45 ms·

Signal app downloads spike as US protesters seek message encryption

472 points by pera 6y ago

matheusmoreira 6y ago
I hope one day apps like Signal will be the default for everyone, not just protesters in a time of crisis.
- senectus1 6y ago
  will only happen if phone manufactures ship them by default rather than the unsecure by default ones they ship atm. Sounds crazy when I say it outloud...
  - RL_Quine 6y ago
    iMessage is end to end encrypted by default. Perhaps not as strongly, but it's a good default to begin with.
    - Nextgrid 6y ago
      Key management is still centralized and controlled by Apple, so they can still MITM communications by messing with the key exchange. iCloud backups (enabled by default) are not end-to-end encrypted. So while it's technically E2E, in practice you get very little protection from it because it's broken by design. I still use iMessage because of the user experience, but let's not be fooled by their misleading E2E claims; it's all just marketing BS.
      - ciarannolan 6y ago
        If both parties disable iCloud on their phones, does Apple have any way to read messages sent via iMessage?
        frisco 6y ago
        We have no idea and there’s no real way even in principle for us to know.
        Nextgrid 6y ago
        They can still pull off an MITM attack by sending the MITM’s keys (pretending to be the other user’s keys) because they control they key exchange. It’s an active attack and can’t apply retroactively but within these constraints they can still do it.
        sneak 6y ago
        Yes, if they add a wiretapping key to one or both of your key lists, which is silent/invisible to the sender.
    - sfifs 6y ago
      Whenever key management is centralized, there is basically no security from the legal authority in the jurisdiction that the messaging vendor is located in. The vendor can always push you an MITM key. They can even show you the "correct" recipient key when you physically verify but use a different one for the actual message transfer and this would be a trivial easy to obfuscate switch in the program binary. E2E with centralized key management is primarily to protect you from casual/private threats (vendor employees, snoopers in your or your recipients network) not from legal authority.
      - TheSpiceIsLife 6y ago
        The Signal Foundation is based in Mountain View and both Moxie Marlinspike and Brian Acton are US nationals... What’s stopping some US government agency from forcing them to insert code that causes the Signal app to a indicate it is behaving correctly but isn’t? And don’t say “laws”. If your threat model includes advanced persistent threats all bets are off.
        deleted 6y ago
        [deleted]
    - driverdan 6y ago
      Regardless of its security features it's Apple device only which is a deal breaker.
  - loyukfai 6y ago
    WhatsApp isn't installed by default AFAIK, but it is one of the first apps installed by millions, if not billions, on their phones. In Korea, Taiwan and Japan, LINE became the de facto IM. In China, WeChat. But ain't sure if these are usually/always preinstalled in those markets. Cheers.
    - bgee 6y ago
      In Korea I think the de facto IM is Kakao, LINE is only third (after FB messager) [0][1]. [0]: https://www.statista.com/statistics/898254/south-korea-most-popular-instant-messenger/ https://www.statista.com/statistics/898254/south-korea-most-... [1]: https://www.quora.com/Which-is-the-most-popular-messaging-app-in-South-Korea https://www.quora.com/Which-is-the-most-popular-messaging-ap...
      - loyukfai 6y ago
        Thanks.
- AtHeartEngineer 6y ago
  It's my default and over a few years I've pretty much converted everyone in my life except my mom
  - sudofail 6y ago
    Same for me as well. All my friends and family have been on it for a few years now
  - ViViDboarder 6y ago
    I convinced my parents because of full resolution images.
  - nmfisher 6y ago
    Sadly, my (65 year old) mum is the only one I managed to convince to use to Signal. All my (mid-30s) friends won't budge from WhatsApp.
    - Abishek_Muthian 6y ago
      Having 'Message me on Signal' as status message on WhatsApp and not replying to non-urgent messages from Whatsapp helped to covert some of my contacts.
