4 ms·

The fact that Signal exists, and I can use it every day with friends and coworkers, is evidence that we are not locked in. No one is making money from Signal, a

by tprynn 10y ago

The fact that Signal exists, and I can use it every day with friends and coworkers, is evidence that we are not locked in. No one is making money from Signal, and anyone who uses Signal can switch to any of ten different (less secure) apps in five minutes. And if Signal goes away or whatever, we can build our own! The only thing stopping us is that we are a lot worse at designing crypto than Moxie and Trevor ;)

marssaxman 10y ago
I was using Signal, too. One day it phoned home, got some new instructions from its creators, refused to work any longer, and demanded that I download an upgrade. I was not excited about this, since upgrades generally break things, but after a few days of grumbling I knuckled under. Sure enough, the upgrade is broken: it insists that I have to upgrade Google Play Services, which I can't do, because I deleted it along with the rest of the Google code I don't want to use. I can't use Signal anymore, by Open Whispersystems' choice, which means I can't easily communicate with a fair number of my friends anymore, and that's apparently just the way it is. Open Whispersystems demands that I let Google have a level of access to my phone I don't want them to have, or they won't let me use Signal. Their proprietary Signal software is the only way to use the Signal service, so I can't just switch to an app whose privacy characteristics might be a better fit for my needs, as no other apps exist. Am I going to convince everyone I want to communicate with that they should stop using Signal and start using something else? No, I am not, because why would they do that? They're all happily using Signal now, and I'm the odd one out, so I lose. Sure feels a lot like lock-in; I have no good choices here.
- throwaway2048 10y ago
  Wisper's arguement here is basicly: you don't matter, and we arn't going to do anything to help you. And due to their walled garden, you can't do anything to help yourself either. so much for "open source infrastructure for a centralized network now provides almost the same level of control as federated protocols" Unless you mean control for Google.
  - marssaxman 10y ago
    I see where you're coming from but I think you're being too harsh. I don't know Moxie personally, but he's been out there fighting the good fight since the '90s - I have a vague and possibly erroneous memory of having encountered him on the old cypherpunks list, back during the dawn of time. While I have had a frustrating experience with Signal, I have nothing but respect for Moxie's skill and his commitment to secure, private communication. Engineering is hard, everything is a tradeoff; I'm certain that nobody involved with Signal has any intention whatsoever of trying to sell us out to Google. They're undoubtedly looking at a complicated problem and trying to do a good job with it. It just happens that their particular choices aren't working for me.
  - kijiki 10y ago
    Signal is open source, so you can just fork it to remove the dependency on GCM. In fact, someone already has, so you can just use it: https://fdroid.eutopia.cz/ https://fdroid.eutopia.cz/
    - ymse 10y ago
      Open Whisper Systems have asked LibreSignal to stop using their servers and may decide to shut it out. See https://github.com/LibreSignal/LibreSignal/issues/37 https://github.com/LibreSignal/LibreSignal/issues/37 and discussion upthread.
- dlmetcalf 10y ago
