7 ms·

Signal Desktop is not really standalone, because you still need to pair it with your phone. And the phone should be turned on. I am very privacy conscious, and

by kome 9y ago

Signal Desktop is not really standalone, because you still need to pair it with your phone. And the phone should be turned on. I am very privacy conscious, and I don't use a smartphone, at all, because it's basically a spying device in your pocket. Why Signal is all about privacy and then it forces me to pair it with a telephone? Telegram desktop is really standalone. They require a telephone number too (and that's very annoying), but they don't require having a smartphone or keeping your phone open. My phone number on telegram is not even my phone number anymore, and it doesn't make any difference... Privacy wise is far from being perfect, but it's already better. At least it's usable.

wakkaflokka 9y ago
Can you expand more on your personal decision to be so privacy conscious?
- kome 9y ago
  No.
  - tedajax 9y ago
    This is a very Ron Swanson style answer that I approve of.
pspeter3 9y ago
Is Telegram as secure as Signal though?
- josh2600 9y ago
  No.
  - matt_kantor 9y ago
    This comment is not helpful.
    - nvr219 9y ago
      Here you go: "One major problem Telegram has is that it doesn’t encrypt chats by default, something the FBI has advocated for. “There are many Telegram users who think they are communicating in an encrypted way, when they’re not because they don’t realize that they have to turn on an additional setting,” Christopher Soghoian, Principal Technologist and Senior Policy Analyst at the American Civil Liberties Union, told Gizmodo. “Telegram has delivered everything that the government wants. Would I prefer that they used a method of encryption that followed industry best practices like WhatsApp and Signal? Certainly. But, if its not turned on by default, it doesn’t matter.”" source https://gizmodo.com/why-you-should-stop-using-telegram-right-now-1782557415 https://gizmodo.com/why-you-should-stop-using-telegram-right...
      - bilkow 9y ago
        That's not entirely true. While Telegram's "cloud chats" are not end-to-end encrypted by default, they're encrypted at rest. They claim that "all data is stored heavily encrypted and the encryption keys in each case are stored in several other DCs in different jurisdictions."[0] It's not even close to perfect, but it's also not everything that the government wants. For me, the problem with Signal is based mainly moxie's position on the LibreSignal fork, which aimed to be a Google-Free version of signal, but moxie said he was not OK with LibreSignal using the Open Whisper Systems servers and the name "Signal".[1] I kind of understand his position, but that's not what I'd expect of the free software community and definitely not what I expect from someone who's in the middle of my communications. In the end, the hope's in matrix.org. It supports end-to-end encryption, works without a number and is fully federated. Maybe someday Telegram and Signal can even federate with matrix. [0] https://telegram.org/privacy#2-storing-data https://telegram.org/privacy#2-storing-data [1] https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
        9y ago
mfwoods 9y ago
Signal Desktop works without having your phone turned on. It acts like a full, independent client after linking it to your smartphone app (unlike WhatsApp, which does require your phone to be turned on).
- kome 9y ago
  wow, sorry. my bad. So I guess there is a way to use signal without having a phone nowadays! That's a great news! I will try right now.
  - nickik 9y ago
    You could always use it without the phone.
  - mfwoods 9y ago
    You still need a phone with a registered Signal on iOS or Android initially to activate the desktop version (sorry if that wasn't clear), but you can turn your phone off after. Edit: It actually has the option to register without smartphone, but it's only enabled in the debug versions.
    - ofek 9y ago
      Where can you get the debug version? I can't find it.
      - fiatjaf 9y ago
        The debug version uses a different server. Will not work.
      - mfwoods 9y ago
        You can build it yourself from source. While it's true that the debug version uses different servers, the functionality is there and can probably be enabled in a production build with little modifications. This might get you started: https://github.com/WhisperSystems/Signal-Desktop/blob/d1f7f5ee8c1111c2b12a2870c64a830ca0f4fd04/js/views/app_view.js#L90 https://github.com/WhisperSystems/Signal-Desktop/blob/d1f7f5...
noja 9y ago
> I am very privacy conscious How did you evaluate Telegram to decide that you trust it?
- kome 9y ago
  I don't trust them, it's just that I can use them. The real problem is requiring a smartphone.
  - noja 9y ago
    I don't get you. You chose a secure messaging platform that you don't trust?
    - e1ven 9y ago
      He's using a messenger app with lower security than he'd like, because he can't use his preferred platform. Without having a smartphone, using Signal wasn't an option (at least previously). Sadly, almost everything involves tradeoffs. He (understandably) prefers to use a tool which doesn't require a phone, over one with a better security model.
  - detaro 9y ago
    The desktop version never required a running smartphone (one might even be able to complete signup using the app in an emulator and a dumbphone or a VoIP provider to receive the SMS, not sure)
wskinner 9y ago
Why do you trust the very large attack surface that is your personal computer less than the smaller attack surface that is your smartphone?
- BlackLotus89 9y ago
  How do you define attack surface? I trust my personal computer more than my phone. My personal computer runs an open source bios (coreboot) with an open source operating system (linux) and no closed source software (at least one of my PCs does). My phone on the other hand has many processors running on it (that I know about) that can interact with my device without me knowing and binary blobs (yes even with lineageos and with microg) that I can't control and many parts I can't update or update as fast/easy as my pc. My point: for most people the attack surface of the smartphone is far larger than the attack surface of the PC
krrrh 9y ago
Wire seems to have better security, and it’s desktop app doesn’t require a phone number and supports multiple logins. Client and server are open source. It’s got a pretty bad case of kitchen-sink flat ui, but is otherwise not bad.
- lqdc13 9y ago
  Wire has crazy usability issues after sending a few hundred messages. Clients just freeze up and crash. Another issue is centralized metadata collection. I know it's open source, but modifying it and recompiling all the clients I'm using would be very annoying.
dopu 9y ago
How can you be very privacy conscious yet lack ownership of the phone number that your Telegram account's registered on? Whoever takes ownership of that number can easily lock you out of your account while retaining access to everything you've ever posted.
- kome 9y ago
  Telegram is protected by an additional password. I hope that's the case for signal or whatsapp as well.

