4 ms·

I wish I could keep recommending Signal to my friends. For an app as famous as theirs, the applications and tooling don’t feel mature at all. Their MacOS deskto

I wish I could keep recommending Signal to my friends. For an app as famous as theirs, the applications and tooling don’t feel mature at all. Their MacOS desktop app insists on updating multiple times a day. Indeed, every time I have it open, it starts bugging me for updates. I can’t have conversations anymore because the app insists on restarting signal. These hourly demands for updates has caused me to ignore them entirely - devaluing the core value add in the process. Was the latest 5pm update a security update that I desperately need? Well, I don’t know and at this point no longer care because I’d like to use the app to talk to people instead. The app also doesn’t work if you have multiple phones or a tablet. I can have signal either on my iPad or my phone. Not both. Why? I don’t know. But Signal insists that it is more secure. It’s a problem with these security focused applications. They often sacrifice usability on the altar of best case security; making applications that are hard to use for anyone but the most ardent of folks. I want to love this app, but their bad UX makes it really really hard.

Aqua 7y ago
I couldn't agree more with this, the constant requests to restart drive me nuts. It wouldn't have been so bad if it happened once a day, but 2-3 times make the usage as annoying as it can get.
- metildaa 7y ago
  What platform are you encountering this on? I have yet to see this behaviour, though Signal Desktop will throw away all its data if the checksum on the database fails (eg: dying SSD/hard drive). Take a peek at my other comment perhaps, signal-weechat & pyre.chat might be of use
izacus 7y ago
Now try backing up your conversations and group memberships - I've rarely seen so convoluted and user hostile process which practically ensures people will lose their chat histories and just switch to FB Messenger in disgust. I do admit the rest of the experience has improved, although the ban from binding more a single device to an account is still preventing me from using it more.
- metildaa 7y ago
  Check out my other comment about pyre.chat and signal-weechat, perhaps one of them will work for your use case? Signal does need serious help on the backup/restore process, iOS users are left in the cold and Android backups often fail when one attempts to restore them. I've followed up on issues on Signal Android about backups being borked (even getting Moxie to fix a bug at one point) but backups are obviously not a priority for the Signal Foundation. Very frustrating, and it has caused my friends and acquaintances to ragequit Signal in some cases.
- bilal4hmed 7y ago
  what are other secure apps that are competition for Signal and do some of the other things right ?
  - whitepoplar 7y ago
    WhatsApp uses the Signal Protocol and Wire uses a derivative of it (not the actual Signal Protocol). Both collect metadata that Signal doesn't (and I believe the last time I checked, WhatsApp stored unencrypted chat history to iCloud).
    - robocap37 7y ago
      you are correct about chats being unencrypted in icloud as well as google drive. So looks like signal is the least of all evils at the moment
    - tptacek 7y ago
      Wire uses a protocol derived from and related to Signal Protocol, but does not implement Signal Protocol.
      - whitepoplar 7y ago
        Thanks for the correction; fixed. I had always thought that Wire implemented the protocol explicitly, but I guess not.
metildaa 7y ago
Check out https://pyre.chat https://pyre.chat (pre-alpha) and signal-weechat for a non-electron based desktop client that won't nom all your ram. https://github.com/thefinn93/signal-weechat https://github.com/thefinn93/signal-weechat Signal makes for a decent SMS replacement, IMO they have put little effort into being a group chat competitor. Some bots like https://git.callpipe.com/yosl/repost4privacy https://git.callpipe.com/yosl/repost4privacy can make groups more user friendly, but group management is still poor. Edit: added last paragraph about groups.
- bilal4hmed 7y ago
  For people using Windows, there is a C# unofficial client as well https://github.com/signal-csharp/Signal-Windows https://github.com/signal-csharp/Signal-Windows
- _emacsomancer_ 7y ago
  signal-weechat looks very interesting. do you have any idea how well it works?
  - metildaa 7y ago
    Its seem much less development than pyre.chat, but it is a functional client (tho pictures all end up in a folder when sent your way, as images + ncurses doesn't really work).
bigDICK 7y ago
> Their MacOS desktop app insists on updating multiple times a day. They got the memo on pushing to production several times a day.
cyphar 7y ago
I've been switching people to Matrix recently, mainly because they have a solution for losing your chat history (you don't, at least not with the new key backup system) and there's a lot of other features like bridging and federation. Matrix is far from perfect at the moment but I feel that it will end up being a much more complete solution than Signal (the new seven-word key verification system is really cool and much better than how verification works for Signal). > Not both. Why? I don’t know. But Signal insists that it is more secure. It's because the provisioning support is only implemented in the JavaScript "SDK" (in scare-quotes because we all know Moxie is very hostile to users using apps other than the one they publish). Not only that, there were PRs that implemented the core functionality required and Moxie effectively said that the author was too inexperienced for the patch to even be worth reviewing[1]. There are third-party signal clients[2] which use that patch to allow for you to create "virtual devices" in your shell and thus (in theory) script signal chats or create Matrix bridges (I hope to do the latter at some point). [1]: https://github.com/signalapp/libsignal-service-java/pull/21 https://github.com/signalapp/libsignal-service-java/pull/21 [2]: https://github.com/AsamK/signal-cli https://github.com/AsamK/signal-cli
_bxg1 7y ago
> It’s a problem with these security focused applications. They often sacrifice usability on the altar of best case security; making applications that are hard to use for anyone but the most ardent of folks. I actually feel like Signal has done a better job than most in this respect. The interface is attractive, they make things like key resetting reasonably parseable, and there are nice mainstream features like built-in gif searching. That said I've fought with syncing problems at times, mostly surrounding the desktop app. Presumably it has to do with the authoritative copy being phones in peer to peer mode, instead of a server, but it's still pretty annoying sometimes.
tptacek 7y ago
Keep in mind that some (though not all) of Signal's UX "weakness" is a deliberate consequence of tradeoffs Signal makes for end-user privacy. Signal didn't even have user profiles until relatively recently, when the team came up with a privacy-preserving way of implementing them. There are UX features that are relatively easy to build, and par for the course in chat applications, that are much harder in Signal's model because they don't keep server-readable directories of who's talking to who. If you seriously care about privacy, when you look at chat app features, think "how would an ordinary developer be most likely to implement this feature, and what would that mean the application was tracking about me as a consequence?" One nice thing about Signal is that as a general rule, you can assume they're not trading privacy for convenience. It is also reasonable not to care as much about privacy as Signal does. If you want something with more UX niceties, but something close to (and, in most cases, cribbed from) Signal's security model, Wire is a good bet. Just remember, Wire has a lot of metadata about who you're talking to that Signal would treat as hazmat.

