7 ms·
Honestly, the one and only feature I'm missing in Signal that would let me use it and recommend it to everyone without reservations (rather than exclusively for
by JoshTriplett 7y ago
Honestly, the one and only feature I'm missing in Signal that would let me use it and recommend it to everyone without reservations (rather than exclusively for ephemeral-only communication) is the ability to keep identity and full message history when moving to a new device.
Today, on iOS, you can't move your Signal history to a new device, and on Android you can only do so by manually making an encrypted backup file and writing down a 30-digit passcode, completely separate from the normal Android process of moving to a new device.
People keep long histories of messages, going back a decade, containing pictures and memories that aren't stored anywhere else. Message history is valuable data.
This doesn't seem like a "new cryptographic research" problem, this seems like a "well-established crypto (encrypted files) plus integration with standard device backup/migration" problem.
I really like Signal, I think they're doing things very well, and I wish I could use it without being constantly at risk of data loss. And this doesn't seem like an uncommon request, from what I've found.
Is there something I'm missing that makes this a hard problem? Or is it just a problem that nobody has prioritized?
- Tomte 7y ago> ability to keep identity and full message history when moving to a new device. I would love that. But even with WhatsApp it never worked for me. Last three device switches: Windows Phone to Android: Not supported. Android to Android: something went wrong. Android to iPhone: Not supported.
- foota 7y agoMaybe the concern is exfiltration? Making it easier to move phones may also make it easier for a hacker to exfil your data from a local hack or your phone's cloud (i.e., just hack your Icloud and trigger restore to a new phone)
- JoshTriplett 7y agoUnencrypted data/keys should never be in the backup, only data encrypted to some passphrase. It's perfectly fine (and necessary) to require a passphrase to recover backed up logs on the new device.
- thatcat 7y agoSignal has had the ability to export chat backups for a long time. I'm not sure why people would complain other than the export is local and you have to manage migration to new device by copying files instead of it being saved on a server and uploaded to your new device after you lose an old one. Also, identity is persistent since you're using a phone number and signal attaches the name you list to that phone number with a registration passcode that must be entered intermittently to keep receiving messages.
- tass 7y ago* on Android
- lawnchair_larry 7y agoThat was only added to the Android version. Not possible on iOS.
- parley 7y agoYes, there are a lot of us out there who use Signal and have this single missing feature as our largest pain point. My previous phone (iOS) would have been donated or sold to someone who could make better use of it, had I been able to actually get years and years of Signal conversations (with media) and memories out of it. But I can't (without prohibitive amounts of manual work), so it lies unused in a drawer waiting for the day I might. The Signal devs don't discuss their roadmap, as is their prerogative. The result is of course that no one knows if such features are even planned, let alone worked on. Half a decade (?) of sad and frustrated forum posts and GitHub issues attest to that. I scan through them from time to time to see if there's any word. But! There was actually a tweet from Moxie just a few weeks ago in a thread started by Matthew Green, I think, hinting that they might be working on it. It did make me a little happier. But yes, five years is a long time to wait for this feature, and we don't know for sure if or when it's coming. Me, amidst all the frustration I am very happy for the software they are giving me almost for free (I've donated a little bit). By the way, Josh, props to you for your patience and professionalism in the debian-devel thread about librsvg the other day.
- JoshTriplett 7y ago> Me, amidst all the frustration I am very happy for the software they are giving me almost for free (I've donated a little bit). Complete agreement. I'm glad for the work going into Signal, both in development and in research. > By the way, Josh, props to you for your patience and professionalism in the debian-devel thread about librsvg the other day. (OT) The other year? That conversation took place late last year. Thank you, though.
- parley 7y agoOh, wow. I stumbled over the thread just the other day and mechanically just read the month and day... Since it was November I somehow assumed it was recent without reacting. Thanks for the correction! Well, belated props to you then. =o)
- thaumasiotes 7y ago> Yes, there are a lot of us out there who use Signal and have this single missing feature as our largest pain point. That is fair, but... I'm willing to make a backup file and handle a 30-digit passcode. I don't want to sign up using a phone number. That's crazy. :-/
- mderazon 7y agoI actually going in the other direction with Signal I turned on timer (1 week) for all of my conversation. Nothing stays more than a week and I do not keep any backup. It's not for security or privacy reasons. I feel like I don't need a full history of all my conversations with everyone from the beginning of time. This fits more to the real life model of having a conversation with someone. I don't record my conversations with people so why do I need to do it in chat apps? My Whatsapp is the same. Don't need all the massive amount of chat history...
- m-p-3 7y agoI'm with you on that. Maybe it's just me, but I believe that a communication system (be Signal or email) is not designed for long term storage, it's just not efficient to keep structured data and not made for that purpose. If a fragment of a conversation is useful, I'd store it somewhere else safe just in case (Password Manager, as a secure note).
