14 ms·

Signal Desktop

555 points by marksamman 11y ago

hedgehog 11y ago
Note: Android only. Edit: In the sense that it only works with the Android version of the app.
- pc86 11y ago
  Which is funny considering they are using a MacBook (with Photoshopped screen) as a promotional image.
  - zellyn 11y ago
    I believe you link to your phone, and that part is Android only.
    - hysan 11y ago
      But why does the app appear with the wrong window decorations? It looks like the app is using the window decorations and title font from Xubuntu.
- liotier 11y ago
  I found myself thinking "WFT - this is Chrome, not desktop and with an Android dependency at that !" and then realizing that it may be time to question my assumptions about "desktop" meaning Linux/Windows/Macintosh
  - mtgx 11y ago
    In this case "Chrome-only" means Windows, Mac, and Linux support.
    - kuschku 11y ago
      No, it means "Support for people on Windows, Mac and x64 Linux who installed spyware".
- zmanian 11y ago
  Android only on the sense that the ability to provisions two device keys with one account is Android only. OWS is hiring iOS devs to implement more pieces of this.
  - newman314 11y ago
    Yeah, I was disappointed to discover this a while back when I tried to provision an iPad to use the same account as the iPhone. The failure mode is horrible too, in that messages will just go into the ether. I apparently missed a whole bunch of messages until I deleted Signal off the iPad and reinstalled on the iPhone.
- Veratyr 11y ago
  Also note that the multi device support only supports multiple desktop clients and not multi-mobile. If you have multiple phones or a tablet you're out of luck.
- skywhopper 11y ago
  It runs on your desktop/laptop but to link up with your Signal identity on your phone, your phone has to be Android ("for now").
thecoffman 11y ago
Shame that its Android only. Was really looking forward to giving this a try!
- moxie 11y ago
  For now! We're hiring, if you know anyone that wants to help us speed up iOS development: https://whispersystems.org/workworkwork/ https://whispersystems.org/workworkwork/
  - Sephr 11y ago
    Why tie it to a phone at all? Why not have this Chrome app work standalone? Apple's messaging app uses end-to-end encryption and it can be routed to multiple devices. I would expect Signal to strive to attain parity with Apple's offerings. Also, the naming of this app is pretty disingenuous. This app should be called "Signal Remote", since it's not running the actual Signal comms on my desktop, it's remotely controlling Signal on my phone.
    - haffenloher 11y ago
      Nope, I think you misunderstood something. Your phone does not need to be online for the desktop app to work.
jmnicolas 11y ago
> Signal Desktop is a Chrome app which links with your [Android] phone,[...] Unless your "adversary" is not the NSA, I wonder what's the point of encrypting your communications when those coms are taking place on technologies (iOS, Android, Chrome) from companies that are members of the Prism program.
- acdha 11y ago
  1. Billions of people live in countries which do not have jurisdiction over Apple, Google, etc. 2. You should learn more about PRISM before spreading FUD about its victims. I'm strongly critical of the NSA's actions but for all of their abuse, PRISM is not the bogeyman you're making it out to be: “The PRISM program collects stored internet communications based on demands made to internet companies such as Google Inc. under Section 702 of the FISA Amendments Act of 2008 to turn over any data that match court-approved search terms” https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%29 https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...
  - 59hhllhbhvc7 11y ago
    > 1. Billions of people live in countries which do not have jurisdiction over Apple, Google, etc. Alternatively, you could say that billions of people live in countries with no restrictions on espionage of these companies, and with no recourse. Has NK faced justice for the Sony hack? Has the US faced justice for taps of overseas cables? No on both counts. If anything, having your country be a member of PRISM grants you as a citizen greater protection over how that data is used against you by that government.
  - SeldomSoup 11y ago
    > court-approved Remember, this a secret court, whose judges are likely highly biased in favor the government, with secret proceedings where only the NSA gets to make a case. Not exactly a legitimate safeguard. I also have reservations about the grandparent comment, but PRISM is still pretty awful.
    - acdha 11y ago
chadk 11y ago
All good with the Android, but disappointed this is Chrome. You would think they would have a FF plugin by now!
- mtgx 11y ago
  It's easier to build Chrome apps, and they are also more secure. It's one of the reasons Mozilla is trying to move away from the add-on model and adopt WebExtensions. When it does that we should start seeing Chrome/Firefox apps appear likely at the same time. It's why I hope Mozilla dismisses the backlash against the switch because some people can't live without their "deep" themes.
  - kuschku 11y ago
    It’s not just "deep themes". What if I want thumbnails of tabs on hover? What if I want the browser UI to be colored in the theme color of the current webpage (similar to chrome mobile)? I can do that today with FF. I can’t do that with WebExtensions.
aw3c2 11y ago
This is a Chrome app. I miss the days of native apps. :(
- AdmiralAsshat 11y ago
  A native app would certainly have its advantages, although it would require putting pre-compiled binaries up for Windows, OSX, and various Linux distros. By contrast, making it a Chrome app allows it to run on any OS that supports Chrome, including Chromebooks. So I understand the decision. But I'm primarily a Firefox user, so a native app or at least an FF add-on would personally be preferable to me.
- lucidstack 11y ago
  True. Although, I don't understand why it has to be a Chrome app. Why not just a NW.js app? Maybe for the whole "connect with your phone" functionality? Perhaps somebody could shed some light on this?
  - lewisl9029 11y ago
    My guess is it uses Chrome's Native Client [1] for crypto. It's understandable why they might want to do this at this point in time, because the only other way to use native code for crypto in the browser is through the the Web Crypto API [2], which is still very young and implementations aren't very consistent across browsers yet anyways. [1] https://developer.chrome.com/native-client https://developer.chrome.com/native-client [2] http://www.w3.org/TR/WebCryptoAPI/ http://www.w3.org/TR/WebCryptoAPI/
    - kuschku 11y ago
      So, effectively, they use native code anyway, but make debugging worse for users? Great...
AdmiralAsshat 11y ago
Any plans to make a Firefox add-on?
mtgx 11y ago
I assume it doesn't have video support yet. Any chance it will within a year?
rmchugh 11y ago
Loving moxie's namedropping of oldschool revolutionaries: Maria (Masha) Alexandrovna Kolenkina was a Russian socialist revolutionary from a merchant family in Temzhuk, a small town on the Sea of Azov. (1850-1926) Vera Ivanovna Zasulich was a Russian Menshevik writer and revolutionary. (1849-1919) Nestor Ivanovych Makhno or Bat'ko Makhno was a Ukrainian anarcho-communist revolutionary and the commander of an independent anarchist army in Ukraine during the Russian Civil War of 1917–1922. (1888-1934) (all above from Wikipedia)
