#MultiProvider

Kevin Karhan :verified:<a href="https://wetdry.world/@soop" class="u-url mention" rel="nofollow noopener" target="_blank">@soop</a> <a href="https://tech.lgbt/@Li" class="u-url mention" rel="nofollow noopener" target="_blank">@Li</a> <a href="https://woof.tech/@meluzzy" class="u-url mention" rel="nofollow noopener" target="_blank">@meluzzy</a> <a href="https://possum.city/@tauon" class="u-url mention" rel="nofollow noopener" target="_blank">@tauon</a> bonus points if said corpo is subject to laws that mandate them to integrate <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Govware</a> <a href="https://infosec.space/tags/Backdoors" class="mention hashtag" rel="nofollow noopener" target="_blank">#Backdoors</a> and hand over data...See <a href="https://infosec.space/tags/CloudAct" class="mention hashtag" rel="nofollow noopener" target="_blank">#CloudAct</a>: <a href="https://en.wikipedia.org/wiki/CLOUD_Act" rel="nofollow noopener" translate="no" target="_blank">https://en.wikipedia.org/wiki/CLOUD_Act</a><ul><li><a href="https://infosec.space/tags/TLDR" class="mention hashtag" rel="nofollow noopener" target="_blank">#TLDR</a>: Only <a href="https://infosec.space/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenSource</a>, <a href="https://infosec.space/tags/MultiVendor" class="mention hashtag" rel="nofollow noopener" target="_blank">#MultiVendor</a> & <a href="https://infosec.space/tags/MultiProvider" class="mention hashtag" rel="nofollow noopener" target="_blank">#MultiProvider</a> solutions that one can <a href="https://infosec.space/tags/SelfHost" class="mention hashtag" rel="nofollow noopener" target="_blank">#SelfHost</a> can be trustworthy at all...</li></ul>This is why <a href="https://infosec.space/tags/IRC" class="mention hashtag" rel="nofollow noopener" target="_blank">#IRC</a> & <a href="https://infosec.space/tags/XMPP" class="mention hashtag" rel="nofollow noopener" target="_blank">#XMPP</a> outlived <a href="https://infosec.space/tags/ICQ" class="mention hashtag" rel="nofollow noopener" target="_blank">#ICQ</a> & <a href="https://infosec.space/tags/Skype" class="mention hashtag" rel="nofollow noopener" target="_blank">#Skype</a> and why <a href="https://infosec.space/tags/Mumble" class="mention hashtag" rel="nofollow noopener" target="_blank">#Mumble</a> & <a href="https://infosec.space/tags/JitsiMeet" class="mention hashtag" rel="nofollow noopener" target="_blank">#JitsiMeet</a> will outlive <a href="https://infosec.space/tags/discord" class="mention hashtag" rel="nofollow noopener" target="_blank">#discord</a> & <a href="https://infosec.space/tags/GoogleMeet" class="mention hashtag" rel="nofollow noopener" target="_blank">#GoogleMeet</a>!

Kevin Karhan :verified:<a href="https://mastodon.social/@stman" class="u-url mention" rel="nofollow noopener" target="_blank">@stman</a> <a href="https://infosec.exchange/@Sempf" class="u-url mention" rel="nofollow noopener" target="_blank">@Sempf</a> <a href="https://chaos.social/@LaF0rge" class="u-url mention" rel="nofollow noopener" target="_blank">@LaF0rge</a> yes.Because physical SIMs, like any "cryptographic chipcard" (i.e. <a href="https://social.nitrokey.com/@nitrokey" class="u-url mention" rel="nofollow noopener" target="_blank">@nitrokey</a> ) did all that fancy public/private crypto on silicon and unless that was compromizeable (which AFAICT always necessistated physical access to the <a href="https://infosec.space/tags/SIM" class="mention hashtag" rel="nofollow noopener" target="_blank">#SIM</a>, espechally in pre-<a href="https://infosec.space/tags/OMAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#OMAPI</a> devices) the SIM wasn't 'cloneable' and the weakest link always had been the <a href="https://infosec.space/tags/MNO" class="mention hashtag" rel="nofollow noopener" target="_blank">#MNO</a> /.