As for #XMPP+#OMEMO clients, I can recommend @gajim / #gajim & @monocles / #monoclesChat hands-down, as both are super-easy to setup and get even abdolute #TechIlliterates rollin'...

#xmpp #omemo #gajim

Replied in thread

**Kevin Karhan** @kkarhan@infosec.space · Feb 21 *

Feb 21 *

Kevin Karhan @kkarhan@infosec.space

@truls46 Ein gutes Gegenbeispiel zu @signalapp ist @monocles / #monoclesChat:

Es werden keine persönliche Daten verlangt!
Es wird ein offener Standard (#XMPP+#OMEMO) genutzt, sodass #SelfCustody und #Datenhoheit gewährleistet ist!
Der Dienst ist zwar kostenpflichtig (€2 p.m.), aber komplett anonym bezahlbar (inkl. #Monero & #CashByMail)!
Nutzung von @torproject #Tor wird nicht verhindert oder blockiert; @guardianproject / #Orbot wird unterstützt!
In #Deutschland gibt's immernoch #Rechtsstaatlichkeit, anders als in den #USA!
Anders als #Signal ist #monocles ehrlich, was Sicherheit und Datenschutz angeht...

Ich denke mal das sollte hinreichend meine Argumebte darlegen.

Kernpunkt ist und bleibt: Signal ist bestenfalls gemeingefährlich-inkompetent oder ein #Honeypot!

docs.monocles.eumonocles chat - monocles Documentation

#honeypot

Replied in thread

**Kevin Karhan** @kkarhan@infosec.space · Feb 21

Feb 21

Kevin Karhan @kkarhan@infosec.space

@pixelschubsi @erebion @inaruck so oder so sind alle aktuellen #XMPP-Clients, besonders @monocles / #monoclesChat & @gajim / #gajim warnen ganz eindeutig gegen unverschlüsselte kommunikation!

Außerdem kann ich schneller #TechIlliterates auf #XMPP+#OMEMO onboarden als irgendwer eine anonyme #SIM oder #eSIM mit #Rufnummer besorgen kann.

Zumal auch das nen Kostenfaktor ist, wohingegen es drölfzig Optionen gibt was XMPP angeht!

Replied in thread

**Kevin Karhan** @kkarhan@infosec.space · Feb 20

Feb 20

Kevin Karhan @kkarhan@infosec.space

@inaruck ich hab' Leute konsequent auf #XMPP+#OMEMO migriert, weil @signalapp zentralisiert und unter #CloudAct fällt, folglich inhärent unsicher.

Ich empfehle @monocles / #monoclesChat

#monocleschat

Replied in thread

**Kevin Karhan** @kkarhan@infosec.space · Feb 20

Feb 20

Kevin Karhan @kkarhan@infosec.space

@pixelschubsi @dalias @puppygirlhornypost2 that doesn't change the inherent issues of @signalapp being #centralized, #SingleVendor & #SingleProvider compared to #XMPP+#OMEMO as in @monocles / #monoclesChat & @gajim / #gajim.

Or des anyone expect #Signal and it's staff to actually resist?

Cuz I don't!https://infosec.space/@kkarhan/113999563684987571

Infosec.SpaceKevin Karhan :verified: (@kkarhan@infosec.space)@lauren@mastodon.laurenweinstein.org no, because @signalapp@mastodon.world is subject to #CloudAct (= incompatible with #GDPR & #BDSG if you ever care!) and collects #PII in the firirm of #PhoneNumbers, which are at best pseudonymous but trivial to track and at most means that people inviting others without their consent comitted an illegal disclosure if PII! - Use *real #E2EE* with #SelfCustody of all the keys that isn't [a](https://www.youtube.com/watch?v=tJoO2uWrX1M) #proprietary #SingleVendor & #SingleProvider solution that [peddles](https://www.youtube.com/watch?v=0DSGq9FQKU4) a #shitcoin #scam! Give #XMPP+#OMEMO a shot: @monocles@monocles.social / #monocles & @gajim@fosstodon.org / #gajim. [1](https://docs.monocles.eu/apps/chat.app/) [2](https://docs.monocles.eu/services/chat.service/) [3](https://docs.monocles.eu/account/account/) [4](https://monocles.eu/more/#account-section) [5](https://monocles.chat/login)