- interrupt13 11y ago
  Oldschool Communist revolutionaries, to be exact. Yeah, it's no mystery where Moxie's politics lie given those allusions and the not-a-company company, eat together, do push ups together, open salary policies.
  - oldmanjay 11y ago
    Fortunately for most of the human population, the politics of the author of the software we use isn't really a consideration.
    - eplanit 11y ago
      That wasn't the case for Brendan Eich[1][2]. [1] http://www.reuters.com/article/2014/04/03/us-mozilla-ceo-resignation-idUSBREA321Y320140403 http://www.reuters.com/article/2014/04/03/us-mozilla-ceo-res... [2] https://en.wikipedia.org/wiki/Brendan_Eich https://en.wikipedia.org/wiki/Brendan_Eich
      - DanBC 11y ago
        HN should declare this off topic.
    - Grue3 11y ago
      I'm sure most people wouldn't use software created by Nazis. Considering Communism has arguably worse track record, I would definitely avoid any software created by its proponents if it's at all possible.
kristofferR 11y ago
Why make it a Chrome app instead of a node-webkit app?
- moloch 11y ago
  nw.js is somewhat concerning from a security standpoint, you're always one XSS vulnerability away for arbitrary code execution.
- fiatjaf 11y ago
  Because doing that requires you to almost download and run a different Chrome.
codemac 11y ago
The join the beta button isn't working? I click and nothing happens. I looked at the page source, but then I realized I don't know how the fuck javascript works.
- spiznnx 11y ago
  the button only worked in chrome, not firefox for me
  - jedahan 11y ago
    same, sigh
- frayesto 11y ago
  Also make sure an ad/popup blocker isn't shooting it down? I think it's using a third party system to run the invites.
sigmar 11y ago
I don't understand why it prompts me to invite other people after putting me in line. Why would I email/tweet my friends to join this service if it isn't even ready for me? Seems rude to bother a friend with joining an internet line just so that I can get a better position in the line. I love signal on android and have been looking forward to this, kind of rubs me the wrong way when I'm put in "line"
- frayesto 11y ago
  The app is still in beta testing. I think this is their way to drum up support. Forces all the die-hards who want in to try and get some people interested. An app like this is only as useful as the number of people who use it.
  - JshWright 11y ago
    Invite them to... not use it? That seems like a solid way to turn people off from using a service, not a way get them excited about it.
    - jegutman 11y ago
      I don't feel strongly about the practice either way, but you're also indirectly prioritizing users who are most willing to share the product. So they're hoping their early users are also those most willing to spread. The "connectors" of the products ecosystem.
      - JshWright 11y ago
        You're prioritizing users who are willing to spam their friends about a product they can't even use. I would be _far_ more likely to tell my friends about the product if I could actually use it and be able to vouch for it (as I have with the mobile version of TextSecure/Signal). Forcing me to get my friends to visit a page where they will find out about an application they can't even use is just annoying.
  - Tyr42 11y ago
leonhandreke 11y ago
Why incentivize spamming my friends with links before I've even seen the app, only to refer them to a waiting line? Sure, launch day momentum and all that, but I wish that as an entity that wants to be "the good guys", they can find a way to gain a broader audience for their app based on the app itself, not the buzz around it. On a sidenote, does anyone know who funds their full-timers? https://whispersystems.org/workworkwork/ https://whispersystems.org/workworkwork/ says they're not VC funded. But then who pays them?
- frayesto 11y ago
  They are part of the [Freedom of the Press foundation](https://freedom.press/ https://freedom.press/) and have grants from the Shuttleworth foundation https://en.wikipedia.org/wiki/Open_Whisper_Systems#Funding https://en.wikipedia.org/wiki/Open_Whisper_Systems#Funding http://www.knightfoundation.org/grants/201499909/ http://www.knightfoundation.org/grants/201499909/ https://www.shuttleworthfoundation.org/fellows/moxie-marlinspike/ https://www.shuttleworthfoundation.org/fellows/moxie-marlins...
- guelo 11y ago
  The buzz about a chat app is more important than the app itself. The usefulness of the app is proportional to the size of the social network. The most difficult thing to build and the most valuable part of a chat app is the social network. WhatsApp wasn't worth $19 billion because of the quality of the software. Buzz, marketing, promotion, virality, user aquisition in general, are the most important thing for Signal to be working on.
gue5t 11y ago
Why are all these encrypted chat programs (Signal, Telegram, &c.) still centralized and not TOR-style onion-routed?
- newman314 11y ago
  Agreed. As I mentioned in a previous thread, my idealized program is Signal+Ricochet.im+Burner-like resettable identity endpoints across desktop and mobile.
- Strom 11y ago
  Maybe because an excellent centralized encrypted chat doesn't exist yet. All options, including Signal, have lots of problems. Some chat apps are great, but really questionable security. Other apps have seemingly great security, but really questionable chat experience. After this duo problem of chat+encryption has been done well, we can start looking into adding additional problems like centralization.
- lewisl9029 11y ago
  As much as I agree with your overall sentiment, the sad truth is that centralized architectures enable many of the UX affordances that users take for granted today in a modern chat app, many of which are much more difficult, sometimes simply impossible, to implement in a decentralized architecture (think features like automatic contact discovery, offline messaging, etc). Without some of these affordances, a chat app has simply has no chance of gaining widespread adoption in such a competitive landscape. This is why it is very difficult to justify pouring any significant resources into building a decentralized chat app, because too few people will ever end up using it to justify the investment. For what it's worth, I am the author of a decentralized messaging app myself [1], and have spent a lot of time thinking about stuff like this, and eventually reached this unfortunate conclusion and decided to leave the project at the prototype stage. [1] http://toc.im/ http://toc.im/
  - deanclatworthy 11y ago
    What kind of things are impossible?
hackuser 11y ago
> Signal Desktop is a Chrome app That surprises me. I don't trust Chrome for confidentiality; I assume it collects data for Google and I don't know that it protects my data from others. If Chrome isn't trustworthy for confidentiality, it would seem to fatally cripple the security of Signal Desktop. However, I believe the people at Whisper Systems would see that obvious flaw so I suspect that I'm misunderstanding something - what is it?
- j_s 11y ago
  Whisper Systems has a track record of prioritizing 'good enough' ease-of-use ahead of 'perfect' security as a practical way of expanding its user base. Edit: Tried to word the above most neutrally; I believe this approach has both pros and cons.