<a href="https://infosec.space/tags/MVNO" class="mention hashtag" rel="nofollow noopener" target="_blank">#MVNO</a> issueing (may it be through <a href="https://infosec.space/tags/SocialHacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#SocialHacking</a> employees into <a href="https://infosec.space/tags/SimSwapping" class="mention hashtag" rel="nofollow noopener" target="_blank">#SimSwapping</a> or LEAs showng up with a warrant and demanding "<a href="https://infosec.space/tags/LawfulInterception" class="mention hashtag" rel="nofollow noopener" target="_blank">#LawfulInterception</a>"):<ul><li>These "attack vectors" were known and whilst unfixable they could at least be mitigated by i.e. NEVER using a <a href="https://infosec.space/tags/PhoneNumber" class="mention hashtag" rel="nofollow noopener" target="_blank">#PhoneNumber</a> for anything and/or using anonymously obtained <a href="https://infosec.space/tags/SIMs" class="mention hashtag" rel="nofollow noopener" target="_blank">#SIMs</a>. But more and more services like <a href="https://mastodon.world/@signalapp" class="u-url mention" rel="nofollow noopener" target="_blank">@signalapp</a> did <a href="https://infosec.space/tags/regression" class="mention hashtag" rel="nofollow noopener" target="_blank">#regression</a> demanding <a href="https://infosec.space/tags/PII" class="mention hashtag" rel="nofollow noopener" target="_blank">#PII</a> and more and more nations criminalized <a href="https://infosec.space/tags/AnonymousSimCards" class="mention hashtag" rel="nofollow noopener" target="_blank">#AnonymousSimCards</a> under utterly <a href="https://infosec.space/tags/cyberfacist" class="mention hashtag" rel="nofollow noopener" target="_blank">#cyberfacist</a> & <a href="https://infosec.space/tags/FalsePretenses" class="mention hashtag" rel="nofollow noopener" target="_blank">#FalsePretenses</a>!</li></ul>Add to that the regression in flexibility: Unlike a <a href="https://infosec.space/tags/SimCard" class="mention hashtag" rel="nofollow noopener" target="_blank">#SimCard</a> which was designed as a vendor-independent, <a href="https://infosec.space/tags/MultiVendor" class="mention hashtag" rel="nofollow noopener" target="_blank">#MultiVendor</a>, <a href="https://infosec.space/tags/MultiProvider" class="mention hashtag" rel="nofollow noopener" target="_blank">#MultiProvider</a>, device agnostic unit to facilitate the the <a href="https://infosec.space/tags/authentification" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentification</a> and <a href="https://infosec.space/tags/encryption" class="mention hashtag" rel="nofollow noopener" target="_blank">#encryption</a> in <a href="https://infosec.space/tags/GSM" class="mention hashtag" rel="nofollow noopener" target="_blank">#GSM</a> (and successor standards), <a href="https://infosec.space/tags/eSIMs" class="mention hashtag" rel="nofollow noopener" target="_blank">#eSIMs</a> act to restrict <a href="https://infosec.space/tags/DeviceFreedom" class="mention hashtag" rel="nofollow noopener" target="_blank">#DeviceFreedom</a> and <a href="https://infosec.space/tags/ConsumerChoice" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConsumerChoice</a>, which with shit like <a href="https://infosec.space/tags/KYC" class="mention hashtag" rel="nofollow noopener" target="_blank">#KYC</a> per <a href="https://infosec.space/tags/IMEI" class="mention hashtag" rel="nofollow noopener" target="_blank">#IMEI</a> (i.e. <a href="https://infosec.space/tags/Turkey" class="mention hashtag" rel="nofollow noopener" target="_blank">#Turkey</a> demands it after 90 days of roaming per year) und <a href="https://infosec.space/tags/lMEI" class="mention hashtag" rel="nofollow noopener" target="_blank">#lMEI</a>-based <a href="https://infosec.space/tags/Allowlisting" class="mention hashtag" rel="nofollow noopener" target="_blank">#Allowlisting</a> (see <a href="https://infosec.space/tags/Australia" class="mention hashtag" rel="nofollow noopener" target="_blank">#Australia</a>'s shitty <a href="https://infosec.space/tags/VoLTE" class="mention hashtag" rel="nofollow noopener" target="_blank">#VoLTE</a> + <a href="https://infosec.space/tags/2G" class="mention hashtag" rel="nofollow noopener" target="_blank">#2G</a> & <a href="https://infosec.space/tags/3G" class="mention hashtag" rel="nofollow noopener" target="_blank">#3G</a> shutdown!) are just acts to clamp down on <a href="https://infosec.space/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#privacy</a> and <a href="https://infosec.space/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a>.