720762
https://x.com/SimpleXChat/status/1802432603150311442
Encryption security was downgraded based on incrorrect statements, transport layer uses their own onion routing network that requires node operators to invest ~$1000 in a cryptocurrency.
You're better off using SimpleX over Tor.

2024-09-17 02:58:07 UTC

- reply

Sadly a lot of the developers see it as competition rather than something that can coexist. I believe it would be beneficial for both platforms too. User safety is being put at risk with the current system.

2024-09-17 02:49:49 UTC

- reply

https://x.com/SimpleXChat/status/1835393532250530132

2024-09-17 02:26:18 UTC

- reply

The developer has said they think SimpleX is more private, but I think Nostr clients in general need to add some big text with warning symbols and sirens to warn about the insecurity of DMs. Also, this should be added: https://github.com/retrnull/garnet/issues/8 ⚠️🚨

2024-09-17 01:32:59 UTC

- reply

The solution is to stop using phones that violate user rights by preinstalling a bunch of unnecessary proprietary services. https://grapheneos.org
#nevent1q…e8dx

2024-09-17 01:23:47 UTC

- reply

SimpleX gets 88 points once you stop punishing them for avoiding those privacy/security issues in the first place.

2024-09-17 01:05:42 UTC

- reply

This points system is punishing apps for for completely avoiding privacy/security problems. If it's not applicable then it should be counted as green, such as:
-Do you get notified if a contact's fingerprint changes?
-Is personal information (mobile number, contact list, etc.) hashed?
-Are messages encrypted when backed up to the cloud?

2024-09-17 00:46:23 UTC

- reply

Depends if quantum computers can break the cryptography.

2024-09-17 00:33:09 UTC

- reply

Someone can easily run a SimpleX relay anonymously, it's no different to Nostr in that sense. It's just the 1 company operating the preset servers in the app, but there's planned to be more in the future, and all of those will be hosted by known companies that signed a legally binding contract to run unmodified server code, and not logging IP addresses except for DDoS prevention. The idea is that anonymous relay operators have no incentive not to store the minimal user data they can access (mainly IP address). You'd want Nostr relays to be run by anonymous operators in an environment where government demand for censorship is high, as relay operators can't be compelled to takedown content if nobody knows who they are. Delivery redundancy is planned (https://github.com/simplex-chat/simplex-chat/issues/3563). Censorship on SimpleX isn't possible in the same way as it is on a public social network, as everything is end-to-end encrypted, so there's not a lot of reason to be actively using multiple relays at the same time for delivering messages, unlike Nostr.

2024-09-16 23:22:09 UTC

- reply

This is what I mean. Cashu has lots of support, but not FediMints. There's a single custodian that can steal your coins. FediMints has multiple custodians, so it seems clearly better, but it has very little support. I might be missing something, but it seems very weird.

2024-09-16 01:42:47 UTC

- reply

I meant to say mobile wallets, there's some command line tools but I can't be bothered with that

2024-09-16 01:41:57 UTC

- reply

Ok. It seems better than cashu because there's multiple custodians supposedly, idk how it works but there's far less support than cashu. Only mutiny wallet and fedi support it, mutiny wallet is shutting down..

2024-09-15 17:44:50 UTC

- reply

What about FediMints

2024-09-15 01:00:12 UTC

- reply

The port is blocked: https://x.com/SimpleXChat/status/1835072004921475219
That's the Mastodon bridge since it wasn't posted on Nostr, and your reply doesn't appear to have gone through on it.

2024-09-14 09:40:12 UTC

- reply

That's why forward secrecy and break-in recovery is used in secure messaging apps.

2024-09-13 22:46:52 UTC

- reply

I hope you're being sarcastic but you really shouldn't joke when it comes to privacy and security. Nostr DMs, the way they're currently implemented in most clients, are simply unsafe. NIP-04 and NIP-44 don't provide forward secrecy, break-in recovery, deniability (if either sender or recipient is compromised, or wants to prove a message was sent), or post-quantum cryptography. GiftWraps appear to do a good job at protecting DM metdata from public view, but not the server operators.

2024-09-07 15:13:41 UTC

- reply

https://www.minibits.cash/

2024-09-07 13:33:27 UTC

- reply

Signal onboarding is good, most people didn't understand why I wanted them to switch apps, but it was fine once they finished setting it up.