      - ClikeX 6y ago
        Nobody gave a shit about my status to contact me elswhwere. People just open the existing conversation and never see it anyway. And most don't care, or want to switch. Whatsapp is THE messaging standard in my country. Hell, even our politicans use it for communication. "Apping" is even used by news outlets to describe communication by Whatsapp. We used to have SMS and MSN. Now it's either Whatsapp or Messenger. Depending only on the fact if you have the others phone number or not.
    - deleted 6y ago
      [deleted]
  - jwr 6y ago
- techntoke 6y ago
  The Signal app experience leaves a lot to be desired compared to Telegram or Matrix.
  - themodelplumber 6y ago
    I was about to ask about this. Signal was comparatively annoying. Can I keep using Telegram or am I postponing the inevitable? Curious.
    - techntoke 6y ago
      As far as I am aware E2E only works on mobile and I think Mac for Telegram, although there may be third-party apps that support it. As long as you use E2E then I believe it has a lot more active users and probably has received an equal amount of security validation, so you should be fine.
    - fossuser 6y ago
      Is Telegram at all trustworthy? I feel like I’ve repeatedly seen on HN that they’re not a good choice for secure messaging (though I don’t remember the specifics around it). Signal and Matrix are the two options I’ve settled on. [Edit]: Looks like the main issues with Telegram are that it doesn't use end to end encryption by default and that they rolled their own encryption protocol that's likely not secure. They also used to leak a ton of metadata, but from searching around it looks like they may have made improvements. Either way seems like something to avoid when there are obviously better alternatives.
      - est31 6y ago
        Telegram is not E2E per default. They claim to not turn over data to authorities but I doubt that claim. Signal on the other hand is fully end to end encrypted.
      - input_sh 6y ago
        Telegram only end-to-end encrypts "secret messages", which I assume are rarely used.
- enraged_camel 6y ago
  I would ditch WhatsApp in a heartbeat if Signal had a browser client.
  - hcurtiss 6y ago
    Not in the browser, but it does have pretty decent desktop applications for most operating systems.
  - atoav 6y ago
    In my opinion Desktop Clients > Browser Clients when it comes to messengers. If you have more than ten tabs open it is annoying to always have to switch tabs or break out a window. Having a desktop application that remembers where you want to save stuff people send you is a plus too.
    - aspenmayer 6y ago
      Just make a new browser profile for your browser client. It will have its own window, and different profiles prevent windows of the same browser from being collapsed onto each other on some platforms.
    - plerpin 6y ago
      If you really like having app-like websites, you can do that in Chrome by clicking "Create Shortcut" then click the box that says "Open In Window". Voila. It behaves like a native app, and you can embed it in your Windows taskbar with a favicon and everything. Electron isn't as safe as Chromium. Last I checked it's based off a vintage build of Chromium with some very important features like the sandbox turned off (!)
    - hjek 6y ago
      My opinion is the opposite, because Electron is quite heavy (which is an issue for Signal Desktop at least), and because you can't use browser containers to use multiple accounts.
      - sorenjan 6y ago
- AnonC 6y ago
  I don't think that's a great idea until Signal stops exposing the phone number of the user to everyone else (for all the bashing that Telegram gets on cryptography, it has mechanisms to hide one's phone number and even the fact that one has a Telegram account from others).
  - 0xy 6y ago
    Absolutely agree. I really wish Telegram would get off the phone number system, especially after the embarrassing hack in Brazil. It's not explicitly Telegram's fault, but if your primary authentication method is insecure it's at least a little bit your fault. Phone numbers are NOT safe. I don't know why SMS MFA is even a thing, they're worse than passwords. When you use phone numbers or SMS for security, you are putting the fate of your entire company's security on an underpaid customer service rep at Verizon.
    - nickik 6y ago
      Telegram should maybe just use proper encryption first.
      - bjoli 6y ago
        And by default.