<ul><li>And with <a href="https://infosec.space/tags/EID" class="mention hashtag" rel="nofollow noopener" target="_blank">#EID</a> being unique per <a href="https://infosec.space/tags/eSIM" class="mention hashtag" rel="nofollow noopener" target="_blank">#eSIM</a> (like the <a href="https://infosec.space/tags/IMEI" class="mention hashtag" rel="nofollow noopener" target="_blank">#IMEI</a> on top!) there's nothing stopping <a href="https://infosec.space/tags/cyberfacist" class="mention hashtag" rel="nofollow noopener" target="_blank">#cyberfacist</a> regimes like "P.R." <a href="https://infosec.space/tags/China" class="mention hashtag" rel="nofollow noopener" target="_blank">#China</a>, <a href="https://infosec.space/tags/Russia" class="mention hashtag" rel="nofollow noopener" target="_blank">#Russia</a>, <a href="https://infosec.space/tags/Iran" class="mention hashtag" rel="nofollow noopener" target="_blank">#Iran</a>, ... from banning "<a href="https://infosec.space/tags/eSIMcards" class="mention hashtag" rel="nofollow noopener" target="_blank">#eSIMcards</a>" (<a href="https://infosec.space/tags/eSIM" class="mention hashtag" rel="nofollow noopener" target="_blank">#eSIM</a> in SIM card form factor) or entire device prefixes (i.e. all phones that are supported by <a href="https://grapheneos.social/@GrapheneOS" class="u-url mention" rel="nofollow noopener" target="_blank">@GrapheneOS</a> ), as M(V)NOs see the EID used to deploy/activate a profile (obviously they don't want people to activate eSIMs more than once, unless explicitly allowed otherwise.</li></ul>"[…] [Technologies] must always be evaluated for their ability to oppress. […] <ul><li>Dan Olson</li></ul>And now you know why I consider a <a href="https://infosec.space/tags/smartphone" class="mention hashtag" rel="nofollow noopener" target="_blank">#smartphone</a> with eSIM instead of two SIM slots not as a real <a href="https://infosec.space/tags/DualSIM" class="mention hashtag" rel="nofollow noopener" target="_blank">#DualSIM</a> device because it restricts my ability to freely move devices.<ul><li>And whilst German Courts reaffirmed §77 TKG (Telco Law)'s mandate to letting people choose their devices freely, (by declarong <a href="https://infosec.space/tags/fees" class="mention hashtag" rel="nofollow noopener" target="_blank">#fees</a> for reissue of eSIMs illegal) that is only enforceable towards M(V)NOs who are in <a href="https://infosec.space/tags/Germany" class="mention hashtag" rel="nofollow noopener" target="_blank">#Germany</a>, so 'good luck' trying to enforce that against some overseas roaming provider.</li></ul>Thus <a href="https://infosec.space/tags/Impersonation" class="mention hashtag" rel="nofollow noopener" target="_blank">#Impersonation</a> attacks in GSM-based networks are easier than ever before which in the age of more skilled than ever <a href="https://infosec.space/tags/Cybercriminals" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybercriminals</a> and <a href="https://infosec.space/tags/Cyberterrorists" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cyberterrorists</a> (i.e. <a href="https://infosec.space/tags/NSA" class="mention hashtag" rel="nofollow noopener" target="_blank">#NSA</a> & <a href="https://infosec.space/tags/Roskomnadnozr" class="mention hashtag" rel="nofollow noopener" target="_blank">#Roskomnadnozr</a>) puts espechally the average <a href="https://infosec.space/tags/TechIlliterate" class="mention hashtag" rel="nofollow noopener" target="_blank">#TechIlliterate</a> User at risk.<ul><li>I mean, anyone else remember the <a href="https://infosec.space/tags/Kiddies" class="mention hashtag" rel="nofollow noopener" target="_blank">#Kiddies</a> that fucked around with <a href="https://infosec.space/tags/CIA" class="mention hashtag" rel="nofollow noopener" target="_blank">#CIA</a> director <a href="https://infosec.space/tags/Brennan" class="mention hashtag" rel="nofollow noopener" target="_blank">#Brennan</a>? Those were just using their "weapons-grade <a href="https://infosec.space/tags/boredom" class="mention hashtag" rel="nofollow noopener" target="_blank">#boredom</a>", not being effective, for-profit cyber criminals!</li></ul>And then think about those who don't have privilegued access to protection by their government, but rather "privilegued access" to prosecution by the state because their very existance is criminalized... The only advantage eSIMs broight in contrast is 'logistical' convenience because it's mostly a <a href="https://infosec.space/tags/QRcode" class="mention hashtag" rel="nofollow noopener" target="_blank">#QRcode</a> and that's just a way to avoid typos on a cryptic <a href="https://infosec.space/tags/LocalProfileAgent" class="mention hashtag" rel="nofollow noopener" target="_blank">#LocalProfileAgent</a> link.