  - frayesto 11y ago
    moxie has stated previously someplace that the goals are 1. Simple encryption for everyone to prevent mass data collection 2. Prevent targeted collection for the crypto enthusiasts The main focus is on step 1. now and they are doing a great job at it. It's slow like anything new, but I managed to convince my parents to switch so that means it's working!
    - hackuser 11y ago
      > 1. Simple encryption for everyone to prevent mass data collection Google might be the second biggest mass data collector, after the U.S. government. Using Chrome, one of Google's tools of collection (if I understand correctly), wouldn't seem to further that goal.
      - kingkilr 11y ago
        Can you articulate a _specific_ threat model under which this extension fails to protect against mass data collection by Google? Or is this idle speculation.
tdkl 11y ago
Since when are browser apps "desktop" apps ?
knocknock 11y ago
I'm assuming this works similarly to WhatsApp Web (https://web.whatsapp.com/ https://web.whatsapp.com/)
- dates 11y ago
  And actually, earlier this year, WhatsApp started using the encrpytion protocol developed by the signal folks (Axolotl) to encrypt message data, Which is super cool. (I think group chats and images are still not encrypted, or something) I wonder if in the future Signal will focus on integrating their encryption into other existing chat systems like Facebook messenger, and put the Signal apps on the backburner.
  - unsignedint 11y ago
    The problem I have is when these systems don't indicate whether their session or secure or not. Last time I checked, WhatsApp still didn't have it. This is especially problematic when the system has exceptions like the ones you've described. (Group chats, images, etc.) Services like LINE also bragged about their secure chat feature, too [0] but honestly, without an active indication of whether their session is secured or not, it's fairly useless and I don't really like this "hide the complicated stuff" attitude that those services seems to be going toward... [0]: http://developers.linecorp.com/blog/?p=3679 http://developers.linecorp.com/blog/?p=3679
  - Quiark 11y ago
    I heard somewhere on the internet (actually /r/crypto) that after being bought by Facebook, they are cancelling or backdooring it. Sounds like conspiracy to me but then again it's Facebook...
joshtgreenwood 11y ago
The header photo looks like a Windows screen photoshopped into OSX.
mrmondo 11y ago
Requiring a google email address and chrome for a secure messaging system? Very strange move.
- frayesto 11y ago
  They're using Google groups to manage the beta testing program. Make sense since that's how you sign into the Chrome app store to download the app.
  - jrnvs 11y ago
    Isn't that just horrible? A secure messaging service that requires a google account for installation.
    - lallysingh 11y ago
      No, not /require/. Here: https://github.com/WhisperSystems/Signal-Desktop https://github.com/WhisperSystems/Signal-Desktop (link from the webpage). Go get bower and npm and build it yourself. It'll be a zipfile.
  - rsync 11y ago
    "Make sense since that's how you sign into the Chrome app store to download the app." I don't think it makes any sense at all. Even if you do use gmail/google in some places (I don't) it's not a given that you want to tie that identity to this app or these activities. A throwaway google account is getting very difficult since google automatically flags an account with no mobile phone number attached to it as a "suspicious activity" account, immediately forcing you to add a mobile number. Google is not the Internet. Their app store is not the Internet. I can't believe that the people I know to be behind this project have tied it to google in such a necessary and intimate way.
    - marssaxman 11y ago
      Really, they do that now!? No way am I giving Google my phone number, goddamn. I have gradually drifted away from using any Google services - I guess I won't be creating any new Google accounts in the future, then.
phantom_oracle 11y ago
I have a question about this... Say a team of volunteers were willing to spend time to make something like a QT- or GTK-based native desktop application instead. How much more difficult would this be compared to what they did/used now? (the chrome-app) ? Also, will it take significantly longer to build such a native app? Anybody with experience building native apps, please share.
- mahyarm 11y ago
  Slack and several other chat apps are web based. You don't really need it. Dev time and cross platform compatibility would be worse. With this they get at least 4 platforms.
- joshka 11y ago
  What about using something like http://electron.atom.io http://electron.atom.io instead. This would likely be the best of both worlds - native, but not browser-dependent.
  - giancarlostoro 11y ago
    I really wish this was an Electron / nw.js app instead of a Chrome plugin.
    - mintplant 11y ago
      I've experimented with this and with a little tweaking it works fine under NW.js's alpha support for running Chrome Apps.
      - giancarlostoro 11y ago
        I mention it because downloading one file (a nw.js / electron build) is a lot less friction filled than (in some cases) downloading an entire browser just to use one app. There's still people out there who still use Firefox or whatever default browser their OS comes with. Instead of downloading one file, you're now forced to download two.
fiatjaf 11y ago
Why do I need a phone number?
- Freak_NL 11y ago
  Yeah, this makes Signal a total non-starter for me. It is doing the same thing WhatsApp does: you need a smartphone to use it. Even the desktop version requires a smartphone to create an account. If privacy is so important for Signal, why forbid using it without a phone number? It makes no sense.
fiatjaf 11y ago
Why is there a queue for entering beta when it is possible to get the source and install on Chrome right away?
darklajid 11y ago
I'm feeling dirty, because I don't like to be that negative, especially if we're talking open-source software. And I feel that I kinda hold this project to higher standards: If I compare this to WhatsApp/Telegram/Threema/Whatever, I inheritently, somewhat subconciously expect more from Signal. And I'm disappointed. I tend to repeat the 'central server' and 'a phone number is not an address and not public information, it certainly is no identity' criticism. When I read the headline/title, I thought 'Now maybe that would be enough to be ~good enough~ to ditch Telegram' in spite of these problems (which Telegram has as well, ofc). But really. A Chrome app. And works only (yeah, I think I said it before: Phone numbers suck) as a secondary client. And only if the first client is Android? I seriously don't get it. And it certainly is not for me: I don't like that browser (I do have it installed for testing and to follow it at times, but there's no 'app' I'd run in Chrome). I don't want to tie something to my phone and I don't think that it should matter what platform my handset runs on - SailfishOS looks nice, FxOS progresses slow but ticks a good number of boxes for me. Full circle to the first line: I don't _like_ to be negative and the headline gave me hope for a couple seconds. Unfortunately this release just deepened my belief that Signal wasn't meant to be for me.