      - xerxesaa 6y ago
        Can someone explain to me why MtProto is not considered proper encryption? Genuinely asking, not challenging. At least since version 2.0 it seems it's using AES encryption: https://core.telegram.org/mtproto/description https://core.telegram.org/mtproto/description
        nickik 6y ago
        By default its not e2e encrypted and if you want to use e2e you lose lots of capability. That is simply not acceptable in a modern messenger.
- deleted 6y ago
  [deleted]
killswitched 6y ago
One has to wonder about behind the scenes heuristics as it pertains to taking a chance distributing a backdoored version sideloaded into the App Stores. One also wonders about whether the encryption or app are possibly compromised generally (even if the source is vetted and distributions are verified) Perhaps most of interest though would be how many phones are owned otherwise, to give access to the protester Signal comms anyway And also metadata must still fly around anyway, no?
- raspyberr 6y ago
  Signal does a pretty good job at minimizing the metadata it has access to. For example, the app can tell you who of your contacts has Signal installed but the Signal service itself never gets to see your contacts (https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/).
  - RL_Quine 6y ago
    It doesn't, logically, know who sent messages either.
  - Mediterraneo10 6y ago
    The problem is that in many countries, one's phone number is already killer metadata: it is linked to your identity, because you cannot purchase a SIM card without showing ID (a copy of which is made and sent to the authorities). Consequently, a repressive state can determine which of its citizens has installed Signal, and merely using an app known for privacy might already be grounds for persecution. Apparently Signal is working on identifiers different from a user's phone number, but it is not clear how many people will actually take advantage of this feature.
    - ViViDboarder 6y ago
      Presumably those that need to will use that feature. The value is still there as the only way for someone to find out if you have Signal remains the same: brute force. If people who need to keep their Signal use private are using an identifier not tied to their identity, brute forcing will not be useful. The uncertainty as to how many would use it is likely why it’s been back burnered for so long, but it shouldn’t impact effectiveness. I realize that you may not have been implying it would though.
monksy 6y ago
I'm not seeing it. I've only had 1 of my friends convert to signal in the last week. The rest of them: they've always have been on signal.
- CGamesPlay 6y ago
  So 100% of the people you know who were not on signal are now on signal?
  - monksy 6y ago
    Not sure I said that right. I have some friends on signal. Of the other platforms out there, I've only seen 1 sign up. I'm saying anidotically, I'm not seeing a massive wave of people sign on to signal.
zaroth 6y ago
Just an anecdote, I live close to the town I grew up in, which happens to have a large high-end mall. Over the weekend there have been large peaceful protests (“protest” perhaps isn’t even the right word, more like a show of solidarity) in the town common, a 2-acre square at the center of town. Police apparently got a tip on Monday night that a separate group was planning on looting the mall. They intercepted a convoy of cars many with out of state plates gathering in the empty parking lot and which fled when they saw the police. I guess that’s one thing that works in favor of suburban malls being only reachable via car, versus the destruction inflicted upon urban malls in my State. Apparently there had been public social media posts calling for the looting which got passed along to local police which deployed ahead of time to close the mall and clear out the parking lots. Op sec is particularly difficult I guess when these groups do not have pre-formed networks and are just sending out public recruitment posts to commit crimes. Anecdote aside, I think that Signal isn’t going to support the many-to-many broadcast messaging that large groups would need to organize effectively (whether peaceably or otherwise) and a system which allowed mass coordination is that much more likely to be infiltrated (see e.g. Project Veritas’ latest work against Antifa).
- ShamelessC 6y ago
  Can you please cite a source for these claims?
  - zaroth 6y ago
    Family members of mine were at the town center to show support for BLM. The town police spokesperson was interviewed on the local news and there is video of the police response at the mall. https://boston.cbslocal.com/2020/06/01/police-respond-to-natick-mall-south-shore-plaza/ https://boston.cbslocal.com/2020/06/01/police-respond-to-nat...
aerophilic 6y ago
Honest question for those in the know: If I wanted to run my own personal “analysis” to verify the security of Signal, where would I start? Is it even possible? Just curious if there was a way to “know” rather than “trust”.