Kevin Karhan :verified:<a href="https://m.ai6yr.org/@ai6yr" class="u-url mention" rel="nofollow noopener" target="_blank">@ai6yr</a> people need to fucking learn proper <a href="https://infosec.space/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoSec</a>, <a href="https://infosec.space/tags/OpSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpSec</a>, <a href="https://infosec.space/tags/CkmSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#CkmSec</a> & <a href="https://infosec.space/tags/ITsec" class="mention hashtag" rel="nofollow noopener" target="_blank">#ITsec</a> and that means learning to proper use <a href="https://infosec.space/tags/XMPP" class="mention hashtag" rel="nofollow noopener" target="_blank">#XMPP</a>+<a href="https://infosec.space/tags/OMEMO" class="mention hashtag" rel="nofollow noopener" target="_blank">#OMEMO</a> & <a href="https://infosec.space/tags/PGP" class="mention hashtag" rel="nofollow noopener" target="_blank">#PGP</a>/MIME.<ul><li><a href="https://infosec.space/tags/Lazyness" class="mention hashtag" rel="nofollow noopener" target="_blank">#Lazyness</a> is not an excuse!</li></ul><a href="https://venera.social/profile/tails_live" class="u-url mention" rel="nofollow noopener" target="_blank">@tails_live</a> / <a href="https://fosstodon.org/@tails" class="u-url mention" rel="nofollow noopener" target="_blank">@tails</a> / <a href="https://infosec.space/tags/Tails" class="mention hashtag" rel="nofollow noopener" target="_blank">#Tails</a> exists. <a href="https://fosstodon.org/@gajim" class="u-url mention" rel="nofollow noopener" target="_blank">@gajim</a> / <a href="https://infosec.space/tags/Gajim" class="mention hashtag" rel="nofollow noopener" target="_blank">#Gajim</a> exists. <a href="https://monocles.social/@monocles" class="u-url mention" rel="nofollow noopener" target="_blank">@monocles</a> / <a href="https://infosec.space/tags/monoclesChat" class="mention hashtag" rel="nofollow noopener" target="_blank">#monoclesChat</a> exists. <a href="https://chaos.social/@delta" class="u-url mention" rel="nofollow noopener" target="_blank">@delta</a> / <a href="https://infosec.space/tags/deltaChat" class="mention hashtag" rel="nofollow noopener" target="_blank">#deltaChat</a> exists. <a href="https://mastodon.online/@thunderbird" class="u-url mention" rel="nofollow noopener" target="_blank">@thunderbird</a> / <a href="https://infosec.space/tags/Thunderbird" class="mention hashtag" rel="nofollow noopener" target="_blank">#Thunderbird</a> exists. <a href="https://mastodon.earth/@cryptoparty" class="u-url mention" rel="nofollow noopener" target="_blank">@cryptoparty@mastodon.earth</a> / <a href="https://chaos.social/@cryptoparty" class="u-url mention" rel="nofollow noopener" target="_blank">@cryptoparty@chaos.social</a> / <a href="https://infosec.space/tags/CryptoParties" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoParties</a> exist. <a href="https://infosec.space/tags/Documentation" class="mention hashtag" rel="nofollow noopener" target="_blank">#Documentation</a> in writing and videos exist.<ul><li>Only <a href="https://infosec.space/tags/SelfHosting" class="mention hashtag" rel="nofollow noopener" target="_blank">#SelfHosting</a>-capable, <a href="https://infosec.space/tags/MultiVendor" class="mention hashtag" rel="nofollow noopener" target="_blank">#MultiVendor</a> & <a href="https://infosec.space/tags/MultiProvider" class="mention hashtag" rel="nofollow noopener" target="_blank">#MultiProvider</a> solutions that implement proper <a href="https://infosec.space/tags/E2EE" class="mention hashtag" rel="nofollow noopener" target="_blank">#E2EE</a> & offer you <a href="https://infosec.space/tags/SelfCustody" class="mention hashtag" rel="nofollow noopener" target="_blank">#SelfCustody</a> of all the keys can be considered <a href="https://infosec.space/tags/secure" class="mention hashtag" rel="nofollow noopener" target="_blank">#secure</a>.</li><li>Everyone who demands <a href="https://infosec.space/tags/PII" class="mention hashtag" rel="nofollow noopener" target="_blank">#PII</a> like <a href="https://infosec.space/tags/PhoneNumbers" class="mention hashtag" rel="nofollow noopener" target="_blank">#PhoneNumbers</a>, including <a href="https://mastodon.world/@signalapp" class="u-url mention" rel="nofollow noopener" target="_blank">@signalapp</a>, must be seen as inherently insecure by design - espechally when they are subject to <a href="https://infosec.space/tags/CloudAct" class="mention hashtag" rel="nofollow noopener" target="_blank">#CloudAct</a>!</li></ul>

