Ask HN: Most Secure Way to Communicate?

Posted by srowaway2 on Tuesday May 09, 2023 @12:29PM
from the ask-hn dept.

A friend of mine lives in a country where they need to discuss politically sensitive things. He wants to communicate with folks outside the country in a way that is as secure as possible. He cannot be sure his phone or device isn't compromised.

What's the safest way to do this?

( 5 comments | 2 points | on HN )

Re:Ask HN: Most Secure Way to Communicate? by LinuxBender on Tuesday May 09, 2023 @12:32PM (#35876847)

- One method could be a Linux laptop and using SSH to talk over devzat [1] They should generate a site-specific ssh key to talk to your devzat instance. The developer is here on HN. Configure devzat to listen on port 443. To do this as a non-root account use "setcap cap_net_bind_service=+ep /path/to/devzat". They have a live instance both of you could try out. Using SSH takes most of the risk of compromised state-run certificate authorities out of the picture.

- If the goal is to have voice chat then install uMurmur [2] on your router or a VM or any node that is publicly reachable. They should use Mumble on a laptop but if they had to use a cell phone then there is the Mumla app to talk to your uMurmur instance. uMurmur takes a couple minutes to set up. Self-hosted uMurmur reduces the risk of utilizing platforms that have a "wink wink nod nod" relationship with the state.

[1] - https://github.com/quackduck/devzat

[2] - https://github.com/umurmur/umurmur/wiki/Configuration

[ Parent | on HN ]

Re:Ask HN: Most Secure Way to Communicate? by quackduck on Tuesday May 09, 2023 @10:45PM (#35883058)

did not know it was possible to use such ports as not-root.

anyway here is a direct link to how you can host your own devzat server: https://github.com/quackduck/devzat#want-to-host-your-own-in...

good luck, OP!

[ Parent | on HN ]

Re:Ask HN: Most Secure Way to Communicate? by DerekBickerton on Tuesday May 09, 2023 @01:01PM (#35877231)

https://chatsecure.org/

> ChatSecure is a free and open source messaging app that features OMEMO encryption and OTR encryption over XMPP. You can connect to your existing Google accounts or create new accounts on public XMPP servers (including via Tor), or even connect to your own server for extra security.

> Unlike other apps that keep you stuck in their walled garden, ChatSecure is fully interoperable with other clients that support OMEMO or OTR and XMPP, such as Conversations (Android), CoyIM (Desktop), and more.

[ Parent | on HN ]

Re:Ask HN: Most Secure Way to Communicate? by pestatije on Tuesday May 09, 2023 @02:27PM (#35878477)

> He cannot be sure his phone or device isn't compromised

all bets are off then. And by the way that might not matter as mobile phones can be compromised "over the wire" [!]

[!] https://en.wikipedia.org/wiki/Pegasus_(spyware)

[ Parent | on HN ]

Re:Ask HN: Most Secure Way to Communicate? by throwawayadvsec on Friday May 12, 2023 @03:12AM (#35912986)

"He cannot be sure his phone or device isn't compromised."

Well first he absolutely needs a new computer, and a new usb drive that he never used on any of his other devices.

Install some linux distro on his usb drive from the NEW device with full encryption, remove the hard drive, then use PGP from the usb drive.

Then the USB should stay in an absolutely safe space, with a physical way to know if someone tampered with it(maybe same for the laptop, UEFI virus are a thing)

But all of this doesn't matter if he lives in a country where they can just torture you to get your password, in that case you may be able to have a decoy partition with innocent looking stuff on it.(actually you shouldn't even save any sensible information even on the encrypted partition, but there could still be salvageable remnants of it)

[ Parent | on HN ]