- raspyberr 6y ago
  Learn cryptography to a high level then read the source code?
  - drdrey 6y ago
    How do you know that the binary you run actually corresponds to the source code you read? EDIT: and would you then also review every commit to make sure nothing bad gets introduced? No, at some point you have to place trust in the vendor, the developers, independent audits, etc.
    - RL_Quine 6y ago
      Determinism. https://tests.reproducible-builds.org/debian/reproducible.html https://tests.reproducible-builds.org/debian/reproducible.ht... We're making great strides into software being completely deterministic. The Bitcoin project for many years has had completely deterministic binaries and a ceremony process for GPG signing the output with many individual parties.
      - drdrey 6y ago
        See my other comment about determinism: https://news.ycombinator.com/item?id=23424925 https://news.ycombinator.com/item?id=23424925 Trying to get a bit-to-bit equivalent of a binary lifted from the app store sounds challenging to say the least.
        ryukafalz 6y ago
        Yes, this is more difficult than it sounds - but GP linked to the reproducible builds project which has gotten there already for a lot of software. See also Guix, which provides tools to challenge servers providing binary packages to see if they match a locally-built version: https://guix.gnu.org/manual/en/html_node/Invoking-guix-challenge.html https://guix.gnu.org/manual/en/html_node/Invoking-guix-chall...
epistasis 6y ago
To paraphrase Lenin, there are years where no one has Signal, then weeks where everyone gets Signal. https://twitter.com/benlorber8/status/1268596748198596608?s=21 https://twitter.com/benlorber8/status/1268596748198596608?s=...
0xADEADBEE 6y ago
Long-time Signal user but I'm on the verge of moving I think. There are several UX shortcomings but the new PIN nag is a bridge too far. What are my options for alternatives? I imagine Telegram is the next best bet but very open to suggestions.
- stevehawk 6y ago
  oof the pin nag is brutal, i hear that. as someone who doesn't back up or transfer their message is completely unnecessary to me to even have it.
  - 0xADEADBEE 6y ago
    Same. How hard is it to make it optional?
    - stevehawk 6y ago
      well it took them like 2 years to add an option to drop the "invite this contact" nag so I reckon pretty difficult /s
- drannex 6y ago
  Settings -> privacy -> Pin Reminders You can disable them there.
  - 0xADEADBEE 6y ago
    I tried that but that just makes you set a PIN which I don't want to do! I appreciate the help though, thank you.
- meitham 6y ago
  Threema. Don’t provide your phone number when signing up, and don’t permit it to access your address book. Set a recovery password. It’s not free, but a one small fee per app is worth getting my privacy back. Oh and it’s hosted outside the jurisdiction of 5-eyes!
TaylorAlexander 6y ago
While I assume Signal is very good at keeping your neighbors and the like out of your business, I feel like the NSA must have some ways of getting in to signal if they want. Like if they have backdoors to get in to iPhones I assume they can replace the binary and get at your info. Idk after learning about the Snowden revelations I assume every computer is compromised. I mean didn’t x86 have unpatched vulnerabilities for like two decades? It’s really hard for me to imagine that apps like Signal running on iphone or android can offer enough security to keep out the NSA. But I’d be very curious what folks think about that. I’ve told my drug dealer friends “signal is fine for selling weed but if you commit a murder they will probably find a way to get your messages.”
- RMPR 6y ago
  > While I assume Signal is very good at keeping your neighbors and the like out of your business, I feel like the NSA must have some ways of getting in to signal if they want. 'You have to go back in history, at least to the time when the devs dropped sms encryption and even earlier. The main developer, in a matter of weeks, had turned from someone harassed by the TSA into a receipient of a major government grant ($13 mln). Then he received lucrative contracts with the “greatest” bastion of privacy, Facebook and affiliates. You don’t get that by accident. You get that by providing your own significant part of the bargain.' https://forum.f-droid.org/t/we-can-include-signal-in-f-droid/7373 https://forum.f-droid.org/t/we-can-include-signal-in-f-droid... Just saying it's not the most unfounded theory out there.
