4 ms·

Signal for Beginners

95 points by heyAaronHatch 10y ago

mvdwoord 10y ago
I have used Signal for a while, alongside Telegram and Whatsapp. I find the fact that they are chrome apps / require your phone to be online very annoying. Also I find signal regularly messes with the order of messages. Right now I am testing with Wire, and waiting for proper pasting from clipboard. Although I am concerned with privacy, and I applaud the efforts from OWS, usability is more important to me. It will always be some sort of a tradeoff I guess. Although things seem to be getting better I am saddened by the lack of federation.
- deleted 10y ago
  [deleted]
- lorenzhs 10y ago
  Signal-Desktop does NOT require your phone to be on! After initial setup, it can be used completely independently of the phone (it only talks to the phone for contact sync, not messages). The opposite is often claimed on here and seems to be self-perpetuating, but it's wrong. (edited for clarification)
  - saycheese 10y ago
    Per the offical docs, you are required to create an account on a phone to use the desktop version: http://support.whispersystems.org/hc/en-us/articles/215077857-What-is-Signal-Desktop-How-can-I-sign-up- http://support.whispersystems.org/hc/en-us/articles/21507785... __________________ What do I need? 1. Register and set up Signal Android or Signal iOS 2. Download and install Google Chrome or use Chromium +++++++ EDIT: Having to buy and throw away a phone to use a service that's intent is to provide privacy is what it is; worth noting you revised your comment after I posted mine.
    - lorenzhs 10y ago
      Sorry if I wasn't clear enough - you need a phone for initial setup. After that, you can throw away the phone (or put it in airplane mode for a less permanent solution) and the Desktop client will keep working. In contrast, WhatsApp Web sends messages via your phone, so your phone needs to be on and connected to use it. Not so with Signal. That said, registration independent of a phone number comes up a lot here. Signal is primarily a mobile messenger, so the assumption that its users have a smart phone running Android or iOS is a valid one imho. It would be nice if people without a smart phone could use it, too, but implementing this in a way that maintains Signal's ease of use for all participants isn't exactly trivial (contact discovery is a big one). I'd appreciate it, but I can also understand why it's not #1 on OWS' list of priorities.
      - deleted 10y ago
        [deleted]
      - whyoh 10y ago
        >implementing this in a way that maintains Signal's ease of use for all participants isn't exactly trivial (contact discovery is a big one). I disagree, as long as it's an OPTIONAL and non-default method. Many people (billions?) have been registering to various messaging services (from email to Skype and all kinds of IMs) and finding each other just fine, without using a phone/phone number. Phone based authentication has a couple of advantages too, but when a "privacy oriented" messaging app has this as the only option it's fair to point it out.
    - shouldbew0rking 10y ago
      Hello saycheese, I have been toying with this idea, I haven't actually done it myself but I know people that have. 1) get a VOIP provider to give you a free iNum number 2) download signal to your smartphone or ipod of choice 3) during the registration phase, delete the number that it suggests, replace it with the iNum number from step 1. 4) make sure to have the registration process do the "voice call" method where it calls you and reads you off the registration number. 5) register. Assuming that you already own a cellphone and you use a free voip app like csipsimple or linphone. iNums are free from most voip providers. Then this process costs nothing.
  - mvdwoord 10y ago
    My apologies, Signal might not need it, but WhatsApp does. Out of order messages and some other quirks still make for a poor UX in my opinion.
- morganvachon 10y ago
  > I find the fact that they are chrome apps...very annoying That's my biggest issue with Signal as well. I very recently (as in, over the past two days) completely dropped Google from my life[1]. I switched from Gmail to FastMail for email, calendar, and contacts, and FastMail also offers 10GB of file storage at their middle tier, which is about five times as much space as I was using in Google Drive. I switched from Chrome/Chromium to Firefox, and I'm currently trying to decide which photo backup service to use to replace Google Photos. I'll probably run CollaboraOnline via a local Nextcloud server for a good Google Docs replacement. I'm using StartPage for search, as I find its results to be more relevant than DDG. All of that said to say this: It's absolutely refreshing to break out of the Google tar pit, and I'm very interested in a secure messaging app that doesn't depend on them at all. Being free from 24/7/365 tracking, no matter if it's "just for advertising purposes", is a breath of fresh air, as is knowing that all my eggs are spread out among several baskets now. [1] I do still have an Android phone (Nexus 6) but I switched from the official Google ROM to the latest stable Cyanogenmod, and opted to not install the Google apps bundle. My battery life has gone from about 30 hours between charges to nearly 70 hours (as predicted by the battery meter; I haven't had to charge it since I installed CM on Monday night and I'm at 81% as of Wednesday morning). I've been using F-Droid for some great replacements for many of my everyday apps, and the Amazon App Store for a few necessities like Paypal and Fing. As on the desktop, I'm using Firefox on the phone mostly for the syncing capability, though I will say the built-in browser on CM is fantastic. Of course, I'm actively seeking a non-Android, non-Apple alternative for a mobile phone, and right now the DragonBox Pyra is a front-runner, with the Neo900 a close second.
