Transcription
Signal, Telegram, WhatsApp, ProtonMail. 210. Nota. What do these encrypted applications and services have in common that make them unsafe? After all, they're encrypted, right?
Today, we're going to challenge your intellect with the correct kind of thinking so you understand where the privacy dangers lurk. It's not enough to listen to pundits say, "Use this app or that email service." It is not enough to say that something is encrypted. This is actually extra dangerous because those of you who use encrypted apps are already in a subset that can be targeted as people with something to hide.
There are other factors to consider when using apps, and these are what intelligence agencies call SIGINT (Signals Intelligence). And surprisingly, the lack of understanding of these factors can lead to some damning evidence. Are you ready for a brain puzzle? Then hang on, because it's coming up next.
What I'm going to focus on today is a type of metadata that actually reveals too much about who we are conversing with in encrypted channels. We're not going to call this SIGINT, but we're going to refer to this in examples that each of you can easily understand. And this can be used against us in many ways, even though the encryption itself may not be broken.
The problem with many of these apps and services that I listed in this video is that they're able to create what is called a relationship map. This means your identity can be derived just from who you associate with. And the reason this can happen is because all of these apps and services have a public identity. In the case of Signal, Telegram, and WhatsApp, it's your phone number. In the case of ProtonMail and Tutanota, it's your email address.
I'm going to show you why this is particularly dangerous to privacy. All these apps also have access to your contact list, which already identifies a circle of people. So if you associate with a known terrorist, even without your knowledge, then you can become labeled as a terrorist. You are already a target from using encryption because you appear to have something to hide. This is the same logic used by many when it is assumed that those who you store must be a bunch of scammers and criminals.
Before I continue, I want to remind you that I'm on the Library platform, LBRY, which is a censor-free platform, and I'm in the top 50 creators on that platform. I post my videos there ahead of YouTube. I also have a link in the description so you can follow me there.
Let me use an example of probably the worst violator of this kind of privacy, and that's WhatsApp. Just to be clear, what I'm saying is in the terms of service of Facebook, they don't hide this fact. And if you don't know this, Facebook, WhatsApp, and Instagram are all Facebook properties. Your device, meaning your phone, is fingerprinted, meaning they figure out its unique characteristics. This means that Facebook knows who the user is regardless of the Facebook platform or the differences in username because they record the device fingerprint. So if you're on WhatsApp, Facebook knows who you are on Facebook. This is obvious to them because the device is the same, so there's a link to your identity on Facebook, WhatsApp, and Instagram. It doesn't matter what your username is on each. And of course, your identity on Facebook is very clear since it has your real name there. There's more on Facebook, your identity is crowd-verified by family, all within the same location by tagging others as family and friends and classmates. Your photos coincide with locations of other relatives using Facebook, and they can see you gathered during holidays, again with intersecting locations. So it should be clear here that when you use WhatsApp, your identity is precisely known, and your relationships are clearly established. In fact, your spouse, children, siblings, and so on are clearly identified in your profile.
Now, you want to have an extramarital affair. None of my business what you do, but I want to exercise your brain here. You decide that you're going to talk privately to the other person via WhatsApp. Yes, WhatsApp is encrypted, even claimed as end-to-end encryption like Signal or Telegram, which is not always true, but for this video, I will not get into that. I will assume that this conversation with the other party is end-to-end encrypted. So it's an affair, and common sense tells us that conversations will occur when each other's spouse is not present. I would expect conversations at off hours. I would expect an intense amount of conversation at those moments, suggesting more than a casual talk. What does Facebook know about this? Let's analyze. Two people are conversing on Facebook, and Facebook knows their identity, their Facebook identity. Strangely, these two people will probably have no friend connection on Facebook, and even more interesting, there will appear to be two separate circles of relatives, and both parties state to be married. Yet, the conversations are more intense and sustained than conversations with spouses. You can see here that relationship maps do a pretty good job of identifying who you are and even what you're doing.
Now, some of you have good privacy practices. You use a VPN, you have pseudo-anonymity on the internet, and so on. But just by choice of a social media or messaging platform, you are clearly identified by your relationship circle. And this privacy breach can happen because all of these apps have a public identity and collect public data.
This reminds me of another problem, a little bit off topic, but completely supportive of what I'm saying. You get a burner phone because you think you can hide your identity, but you call your mother or your wife every day. So you're not identified by your current device phone number, but who you are connecting to. Signal and Telegram, though popular as secure platforms, have the same problem as WhatsApp with Facebook, a little less extreme because the only identity you've given them in theory is your phone number and a contact list. But even that is enough.
Let's say I'm in law enforcement. I'm looking for suspects in a hacking case. I have a list of these suspects, and I've already subpoenaed the phone numbers of the suspects, which is easily acquired from the carriers. This is hard to hide because of Know Your Customer (KYC) laws. All I do then is to plug in those phone numbers into a contact list, then I upload a contact list to all the E2EE apps like Signal, Telegram, and WhatsApp. Those apps will dutifully tell me which of these people are on these apps. I will then get a list of people with something to hide. These people move up to the top of my surveillance list. Do you see how this is a breach of privacy?