Kevin Karhan :verified:<a href="https://chaos.social/@delta" class="u-url mention" rel="nofollow noopener" target="_blank">@delta</a> TBH, I think that <a href="https://infosec.space/tags/deltaChat" class="mention hashtag" rel="nofollow noopener" target="_blank">#deltaChat</a>, alongside <a href="https://monocles.social/@monocles" class="u-url mention" rel="nofollow noopener" target="_blank">@monocles</a> / <a href="https://infosec.space/tags/monoclesChat" class="mention hashtag" rel="nofollow noopener" target="_blank">#monoclesChat</a> is one of the few real <a href="https://infosec.space/tags/E2EE" class="mention hashtag" rel="nofollow noopener" target="_blank">#E2EE</a> <a href="https://infosec.space/tags/Chat" class="mention hashtag" rel="nofollow noopener" target="_blank">#Chat</a> & <a href="https://infosec.space/tags/Messaging" class="mention hashtag" rel="nofollow noopener" target="_blank">#Messaging</a> solutions (which allow for full <a href="https://infosec.space/tags/SelfCustody" class="mention hashtag" rel="nofollow noopener" target="_blank">#SelfCustody</a> of keys as well as being based on <a href="https://infosec.space/tags/OpenStandards" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenStandards</a> for a <a href="https://infosec.space/tags/MultiVendor" class="mention hashtag" rel="nofollow noopener" target="_blank">#MultiVendor</a> & <a href="https://infosec.space/tags/MultiProvider" class="mention hashtag" rel="nofollow noopener" target="_blank">#MultiProvider</a> ecosystem) and even out-of-band verification and key exchange...<ul><li>The main difference is that deltaChat implements <a href="https://infosec.space/tags/PGP" class="mention hashtag" rel="nofollow noopener" target="_blank">#PGP</a>/MIME on <a href="https://infosec.space/tags/IMAP" class="mention hashtag" rel="nofollow noopener" target="_blank">#IMAP</a>+<a href="https://infosec.space/tags/SMTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#SMTP</a>, which may be easier to setup in some cases and also offer an easy pipeline to archival requirements in <a href="https://infosec.space/tags/business" class="mention hashtag" rel="nofollow noopener" target="_blank">#business</a> setups whilst <a href="https://infosec.space/tags/monocles" class="mention hashtag" rel="nofollow noopener" target="_blank">#monocles</a> chat uses <a href="https://infosec.space/tags/XMPP" class="mention hashtag" rel="nofollow noopener" target="_blank">#XMPP</a>+<a href="https://infosec.space/tags/OMEMO" class="mention hashtag" rel="nofollow noopener" target="_blank">#OMEMO</a> first and supports PGP/MIME as a secondary option, making it a good option in individual setups...</li></ul>Needless to say both support using <a href="https://mastodon.social/@torproject" class="u-url mention" rel="nofollow noopener" target="_blank">@torproject</a> / <a href="https://infosec.space/tags/Tor" class="mention hashtag" rel="nofollow noopener" target="_blank">#Tor</a> via <a href="https://infosec.space/tags/Orbot" class="mention hashtag" rel="nofollow noopener" target="_blank">#Orbot</a> and thus connecting to an <a href="https://infosec.space/tags/OnionService" class="mention hashtag" rel="nofollow noopener" target="_blank">#OnionService</a> or just anonymously connecting to the server one personally chooses...<ul><li>So unless a provider explicitly bans Tor proactively, they'll work just fine.</li></ul>The advantage of XMPP is that it also allows for calls, whereas I've to see how one can do Group Chats on deltaChat at all...

Recent searches

Search options

Administered by:

Server stats: