4 ms·

It's too bad Signal isn't used more widely. I even deleted it from my iPhone because of its very high data usage for contact discovery: about ~5MB for every(!)

It's too bad Signal isn't used more widely. I even deleted it from my iPhone because of its very high data usage for contact discovery: about ~5MB for every(!) change in my iPhone contacts. And after over six months, a fix has not been released yet [1] (and a new release doesn't seem planned for anytime soon). [1] https://github.com/WhisperSystems/Signal-iOS/issues/866 https://github.com/WhisperSystems/Signal-iOS/issues/866

Matt3o12_ 11y ago
The reason why I don't use signal is because it uploads all my contacts to their server, something which I don't want. I don't mind adding a contact by hand. I currently use Threema, which seems to be pretty secure. Unfortunately, it is not open source. A killer feature in Threema ist that you can exchange (and verify I believe) the certificates physicly. You just scan the other party's qr code (it think it is either the fingerprint or the public key) and it saves it to the contact (it will not save it to your phone it will just remember that user with the id ABC uses that certificate. But until it is open sourced, we can only use the good ole PGP.
- pfg 11y ago
  Actually, Signal uses bloom filters to do "offline", private contact discovery[1]. That's why their contact discovery is rather bandwidth-intensive, as @praseodym mentioned. [1]: https://whispersystems.org/blog/contact-discovery/ https://whispersystems.org/blog/contact-discovery/
- praseodym 11y ago
  Signal tried to avoid uploading contacts by downloading an encrypted bloom filter to match contacts on the device instead. Unfortunately this doesn't work out with many users (causing large downloads), so they ditched the feature. Reference and more details: https://whispersystems.org/blog/contact-discovery/ https://whispersystems.org/blog/contact-discovery/ Commit that removes bloom filters (unreleased, will be in version 2.4): https://github.com/WhisperSystems/Signal-iOS/commit/26f9207cab06e4df4af3dc9c02deca3d250eb4ae https://github.com/WhisperSystems/Signal-iOS/commit/26f9207c...
  - newman314 11y ago
    Wait, are you saying that encrypted contact discovery has been removed because it's "hard to do"?? I would think that's a pretty big change to be announced other than a blog post. I reread the post and the only mention is "For TextSecure, however, we’ve grown beyond the size where that remains practical, so the only thing we can do is write the server such that it doesn’t store the transmitted contact information, inform the user, and give them the choice of opting out". That's pretty WTF to me. Disabling access to contacts now and back to wishing for my unicorn messaging app.
    - StavrosK 11y ago
      No, it was removed because it "used 5MB for every change". I also wish for an app that would defy reality, but, until then, telling a server who your friends are so it can check, without telling it who your friends are, is a hard problem to solve.
      - tveita 11y ago
        There is nothing reality defying about meeting up and exchanging keys in person. Unfortunately, that's a use case the Signal UI goes out of its way to discourage. It's not like they don't know how, copying Threema's UI would be a massive improvement. Hell, even Snapchat lets you add a friend by scanning their screen, it's not like it's some user hostile ivory tower feature.
        StavrosK 11y ago
        Signal does too. We're talking about contact discovery, not key verification. Contact discovery is the problem of, given a list of contacts, returning the ones that are on the service. Contact discovery without the server seeing the list of contacts is hard.
        newman314 11y ago
        Given that the way Signal presents contacts is suboptimal too (contacts showing up irregardless if they have Signal installed only someone else uploaded said contact), I'd rather have a mode where I have to manually exchange contact info until such time secure contact exchange is solved.

Matt3o12_ 11y ago

The reason why I don't use signal is because it uploads all my contacts to their server, something which I don't want. I don't mind adding a contact by hand. I currently use Threema, which seems to be pretty secure. Unfortunately, it is not open source. A killer feature in Threema ist that you can exchange (and verify I believe) the certificates physicly. You just scan the other party's qr code (it think it is either the fingerprint or the public key) and it saves it to the contact (it will not save it to your phone it will just remember that user with the id ABC uses that certificate. But until it is open sourced, we can only use the good ole PGP.

pfg 11y ago
Actually, Signal uses bloom filters to do "offline", private contact discovery[1]. That's why their contact discovery is rather bandwidth-intensive, as @praseodym mentioned. [1]: https://whispersystems.org/blog/contact-discovery/ https://whispersystems.org/blog/contact-discovery/
praseodym 11y ago
Signal tried to avoid uploading contacts by downloading an encrypted bloom filter to match contacts on the device instead. Unfortunately this doesn't work out with many users (causing large downloads), so they ditched the feature. Reference and more details: https://whispersystems.org/blog/contact-discovery/ https://whispersystems.org/blog/contact-discovery/ Commit that removes bloom filters (unreleased, will be in version 2.4): https://github.com/WhisperSystems/Signal-iOS/commit/26f9207cab06e4df4af3dc9c02deca3d250eb4ae https://github.com/WhisperSystems/Signal-iOS/commit/26f9207c...
- newman314 11y ago
  Wait, are you saying that encrypted contact discovery has been removed because it's "hard to do"?? I would think that's a pretty big change to be announced other than a blog post. I reread the post and the only mention is "For TextSecure, however, we’ve grown beyond the size where that remains practical, so the only thing we can do is write the server such that it doesn’t store the transmitted contact information, inform the user, and give them the choice of opting out". That's pretty WTF to me. Disabling access to contacts now and back to wishing for my unicorn messaging app.
  - StavrosK 11y ago
    No, it was removed because it "used 5MB for every change". I also wish for an app that would defy reality, but, until then, telling a server who your friends are so it can check, without telling it who your friends are, is a hard problem to solve.
    - tveita 11y ago
      There is nothing reality defying about meeting up and exchanging keys in person. Unfortunately, that's a use case the Signal UI goes out of its way to discourage. It's not like they don't know how, copying Threema's UI would be a massive improvement. Hell, even Snapchat lets you add a friend by scanning their screen, it's not like it's some user hostile ivory tower feature.
      - StavrosK 11y ago
        Signal does too. We're talking about contact discovery, not key verification. Contact discovery is the problem of, given a list of contacts, returning the ones that are on the service. Contact discovery without the server seeing the list of contacts is hard.
        newman314 11y ago
        Given that the way Signal presents contacts is suboptimal too (contacts showing up irregardless if they have Signal installed only someone else uploaded said contact), I'd rather have a mode where I have to manually exchange contact info until such time secure contact exchange is solved.