AnonC 6y ago
The biggest drawback with Signal for protesters is that it exposes the user's phone number to everyone else in groups (just like WhatsApp does). There is no way to even hide the fact that you have an account on Signal. I can add phone numbers by enumeration into my contacts and Signal will show who among my contacts is on it. If the authorities don't use tactics like they did in Hong Kong, the protesters may be safe from being spied on (or worse).
- hjek 6y ago
  Signal is not only used by protesters[0][1] so discovering that a phone number is connected to a Signal account by no means implies that the phone is used by a protester. [0]: https://www.militarytimes.com/flashpoints/2020/01/23/deployed-82nd-airborne-unit-told-to-use-these-encrypted-messaging-apps-on-government-cellphones/ https://www.militarytimes.com/flashpoints/2020/01/23/deploye... [1]: https://www.theguardian.com/politics/2019/dec/17/tories-switch-to-messaging-app-signal-to-curb-whatsapp-leaks https://www.theguardian.com/politics/2019/dec/17/tories-swit...
  - m12k 6y ago
    Yeah, if you're ever asked why you're on Signal, just say you wanted to stay in touch with a programmer friend who's not on Facebook/WhatsApp, and they suggested Signal (that is now literally true as well - I suggest you try Signal, friend)
    - pwdisswordfish2 6y ago
      Couldn't you just say "I really like the user interface." Or "The logo looks cool." Or "It had 4 stars." Of "It had lots of good reviews."
      - Blaiz0r 6y ago
        no one would believe you...
        6y ago
_pmf_ 6y ago
Cell tower association should be enough. Maybe not recording videos of yourself and others committing felonies would be a start.
- bzb3 6y ago
  That would require an IQ of over 85.
lordnacho 6y ago
I like signal, mainly because it's open source. One minor annoyance though, perhaps someone knows how to fix it: when I use Signal on either my phone or my laptop, going back to the other device makes it sync the messages. But it does this really slowly, making a notification noise for each message, sometimes for several minutes. How do you either coalesce them or just do it fast? Doesn't seem like it's really a speed issue.
kome 6y ago
Signal exposes the user's phone number, better alternative is to use burner phones or Telegram.
- Evidlo 6y ago
  Or an open standard like Matrix
  - RMPR 6y ago
    I was wondering why nobody seemed to mention Matrix here
  - 0x49d1 6y ago
    First time hearing about Matrix standard. But in case the clients are maintained by some individuals - why should we trust them that there are no backdoors in their compiled binaries? Seems like a nice project! But probably it will take it's small niche, probably for now it is not wide spreaded, haven't heard any noise about the standard.
    - INTPenis 6y ago
      The signal server has 10 maintainers out of which 5 are signal employees. Matrix is 100% open source, has a larger community maintaining it and is federated. If you're worried about backdoors then you should have more eyes on the code.
- soziawa 6y ago
  Telegram doesn't have encryption for groups though.
  - 0x49d1 6y ago
    Actually they do: https://telegram.org/faq#q-so-how-do-you-encrypt-data https://telegram.org/faq#q-so-how-do-you-encrypt-data , but since group chats are using Telegram's servers the encryption is not client-to-client. Here is the actual specification of how does their srever-client encryption work: https://core.telegram.org/mtproto https://core.telegram.org/mtproto
upofadown 6y ago
>Signal and other encrypted messaging apps offer limited protections. If police have access to an unlocked phone, they can still read any messages on it that haven’t been deleted. In general, forward secrecy can't work if you insist on keeping the messages. If you truly want the messages to be gone for others you have to have to make them gone for you as well.
jwr 6y ago
What really hurts Signal are two things: * sub-par user experience: WhatsApp is just nicer and smoother, and people tend to like that * very few people understand that Signal DOES NOT get your full contact list, while Facebook (through WhatsApp) does Especially the second point is very relevant with the current situation — you do not necessarily want to expose your entire social graph to Facebook. But so few people understand this, and even fewer grasp that Signal can still work without doing the same thing.
