4 ms·
Why does Signal want to make things so complicated? This starting premise about the 'normal approach' is not true: > However, you may want to change devices,
by gojomo 7y ago
Why does Signal want to make things so complicated?
This starting premise about the 'normal approach' is not true:
> However, you may want to change devices, and accidents sometimes happen. The normal approach to these situations would be to store data remotely in an unencrypted database,
No, the normal approach would be to let authenticated users export their data from their own secure device to a place of their choosing, then let authenticated users also import that data.
For paternalistic control-freaks like the Signal team, the data could even only ever be exported in an encrypted format, for encryption-at-rest. Sure, there'd be some risk that the encryption key is not well-protected, or the data-at-rest is subject to brute-force attacks – but many users can manage those risks themselves.
So why this strawman premise that the baseline is "remote" and "unencrypted"? Just give me a local export, and import, and I'll protect my data fairly well, thank you.
That would solve a major usability disaster of Signal on iOS devices: that even an orderly, planned device upgrade where both devices are in your sole control – and could conceivably do a direct transfer of all sensitive data! – will still lose all your history and Signal-contacts.
The cloud-centric strawmen from Signal continue with this related claim:
> In the example of a non-phone-number-based addressing system, cloud storage is necessary for recovering the social graph that would otherwise be lost with a device switch or app reinstall.
No, again, all a user needs is a local backup/transfer method for that list of usernames/identity-endpoints. (And to be no worse than the current Signal approach of re-using the device's native contact list, this list-at-rest or list-in-transit only needs protection as good as the native contact list, a pretty low bar.)
- mkj 7y agoYou're describing the zip drive approach that they mention in the article, which isn't competitive with current user expectations. Signal are trying to make a secure mass market product, not just something usable for geeks who will export a backup to their home sftp server.
- gojomo 7y agoThey don't really explain any specific problems with what they've slurred as a "zip drive" approach. Offering a self-backup option would be more competitive than Signal's current nothing at all – which means total data loss on any device loss or upgrade, for iOS users. Absolutely, promise users a Signal-quality cloud experience, someday, when this novel development is finished, and when there's an economic model for reliably storing users' opaque data in the cloud – and if users trust Intel SGX. But in the indefinitely-long meantime, why deny users the proven & well-worn path of self-data management? (And shouldn't users have the right to an exportable format of their own contact/messaging data?)
- ahelwer 7y agoThe manual backup & restore flow on Android is quite fragile - I filed two separate bugs during the process. It kinda seems like most people never get it working, which isn't surprising when you're dealing with two phone OSs interacting with a desktop OS (plus a user who is probably unfamiliar with directly accessing their phone storage over USB). The troubleshooting costs are quite high for such a rarely-used feature when their main competition (WhatsApp) has seamless backup restore. Investing time to develop the manual backup & restore feature on iOS might not be worth it.
- gojomo 7y agoThat's useful info on the Android experience... but if it works for anyone, it's still better than Signal's crappy answer to iOS users: "wait until someday when you can trust our new crypto & Intel SGX to upload all your data to a cloud". And yes, WhatsApp has a seamless experience – even if you never share your contact lists, or back-up your message history, to WhatsApp. It "just works" even if you only use encrypted local iOS phone backup/restores – no "unencrypted database in the remote cloud" required. That's why I find Signal's rationale, that "unencrypted remote cloud" is either the "normal approach" or "necessary for recovering the social graph", to be a hand-wavy & borderline dishonest oversimplification. There's a simple approach that works pretty well, including in their major competitor, without the flaws they allege! Debugging an "export to a single file whose format is completely under our control", then "import from that single file" cycle isn't exactly rocket science. But Signal clearly sees their desire to do rocket science as a sufficient excuse for why iOS users (& perhaps per your report, many Android users) can't have any working backup/device-migration solution for 5 years, and counting.