Aqua 7y ago

I couldn't agree more with this, the constant requests to restart drive me nuts. It wouldn't have been so bad if it happened once a day, but 2-3 times make the usage as annoying as it can get.

metildaa 7y ago
What platform are you encountering this on? I have yet to see this behaviour, though Signal Desktop will throw away all its data if the checksum on the database fails (eg: dying SSD/hard drive). Take a peek at my other comment perhaps, signal-weechat & pyre.chat might be of use

izacus 7y ago

Now try backing up your conversations and group memberships - I've rarely seen so convoluted and user hostile process which practically ensures people will lose their chat histories and just switch to FB Messenger in disgust. I do admit the rest of the experience has improved, although the ban from binding more a single device to an account is still preventing me from using it more.

metildaa 7y ago
Check out my other comment about pyre.chat and signal-weechat, perhaps one of them will work for your use case? Signal does need serious help on the backup/restore process, iOS users are left in the cold and Android backups often fail when one attempts to restore them. I've followed up on issues on Signal Android about backups being borked (even getting Moxie to fix a bug at one point) but backups are obviously not a priority for the Signal Foundation. Very frustrating, and it has caused my friends and acquaintances to ragequit Signal in some cases.
bilal4hmed 7y ago
what are other secure apps that are competition for Signal and do some of the other things right ?
- whitepoplar 7y ago
  WhatsApp uses the Signal Protocol and Wire uses a derivative of it (not the actual Signal Protocol). Both collect metadata that Signal doesn't (and I believe the last time I checked, WhatsApp stored unencrypted chat history to iCloud).
  - robocap37 7y ago
    you are correct about chats being unencrypted in icloud as well as google drive. So looks like signal is the least of all evils at the moment
  - tptacek 7y ago
    Wire uses a protocol derived from and related to Signal Protocol, but does not implement Signal Protocol.
    - whitepoplar 7y ago
      Thanks for the correction; fixed. I had always thought that Wire implemented the protocol explicitly, but I guess not.