  I guess at the end of the day, that exactly my concern too. Signal is awesome, which is why we want to use it, but then suddenly the user finds they're now inextricably tied to Google or Facebook collecting their metadata - while we know Google themselves have been compromised (technically & legally) and are forced to hand that data over. Notably, to an NSA that has lied to Congress about it's operations, without consequence, and hence is now beyond oversight and reach of regulators too. Also that the iOS code, which appeared to be free & open, is actually not, because other projects are denied permission to use in a way that's compatible with iOS's App Store). Ironically because the libraries are under GPL. Hey, blame Apple I know, or ourselves for not reading all Apple's T&Cs before promoting Signal, but it's disappointing none-the-less (while also still being OWS's right). From all their history, the OWS guys seem to really want and be trying to do the right things, within the constraints and trade-offs available to them. The answers aren't trivial, but something about where it's all ended up leaves a very uncomfortable feeling.
nileshtrivedi 10y ago
You cannot use it with EVERYONE though, can you? Signal requires Google Play Services and is refusing to remove that dependency - leaving out all those users who cannot install Google Play Services, either for privacy reasons (as moxie calls them: "cryptonerds") or because they live in countries where Google is banned (all of China for example). LibreSignal folks are willing to do the work for removing that dependency on GCM but Signal won't federate with them. OTOH, moxie does have a point. They've tried federation with Cyanogen and the experience was painful.
- drjesusphd 10y ago
  I'm an outsider, so I'd like to make sure I understand this... So moxie here is claiming to offer the superlative encrypted communication service. On the other hand, he's insisting on a hard dependency that not only compromises privacy, but locks out one of the biggest emerging markets?
  - nileshtrivedi 10y ago
    His reply here may be relevant: https://news.ycombinator.com/item?id=10665520 https://news.ycombinator.com/item?id=10665520
pdkl95 10y ago
> Signal exists Only if you have an Android device with a mobile phone number.
- kkl 10y ago
  Signal does not require an Android device.
  - pdkl95 10y ago
    So how can I run it? Difficulty: the only hardware I own is my desktop that runs a custom Linux.
    - ashitlerferad 10y ago
      You aren't in the target audience; normal people who make up mainstream society.
      - pdkl95 10y ago
        What does that have to do with Signal's dependency on a mobile number? Signal is not an option for everyone, while other tools that use a less myopic design don't have that restriction. If the goal is to fight passive surveillance, it's a bad idea to artificially exclude minority groups. Cell phones may be popular, but they are not universal.
        ashitlerferad 10y ago
        I'm not moxie, but that is his stated goal; the majority not everyone. Especially not people who have heard of OpenPGP.
        ashitlerferad 10y ago
        Source for that last quip: http://www.thoughtcrime.org/blog/gpg-and-me/ http://www.thoughtcrime.org/blog/gpg-and-me/
mcepl 10y ago
> The fact that Signal exists, and I can use it every day with friends and coworkers, is evidence that we are not locked in. ???? This does not even start to make sense to me. The fact you could chat with your friends on ICQ/MSN/FacebookChat/Compuserve/AIM/Yahoo! IM/Prodigy meant you were not locked in?