  - notheguyouthink 10y ago
    > as is knowing that all my eggs are spread out among several baskets now. This is what i want (and what i'm actively working towards)! The "banned from Google" talk has really harmed them in my eyes.. at least for people like me. I hadn't really questioned Google in the past, but now i'm looking to spread out my eggs as much as possible. Very important to me.
    - jhauris 10y ago
- johnchristopher 10y ago
  Telegram doesn't require your phone to be online. I have a telegram account the number of which has never been used with the smartphone application.
  - mvdwoord 10y ago
    I also use Telegram, it is currently my favourite messaging platform actually. It is not even so much the registering with a telephone I mind personally, but WhatsApp requires your phone to be online whilst using the desktop app. Jumping WiFi and VPN throughout the day this sometimes gets annoying. Testing wire for being Swiss based as well as being an implementation of the Axolotl/Signal protocol.
- tdkl 10y ago
  What's wrong with pasting from clipboard ?
  - mvdwoord 10y ago
    The wire desktop client currently does not support pasting an image from the clipboard. It is listed as a feature request though, so I expect it to be implemented in the near future.
    - tdkl 10y ago
      Oh, I thought it's something about the mobile client. I also noticed it doesn't support drag/drop with an image, probably because it's an electron app and things like that has to be coded specifically.
- mrbiber 10y ago
  If you are interested in federation, riot.im [1] / matrix.org seems to have comparable security properties to Signal, allows federation of servers and does not require your phone number or Google Play. [1] https://riot.im https://riot.im
- Mithaldu 10y ago
  Wire is even worse because the person responsible for design and UX is unassailably high in the company, and doesn't take advice from anyone
saycheese 10y ago
Ironic that Moxie, who doesn't go by his real name and is the founder of Signal, wants all of his users to identify themselves by providing their phone number and IMEI numbers; IMEI or 'International Mobile Equipment Identity' is a unique 15-digit number assigned to all cellular devices.
- zachlatta 10y ago
  It's a usability problem. Can you think of anything easier? I can't.
  - saycheese 10y ago
    Agree that the majority of users desire for anonymity is without merit, but so is requiring users to identify themselves. If a user is willing to put up with a less useful and usable version of Signal - they should be allowed to use it without identifying themselves. Beyond this issue, there are others that me show a troubling pattern. For example, Moxie has refused to post a "warrant canary" for US National Security Letters. In spirit, I like Moxie, in practice, I feel like he's the captain of ship flying a false flag.
    - lorenzhs 10y ago
      Anonymity isn't Signal's goal, simple as that. If you're looking for anonymous messaging, you'll have to search elsewhere. OWS recently received a subpoena and fought to be able to publish it (and their response), the only data they could provide were registration and last contact timestamps.
  - detaro 10y ago
    I find usernames a lot easier to communicate than phone numbers, and they are cheaper to move to another phone provider. And don't require me to share my phone number, which is an extremely high priority channel, with everybody I might want to send a message to. And if it is face2face, scanning a barcode like e.g. Threema supports is even quicker.
ohstopitu 10y ago
I want to add this here...very recently, my family was looking for a new chatting app to use (I tried to get them to use Slack, but they found it a bit too complicated). I really really wanted to use Signal (even with it not having a bots API), but the fact that you need a phone number to sign up is a no-go. My question is..why do you need a phone number (which imo is way more personal, than say an email?). Being security focused...would it not make sense to have as much less info on the person as possible? We have settled on kik for now. (although call support is lacking, i feel like it'll be added eventually)
- doubt_me 10y ago
  To make sure your connections are secure. You want to make sure the recipient is who they are. So phone Numbers. Also probably because signal isn't a chat app. It's an sms/ MMS end to end app.
- deleted 10y ago
  [deleted]
725686 10y ago
How does one know that the app being installed through an app store comes from the public source code? Shouldn't I need to create and install my own APK from source?
- heyAaronHatch 10y ago
  The code can certainly be different than the public source.
deleted 10y ago
[deleted]
a_imho 10y ago
To me it feels Signal just wants to become the new WhatsApp more than anything. Yes, I'm basing this on the gif support and that it requires a phone number. The security argument only worked as long as whatsapp and co. did not roll out e2ee. I could support a sincere attempt that want to do good which OWS seemed to be doing, but now that they are competing on the emoji front they have lost their edge for me* *I don't really have a horse in this as I use none of them
- bradyo 10y ago
  Except is rather everyone be using an open source, minimal logging version of WhatsApp
  - heyAaronHatch 10y ago
    Presuming the signed app code is the same as the published source; and of course we can't see the server code.
heyAaronHatch 10y ago
If you haven't noticed, check out my comments in the article. I provide a concerned, critical response arguing for why Signal might not be a good idea. Or in the least, Mr. Shelton should explain the possible risks and dangers.