- wpietri 7y agoI think maybe we have different definitions of "useful". I'm pretty stubborn about preserving my chat history; it goes back across several phone upgrades. When my dad died earlier this year, I was glad of it. I get to scroll back and see what we talked about. If my choice was between secure comms and keeping history, I'd take keeping history. Surely many people are in the same boat. So if Signal wants to be truly ubiquitous (which increases security for all users), they really have to solve common user needs.
- JoshTriplett 7y agoInteresting that that model works for you, but that doesn't mean it works for everyone. Persistent history that lasts many times longer than the lifetime of any one device is a required feature to fully replace chat apps that have such history.
- benhurmarcel 7y agoWhatsapp doesn't have that feature when you switch between iOS and Android however.
- BLKNSLVR 7y agoI think I'm an exception in this instance, but I don't understand what value there is in message history. How often do you find yourself reminiscing by going back through a messaging log? If there are photos that should be kept then there are other ways to back them up. Is there valuable context in the conversation that was had around the delivery of the photo? Are messages backed up and restorable for other messaging systems, and have you ever needed to go through a restore process to look back through a conversation? If it's for the purposes of software project development team discussion and history needs to be kept for legal reasons then I think Signal is intentionally not aiming at that demographic. I get that there are special moments in life but, for me, the textual conversations around them are very secondary to the moments themselves. But then, in discussions I've had with other people, my opinion seems to be the exception.
- atoav 7y agoI think if yoi know everything is gone you will decide actively what is worth keeping. I keep a journal for exactlt these things
- m-p-3 7y agoI remember searching for something in Hangouts at work for a tidbit of info that I should have noted elsewhere. It was useful, but I wouldn't say it's a must. An email thread is useful and somewhat readable, and endless conversation between an individual or a group is less so.
- wpietri 7y agoYes, you are an exception. Just look at how popular books of letters are: https://www.goodreads.com/list/show/100260.Best_Books_of_Letters_Non_Fiction_ https://www.goodreads.com/list/show/100260.Best_Books_of_Let... Or look at how popular "Letters of Note" is: https://twitter.com/lettersofnote https://twitter.com/lettersofnote Conversation is connection.
- BLKNSLVR 7y agoI'm going to keep digging this hole for myself because I think there is some amount of treasure to be found. I'm also interested to see how far out of touch I am. There are tiers of conversation. Letters between famously literate people or during times of war have a value proposition on an entirely different scale to group chat messages. It's about the value that the individual assigns to the content of the conversation (this is almost arguing against my stated position). But if that conversation is never re-visited anyway, the value is the status of Schroedinger's cat. What content that is worthy of "Letters of note" is a) to be found in chat history? b) not already been saved elsewhere due to it's noteworthiness? c) going to be re-discovered by going back through hundreds or thousands of lines of conversation text on a mobile device screen? d) worth trawling back through hundreds or thousands of lines of conversation text on a mobile device screen? Again, I'm aware that I'm an exception, but I think it's potentially natural human laziness to want to keep 'everything' in case it might be useful or valuable in a few years' time. Electronic hoarding. I've recently setup an instance of NoteSelf to more easily track links to interesting articles and my own thoughts and ideas and various other things that I think are worthy of keeping. This is my form of targeted electronic hoarding. I'm in control of it, and it's robust enough to survive a mobile device theft, breakage, or some other kind of failure. Prior to that I write things down in journals, or other systems, some of which have been totally lost, but I don't find myself missing it or 'wondering what could have been'. It feels as if the point that I'm trying to make is that mindful archiving is a better solution than to just 'keep all the things' - for me, primarily, it's the far improved wheat / chaff ratio. Conversation is connection. Yes. But recorded conversation is just a reminder of connection, not the connection itself. I think my argument falls down when it comes to someone that's passed away, and keeping their flame alive to some extent. I don't work like that, but I wouldn't expect it of others.
- lawnchair_larry 7y agoI converted several non-technical people to Signal, and a few were devastated to learn that getting a new phone meant that they lost their message history. They refuse to use it ever again. The other sticking point is the phone number requirement. A (female) friend shared her “Signal” contact info with a professional acquaintance who doesn’t understand boundaries. After ignoring him on Signal, that led to unwanted SMS messages and even phone calls. For such a privacy-focused app, I don’t know why they are not more interested in protecting phone numbers.
- schoen 7y agoI just had the experience with a friend whom I got to use Signal who was shocked that she lost her message history when switching phones. Our conversation about it was kind of awkward because I was thinking something like "mud puddle test" (https://blog.cryptographyengineering.com/2012/04/05/icloud-who-holds-key/ https://blog.cryptographyengineering.com/2012/04/05/icloud-w...) and she was thinking something like "missing basic feature".