Replied in thread

**Kevin Karhan** @kkarhan@infosec.space · Feb 14 *

Feb 14 *

Kevin Karhan @kkarhan@infosec.space

@Avitus @lispi314 @lauren THE REQUIREMENT FOR A #PhoneNumber BY @signalapp IS LITERALLY THE PROBLEM!

#KYC IS THE ILLICT ACTIVITY!!!

If you gonna say "JuSt GeT aN iMpOrTeD #SIM / #eSIM!" then you obviously expect people to have way more #financial means and #TechLiteracy than is needed to get absolute N0obs setup withb#XMPP+#OMEMO and pay for @monocles / #monoclesChat!

IOC.exchangeAvitus (@Avitus@ioc.exchange)@kkarhan@infosec.space @lispi314@udongein.xyz @lauren@mastodon.laurenweinstein.org @signalapp@mastodon.world You can register any number on Signal even a landline, ass long as you can get a 2FA SMS or phone call. Signal knows nothing about its users, nor does it attempt to. See https://signal.org/bigbrother/. All they have is the date and time you registered and the last date and time your device connected to a service. They've been subpoenaed many times but haven't been able to provide any data because they don't have it.

#sim #esim

Replied in thread

**Kevin Karhan** @kkarhan@infosec.space · Feb 13

Feb 13

Kevin Karhan @kkarhan@infosec.space

@Beggarmidas @Em0nM4stodon personally, I do consider #Smartphones an attack vector and recommend everyone to use @tails_live / @tails / #Tails or at least @torproject / #Tor via @guardianproject / #Orbot and ideally open, #PublicWiFi like @freifunk / #freifunk.

Fortunately, @monocles / #monoclesChat integrates Orbot Support so it's just a few taps to get everything tunned through Tor!

https://docs.monocles.eu/apps/torify.app/

If @signalapp cared, they would've #decentralized and put their backend on Tor and not demand #PII like a #PhoneNumber.

docs.monocles.eumonocles chat - monocles Documentation

Replied in thread

**Kevin Karhan** @kkarhan@infosec.space · Feb 13

Feb 13

Kevin Karhan @kkarhan@infosec.space

@Beggarmidas @Em0nM4stodon #Govware aside, I think @signalapp 's #architecture of being a #centralized, #proprietary, #SingleVendor & #SingleProvider "solution" that.collects #PII like #PhoneNumbers will bite it in it's rear, cuz I'd not count on @Mer__edith not breaking when facing life in prison under torturous conditions (by European Standards).

Whereas @monocles / #monoclesChat, @gajim / #gajim and other #XMPP+#OMEMO clients do real #E2EE with #SelfCustody of all the keys!

#monocleschat #gajim #xmpp

Replied in thread

**Kevin Karhan** @kkarhan@infosec.space · Feb 13

Feb 13

Kevin Karhan @kkarhan@infosec.space

@Beggarmidas @Em0nM4stodon which is why migrating away from #GAFAMs and anyone else.under #CloudAct is vital.

And that includes @signalapp [use #XMPP+#OMEMO; i.e. @monocles / #monoclesChat instead] for obvious reasons…

Twitterthaddeus e. grugq on Twitter“I’m gonna tell you a secret about “logless VPNs” — they don’t exist. Noone is going to risk jail for your $5/mo https://t.co/Q2aOQJkG4g”

#xmpp #omemo #monocleschat

**Kevin Karhan** @kkarhan@infosec.space · Feb 10 *

Feb 10 *

Kevin Karhan @kkarhan@infosec.space

Addendum: Funzt wieder. Danke an @Natanox !

