6 ms·

There isn't much point in having a secure chat application if you want all your chats to be portable and exportable across devices and operating system upgrades

There isn't much point in having a secure chat application if you want all your chats to be portable and exportable across devices and operating system upgrades. You may as well just use Telegram and opt for 1:1 secret chats for when you actually want security.

gojomo 7y ago
Signal offers this backup/restore function on Android – where about 60-70% of their users are, if I understand the Wired stats correctly. So user-controlled portability doesn't seems fatal to the "point" of having a secure chat app, there. My workaround, last time I upgraded my iOS device, was to screenshot all the old conversations I wanted to retain. Pictures come over just fine! Did Signal forcing me to do that make me more secure? I think they just hate iCloud. (Perhaps while they trust Intel, they distrust Apple? It'd be great to know why.) Well, I don't trust iCloud with my device backups, either. There are other things, in other apps on my phone, more sensitive than my Signal logs. But it seems Signal is holding my chat histories hostage because they don't trust me. And it seems their ultimate plan for this will require me to use some Signal-run, Intel-SGX-mediated 'trustable cloud' for my contacts & messages. No, thanks!
- rpm91 7y ago
  A backup method that just copies it _somewhere else on the same device_ is not really a very useful backup. It involves manually moving files around if you want a real backup, which feels very antiquated in 2020. Why isn't there some way to automatically store my (encrypted!) backup via a cloud backup solution, whether that's Google Drive, Dropbox, or just allowing it to be backed up as part of an Android backup?
  - illvm 7y ago
    Doesn't copying device data to another device, such as a laptop or desktop, do that? I mean... it's not cloud based, but I _thought_ it was a full local backup.
    - JetSpiegel 7y ago
      Can you do that on Android? Other than shutting the phone down and `dd`ing the correct partition?
lucideer 7y ago
> There isn't much point in having a secure chat application if you want all your chats to be portable and exportable across devices and operating system upgrades Sorry but I don't understand this sentence. Why? Like, I get that it's challenging from a technical standpoint, but I absolutely don't see why it would be pointless? Riot/Matrix does it: it's far from mature/polished—plenty of room for improvement—but it uses double-ratchet, and it functions.
- hurricanetc 7y ago
  Storing conversations is introducing a massive security hole. One single person in a group can compromise every message from every user. Secure messages shouldn’t persist and if they do they aren’t secure. Being able to export, upload, and restore an entire conversation history is the opposite of secure. There is no point in using a secure messaging system if your entire conversation history can be downloaded the minute a single person in your group loses physical security on their device. Just use FB Messenger.
  - frandroid 7y ago
    > Storing conversations is introducing a massive security hole. Sure, but that could be up to every sender to decide whether they want their messages to be view once/view for 24hrs/store forever.
  - TheSpiceIsLife 7y ago
    Your comment only makes sense if we assume your security requirements match everyone else’s under all circumstances. This is not likely to be the case.
  - lucideer 7y ago
    > Secure messages shouldn’t persist This is a nice, but ultimately utopic, non-sensical, impossible security requirement. I take your point that anything persistent is insecure, but anything received is potentially persistent. There's no such thing as perfect security, there are only levels. Even a system with some hypothetical form of perfect plausible deniability designed into the receiving end could be compromised via transit metadata. Saying persistence makes secure messaging pointless is pure hyperbole. Encryption protects against a broad range of threat vectors, some simple, others extremely challenging. There's value in every measure.

gojomo 7y ago

Signal offers this backup/restore function on Android – where about 60-70% of their users are, if I understand the Wired stats correctly. So user-controlled portability doesn't seems fatal to the "point" of having a secure chat app, there. My workaround, last time I upgraded my iOS device, was to screenshot all the old conversations I wanted to retain. Pictures come over just fine! Did Signal forcing me to do that make me more secure? I think they just hate iCloud. (Perhaps while they trust Intel, they distrust Apple? It'd be great to know why.) Well, I don't trust iCloud with my device backups, either. There are other things, in other apps on my phone, more sensitive than my Signal logs. But it seems Signal is holding my chat histories hostage because they don't trust me. And it seems their ultimate plan for this will require me to use some Signal-run, Intel-SGX-mediated 'trustable cloud' for my contacts & messages. No, thanks!

rpm91 7y ago
A backup method that just copies it _somewhere else on the same device_ is not really a very useful backup. It involves manually moving files around if you want a real backup, which feels very antiquated in 2020. Why isn't there some way to automatically store my (encrypted!) backup via a cloud backup solution, whether that's Google Drive, Dropbox, or just allowing it to be backed up as part of an Android backup?
- illvm 7y ago
  Doesn't copying device data to another device, such as a laptop or desktop, do that? I mean... it's not cloud based, but I _thought_ it was a full local backup.
  - JetSpiegel 7y ago
    Can you do that on Android? Other than shutting the phone down and `dd`ing the correct partition?

lucideer 7y ago

> There isn't much point in having a secure chat application if you want all your chats to be portable and exportable across devices and operating system upgrades Sorry but I don't understand this sentence. Why? Like, I get that it's challenging from a technical standpoint, but I absolutely don't see why it would be pointless? Riot/Matrix does it: it's far from mature/polished—plenty of room for improvement—but it uses double-ratchet, and it functions.

hurricanetc 7y ago
Storing conversations is introducing a massive security hole. One single person in a group can compromise every message from every user. Secure messages shouldn’t persist and if they do they aren’t secure. Being able to export, upload, and restore an entire conversation history is the opposite of secure. There is no point in using a secure messaging system if your entire conversation history can be downloaded the minute a single person in your group loses physical security on their device. Just use FB Messenger.
- frandroid 7y ago
  > Storing conversations is introducing a massive security hole. Sure, but that could be up to every sender to decide whether they want their messages to be view once/view for 24hrs/store forever.
- TheSpiceIsLife 7y ago
  Your comment only makes sense if we assume your security requirements match everyone else’s under all circumstances. This is not likely to be the case.
- lucideer 7y ago
  > Secure messages shouldn’t persist This is a nice, but ultimately utopic, non-sensical, impossible security requirement. I take your point that anything persistent is insecure, but anything received is potentially persistent. There's no such thing as perfect security, there are only levels. Even a system with some hypothetical form of perfect plausible deniability designed into the receiving end could be compromised via transit metadata. Saying persistence makes secure messaging pointless is pure hyperbole. Encryption protects against a broad range of threat vectors, some simple, others extremely challenging. There's value in every measure.