3 ms·

What's this have that Signal doesn't?

uniformlyrandom 8y ago
Signal is server-based and not federated, tox is p2p. Matrix seems to be a closer match to what tox can do. > The Signal Protocol is a non-federated cryptographic protocol that can be used to provide end-to-end encryption for voice calls, video calls,[3] and instant messaging conversations. > Tox is a peer-to-peer instant-messaging and video-calling protocol that offers end-to-end encryption. https://en.wikipedia.org/wiki/Tox_(protocol) https://en.wikipedia.org/wiki/Tox_(protocol) https://en.wikipedia.org/wiki/Signal_Protocol https://en.wikipedia.org/wiki/Signal_Protocol https://en.wikipedia.org/wiki/Matrix_(protocol) https://en.wikipedia.org/wiki/Matrix_(protocol)
runn1ng 8y ago
security issues
CBLT 8y ago
A really well designed logo. (There's a running joke/observation that every time 4chan /g/ tries to produce something, they spend all their time debating logo design instead of working on the product. So for this /g/ project to take off, its logo must be so good as to be beyond reproach.)
crankylinuxuser 8y ago
Demands to your phone number/identity, and access to all your metadata. But hey, "Security and privacy"!
rjf72 8y ago
Many people that are interested in privacy and security consider server based software to be problematic. Even when server based software is open source, as Signal is, you are required to trust that what is being run on a server is the same code that they have released. And you are also required to trust that it is the only software they are running as it relates to your usage. This requires substantial trust which in modern times has, time and again, been shown to be something that should not be given. Signal is server based. Tox is serverless. In the case of Signal they also had unusual peculiarities. They have framed themselves as a privacy and security oriented company yet the first thing they require when signing up is a mobile number. And for years they required Google Play Services and were dependent upon Google Cloud Messaging. These sort of things send quite mixed signals, though to Signal's benefit they no longer require Google Play Services. Finally there is one practical issue with centralized services. They need to make money. Servers cost money. And as the popularity of a platform grows, the amount of money they need to earn also continues to grow. And that's just to exist - not to make a profit. For free services their most valuable resource that can be spun into money is user information. Signal for now has managed to get by on donations and grants. The vast majority of their funding coming from the "Open Technology Fund" [1], which is a US government program. If their funding dries up you risk seeing their ideological views change as a means of self preservation, or the entire service become unusable. This is not a problem with decentralized services. Ultimately it all comes down to what you'd prefer - centralized or decentralized. Signal is centralized, Tox is decentralized. Ideologically I believe the future of all digital technology ought and eventually will be decentralized, though the time scale of "future" there is quite immense. Nonetheless, I like to do my small bit today and support decentralized tech whenever possible. [1] - https://en.wikipedia.org/wiki/Open_Whisper_Systems#Funding https://en.wikipedia.org/wiki/Open_Whisper_Systems#Funding
- crtasm 8y ago
  The linked page says their funding from OTF was between 2013-16. You've managed to omit the fact that in Feb 2018 the Signal Foundation was formed - a non profit with $50m initial funding. I see that its nonprofit status is still pending however.
  - rjf72 8y ago
    And here we could get into all sorts of back and forth. For instance while it says OTF was from 2013-2016, there is also nothing listed after 2016. Does this mean that OTF cut funding for some reason, that future donations were not listed, that Signal was able to coast just based upon the relatively large OTF donations, or something altogether different? Who knows. And similarly the problem with funding is not one that's paradoxically not solved by money alone because it then raises new questions. In particular why would you put $50 million into a project like this? Is it simple good will and benevolence expecting that money to simply be gone but in exchange society gains a great centralized communication medium? Well, maybe - but it's also possible that there are different motivations. And when this money runs out what happens next? Ultimately I'm not trying to convince you not to use Signal, I'm explaining where I see problems with Signal. And with all centralized services it's going to come down to trust. If you trust Signal then you might answer the above questions in one way. If you don't trust them, then your answers would probably be quite different. In my opinion no tech company deserves the benefit of the doubt when it comes to trust anymore.