Weiß irgendwer warum der #Jabber / #XMPP-#Server vom #CCC / @CCC nicht unter dessen .onion - Domain via @torproject / #Tor erreichbar ist?
https://infosec.space/@kkarhan/113974956128605484

Ist das nen #Bug von @monocles / #monoclesChat, @guardianproject #Orbot oder warum 404'd das?

#FollowerPower:

Infosec.SpaceKevin Karhan :verified: (@kkarhan@infosec.space)Seems like the #OnionService for ```jabber.ccc.de``` @ ```m2ylflyeak6i6o4hsfwcrfwcq2bbjxk6nf2rnmm7fu6qiuu3hybenzid.onion``` is down. - Can anyone else confirm? Cc: @ccc@anonsys.net @CCC@social.bau-ha.us @ccc@chaos.social @clubdiscordia@chaos.social @torproject@mastodon.social #DownForEveryoneOrJustMe #DownDetector #DownDetection #Downtime #Tor #OnionServices #CCC #Jabber #XMPP #Chat #Onion

#OnionService #Debug #Debugging

Replied in thread

**Kevin Karhan** @kkarhan@infosec.space · Feb 7

Feb 7

Kevin Karhan @kkarhan@infosec.space

@EnfysBook or even better: stop using #iOS and #Google-tainted #Android!

Good #Apps will also reject access to their storage and notifications to others, which is literally a feature one csn set/activate (#banking apps do that allVthe time!)...

@monocles / #monoclesChat allows to toggle thaf as a setting...

#monocleschat

Replied in thread

**Kevin Karhan** @kkarhan@infosec.space · Feb 3

Feb 3

Kevin Karhan @kkarhan@infosec.space

@ck @sven222 @kuketzblog problem is @signalapp is a #Centralized, #Proprietary, #SingleVendor & #SingleProvider solution that falls under #CloudAct and demands #PII in the form of #PhoneNumbers.

So even if we'd agree that #XMPP+#OMEMO as implememented in @monocles / #monoclesChat & @gajim / #gajim is bad (and #PGP/MIME over XMPP isn't good either) there are still better options than #Signal (i.e. @delta / #deltaChat which uses PGP/MIME & #IMAP-Push aka. #eMail) that don't require a #PhoneNumber, allow #SelfHosting and are truly #OpenSource with an #OpebStandard that allows for real #E2EE as in #SelfCustody of all the #Keys.

Cuz all the #advertising of Signal is close to #TrustMeBro and I'd not trust in @Mer__edith to risk jail for users!

But you do you...

Twitterthaddeus e. grugq on Twitter“I’m gonna tell you a secret about “logless VPNs” — they don’t exist. Noone is going to risk jail for your $5/mo https://t.co/Q2aOQJkG4g”

#ITsec #InfoSec #OpSec

Replied in thread

**Kevin Karhan** @kkarhan@infosec.space · Feb 3 *

Feb 3 *

Kevin Karhan @kkarhan@infosec.space

@tauon Also what goid is an encryption like @signalapp is you don't have #SelfCustody of all the keys?

Shure you could disable encryption but @monocles shows you when it's active and when not and comes with sensible defaults like having #OMEMO active per default...

I can setup over a dozen #TechIlliterates 1:1 with #XMPP accounts and #monoclesChat & @gajim / #gajim in the time it takes me to get a #nonKYC #eSIM from overseas with a phone number as mandated by @signalapp and maintaining that number for #Signal will easily cost like $2,50 p.m. at minimum.

Whereas a Data-only eSIM is way faster and cheaper to get and maintain.

In fact even legitimately acquiring and registering a #Prepaid #SIM in-store in #Germany takes longer than setting up #Fdroid & monocles chat & a XMPP account whilst on throttled #EDGEland speeds...