2024-09-06 18:02:40 UTC

- reply

#nevent1q…rms0

2024-09-06 17:50:36 UTC

- reply

And Nostr DMs are simply unsafe at the moment.

2024-09-06 17:48:32 UTC

- reply

SimpleX could use Nostr for discovery, but it requires support from clients first. It would be very easy to add a field for SimpleX addresses, as was made in this proposal: https://github.com/retrnull/garnet/issues/8
Once this is added, SimpleX could add in-app support for discovery via Nostr, similar to how many Lightning wallets already do it.

2024-09-06 17:27:31 UTC

- reply

Signal added a post-quantum key exchange: https://signal.org/blog/pqxdh/

2024-09-06 17:26:04 UTC

- reply

Session is not very decentralized as Tor because it requires imvesting ~$1000 in a token (which is being replaced soon...) to run a node. Tor nodes can be ran by anyone. Session downgraded their encryption based on incorrect statements: https://getsession.org/blog/session-protocol-explained
Anyone can run the SimpleX servers, there's many other public instances you can use instead. IP address is indeed an identifier, but not part of the messaging protocol itself. You always have to expose your IP address to third parties, it's just your choice who sees it (SimpleX servers, VPN, Tor, etc).
Tor is also fully supported with in-app SOCKS proxy support and effectively kill switch for not connecting directly to non-onion servers, as well as .onion server mirrors. They wrote about it here: https://simplex.chat/blog/20240604-simplex-chat-v5.8-private-message-routing-chat-themes.html

2024-09-06 17:08:50 UTC

- reply

Does Keychat use post-quantum encryption?

2024-09-06 17:08:05 UTC

- reply

To match SimpleX, you need to have the same encryption (Signal Double Ratchet Algorithm) + post-quantim ratchets (like Apple & SimpleX have done https://security.apple.com/blog/imessage-pq3/
https://simplex.chat/blog/20240314-simplex-chat-v5-6-quantum-resistance-signal-double-ratchet-algorithm.html )
As well as using pairwise identifiers for messaging queues (separate sending receiving servers and address) which should be done automatically, behind the scenes so users don't have to create a separate identity for each contact.

2024-09-06 16:52:53 UTC

- reply

Privacy saves you money.
Companies use information about who you are connected with to estimate your income, sell you the products you don't really need, and to determine the prices.
Online retailers know that people with lower incomes are more likely to make urgent purchases, so they may charge higher prices or remove discounts.
Some financial and insurance companies use social graphs to determine interest rates and premiums. It often makes people with lower incomes pay more — it is known as 'poverty premium'.

2024-09-04 21:28:43 UTC

- reply

By 'it' I mean mean NIP-44 encryption.

2024-09-04 21:22:59 UTC

- reply

NIP-59 seems to do a good job at hiding metadata from public view but it doesn't provide
- break-in recovery.
- repudiation (deniability).
- (lack of) visibility of connection graph to observers.
- fixed message sizes (although it can be provided by the specific app)
- resistance to Shore algorithm (PQ encryption).
I can add that it definitely doesn't provide forward secrecy.
It's concerning that these developers simply don't seem qualified to properly implement secure messaging, and I believe users are being put at risk, although I do see a lot of people just putting @nprofile…cway addresses in their profile anyway.

2024-09-04 21:13:50 UTC

- reply

#nevent1q…ugx4

2024-09-04 21:09:13 UTC

- reply

I'd like it if they fixed the privacy of DMs first.. it's also strange that there's no way to turn them off

2024-09-03 23:21:49 UTC

- reply

Apparently people use their zaps from here to go and buy a coffee, so it'd be good if that link was broken.

