5 ms·

Let's not forget what Signal and the Signal Protocol (used by WhatsApp) have achieved: making end-to-end encrypted chat EASY and accessible for the masses, for

Let's not forget what Signal and the Signal Protocol (used by WhatsApp) have achieved: making end-to-end encrypted chat EASY and accessible for the masses, for many of whom "security" is password123. It's important in our post-Snowden world.

godelski 8y ago
I'm not sure why this is downvoted. The reason WA has so much popularity is that it is easy to use and you could use wifi. Signal is not as easy to use (less features) but more secure and so privacy conscious people like it. But people don't like switching to Signal because "it is hard". Making a more secure app is good, but we have to question "do we want people using pretty good e2e or do we want to make the perfect app first?"
- mikekchar 8y ago
  I don't think your question is as easy to answer as you might be implying. I certainly don't know the answer. My main concern is: what is the downside to "pretty good e2e"? Without understanding what that means, we can't evaluate the situation. "Good" is better than "best" if "best" is not available seems obvious, but it certainly isn't true in a lot of cases. If I tell you that X secure and you trust it to be secure, when it actually has problems -- that might be worse than me telling you that X is not secure. People are bad at evaluating risk. If I want to pass notes in class and don't want my teacher to know what the note says if I get caught, then rot-13 is probably "good enough". But if I'm a whistle-blower for a government agency, my security needs are quite a bit higher. We can never make a perfect app, but I'm not sure I could define what "good enough" looks like for the general populous. It's completely reasonable to me that different groups have different opinions on the matter -- and I think that's a good thing.
  - godelski 8y ago
    > If I tell you that X secure and ... Is Signal or WA in that regime? Literally the only reason I don't use WA is because it is owned by FB. But as far as I'm aware both are cryptographically secure. Yes, I'm aware WA has a metadata problem. So what's good enough? I'd say that if you need a state actor to crack it, I'll call it good enough. At least for the general populous. Any more difficulty that can be made is a bonus imo. Clearly we can't get a perfect e2e app. So at what point in time do we say "we also need other features that people want so that they'll use our app". That doesn't mean "stop working on encryption" (you can never stop that) but "we're at a good enough point to start targeting a larger market." I think something like Signal is there. Stop focusing on the security geeks and bring in the general public.
- diaz 8y ago
  I don't understand the it is hard part. You register with a phone number after installing and that's it. Isn't that the same use case as whatsapp? Sorry I never used Whatsapp, so it's really really hard to understand what are those features that people keep arguing about that are missing or so much easy of use on that application. I use Signal and Keybase regularly and I don't find them lacking. So any write up anywhere talking about those misterious and amazing features and user friendly UI that only Whatsapp has?
  - godelski 8y ago
    Here's what WA has that people want in Signal. > Group admins > Group calling I'm actually stopping there because Signal in the last year picked up a lot of other features that WA has and people want (like emojis). What still could be useful > Enabling md markup (I'd argue that this is more important to Signal because of the large amount of coders that use it). Note: this is in messenger. > A better desktop app > Way to add users without handing out phone numbers (low priority) As just texting a single person it is just fine. But text is not alone. This needs to be a chat app, not a texting app. Because that's what people want. > it's really really hard to understand what are those features that people keep arguing about that are missing Ask them. Use WA. Figure it out. Figure out why non-techie people don't use Signal.

godelski 8y ago

I'm not sure why this is downvoted. The reason WA has so much popularity is that it is easy to use and you could use wifi. Signal is not as easy to use (less features) but more secure and so privacy conscious people like it. But people don't like switching to Signal because "it is hard". Making a more secure app is good, but we have to question "do we want people using pretty good e2e or do we want to make the perfect app first?"

mikekchar 8y ago
I don't think your question is as easy to answer as you might be implying. I certainly don't know the answer. My main concern is: what is the downside to "pretty good e2e"? Without understanding what that means, we can't evaluate the situation. "Good" is better than "best" if "best" is not available seems obvious, but it certainly isn't true in a lot of cases. If I tell you that X secure and you trust it to be secure, when it actually has problems -- that might be worse than me telling you that X is not secure. People are bad at evaluating risk. If I want to pass notes in class and don't want my teacher to know what the note says if I get caught, then rot-13 is probably "good enough". But if I'm a whistle-blower for a government agency, my security needs are quite a bit higher. We can never make a perfect app, but I'm not sure I could define what "good enough" looks like for the general populous. It's completely reasonable to me that different groups have different opinions on the matter -- and I think that's a good thing.
- godelski 8y ago
  > If I tell you that X secure and ... Is Signal or WA in that regime? Literally the only reason I don't use WA is because it is owned by FB. But as far as I'm aware both are cryptographically secure. Yes, I'm aware WA has a metadata problem. So what's good enough? I'd say that if you need a state actor to crack it, I'll call it good enough. At least for the general populous. Any more difficulty that can be made is a bonus imo. Clearly we can't get a perfect e2e app. So at what point in time do we say "we also need other features that people want so that they'll use our app". That doesn't mean "stop working on encryption" (you can never stop that) but "we're at a good enough point to start targeting a larger market." I think something like Signal is there. Stop focusing on the security geeks and bring in the general public.
diaz 8y ago
I don't understand the it is hard part. You register with a phone number after installing and that's it. Isn't that the same use case as whatsapp? Sorry I never used Whatsapp, so it's really really hard to understand what are those features that people keep arguing about that are missing or so much easy of use on that application. I use Signal and Keybase regularly and I don't find them lacking. So any write up anywhere talking about those misterious and amazing features and user friendly UI that only Whatsapp has?
- godelski 8y ago
  Here's what WA has that people want in Signal. > Group admins > Group calling I'm actually stopping there because Signal in the last year picked up a lot of other features that WA has and people want (like emojis). What still could be useful > Enabling md markup (I'd argue that this is more important to Signal because of the large amount of coders that use it). Note: this is in messenger. > A better desktop app > Way to add users without handing out phone numbers (low priority) As just texting a single person it is just fine. But text is not alone. This needs to be a chat app, not a texting app. Because that's what people want. > it's really really hard to understand what are those features that people keep arguing about that are missing Ask them. Use WA. Figure it out. Figure out why non-techie people don't use Signal.