95 points by heyAaronHatch 10y ago

I have used Signal for a while, alongside Telegram and Whatsapp. I find the fact that they are chrome apps / require your phone to be online very annoying. Also I find signal regularly messes with the order of messages. Right now I am testing with Wire, and waiting for proper pasting from clipboard. Although I am concerned with privacy, and I applaud the efforts from OWS, usability is more important to me. It will always be some sort of a tradeoff I guess. Although things seem to be getting better I am saddened by the lack of federation.

deleted 10y ago
[deleted]
lorenzhs 10y ago
Signal-Desktop does NOT require your phone to be on! After initial setup, it can be used completely independently of the phone (it only talks to the phone for contact sync, not messages). The opposite is often claimed on here and seems to be self-perpetuating, but it's wrong. (edited for clarification)
- saycheese 10y ago
  Per the offical docs, you are required to create an account on a phone to use the desktop version: http://support.whispersystems.org/hc/en-us/articles/215077857-What-is-Signal-Desktop-How-can-I-sign-up- http://support.whispersystems.org/hc/en-us/articles/21507785... __________________ What do I need? 1. Register and set up Signal Android or Signal iOS 2. Download and install Google Chrome or use Chromium +++++++ EDIT: Having to buy and throw away a phone to use a service that's intent is to provide privacy is what it is; worth noting you revised your comment after I posted mine.
  - lorenzhs 10y ago
    Sorry if I wasn't clear enough - you need a phone for initial setup. After that, you can throw away the phone (or put it in airplane mode for a less permanent solution) and the Desktop client will keep working. In contrast, WhatsApp Web sends messages via your phone, so your phone needs to be on and connected to use it. Not so with Signal. That said, registration independent of a phone number comes up a lot here. Signal is primarily a mobile messenger, so the assumption that its users have a smart phone running Android or iOS is a valid one imho. It would be nice if people without a smart phone could use it, too, but implementing this in a way that maintains Signal's ease of use for all participants isn't exactly trivial (contact discovery is a big one). I'd appreciate it, but I can also understand why it's not #1 on OWS' list of priorities.
    - deleted 10y ago
      [deleted]
    - whyoh 10y ago
      >implementing this in a way that maintains Signal's ease of use for all participants isn't exactly trivial (contact discovery is a big one). I disagree, as long as it's an OPTIONAL and non-default method. Many people (billions?) have been registering to various messaging services (from email to Skype and all kinds of IMs) and finding each other just fine, without using a phone/phone number. Phone based authentication has a couple of advantages too, but when a "privacy oriented" messaging app has this as the only option it's fair to point it out.
  - shouldbew0rking 10y ago
    Hello saycheese, I have been toying with this idea, I haven't actually done it myself but I know people that have. 1) get a VOIP provider to give you a free iNum number 2) download signal to your smartphone or ipod of choice 3) during the registration phase, delete the number that it suggests, replace it with the iNum number from step 1. 4) make sure to have the registration process do the "voice call" method where it calls you and reads you off the registration number. 5) register. Assuming that you already own a cellphone and you use a free voip app like csipsimple or linphone. iNums are free from most voip providers. Then this process costs nothing.
- mvdwoord 10y ago
  My apologies, Signal might not need it, but WhatsApp does. Out of order messages and some other quirks still make for a poor UX in my opinion.