- tptacek 11y ago
  The central server in Signal does not have the same role as the Telegram's. If you care first and foremost about UX, use Telegram. If you care first and foremost about the security of your communications, use Signal; go out of your way to use Signal.
  - aw3c2 11y ago
    > go out of your way to use Signal With that mindset we will never get secure communications to the masses but will repeat the PGP dilemma again and again. UX is of utmost importance. We would still be on 99.99% HTTP websites if HTTPS required going out of one's way.
    - tptacek 11y ago
      That's what the Cryptocat people said.
dates 11y ago
I got excited about signal after watching this video, which explains pretty well the challenges of encrypted communication and how Signal addresses them (it might be basic stuff for people super familiar with the topic though): https://www.youtube.com/watch?v=tOMiAeRwpPA https://www.youtube.com/watch?v=tOMiAeRwpPA
finnn 11y ago
>Don't leave your friends behind, invite them to signup with this unique link. The more friends that join, the further you will advance in line for the beta. That's annoying.
- JshWright 11y ago
  Even more annoying is that it tells you how many people are ahead of you in line, so you get to watch that number grow as you move further down the list... I was pretty excited about this when I saw the title, now I'm just annoyed.
- anotheryou 11y ago
  with "34 clicks and 0 signups" I'm not even in the top 10% Of course no human ever had clicked my link, but I'm surprised how many clicks other people generate (given they don't cheat as well, hehe).
morsch 11y ago
I've been looking forward to this! Thanks for all the hard work.
klapinat0r 11y ago
This is slightly off-topic, but I hope moxie (or an employee of WhisperSystems - nothing official needed) wouldn't mind chiming in: Since I loved the fact that I can run my own TextSecure server, I'm wondering why Signal does not run a similar model? I'm curious which considerations went into this decision.
NfnK2ECvNE 11y ago
I agree with some of the folks here. I have the utmost respect for Signal and Marlinspike but this seems like a weird direction for this to go in. A Chrome app? Tying it to the Chrome App Store? Requiring a Google email for the beta group? Just seems out of place for Signal.
Sephr 11y ago
Call it what it really is: "Signal Phone Remote". This is not Signal Desktop if you need a non-desktop to use it.
- haffenloher 11y ago
  That name would imply your phone had to be online for the desktop app to work - that's not the case.
  - Sephr 11y ago
    Oh, that does sound a lot more reasonable and I made an incorrect assumption. I take it that you still need a phone to make a signal account though?
    - haffenloher 11y ago
      Yep, at least that's how the official version of the chrome app works at the moment, it offers no standalone option.
degenerate 11y ago
If I wanted someting that looked like skype, I would just use skype. These bubbly colorful interfaces make me sad on the inside :(
wepple 11y ago
This isn't working for me - the code that is supposed to show up for me to scan doesn't work, I just see: connecting....
wepple 11y ago
This isn't working for me, the code I'm supposed to scan won't show up, just Connecting.... (I installed from github)
- muppetman 11y ago
  EDIT: I apologise, I'm wrong. It appears github has been updated to remove this warning. and as it pretty says on github, the github repo is confiugred to connect to the development server. So yea, trying to jump the queue by installing the dev blob from github won't work.
  - benedictp 11y ago
    I made it working: 1. Clone the Signal-Desktop Repo 2. Edit the File: "js/background.js" Line 56 SERVER_URL to 'https://textsecure-service.whispersystems.org' https://textsecure-service.whispersystems.org' and Line 57 ATTACHMENT_SERVER_URL to 'https://whispersystems-textsecure-attachments.s3.amazonaws.com' https://whispersystems-textsecure-attachments.s3.amazonaws.c... and save it 3. Open chrome://extensions/ 4. Activate Developer mode 5. Click "Load unpacked extension..." and select the Signal-Desktop directory 6. Open https://textsecure-service.whispersystems.org/ https://textsecure-service.whispersystems.org/ and accept the cert (otherwise you won't see the qr code) 7. Scan the qr code and have fun!
    - muppetman 11y ago
      Fantastic, thanks, it's working great!
    - spin 11y ago
      > and accept the cert ... sigh... Trusted encryption fail. Is there some way to verify this cert?
riquito 11y ago
How much money do you need to develop and maintain a Firefox version? Can I donate? I don't want to help to enforce this idea that Chrom* is the only browser that can run certain things, is against my believes.
welly 11y ago
Sadly, as much as I'd like to use Telegram or Signal rather than the usual suspects (sms, whatsapp, facebook messenger), it would require someone on the other end to receive my messages. The likelihood of convincing my friends/family to use a messaging app that isn't any of the usual suspects is low to none. And none of my bleating about privacy issues will convince them otherwise ("I've got nothing to hide, doesn't bother me").
AndyMcConachie 11y ago
Why should I use this instead of Jabber/XMPP over TLS? Can someone sell me on this that knows how both work? Thanks!
- ge0rg 11y ago
  The differences are: * XMPP is using addresses with the same format as e-mail addresses (Jabber ID/JID), Signal accounts are bound to your phone number * Signal has strong end-to-end encryption built-in, for XMPP you need OTR or the recent OMEMO port of Signal's end-to-end crypto magic * XMPP is federated, where you talk to your server, and it talks to your buddies servers; with Signal everybody talks to WhisperSystems' servers * XMPP has no decent iOS app, but pretty good multi-device support otherwise
thursdaydecide3 11y ago
This is slightly off topic but am I the only one surprised at the litany of permissions they require for the android app? Some make sense (like SMS or camera) but device & app history/location/identity/device ID & call info/contacts/calendar/microphone/phone seems like a smash and grab. I saw moxie speak at a conference once and he specifically called out the device id/call information permission as evidence that google doesn't care about your privacy, so why is his privacy-enabling app requiring it?? I thought these were supposed to be the good guys (and girls)? The good guys (and girls) don't do 'collect it all.'
- haffenloher 11y ago
  > am I the only one surprised Why not ask your favorite search engine? Definitely faster than creating a HN account ;) First Google search result: http://support.whispersystems.org/hc/en-us/articles/212535858-What-are-all-these-permissions- http://support.whispersystems.org/hc/en-us/articles/21253585...
deleted 11y ago
[deleted]
Spakman 11y ago
I love Signal and advocate it wherever possible. After following along on the GitHub tickets for this project, I'm happy to say thank you and congratulations on the beta release folks! I'm probably about to ask this on the mailing list soon anyway, but in case there is any hidden knowledge here: 1. There was talk of server federation long ago. Is this still part of the long term plan? 2. There was talk of not using a phone number as a required identifier. Is this still part of the long term plan?