by tprynn 10y ago

marssaxman 10y ago

I was using Signal, too. One day it phoned home, got some new instructions from its creators, refused to work any longer, and demanded that I download an upgrade. I was not excited about this, since upgrades generally break things, but after a few days of grumbling I knuckled under. Sure enough, the upgrade is broken: it insists that I have to upgrade Google Play Services, which I can't do, because I deleted it along with the rest of the Google code I don't want to use. I can't use Signal anymore, by Open Whispersystems' choice, which means I can't easily communicate with a fair number of my friends anymore, and that's apparently just the way it is. Open Whispersystems demands that I let Google have a level of access to my phone I don't want them to have, or they won't let me use Signal. Their proprietary Signal software is the only way to use the Signal service, so I can't just switch to an app whose privacy characteristics might be a better fit for my needs, as no other apps exist. Am I going to convince everyone I want to communicate with that they should stop using Signal and start using something else? No, I am not, because why would they do that? They're all happily using Signal now, and I'm the odd one out, so I lose. Sure feels a lot like lock-in; I have no good choices here.

throwaway2048 10y ago
Wisper's arguement here is basicly: you don't matter, and we arn't going to do anything to help you. And due to their walled garden, you can't do anything to help yourself either. so much for "open source infrastructure for a centralized network now provides almost the same level of control as federated protocols" Unless you mean control for Google.
- marssaxman 10y ago
  I see where you're coming from but I think you're being too harsh. I don't know Moxie personally, but he's been out there fighting the good fight since the '90s - I have a vague and possibly erroneous memory of having encountered him on the old cypherpunks list, back during the dawn of time. While I have had a frustrating experience with Signal, I have nothing but respect for Moxie's skill and his commitment to secure, private communication. Engineering is hard, everything is a tradeoff; I'm certain that nobody involved with Signal has any intention whatsoever of trying to sell us out to Google. They're undoubtedly looking at a complicated problem and trying to do a good job with it. It just happens that their particular choices aren't working for me.
- kijiki 10y ago
  Signal is open source, so you can just fork it to remove the dependency on GCM. In fact, someone already has, so you can just use it: https://fdroid.eutopia.cz/ https://fdroid.eutopia.cz/
  - ymse 10y ago
    Open Whisper Systems have asked LibreSignal to stop using their servers and may decide to shut it out. See https://github.com/LibreSignal/LibreSignal/issues/37 https://github.com/LibreSignal/LibreSignal/issues/37 and discussion upthread.
dlmetcalf 10y ago
I guess at the end of the day, that exactly my concern too. Signal is awesome, which is why we want to use it, but then suddenly the user finds they're now inextricably tied to Google or Facebook collecting their metadata - while we know Google themselves have been compromised (technically & legally) and are forced to hand that data over. Notably, to an NSA that has lied to Congress about it's operations, without consequence, and hence is now beyond oversight and reach of regulators too. Also that the iOS code, which appeared to be free & open, is actually not, because other projects are denied permission to use in a way that's compatible with iOS's App Store). Ironically because the libraries are under GPL. Hey, blame Apple I know, or ourselves for not reading all Apple's T&Cs before promoting Signal, but it's disappointing none-the-less (while also still being OWS's right). From all their history, the OWS guys seem to really want and be trying to do the right things, within the constraints and trade-offs available to them. The answers aren't trivial, but something about where it's all ended up leaves a very uncomfortable feeling.

nileshtrivedi 10y ago

You cannot use it with EVERYONE though, can you? Signal requires Google Play Services and is refusing to remove that dependency - leaving out all those users who cannot install Google Play Services, either for privacy reasons (as moxie calls them: "cryptonerds") or because they live in countries where Google is banned (all of China for example). LibreSignal folks are willing to do the work for removing that dependency on GCM but Signal won't federate with them. OTOH, moxie does have a point. They've tried federation with Cyanogen and the experience was painful.

drjesusphd 10y ago
I'm an outsider, so I'd like to make sure I understand this... So moxie here is claiming to offer the superlative encrypted communication service. On the other hand, he's insisting on a hard dependency that not only compromises privacy, but locks out one of the biggest emerging markets?
- nileshtrivedi 10y ago
  His reply here may be relevant: https://news.ycombinator.com/item?id=10665520 https://news.ycombinator.com/item?id=10665520

pdkl95 10y ago

> Signal exists Only if you have an Android device with a mobile phone number.

kkl 10y ago
Signal does not require an Android device.
- pdkl95 10y ago
  So how can I run it? Difficulty: the only hardware I own is my desktop that runs a custom Linux.
  - ashitlerferad 10y ago
    You aren't in the target audience; normal people who make up mainstream society.
    - pdkl95 10y ago
      What does that have to do with Signal's dependency on a mobile number? Signal is not an option for everyone, while other tools that use a less myopic design don't have that restriction. If the goal is to fight passive surveillance, it's a bad idea to artificially exclude minority groups. Cell phones may be popular, but they are not universal.
      - ashitlerferad 10y ago
        I'm not moxie, but that is his stated goal; the majority not everyone. Especially not people who have heard of OpenPGP.
        ashitlerferad 10y ago
        Source for that last quip: http://www.thoughtcrime.org/blog/gpg-and-me/ http://www.thoughtcrime.org/blog/gpg-and-me/

mcepl 10y ago

> The fact that Signal exists, and I can use it every day with friends and coworkers, is evidence that we are not locked in. ???? This does not even start to make sense to me. The fact you could chat with your friends on ICQ/MSN/FacebookChat/Compuserve/AIM/Yahoo! IM/Prodigy meant you were not locked in?