2024-09-03 17:43:13 UTC

This is a reminder that majority of DM metadata (whom you're talking to and when) is public and images in Amethyst are uploaded to a webserver without end-to-end encryption

2024-09-03 14:45:06 UTC

- reply

#nevent1q…n8zd

2024-09-02 23:03:29 UTC

- reply

NosTuber

2024-09-01 19:34:52 UTC

- reply

@nprofile…cway

2024-08-27 12:48:17 UTC

- reply

GrapheneOS and CalyxOS are very different. GrapheneOS is a hardened OS with substantial privacy/security improvements:
grapheneos.org/features
CalyxOS is not a hardened OS. It greatly reduces security vs. AOSP via added attack surface, rolled back security and slow patches.
Compatibility with Android apps is also much different. GrapheneOS provides our sandboxed Google Play compatibility layer:
grapheneos.org/usage#sandboxe…
Can run vast majority of Play Store apps on GrapheneOS, but not CalyxOS with the far more limited and less secure microG approach.
https://eylenburg.github.io/android_comparison.htm is a third party comparison between different alternate mobile operating systems. It could include many more privacy/security features but it's a good starting point.
https://privsec.dev/posts/android/choosing-your-android-based-operating-system/ is an article with more long form comparisons between OSes.

2024-08-26 17:18:06 UTC

- reply

Don't use Session though.

2024-08-25 13:14:11 UTC

- reply

> Large groups are still abysmal on simplex.
Getting fixed this year.

2024-08-25 13:07:40 UTC

- reply

https://simplex.chat/contact#/?v=2-7&smp=smp%3A%2F%2Fhejn2gVIqNU6xjtGM3OwQeuk8ZEbDXVJXAlnSBJBWUA%3D%40smp16.simplex.im%2F6sgt5HXO67waS511ySjAjMdfVTlxH40f%23%2F%3Fv%3D1-3%26dh%3DMCowBQYDK2VuAyEAEnBG0EnXUdVnkDclCItASoAeCedLR6ohSzaKZutFtQw%253D%26srv%3Dp3ktngodzi6qrf7w64mmde3syuzrv57y55hxabqcq3l5p6oi7yzze6qd.onion&data=%7B%22type%22%3A%22group%22%2C%22groupLinkId%22%3A%22kWH8D7W0oqPF9Rxa3dVgGQ%3D%3D%22%7D

2024-08-25 12:56:50 UTC

- reply

#nevent1q…p8at

2024-08-25 12:48:49 UTC

- reply

I don't read the news. Telegram markets itself as a private & secure messaging app yet fails to provide default end-to-end encryption, or any end-to-end encryption in groups. Telegram, and especially Durov have heavily participated in misinformation campaigns targeting actual private messaging apps with always enabled, properly implemented end-to-end encryption such as Signal. Should stop getting any advice from anyone who told you to use Telegram as a private messenger.

2024-08-25 02:17:50 UTC

- reply

Durov is a fruad and a liar. He enables free speech as well as very dangerous criminals. It's obvious why they went after him as he has a bunch of unencrypted data that he won't hand over.

2024-08-20 06:30:52 UTC

- reply

I can see you've been on here for a while. It's definitely improved since you first joined, I agree that the different relays are confusing.

2024-08-20 06:00:48 UTC

- reply

Hi Sattler, I can read you. Is Waldorf doing well?

2024-08-20 05:36:37 UTC

- reply

Scan QR code from phone to sign event. Solved.

2024-08-15 15:37:31 UTC

- reply

Read the article :)

2024-08-11 14:13:23 UTC

- reply

Why does Satoshi Nakamoto mean Central Intelligence then?

2024-08-08 23:17:21 UTC

- reply

F-Droid takes a while to approve the updates, you can get it directly from SimpleX's repo instead but you will need to uninstall the app first due to having different signatures https://app.simplex.chat

2024-08-08 23:10:13 UTC

Microsoft is here to safe the day! https://learn.microsoft.com/en-us/entra/verified-id/decentralized-identifier-overview

2024-08-08 01:58:50 UTC

- reply

I love Nostr but I really don't trust the devs to make a safe messaging protocol. I'm glad we have SimpleX and I wish Nostr could be used as a discovery layer. There were talks about this last year that didn't go anywhere. I made a proposal for a contact info field to link to an external messenger like SimpleX to hopefully replace the DM button in clients with but it was declined.

2024-08-08 01:13:26 UTC

- reply

It's possible that Satoshi came up with the term cryptocurrency, he branded Bitcoin as cryptocurrency at least.

2024-08-02 18:50:48 UTC

- reply

I think Wownero suits him better
https://wownero.org/img/Wownero_Splash_Illustration.svg

2024-07-31 14:43:52 UTC

- reply

#GrpaheneOS