Signal is server-based and not federated, tox is p2p. Matrix seems to be a closer match to what tox can do. > The Signal Protocol is a non-federated cryptographic protocol that can be used to provide end-to-end encryption for voice calls, video calls,[3] and instant messaging conversations. > Tox is a peer-to-peer instant-messaging and video-calling protocol that offers end-to-end encryption. https://en.wikipedia.org/wiki/Tox_(protocol) https://en.wikipedia.org/wiki/Tox_(protocol) https://en.wikipedia.org/wiki/Signal_Protocol https://en.wikipedia.org/wiki/Signal_Protocol https://en.wikipedia.org/wiki/Matrix_(protocol) https://en.wikipedia.org/wiki/Matrix_(protocol)

runn1ng 8y ago

security issues

CBLT 8y ago

A really well designed logo. (There's a running joke/observation that every time 4chan /g/ tries to produce something, they spend all their time debating logo design instead of working on the product. So for this /g/ project to take off, its logo must be so good as to be beyond reproach.)

crankylinuxuser 8y ago

Demands to your phone number/identity, and access to all your metadata. But hey, "Security and privacy"!

rjf72 8y ago

Many people that are interested in privacy and security consider server based software to be problematic. Even when server based software is open source, as Signal is, you are required to trust that what is being run on a server is the same code that they have released. And you are also required to trust that it is the only software they are running as it relates to your usage. This requires substantial trust which in modern times has, time and again, been shown to be something that should not be given. Signal is server based. Tox is serverless. In the case of Signal they also had unusual peculiarities. They have framed themselves as a privacy and security oriented company yet the first thing they require when signing up is a mobile number. And for years they required Google Play Services and were dependent upon Google Cloud Messaging. These sort of things send quite mixed signals, though to Signal's benefit they no longer require Google Play Services. Finally there is one practical issue with centralized services. They need to make money. Servers cost money. And as the popularity of a platform grows, the amount of money they need to earn also continues to grow. And that's just to exist - not to make a profit. For free services their most valuable resource that can be spun into money is user information. Signal for now has managed to get by on donations and grants. The vast majority of their funding coming from the "Open Technology Fund" [1], which is a US government program. If their funding dries up you risk seeing their ideological views change as a means of self preservation, or the entire service become unusable. This is not a problem with decentralized services. Ultimately it all comes down to what you'd prefer - centralized or decentralized. Signal is centralized, Tox is decentralized. Ideologically I believe the future of all digital technology ought and eventually will be decentralized, though the time scale of "future" there is quite immense. Nonetheless, I like to do my small bit today and support decentralized tech whenever possible. [1] - https://en.wikipedia.org/wiki/Open_Whisper_Systems#Funding https://en.wikipedia.org/wiki/Open_Whisper_Systems#Funding

crtasm 8y ago
The linked page says their funding from OTF was between 2013-16. You've managed to omit the fact that in Feb 2018 the Signal Foundation was formed - a non profit with $50m initial funding. I see that its nonprofit status is still pending however.
- rjf72 8y ago
  And here we could get into all sorts of back and forth. For instance while it says OTF was from 2013-2016, there is also nothing listed after 2016. Does this mean that OTF cut funding for some reason, that future donations were not listed, that Signal was able to coast just based upon the relatively large OTF donations, or something altogether different? Who knows. And similarly the problem with funding is not one that's paradoxically not solved by money alone because it then raises new questions. In particular why would you put $50 million into a project like this? Is it simple good will and benevolence expecting that money to simply be gone but in exchange society gains a great centralized communication medium? Well, maybe - but it's also possible that there are different motivations. And when this money runs out what happens next? Ultimately I'm not trying to convince you not to use Signal, I'm explaining where I see problems with Signal. And with all centralized services it's going to come down to trust. If you trust Signal then you might answer the above questions in one way. If you don't trust them, then your answers would probably be quite different. In my opinion no tech company deserves the benefit of the doubt when it comes to trust anymore.