10

Hello I am a protester in Hong Kong.

Many protesters use telegram group. I have heard recently from the News that a group admin was tricked by the police to unlock their phone (police cannot force one to unlock their phone under the law of HK) and a list of 20k - 30k participants were exposed. (That group admin was detained by the police as an organizer.)

Personally, I know telegram was never a good choice because it uses home-grown crypto (I don't think a typical user is aware of this). However, I don't think it matters in this case.

How to prevent this from happening? Does using signal group with sealed sender help? Do we need anonymous messaging?

Source (In English): Student arrested for being admin of social media group supporting Hong Kong protests

  • 6
    Signal uses mobile number as user- identifier. If one of your group member's phone is compromised, then then the entire list of participants will be exposed. Sealed sender only prevents the server from learning the source of message delivery. Use Threema messenger. It randomly generates an ID and does not associate you with mobile number or email address. – defalt Jun 14 at 4:03
  • 2
    You might also be interested in peer-to-peer messaging. There are bluetooth-based messaging solutions for large gatherings. It however works only at the event, because the users must be in proximity of them. – Marcel Jun 14 at 6:53
6

This is hard to answer, because, depending on how hard an entity might push, anyone might still give away information/unlock his/her phone under a threat. However:

  • To mitigate accidental unlocks, you might want to have a messenger app with it's own lock, besides the phone lock.
  • To not being identifiable by the phone number itself, use a messenger identity that is not tied to the phone number
  • To however, identify you as a trusthworty source among your peers, use an app that provides a safe way to assert identities, with public/private key cryptography.

Threema, as already mentioned by @defalt, does all three. It's not free though, so you might want to look into similar alternatives.

  • 3
    Threema cryptography whitepaper: threema.ch/press-files/2_documentation/… – A. Hersean Jun 14 at 8:45
  • Thanks for highlighting these 3 criterion. I think criterion 1 can be satisfied using "Protected apps" (it uses pattern locks which is not as good as password though) or similar features. Point 2 rules out signal, whatapps and telegram. For point 3, I have seen some apps generate QR code of fingerprints for verification. – hkprotester Jun 15 at 1:07
  • I have also been looking for FOSS alternatives. Basically, they are apps implementing omemo or matrix protocol. Please let me know if you have a suggestion. Thank you! – hkprotester Jun 15 at 1:09
  • @hkprotester I am not sure, whether "Protected apps" is safe here. Presumably it only prevents the click on the app icon, but will not prevent access to the app's data on the phone's file system. – Marcel Jun 16 at 20:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.