That’s great when my bank only uses sms for mfa though.
Seriously, bank and credit card companies need to get with the program more than me and my friends.
Steam. The store front I get my video games from. Has 2-factor authentication with a short time rotating code. To secure my Steam account.
My bank uses SMS and “security questions” aka personal trivia questions.
Easy to guess with some social engineering
Or literally anyone who knows you. It’s based on the idea that strangers are the ones who will try to screw you over but everyone knows that it’s people who you know that end up screwing you over in most cases. So security questions are basically useless in all those cases.
While I agree with you, some people answer these questions with deliberately incorrect answers. If my closest friend tried to compromise my bank account with my security questions, he’d get them all wrong (and even he doesn’t know my wrong answers).
Still a bad design, though.
Right? Had a bank account once, where the login password could only have up to 8 characters. And only digits.
Lucky, mine is 6 (yes, right now in 2024)
I just checked my KeePass and turns out I still have the entry in the recycle bin.
It was 5 digits. Admittedly, that was “back in 2012,” but still. For shame, Bank Austria!Swiss (Cheese) Bank?
That’s a huge part of why I use my brokerage, Fidelity, as my main bank, they support Symantec VIP TOTP. I prefer my regular TOTP solution, but this us miles ahead of literally every other bank I’ve used.
The only bank that allowed me to use totp was a credit union. You’d think the rich ass banks could afford to hire a developer to set up good MFA.
Yeah, and just for a few months. TOTP really isn’t that complicated…
That’s wild
Ok FBI, let me know which ones to use
Are there still apps that arnt encrypted?
Telegram, for all their security claims, is basically not actually encrypted at all.
This is incorrect. Telegram is not end to end encrypted by default. But it is encrypted to and from their servers.
TLS isn’t sufficient for messaging apps in 2024
Except Telegram doesn’t use TLS :) They use MTProto.
This is not me endorsing Telegram. I’m just pointing out your mistake. Telegram has other issues but it definitely does have transport encryption.
The above commenter said that their end-to-end MTProto protocol is not enabled by default.
Defaulting to just using transport encryption like TLS on a messaging app isn’t sufficient in 2024.
MTProto is not end-to-end. MTProto is their obfuscated client-server transport encryption.
What the commenter above is referring to is Telegram defaulting to saving your messages on the server in plaintext. You can use a “secret chat” which enables end-to-end encryption, but that is separate from MTProto.
Your sentiment is correct though. Messages should not be visible in plaintext to the server.
I dont know much about it, but Wikipedia says that MTProto is specifically for “secret chats”:
For encrypted chats (branded as Secret Chats), Telegram uses a custom-built symmetric encryption scheme called MTProto.
https://en.m.wikipedia.org/wiki/Telegram_(software)#Architecture
Maybe Wikipedia is misleading here
yeah, that means not encrypted. When speaking to a web server, you are one end, and the server is the other. Tls ensures that there isn’t a man-in-the-middle.
In case of telegram, you are one end another user is the other end. Telegram themselves are, by design, a man-in-the-middle in this case. I’m not concerned about a different middleman intercepting communications between me and telegram. I’m concerned about any middleman (which includes telegram themselves) intercepting communications between me and my friend.
So no, telegram chats are not encrypted by default. Telegram can read them.
Luckily I misuse Telegram only as a system notification program.
Thank you! It winds me up so much when people parrot that claim.
Telegram is encrypted in transit and encrypted at rest on their servers. At no point is any data stored or transmitted without encryption. Whether you believe their claims of never giving out encryption keys is another matter.
My view is that if the feds wanted my chat logs that badly they wouldn’t go after Telegram, they’d go after me and my device directly, and at that point all bets are off.
There are many where the server owners can see the messages, just not anyone else between the sender and receiver.
Threema and Signal are good options that don’t do this.
Signal being an American company is also problematic.
These two are the best balance of security/convenience, however.
You can create and run your own Signal server if you don’t trust Signal.
Interesting. Are the server and client open source? Is a self-hosted server interoperable with the main ones?
Signal is completely open source and auditable by anyone: https://github.com/signalapp
if you were to create your own clone, it would not interoperate with the real one.
server location and legal jurisdiction shouldn’t matter for any truly secure messenger
What do you mean?
if a messenger is truly 0 trust end to end encryption, it doesn’t matter who owns the servers or the legal protections of data because they won’t have any data anyway. that’s why signal is so good, when they get subpoenaed the only information that they actually have is the last connection and message sent unix times or something. still secure regardless of being in the US and being run on centralized Amazon, google, and cloudflare servers.
Then the jurisdiction of software development matters. Don’t want a back door being forced into an update by the FBI.
1/20/25: FBI Orders Americans to Use Unencrypted Messaging Apps
Why not Matrix ? Its E2E nit just TLS and also it prevents vendor lock in. This way chosing a providor is really about trust and not also about having to chose the same thing what your friends use
Someone didn’t see police got into it according to another article I just saw in another post.
Different matrix
Interesting. 2 spa with similar intents with the same name? Seems odd.
I mean this comment was the first time I’ve heard of either one, but based on the original comment and that article I’m surprised to hear this.
silly question maybe but after researching China a bit for a few days, I’m genuinely curious: I like supporting the LGBTQ cause, which I could see making me want to avoid Trump probing, but from what I researched, China gov is not against LGBTQ. So is there any specific reason I should fear China looking at my stuff?
Is it basically if I have account info in messages they would hack my accounts?https://www.chinafile.com/reporting-opinion/viewpoint/how-crackdown-transformed-lgbtq-activism-china
Looks like they’re cracking down on LGBT
interesting! thanks for sharing!