metildaa 7y ago

Check out https://pyre.chat https://pyre.chat (pre-alpha) and signal-weechat for a non-electron based desktop client that won't nom all your ram. https://github.com/thefinn93/signal-weechat https://github.com/thefinn93/signal-weechat Signal makes for a decent SMS replacement, IMO they have put little effort into being a group chat competitor. Some bots like https://git.callpipe.com/yosl/repost4privacy https://git.callpipe.com/yosl/repost4privacy can make groups more user friendly, but group management is still poor. Edit: added last paragraph about groups.

bilal4hmed 7y ago
For people using Windows, there is a C# unofficial client as well https://github.com/signal-csharp/Signal-Windows https://github.com/signal-csharp/Signal-Windows
_emacsomancer_ 7y ago
signal-weechat looks very interesting. do you have any idea how well it works?
- metildaa 7y ago
  Its seem much less development than pyre.chat, but it is a functional client (tho pictures all end up in a folder when sent your way, as images + ncurses doesn't really work).

bigDICK 7y ago

> Their MacOS desktop app insists on updating multiple times a day. They got the memo on pushing to production several times a day.

cyphar 7y ago

I've been switching people to Matrix recently, mainly because they have a solution for losing your chat history (you don't, at least not with the new key backup system) and there's a lot of other features like bridging and federation. Matrix is far from perfect at the moment but I feel that it will end up being a much more complete solution than Signal (the new seven-word key verification system is really cool and much better than how verification works for Signal). > Not both. Why? I don’t know. But Signal insists that it is more secure. It's because the provisioning support is only implemented in the JavaScript "SDK" (in scare-quotes because we all know Moxie is very hostile to users using apps other than the one they publish). Not only that, there were PRs that implemented the core functionality required and Moxie effectively said that the author was too inexperienced for the patch to even be worth reviewing[1]. There are third-party signal clients[2] which use that patch to allow for you to create "virtual devices" in your shell and thus (in theory) script signal chats or create Matrix bridges (I hope to do the latter at some point). [1]: https://github.com/signalapp/libsignal-service-java/pull/21 https://github.com/signalapp/libsignal-service-java/pull/21 [2]: https://github.com/AsamK/signal-cli https://github.com/AsamK/signal-cli

_bxg1 7y ago

> It’s a problem with these security focused applications. They often sacrifice usability on the altar of best case security; making applications that are hard to use for anyone but the most ardent of folks. I actually feel like Signal has done a better job than most in this respect. The interface is attractive, they make things like key resetting reasonably parseable, and there are nice mainstream features like built-in gif searching. That said I've fought with syncing problems at times, mostly surrounding the desktop app. Presumably it has to do with the authoritative copy being phones in peer to peer mode, instead of a server, but it's still pretty annoying sometimes.

tptacek 7y ago

Keep in mind that some (though not all) of Signal's UX "weakness" is a deliberate consequence of tradeoffs Signal makes for end-user privacy. Signal didn't even have user profiles until relatively recently, when the team came up with a privacy-preserving way of implementing them. There are UX features that are relatively easy to build, and par for the course in chat applications, that are much harder in Signal's model because they don't keep server-readable directories of who's talking to who. If you seriously care about privacy, when you look at chat app features, think "how would an ordinary developer be most likely to implement this feature, and what would that mean the application was tracking about me as a consequence?" One nice thing about Signal is that as a general rule, you can assume they're not trading privacy for convenience. It is also reasonable not to care as much about privacy as Signal does. If you want something with more UX niceties, but something close to (and, in most cases, cribbed from) Signal's security model, Wire is a good bet. Just remember, Wire has a lot of metadata about who you're talking to that Signal would treat as hazmat.