Signal Desktop

555 points by marksamman 11y ago

hedgehog 11y ago

Note: Android only. Edit: In the sense that it only works with the Android version of the app.

pc86 11y ago
Which is funny considering they are using a MacBook (with Photoshopped screen) as a promotional image.
- zellyn 11y ago
  I believe you link to your phone, and that part is Android only.
  - hysan 11y ago
    But why does the app appear with the wrong window decorations? It looks like the app is using the window decorations and title font from Xubuntu.
liotier 11y ago
I found myself thinking "WFT - this is Chrome, not desktop and with an Android dependency at that !" and then realizing that it may be time to question my assumptions about "desktop" meaning Linux/Windows/Macintosh
- mtgx 11y ago
  In this case "Chrome-only" means Windows, Mac, and Linux support.
  - kuschku 11y ago
    No, it means "Support for people on Windows, Mac and x64 Linux who installed spyware".
zmanian 11y ago
Android only on the sense that the ability to provisions two device keys with one account is Android only. OWS is hiring iOS devs to implement more pieces of this.
- newman314 11y ago
  Yeah, I was disappointed to discover this a while back when I tried to provision an iPad to use the same account as the iPhone. The failure mode is horrible too, in that messages will just go into the ether. I apparently missed a whole bunch of messages until I deleted Signal off the iPad and reinstalled on the iPhone.
Veratyr 11y ago
Also note that the multi device support only supports multiple desktop clients and not multi-mobile. If you have multiple phones or a tablet you're out of luck.
skywhopper 11y ago
It runs on your desktop/laptop but to link up with your Signal identity on your phone, your phone has to be Android ("for now").

thecoffman 11y ago

Shame that its Android only. Was really looking forward to giving this a try!

moxie 11y ago
For now! We're hiring, if you know anyone that wants to help us speed up iOS development: https://whispersystems.org/workworkwork/ https://whispersystems.org/workworkwork/
- Sephr 11y ago
  Why tie it to a phone at all? Why not have this Chrome app work standalone? Apple's messaging app uses end-to-end encryption and it can be routed to multiple devices. I would expect Signal to strive to attain parity with Apple's offerings. Also, the naming of this app is pretty disingenuous. This app should be called "Signal Remote", since it's not running the actual Signal comms on my desktop, it's remotely controlling Signal on my phone.
  - haffenloher 11y ago
    Nope, I think you misunderstood something. Your phone does not need to be online for the desktop app to work.

jmnicolas 11y ago

> Signal Desktop is a Chrome app which links with your [Android] phone,[...] Unless your "adversary" is not the NSA, I wonder what's the point of encrypting your communications when those coms are taking place on technologies (iOS, Android, Chrome) from companies that are members of the Prism program.

acdha 11y ago
1. Billions of people live in countries which do not have jurisdiction over Apple, Google, etc. 2. You should learn more about PRISM before spreading FUD about its victims. I'm strongly critical of the NSA's actions but for all of their abuse, PRISM is not the bogeyman you're making it out to be: “The PRISM program collects stored internet communications based on demands made to internet companies such as Google Inc. under Section 702 of the FISA Amendments Act of 2008 to turn over any data that match court-approved search terms” https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%29 https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%...
- 59hhllhbhvc7 11y ago
  > 1. Billions of people live in countries which do not have jurisdiction over Apple, Google, etc. Alternatively, you could say that billions of people live in countries with no restrictions on espionage of these companies, and with no recourse. Has NK faced justice for the Sony hack? Has the US faced justice for taps of overseas cables? No on both counts. If anything, having your country be a member of PRISM grants you as a citizen greater protection over how that data is used against you by that government.
- SeldomSoup 11y ago
  > court-approved Remember, this a secret court, whose judges are likely highly biased in favor the government, with secret proceedings where only the NSA gets to make a case. Not exactly a legitimate safeguard. I also have reservations about the grandparent comment, but PRISM is still pretty awful.
  - acdha 11y ago

chadk 11y ago

All good with the Android, but disappointed this is Chrome. You would think they would have a FF plugin by now!

mtgx 11y ago
It's easier to build Chrome apps, and they are also more secure. It's one of the reasons Mozilla is trying to move away from the add-on model and adopt WebExtensions. When it does that we should start seeing Chrome/Firefox apps appear likely at the same time. It's why I hope Mozilla dismisses the backlash against the switch because some people can't live without their "deep" themes.
- kuschku 11y ago
  It’s not just "deep themes". What if I want thumbnails of tabs on hover? What if I want the browser UI to be colored in the theme color of the current webpage (similar to chrome mobile)? I can do that today with FF. I can’t do that with WebExtensions.

aw3c2 11y ago

This is a Chrome app. I miss the days of native apps. :(

AdmiralAsshat 11y ago
A native app would certainly have its advantages, although it would require putting pre-compiled binaries up for Windows, OSX, and various Linux distros. By contrast, making it a Chrome app allows it to run on any OS that supports Chrome, including Chromebooks. So I understand the decision. But I'm primarily a Firefox user, so a native app or at least an FF add-on would personally be preferable to me.
lucidstack 11y ago
True. Although, I don't understand why it has to be a Chrome app. Why not just a NW.js app? Maybe for the whole "connect with your phone" functionality? Perhaps somebody could shed some light on this?
- lewisl9029 11y ago
  My guess is it uses Chrome's Native Client [1] for crypto. It's understandable why they might want to do this at this point in time, because the only other way to use native code for crypto in the browser is through the the Web Crypto API [2], which is still very young and implementations aren't very consistent across browsers yet anyways. [1] https://developer.chrome.com/native-client https://developer.chrome.com/native-client [2] http://www.w3.org/TR/WebCryptoAPI/ http://www.w3.org/TR/WebCryptoAPI/
  - kuschku 11y ago
    So, effectively, they use native code anyway, but make debugging worse for users? Great...