- hinkley 7y agoDoes this hold for backup and restore to the new phone?
- lightcatcher 7y agoYes. There is no way to move messages from one iOS device to another (such as a new phone). My girlfriend recently got a new iPhone and wanted to transfer our Signal message history from her old iPhone onto the new one. She said it wasn't possible, and then I spent an hour or two reading about it figuring there must be some hacky awful way to accomplish it. I couldn't find one. This has been an open issue for years [0][1]. Android has an inconvenient backup flow (that involves randomly generated 30 digit PIN and manual transfer of file), but that's infinitely better than the total lack of options on iOS. I do wish Android (and iOS) had a method to download all message history to decrypted plaintext (or JSON) for use with other apps. If I own my data, decrypting it should be my choice. I regret recommending to my girlfriend that we use Signal, and won't recommend Signal to more people after this. [0] https://github.com/signalapp/Signal-iOS/issues/2542 https://github.com/signalapp/Signal-iOS/issues/2542 [1] https://whispersystems.discoursehosting.net/t/ios-backup-keeping-message-history-when-switching-phones/1736 https://whispersystems.discoursehosting.net/t/ios-backup-kee...
- AmericanChopper 7y ago> Is there something I'm missing that makes this a hard problem? Yes. Pretty much the entire security model of Signal underpinned by this UX compromise. The way signal works at the moment, you sign up for an account with your phone number, your device generates a secret, and that secret is used to secure all your communication. You can pass that secret around devices (as long as you have a device that has it - or just the original phone, I can’t remember). You are also responsible for making sure the people you talk to are really who they say they are. When you first add a contact, it’s up to you to make sure they’re not an imposter, and if they have to reset their account their secret changes, and you have to verify who they are again. If somebody takes over their phone number on a new device, they have to generate a new secret, and while they may succeed in impersonating the person (depending on how vigilant their contacts are), they at least won’t get access to the message history. To allow for recovery of message history, you have to escrow the secret somewhere. If you give it to the service provider, then the security model is thrown out the window, and you just invented FB Messenger. If you give it to the user to escrow, then you’ve just kicked the can down the road, because a consumer is just as likely to lose a secret as they are their device, and the ways they may choose to store it will make the whole system less secure for essentially no UX gain. This is an unavoidable trade off. If you want the service provider to be able to recover your account, then they (or at least somebody in addition to you) has to have access to your secret. If you want your messages to be private, then you can’t allow for a 3rd party to be able to recover your account.
- saurik 7y ago> To allow for recovery of message history, you have to escrow the secret somewhere. You seem to be missing the point here: this isn't even about storing your data on someone else's computer with some kind of key escrow, this is about local backups not even working. Apple only recently implemented iMessage "sync", but before that (and still now), iMessage data was backed up to your Mac and accessible in your backup, without any concern about it being on some server or key escrow issues. Signal is simply missing the ability to get your own data out of the app on iOS. (And like, to really underscore how this is not a fundamental issue with Signal, their Android app does have a data export feature. They just don't think this is important enough to prioritize for some crazy reason.)
- Krasnol 7y agoI don't see the issue as dramatic as you do as I probably don't change my device so often. Writing down a 30-digit code once every 2-3 years isn't that hard. I assume people for whom this is too much do already use whatsapp and wouldn't switch over because they don't care about the reasons for why you have to write down this 30-digits code.
- JoshTriplett 7y ago> Writing down a 30-digit code once every 2-3 years isn't that hard. If you know that Signal needs a special backup procedure. If you don't, you've lost your data. Also, that process applies to manual backups and recoveries, such as for device-to-device transfer from a working device. It doesn't work nearly as well for performing regular backups of a working device in case it abruptly becomes a non-working device.
- lightcatcher 7y agoThe 30 digit code option is only possible on Android. I agree it's not that bad to do every couple years. There's no way to do backup/restore with Signal on iOS.
- kelnos 7y agoI've written a little Android app that watches the Signal backups directory and uploads new files to Google Drive when they appear. For a new phone, it can download your latest backup and put it where Signal will find it when you first run the app. I want to polish it and put it on the Play Store, but of course the last 20% is 80% of the work. I'm also reluctant to release it publicly because I'm worried about the support burden, because, while I've made the experience as easy as possible, it's still not a great experience considering how Signal works. I expect to see a lot of angry users who don't realize (despite documentation) that they need to download the backup to their new phone before running the Signal app for the first time. And then I expect people who lose their backup encryption key to blame me that their backups are unrecoverable. I guess at the very least I could open source it at some point, but the setup is a pain since you need to create a Google Cloud project authorized to use the GDrive APIs. Signal really needs this built-in. It puzzles me that it hasn't happened yet, since I built this little app in under ten hours (and I hadn't touched Android development in a good 7 years and had no experience with the GDrive APIs).