morganvachon 10y ago
> I find the fact that they are chrome apps...very annoying That's my biggest issue with Signal as well. I very recently (as in, over the past two days) completely dropped Google from my life[1]. I switched from Gmail to FastMail for email, calendar, and contacts, and FastMail also offers 10GB of file storage at their middle tier, which is about five times as much space as I was using in Google Drive. I switched from Chrome/Chromium to Firefox, and I'm currently trying to decide which photo backup service to use to replace Google Photos. I'll probably run CollaboraOnline via a local Nextcloud server for a good Google Docs replacement. I'm using StartPage for search, as I find its results to be more relevant than DDG. All of that said to say this: It's absolutely refreshing to break out of the Google tar pit, and I'm very interested in a secure messaging app that doesn't depend on them at all. Being free from 24/7/365 tracking, no matter if it's "just for advertising purposes", is a breath of fresh air, as is knowing that all my eggs are spread out among several baskets now. [1] I do still have an Android phone (Nexus 6) but I switched from the official Google ROM to the latest stable Cyanogenmod, and opted to not install the Google apps bundle. My battery life has gone from about 30 hours between charges to nearly 70 hours (as predicted by the battery meter; I haven't had to charge it since I installed CM on Monday night and I'm at 81% as of Wednesday morning). I've been using F-Droid for some great replacements for many of my everyday apps, and the Amazon App Store for a few necessities like Paypal and Fing. As on the desktop, I'm using Firefox on the phone mostly for the syncing capability, though I will say the built-in browser on CM is fantastic. Of course, I'm actively seeking a non-Android, non-Apple alternative for a mobile phone, and right now the DragonBox Pyra is a front-runner, with the Neo900 a close second.
- notheguyouthink 10y ago
  > as is knowing that all my eggs are spread out among several baskets now. This is what i want (and what i'm actively working towards)! The "banned from Google" talk has really harmed them in my eyes.. at least for people like me. I hadn't really questioned Google in the past, but now i'm looking to spread out my eggs as much as possible. Very important to me.
  - jhauris 10y ago
johnchristopher 10y ago
Telegram doesn't require your phone to be online. I have a telegram account the number of which has never been used with the smartphone application.
- mvdwoord 10y ago
  I also use Telegram, it is currently my favourite messaging platform actually. It is not even so much the registering with a telephone I mind personally, but WhatsApp requires your phone to be online whilst using the desktop app. Jumping WiFi and VPN throughout the day this sometimes gets annoying. Testing wire for being Swiss based as well as being an implementation of the Axolotl/Signal protocol.
tdkl 10y ago
What's wrong with pasting from clipboard ?
- mvdwoord 10y ago
  The wire desktop client currently does not support pasting an image from the clipboard. It is listed as a feature request though, so I expect it to be implemented in the near future.
  - tdkl 10y ago
    Oh, I thought it's something about the mobile client. I also noticed it doesn't support drag/drop with an image, probably because it's an electron app and things like that has to be coded specifically.
mrbiber 10y ago
If you are interested in federation, riot.im [1] / matrix.org seems to have comparable security properties to Signal, allows federation of servers and does not require your phone number or Google Play. [1] https://riot.im https://riot.im
Mithaldu 10y ago
Wire is even worse because the person responsible for design and UX is unassailably high in the company, and doesn't take advice from anyone