AdmiralAsshat 11y ago

Any plans to make a Firefox add-on?

mtgx 11y ago

I assume it doesn't have video support yet. Any chance it will within a year?

rmchugh 11y ago

Loving moxie's namedropping of oldschool revolutionaries: Maria (Masha) Alexandrovna Kolenkina was a Russian socialist revolutionary from a merchant family in Temzhuk, a small town on the Sea of Azov. (1850-1926) Vera Ivanovna Zasulich was a Russian Menshevik writer and revolutionary. (1849-1919) Nestor Ivanovych Makhno or Bat'ko Makhno was a Ukrainian anarcho-communist revolutionary and the commander of an independent anarchist army in Ukraine during the Russian Civil War of 1917–1922. (1888-1934) (all above from Wikipedia)

interrupt13 11y ago
Oldschool Communist revolutionaries, to be exact. Yeah, it's no mystery where Moxie's politics lie given those allusions and the not-a-company company, eat together, do push ups together, open salary policies.
- oldmanjay 11y ago
  Fortunately for most of the human population, the politics of the author of the software we use isn't really a consideration.
  - eplanit 11y ago
    That wasn't the case for Brendan Eich[1][2]. [1] http://www.reuters.com/article/2014/04/03/us-mozilla-ceo-resignation-idUSBREA321Y320140403 http://www.reuters.com/article/2014/04/03/us-mozilla-ceo-res... [2] https://en.wikipedia.org/wiki/Brendan_Eich https://en.wikipedia.org/wiki/Brendan_Eich
    - DanBC 11y ago
      HN should declare this off topic.
  - Grue3 11y ago
    I'm sure most people wouldn't use software created by Nazis. Considering Communism has arguably worse track record, I would definitely avoid any software created by its proponents if it's at all possible.

kristofferR 11y ago

Why make it a Chrome app instead of a node-webkit app?

moloch 11y ago
nw.js is somewhat concerning from a security standpoint, you're always one XSS vulnerability away for arbitrary code execution.
fiatjaf 11y ago
Because doing that requires you to almost download and run a different Chrome.

codemac 11y ago

The join the beta button isn't working? I click and nothing happens. I looked at the page source, but then I realized I don't know how the fuck javascript works.

spiznnx 11y ago
the button only worked in chrome, not firefox for me
- jedahan 11y ago
  same, sigh
frayesto 11y ago
Also make sure an ad/popup blocker isn't shooting it down? I think it's using a third party system to run the invites.

sigmar 11y ago

I don't understand why it prompts me to invite other people after putting me in line. Why would I email/tweet my friends to join this service if it isn't even ready for me? Seems rude to bother a friend with joining an internet line just so that I can get a better position in the line. I love signal on android and have been looking forward to this, kind of rubs me the wrong way when I'm put in "line"

frayesto 11y ago
The app is still in beta testing. I think this is their way to drum up support. Forces all the die-hards who want in to try and get some people interested. An app like this is only as useful as the number of people who use it.
- JshWright 11y ago
  Invite them to... not use it? That seems like a solid way to turn people off from using a service, not a way get them excited about it.
  - jegutman 11y ago
    I don't feel strongly about the practice either way, but you're also indirectly prioritizing users who are most willing to share the product. So they're hoping their early users are also those most willing to spread. The "connectors" of the products ecosystem.
    - JshWright 11y ago
      You're prioritizing users who are willing to spam their friends about a product they can't even use. I would be _far_ more likely to tell my friends about the product if I could actually use it and be able to vouch for it (as I have with the mobile version of TextSecure/Signal). Forcing me to get my friends to visit a page where they will find out about an application they can't even use is just annoying.
- Tyr42 11y ago

leonhandreke 11y ago

Why incentivize spamming my friends with links before I've even seen the app, only to refer them to a waiting line? Sure, launch day momentum and all that, but I wish that as an entity that wants to be "the good guys", they can find a way to gain a broader audience for their app based on the app itself, not the buzz around it. On a sidenote, does anyone know who funds their full-timers? https://whispersystems.org/workworkwork/ https://whispersystems.org/workworkwork/ says they're not VC funded. But then who pays them?

frayesto 11y ago
They are part of the [Freedom of the Press foundation](https://freedom.press/ https://freedom.press/) and have grants from the Shuttleworth foundation https://en.wikipedia.org/wiki/Open_Whisper_Systems#Funding https://en.wikipedia.org/wiki/Open_Whisper_Systems#Funding http://www.knightfoundation.org/grants/201499909/ http://www.knightfoundation.org/grants/201499909/ https://www.shuttleworthfoundation.org/fellows/moxie-marlinspike/ https://www.shuttleworthfoundation.org/fellows/moxie-marlins...
guelo 11y ago
The buzz about a chat app is more important than the app itself. The usefulness of the app is proportional to the size of the social network. The most difficult thing to build and the most valuable part of a chat app is the social network. WhatsApp wasn't worth $19 billion because of the quality of the software. Buzz, marketing, promotion, virality, user aquisition in general, are the most important thing for Signal to be working on.

gue5t 11y ago

Why are all these encrypted chat programs (Signal, Telegram, &c.) still centralized and not TOR-style onion-routed?

newman314 11y ago
Agreed. As I mentioned in a previous thread, my idealized program is Signal+Ricochet.im+Burner-like resettable identity endpoints across desktop and mobile.
Strom 11y ago
Maybe because an excellent centralized encrypted chat doesn't exist yet. All options, including Signal, have lots of problems. Some chat apps are great, but really questionable security. Other apps have seemingly great security, but really questionable chat experience. After this duo problem of chat+encryption has been done well, we can start looking into adding additional problems like centralization.
lewisl9029 11y ago
As much as I agree with your overall sentiment, the sad truth is that centralized architectures enable many of the UX affordances that users take for granted today in a modern chat app, many of which are much more difficult, sometimes simply impossible, to implement in a decentralized architecture (think features like automatic contact discovery, offline messaging, etc). Without some of these affordances, a chat app has simply has no chance of gaining widespread adoption in such a competitive landscape. This is why it is very difficult to justify pouring any significant resources into building a decentralized chat app, because too few people will ever end up using it to justify the investment. For what it's worth, I am the author of a decentralized messaging app myself [1], and have spent a lot of time thinking about stuff like this, and eventually reached this unfortunate conclusion and decided to leave the project at the prototype stage. [1] http://toc.im/ http://toc.im/
- deanclatworthy 11y ago
  What kind of things are impossible?

hackuser 11y ago

> Signal Desktop is a Chrome app That surprises me. I don't trust Chrome for confidentiality; I assume it collects data for Google and I don't know that it protects my data from others. If Chrome isn't trustworthy for confidentiality, it would seem to fatally cripple the security of Signal Desktop. However, I believe the people at Whisper Systems would see that obvious flaw so I suspect that I'm misunderstanding something - what is it?