Let me give you another example, and this relates to supposedly secure email services like ProtonMail, Tutanota, Hushmail, and so on, and show you how your conversations may lose their secrecy. One of the reasons I have a particular knowledge of an email service like ProtonMail is because I wrote this kind of application many years ago. I did a test of the service for a few months just to see how it worked, and while the encryption of the messages was nice to see, I noticed the extreme amount of metadata available to me. First, I could see all the non-encrypted email. Most people will use these accounts as their primary email, and so you are easily identified by non-encrypted mail that a third party can now read. From the IP address that's in each email header to the actual conversations with insurance agents, accountants, schools, and so on, it is not difficult to get each person's full identity and even home address. So while you spend all your time thinking that any ProtonMail to ProtonMail is secure or to Tutanota, you're not thinking about all the other inter-domain mail that has information about you.
Someone suggested that these email services could be controlled by a three-letter agency. While I have no comment on this since I don't have any facts, if I were an intelligence agency and I want to collect information, I'd set up a privacy service honeypot like this that is chock full of metadata. It doesn't matter that I can't read the encrypted messages. I know someone will respond to me and say, "You're wrong. I only use ProtonMail with particular contacts." Which I already know will be false. If you advertise your ProtonMail account, so your account will have a mix of non-ProtonMail activity. If you publicize your email address, and that inter-domain email will of course be the death of you. Death by 8,000 paper cuts of metadata.
Here's another thought that people don't think about. So some of you use ProtonMail and Tutanota correctly, which is only for a specific and small set of people for each email address and only inside the domain of ProtonMail or Tutanota. Single purpose and only for people with a ProtonMail account. In other words, intra-domain conversations only. Okay, that makes it safer in your mind. But again, you can't control this because of the other party you're talking to. Has a contact list and relationship map and identity metadata from a public ProtonMail account, then you are also identified to be in this person's circle. You get data contaminated even though you're doing your best to protect your privacy.
Let me give you another example of how privacy can be ruined using a contact list. I don't have a real Facebook account. I did have a test Facebook account that had no friends, no posts, no photos, not a real name. I just used it to test the privacy flaws of Facebook. One of the things I often check is the recommended friends. As long as the recommended friends are not people I actually know, then I'm doing a good job of not getting fingerprinted. One day, I went into this Facebook account and with all the protections I do (Tor, VPN, browser isolation, and so on), I was surprised to see that it was recommending friends that were people I actually knew. This really shocked me, and I realized then that I made a mistake. I made an email address for just this particular use on Facebook, and I forgot that I gave this email to a particular organization I belong to. So during a mass mailing of this organization, my email address reached some of the people on the list and got imported to their contact list. Then those contact lists were uploaded to Facebook later, and then I was tainted because now my test account was tainted, and I could easily now be identified with a general location just from my association with people on my contact list. Those associations can be implied. It could be an employer, a club, a church, a political party, and so on. Just by looking at the common intersections of activities of people in a contact list, you can easily be profiled.
Is it possible to use some of these apps in a safe way? Yes, but very carefully and with deep thought. Since the fear is the establishing of a relationship map, there is a relationship map that is already publicly known and uncomplicated, and that is with family members. So if you use Signal with family members and not upload a contact list, is there an issue? No. I use Signal with family. It has the best voice over IP with encryption and has a mostly safe video calling, not 100%, but good enough for casual use. Would I use Signal with people I don't know or don't want to be associated with? Hell no. And I'm not going to give out my phone number.
Would I use ProtonMail or Tutanota? Now, this is hard to justify because it is so easy for someone to find your ProtonMail or Tutanota account and send you emails that are completely readable and implicate you in their circle. So I'd rather have my own private email server because then I don't have to worry about someone else correlating this metadata. Now, I've said this before, all emails aren't safe, so you've got to use it in kind of a limited way. My intra-domain conversations are completely private, meaning inside my domain only. My inter-domain traffic is visible, but at least not centrally collected by a third-party company. And here, I don't even need encryption. It is collected centrally by the three-letter agencies, but that I cannot help.
So people are quick to tell me what apps I should use because of such and such encryption when the actual problem is the public identity and the contact list, all elements in the creation of a scary relationship map. In the Snowden movie, the relationship map was used to justify surveillance by the NSA using several degrees of separation from a known target, which I think was a Saudi banker. The NSA could tell who was connected to whom based on metadata from conversations on phones, messaging, and so on. And in the movie, the target was actually someone the NSA agent knew, and it was used to justify spying on family, girlfriends, enemies, and so forth.
If you want to be safer on the internet, think, people. This is more complex than some pundits claim. You need to be aware of contact lists, identities, and other metadata like intersections of locations. Don't believe everyone that claims that some new platform is best for you. I see those pushing a platform like Matrix, XMPP, and so on without the rigorous thought process about what happens to the metadata and relationship maps or SIGINT.
The best way to protect yourself on the internet is to only use services that have no public identity, meaning not requiring an email, phone number, real name, or some permanent identity tag, and a service that does not upload a contact list. Unfortunately, you will find it hard to find popular apps that collect no metadata such as these. I made my own app, Brax.me, which is a privacy platform. Not popular, but it's privacy-based because it collects no identity or contact list. Believe it or not, you can make even Twitter, which has no encryption, a safe platform if you make sure you use no identity and you understand how you can use it.
If you found this video interesting, it would be really great if you subscribe to this channel. I will get you intellectually stimulated, that's for sure. Maybe hit that like button if I gave you something positive. Thank you.
[Music]