saycheese 10y ago

Ironic that Moxie, who doesn't go by his real name and is the founder of Signal, wants all of his users to identify themselves by providing their phone number and IMEI numbers; IMEI or 'International Mobile Equipment Identity' is a unique 15-digit number assigned to all cellular devices.

zachlatta 10y ago
It's a usability problem. Can you think of anything easier? I can't.
- saycheese 10y ago
  Agree that the majority of users desire for anonymity is without merit, but so is requiring users to identify themselves. If a user is willing to put up with a less useful and usable version of Signal - they should be allowed to use it without identifying themselves. Beyond this issue, there are others that me show a troubling pattern. For example, Moxie has refused to post a "warrant canary" for US National Security Letters. In spirit, I like Moxie, in practice, I feel like he's the captain of ship flying a false flag.
  - lorenzhs 10y ago
    Anonymity isn't Signal's goal, simple as that. If you're looking for anonymous messaging, you'll have to search elsewhere. OWS recently received a subpoena and fought to be able to publish it (and their response), the only data they could provide were registration and last contact timestamps.
- detaro 10y ago
  I find usernames a lot easier to communicate than phone numbers, and they are cheaper to move to another phone provider. And don't require me to share my phone number, which is an extremely high priority channel, with everybody I might want to send a message to. And if it is face2face, scanning a barcode like e.g. Threema supports is even quicker.

ohstopitu 10y ago

I want to add this here...very recently, my family was looking for a new chatting app to use (I tried to get them to use Slack, but they found it a bit too complicated). I really really wanted to use Signal (even with it not having a bots API), but the fact that you need a phone number to sign up is a no-go. My question is..why do you need a phone number (which imo is way more personal, than say an email?). Being security focused...would it not make sense to have as much less info on the person as possible? We have settled on kik for now. (although call support is lacking, i feel like it'll be added eventually)

doubt_me 10y ago
To make sure your connections are secure. You want to make sure the recipient is who they are. So phone Numbers. Also probably because signal isn't a chat app. It's an sms/ MMS end to end app.
deleted 10y ago
[deleted]

725686 10y ago

How does one know that the app being installed through an app store comes from the public source code? Shouldn't I need to create and install my own APK from source?

heyAaronHatch 10y ago
The code can certainly be different than the public source.

deleted 10y ago

[deleted]

a_imho 10y ago

To me it feels Signal just wants to become the new WhatsApp more than anything. Yes, I'm basing this on the gif support and that it requires a phone number. The security argument only worked as long as whatsapp and co. did not roll out e2ee. I could support a sincere attempt that want to do good which OWS seemed to be doing, but now that they are competing on the emoji front they have lost their edge for me* *I don't really have a horse in this as I use none of them

bradyo 10y ago
Except is rather everyone be using an open source, minimal logging version of WhatsApp
- heyAaronHatch 10y ago
  Presuming the signed app code is the same as the published source; and of course we can't see the server code.

heyAaronHatch 10y ago

If you haven't noticed, check out my comments in the article. I provide a concerned, critical response arguing for why Signal might not be a good idea. Or in the least, Mr. Shelton should explain the possible risks and dangers.