j_s 11y ago
Whisper Systems has a track record of prioritizing 'good enough' ease-of-use ahead of 'perfect' security as a practical way of expanding its user base. Edit: Tried to word the above most neutrally; I believe this approach has both pros and cons.
- frayesto 11y ago
  moxie has stated previously someplace that the goals are 1. Simple encryption for everyone to prevent mass data collection 2. Prevent targeted collection for the crypto enthusiasts The main focus is on step 1. now and they are doing a great job at it. It's slow like anything new, but I managed to convince my parents to switch so that means it's working!
  - hackuser 11y ago
    > 1. Simple encryption for everyone to prevent mass data collection Google might be the second biggest mass data collector, after the U.S. government. Using Chrome, one of Google's tools of collection (if I understand correctly), wouldn't seem to further that goal.
    - kingkilr 11y ago
      Can you articulate a _specific_ threat model under which this extension fails to protect against mass data collection by Google? Or is this idle speculation.

tdkl 11y ago

Since when are browser apps "desktop" apps ?

knocknock 11y ago

I'm assuming this works similarly to WhatsApp Web (https://web.whatsapp.com/ https://web.whatsapp.com/)

dates 11y ago
And actually, earlier this year, WhatsApp started using the encrpytion protocol developed by the signal folks (Axolotl) to encrypt message data, Which is super cool. (I think group chats and images are still not encrypted, or something) I wonder if in the future Signal will focus on integrating their encryption into other existing chat systems like Facebook messenger, and put the Signal apps on the backburner.
- unsignedint 11y ago
  The problem I have is when these systems don't indicate whether their session or secure or not. Last time I checked, WhatsApp still didn't have it. This is especially problematic when the system has exceptions like the ones you've described. (Group chats, images, etc.) Services like LINE also bragged about their secure chat feature, too [0] but honestly, without an active indication of whether their session is secured or not, it's fairly useless and I don't really like this "hide the complicated stuff" attitude that those services seems to be going toward... [0]: http://developers.linecorp.com/blog/?p=3679 http://developers.linecorp.com/blog/?p=3679
- Quiark 11y ago
  I heard somewhere on the internet (actually /r/crypto) that after being bought by Facebook, they are cancelling or backdooring it. Sounds like conspiracy to me but then again it's Facebook...

joshtgreenwood 11y ago

The header photo looks like a Windows screen photoshopped into OSX.

mrmondo 11y ago

Requiring a google email address and chrome for a secure messaging system? Very strange move.

frayesto 11y ago
They're using Google groups to manage the beta testing program. Make sense since that's how you sign into the Chrome app store to download the app.
- jrnvs 11y ago
  Isn't that just horrible? A secure messaging service that requires a google account for installation.
  - lallysingh 11y ago
    No, not /require/. Here: https://github.com/WhisperSystems/Signal-Desktop https://github.com/WhisperSystems/Signal-Desktop (link from the webpage). Go get bower and npm and build it yourself. It'll be a zipfile.
- rsync 11y ago
  "Make sense since that's how you sign into the Chrome app store to download the app." I don't think it makes any sense at all. Even if you do use gmail/google in some places (I don't) it's not a given that you want to tie that identity to this app or these activities. A throwaway google account is getting very difficult since google automatically flags an account with no mobile phone number attached to it as a "suspicious activity" account, immediately forcing you to add a mobile number. Google is not the Internet. Their app store is not the Internet. I can't believe that the people I know to be behind this project have tied it to google in such a necessary and intimate way.
  - marssaxman 11y ago
    Really, they do that now!? No way am I giving Google my phone number, goddamn. I have gradually drifted away from using any Google services - I guess I won't be creating any new Google accounts in the future, then.

phantom_oracle 11y ago

I have a question about this... Say a team of volunteers were willing to spend time to make something like a QT- or GTK-based native desktop application instead. How much more difficult would this be compared to what they did/used now? (the chrome-app) ? Also, will it take significantly longer to build such a native app? Anybody with experience building native apps, please share.

mahyarm 11y ago
Slack and several other chat apps are web based. You don't really need it. Dev time and cross platform compatibility would be worse. With this they get at least 4 platforms.
joshka 11y ago
What about using something like http://electron.atom.io http://electron.atom.io instead. This would likely be the best of both worlds - native, but not browser-dependent.
- giancarlostoro 11y ago
  I really wish this was an Electron / nw.js app instead of a Chrome plugin.
  - mintplant 11y ago
    I've experimented with this and with a little tweaking it works fine under NW.js's alpha support for running Chrome Apps.
    - giancarlostoro 11y ago
      I mention it because downloading one file (a nw.js / electron build) is a lot less friction filled than (in some cases) downloading an entire browser just to use one app. There's still people out there who still use Firefox or whatever default browser their OS comes with. Instead of downloading one file, you're now forced to download two.

fiatjaf 11y ago

Why do I need a phone number?

Freak_NL 11y ago
Yeah, this makes Signal a total non-starter for me. It is doing the same thing WhatsApp does: you need a smartphone to use it. Even the desktop version requires a smartphone to create an account. If privacy is so important for Signal, why forbid using it without a phone number? It makes no sense.

fiatjaf 11y ago

Why is there a queue for entering beta when it is possible to get the source and install on Chrome right away?

darklajid 11y ago

I'm feeling dirty, because I don't like to be that negative, especially if we're talking open-source software. And I feel that I kinda hold this project to higher standards: If I compare this to WhatsApp/Telegram/Threema/Whatever, I inheritently, somewhat subconciously expect more from Signal. And I'm disappointed. I tend to repeat the 'central server' and 'a phone number is not an address and not public information, it certainly is no identity' criticism. When I read the headline/title, I thought 'Now maybe that would be enough to be ~good enough~ to ditch Telegram' in spite of these problems (which Telegram has as well, ofc). But really. A Chrome app. And works only (yeah, I think I said it before: Phone numbers suck) as a secondary client. And only if the first client is Android? I seriously don't get it. And it certainly is not for me: I don't like that browser (I do have it installed for testing and to follow it at times, but there's no 'app' I'd run in Chrome). I don't want to tie something to my phone and I don't think that it should matter what platform my handset runs on - SailfishOS looks nice, FxOS progresses slow but ticks a good number of boxes for me. Full circle to the first line: I don't _like_ to be negative and the headline gave me hope for a couple seconds. Unfortunately this release just deepened my belief that Signal wasn't meant to be for me.

tptacek 11y ago
The central server in Signal does not have the same role as the Telegram's. If you care first and foremost about UX, use Telegram. If you care first and foremost about the security of your communications, use Signal; go out of your way to use Signal.
- aw3c2 11y ago
  > go out of your way to use Signal With that mindset we will never get secure communications to the masses but will repeat the PGP dilemma again and again. UX is of utmost importance. We would still be on 99.99% HTTP websites if HTTPS required going out of one's way.
  - tptacek 11y ago
    That's what the Cryptocat people said.

dates 11y ago

I got excited about signal after watching this video, which explains pretty well the challenges of encrypted communication and how Signal addresses them (it might be basic stuff for people super familiar with the topic though): https://www.youtube.com/watch?v=tOMiAeRwpPA https://www.youtube.com/watch?v=tOMiAeRwpPA

finnn 11y ago

>Don't leave your friends behind, invite them to signup with this unique link. The more friends that join, the further you will advance in line for the beta. That's annoying.