by kome 9y ago

wakkaflokka 9y ago

Can you expand more on your personal decision to be so privacy conscious?

kome 9y ago
No.
- tedajax 9y ago
  This is a very Ron Swanson style answer that I approve of.

pspeter3 9y ago

Is Telegram as secure as Signal though?

josh2600 9y ago
No.
- matt_kantor 9y ago
  This comment is not helpful.
  - nvr219 9y ago
    Here you go: "One major problem Telegram has is that it doesn’t encrypt chats by default, something the FBI has advocated for. “There are many Telegram users who think they are communicating in an encrypted way, when they’re not because they don’t realize that they have to turn on an additional setting,” Christopher Soghoian, Principal Technologist and Senior Policy Analyst at the American Civil Liberties Union, told Gizmodo. “Telegram has delivered everything that the government wants. Would I prefer that they used a method of encryption that followed industry best practices like WhatsApp and Signal? Certainly. But, if its not turned on by default, it doesn’t matter.”" source https://gizmodo.com/why-you-should-stop-using-telegram-right-now-1782557415 https://gizmodo.com/why-you-should-stop-using-telegram-right...
    - bilkow 9y ago
      That's not entirely true. While Telegram's "cloud chats" are not end-to-end encrypted by default, they're encrypted at rest. They claim that "all data is stored heavily encrypted and the encryption keys in each case are stored in several other DCs in different jurisdictions."[0] It's not even close to perfect, but it's also not everything that the government wants. For me, the problem with Signal is based mainly moxie's position on the LibreSignal fork, which aimed to be a Google-Free version of signal, but moxie said he was not OK with LibreSignal using the Open Whisper Systems servers and the name "Signal".[1] I kind of understand his position, but that's not what I'd expect of the free software community and definitely not what I expect from someone who's in the middle of my communications. In the end, the hope's in matrix.org. It supports end-to-end encryption, works without a number and is fully federated. Maybe someday Telegram and Signal can even federate with matrix. [0] https://telegram.org/privacy#2-storing-data https://telegram.org/privacy#2-storing-data [1] https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
      - 9y ago

mfwoods 9y ago

Signal Desktop works without having your phone turned on. It acts like a full, independent client after linking it to your smartphone app (unlike WhatsApp, which does require your phone to be turned on).

kome 9y ago
wow, sorry. my bad. So I guess there is a way to use signal without having a phone nowadays! That's a great news! I will try right now.
- nickik 9y ago
  You could always use it without the phone.
- mfwoods 9y ago
  You still need a phone with a registered Signal on iOS or Android initially to activate the desktop version (sorry if that wasn't clear), but you can turn your phone off after. Edit: It actually has the option to register without smartphone, but it's only enabled in the debug versions.
  - ofek 9y ago
    Where can you get the debug version? I can't find it.
    - fiatjaf 9y ago
      The debug version uses a different server. Will not work.
    - mfwoods 9y ago
      You can build it yourself from source. While it's true that the debug version uses different servers, the functionality is there and can probably be enabled in a production build with little modifications. This might get you started: https://github.com/WhisperSystems/Signal-Desktop/blob/d1f7f5ee8c1111c2b12a2870c64a830ca0f4fd04/js/views/app_view.js#L90 https://github.com/WhisperSystems/Signal-Desktop/blob/d1f7f5...

noja 9y ago

> I am very privacy conscious How did you evaluate Telegram to decide that you trust it?

kome 9y ago
I don't trust them, it's just that I can use them. The real problem is requiring a smartphone.
- noja 9y ago
  I don't get you. You chose a secure messaging platform that you don't trust?
  - e1ven 9y ago
    He's using a messenger app with lower security than he'd like, because he can't use his preferred platform. Without having a smartphone, using Signal wasn't an option (at least previously). Sadly, almost everything involves tradeoffs. He (understandably) prefers to use a tool which doesn't require a phone, over one with a better security model.
- detaro 9y ago
  The desktop version never required a running smartphone (one might even be able to complete signup using the app in an emulator and a dumbphone or a VoIP provider to receive the SMS, not sure)

wskinner 9y ago

Why do you trust the very large attack surface that is your personal computer less than the smaller attack surface that is your smartphone?

BlackLotus89 9y ago
How do you define attack surface? I trust my personal computer more than my phone. My personal computer runs an open source bios (coreboot) with an open source operating system (linux) and no closed source software (at least one of my PCs does). My phone on the other hand has many processors running on it (that I know about) that can interact with my device without me knowing and binary blobs (yes even with lineageos and with microg) that I can't control and many parts I can't update or update as fast/easy as my pc. My point: for most people the attack surface of the smartphone is far larger than the attack surface of the PC

krrrh 9y ago

Wire seems to have better security, and it’s desktop app doesn’t require a phone number and supports multiple logins. Client and server are open source. It’s got a pretty bad case of kitchen-sink flat ui, but is otherwise not bad.

lqdc13 9y ago
Wire has crazy usability issues after sending a few hundred messages. Clients just freeze up and crash. Another issue is centralized metadata collection. I know it's open source, but modifying it and recompiling all the clients I'm using would be very annoying.

dopu 9y ago

How can you be very privacy conscious yet lack ownership of the phone number that your Telegram account's registered on? Whoever takes ownership of that number can easily lock you out of your account while retaining access to everything you've ever posted.

kome 9y ago
Telegram is protected by an additional password. I hope that's the case for signal or whatsapp as well.