JshWright 11y ago
Even more annoying is that it tells you how many people are ahead of you in line, so you get to watch that number grow as you move further down the list... I was pretty excited about this when I saw the title, now I'm just annoyed.
anotheryou 11y ago
with "34 clicks and 0 signups" I'm not even in the top 10% Of course no human ever had clicked my link, but I'm surprised how many clicks other people generate (given they don't cheat as well, hehe).

morsch 11y ago

I've been looking forward to this! Thanks for all the hard work.

klapinat0r 11y ago

This is slightly off-topic, but I hope moxie (or an employee of WhisperSystems - nothing official needed) wouldn't mind chiming in: Since I loved the fact that I can run my own TextSecure server, I'm wondering why Signal does not run a similar model? I'm curious which considerations went into this decision.

NfnK2ECvNE 11y ago

I agree with some of the folks here. I have the utmost respect for Signal and Marlinspike but this seems like a weird direction for this to go in. A Chrome app? Tying it to the Chrome App Store? Requiring a Google email for the beta group? Just seems out of place for Signal.

Sephr 11y ago

Call it what it really is: "Signal Phone Remote". This is not Signal Desktop if you need a non-desktop to use it.

haffenloher 11y ago
That name would imply your phone had to be online for the desktop app to work - that's not the case.
- Sephr 11y ago
  Oh, that does sound a lot more reasonable and I made an incorrect assumption. I take it that you still need a phone to make a signal account though?
  - haffenloher 11y ago
    Yep, at least that's how the official version of the chrome app works at the moment, it offers no standalone option.

degenerate 11y ago

If I wanted someting that looked like skype, I would just use skype. These bubbly colorful interfaces make me sad on the inside :(

wepple 11y ago

This isn't working for me - the code that is supposed to show up for me to scan doesn't work, I just see: connecting....

wepple 11y ago

This isn't working for me, the code I'm supposed to scan won't show up, just Connecting.... (I installed from github)

muppetman 11y ago
EDIT: I apologise, I'm wrong. It appears github has been updated to remove this warning. and as it pretty says on github, the github repo is confiugred to connect to the development server. So yea, trying to jump the queue by installing the dev blob from github won't work.
- benedictp 11y ago
  I made it working: 1. Clone the Signal-Desktop Repo 2. Edit the File: "js/background.js" Line 56 SERVER_URL to 'https://textsecure-service.whispersystems.org' https://textsecure-service.whispersystems.org' and Line 57 ATTACHMENT_SERVER_URL to 'https://whispersystems-textsecure-attachments.s3.amazonaws.com' https://whispersystems-textsecure-attachments.s3.amazonaws.c... and save it 3. Open chrome://extensions/ 4. Activate Developer mode 5. Click "Load unpacked extension..." and select the Signal-Desktop directory 6. Open https://textsecure-service.whispersystems.org/ https://textsecure-service.whispersystems.org/ and accept the cert (otherwise you won't see the qr code) 7. Scan the qr code and have fun!
  - muppetman 11y ago
    Fantastic, thanks, it's working great!
  - spin 11y ago
    > and accept the cert ... sigh... Trusted encryption fail. Is there some way to verify this cert?

riquito 11y ago

How much money do you need to develop and maintain a Firefox version? Can I donate? I don't want to help to enforce this idea that Chrom* is the only browser that can run certain things, is against my believes.

welly 11y ago

Sadly, as much as I'd like to use Telegram or Signal rather than the usual suspects (sms, whatsapp, facebook messenger), it would require someone on the other end to receive my messages. The likelihood of convincing my friends/family to use a messaging app that isn't any of the usual suspects is low to none. And none of my bleating about privacy issues will convince them otherwise ("I've got nothing to hide, doesn't bother me").

AndyMcConachie 11y ago

Why should I use this instead of Jabber/XMPP over TLS? Can someone sell me on this that knows how both work? Thanks!

ge0rg 11y ago
The differences are: * XMPP is using addresses with the same format as e-mail addresses (Jabber ID/JID), Signal accounts are bound to your phone number * Signal has strong end-to-end encryption built-in, for XMPP you need OTR or the recent OMEMO port of Signal's end-to-end crypto magic * XMPP is federated, where you talk to your server, and it talks to your buddies servers; with Signal everybody talks to WhisperSystems' servers * XMPP has no decent iOS app, but pretty good multi-device support otherwise

thursdaydecide3 11y ago

This is slightly off topic but am I the only one surprised at the litany of permissions they require for the android app? Some make sense (like SMS or camera) but device & app history/location/identity/device ID & call info/contacts/calendar/microphone/phone seems like a smash and grab. I saw moxie speak at a conference once and he specifically called out the device id/call information permission as evidence that google doesn't care about your privacy, so why is his privacy-enabling app requiring it?? I thought these were supposed to be the good guys (and girls)? The good guys (and girls) don't do 'collect it all.'

haffenloher 11y ago
> am I the only one surprised Why not ask your favorite search engine? Definitely faster than creating a HN account ;) First Google search result: http://support.whispersystems.org/hc/en-us/articles/212535858-What-are-all-these-permissions- http://support.whispersystems.org/hc/en-us/articles/21253585...

deleted 11y ago

[deleted]

Spakman 11y ago

I love Signal and advocate it wherever possible. After following along on the GitHub tickets for this project, I'm happy to say thank you and congratulations on the beta release folks! I'm probably about to ask this on the mailing list soon anyway, but in case there is any hidden knowledge here: 1. There was talk of server federation long ago. Is this still part of the long term plan? 2. There was talk of not using a phone number as a required identifier. Is this still part of the long term plan?