- sekai 6y ago
  Telegram is a great alternative also, offers encrypted chat's also.
  - outadoc 6y ago
    Not encrypted by default afaik.
    - partyboat1586 6y ago
      Yeah you have to manually start an encrypted chat. I always thought that increased the sense of security since you have the lock symbol and all but apparently people prefer encryption by default.
    - theshrike79 6y ago
      They're all encrypted, but only specifically created Secret Chats are end-to-end encrypted.
      - CultOfSkaro 6y ago
        Encrypted in transit... But stored plain-text accessible in Telegram’s cloud. They store all your metadata, full contact list, all conversations, all media and attachments, etc. If you value your privacy, Telegram is the absolute worst and one of the most dangerous messengers out there. Telegram should never be recommended as a secure alternative. It’s insecure right to their core. Heck, even their secret chat crypto is a joke. Telegram should be avoided at all costs for private and/or sensitive communication. Even WhatsApp is wayyy more secure.
LongHalloween 6y ago
Has anyone here successfully convinced their non-techie friends to switch to Signal? How have you done it? I've been trying on and off with my closest friends, but no luck.
- akerro 6y ago
  Yesterday my non-technical colleagues a whatsapp group just said "I'm switching to signal, see you there" and suddenly a few people switched.
- caoilte 6y ago
  I got my family group chat setup in Signal. The biggest problem was how long it takes signal to sync your contacts. WhatsApp can do it in seconds but signal was taking an hour or more (this was on Xmas day).
- markosaric 6y ago
  I tried but couldn't. It just wasn't sticky enough for people to continue using it. Perhaps something like this latest growth could help? I tried with Telegram after failing with Signal and that worked for many. For whatever reason (I assume the user experience is nice and more compatible with Whatsapp etc), non-techie people do prefer Telegram to Signal in my experience.
- josefresco 6y ago
  I've convinced less than 3 clients to send me their sensitive credentials via Signal. I've instructed and asked dozens to use the service but most just use email.
- ardy42 6y ago
  > Has anyone here successfully convinced their non-techie friends to switch to Signal? How have you done it? I've been trying on and off with my closest friends, but no luck. I've gotten my girlfriend (now wife) and parents to switch. My siblings use it sporadically, but I think mostly to talk to me.
- Vinnl 6y ago
  Yep (or at least, less techie friends). Strategy is to not have WhatsApp - which leaves plenty of other alternatives (SMS, email, calling, Twitter DMs, whatever) for people who do need to contact me, but Signal is just considered easier by some. I just made sure that I've got groups chats for all my social circles that I add everyone who joins Signal to. Additionally, taking the initiative for fun activities (or always being eager to join), which -besides being fun- gives people without Signal FOMO, haha. Edit: Well, "switching" is a big word. They've got it installed, use it to contact me, and some have started using it as the primary means of communication with others who also have it. Most of them will still use WhatsApp even for contacts who are also on Signal though.
Markoff 6y ago
even after spike lower than already extremely obscure (in US) Telegram
maverick74 6y ago
Jami, anyone? Jami.net It does not have Signals problems
grandinj 6y ago
The thing about using these kinds of tools (IMO) is that it is effectively a giant flag waving at the NSA saying "hey: over here, I'm doing something worth keeping a close eye on!" And once they get sufficiently interested, they can crack pretty much anything the market can come up with. So if you're trying to hide stuff - old school is probably best, innocuous code-word language stuff, keep communication to a minimum, leave phone at home, etc, etc.
- ardy42 6y ago
  > The thing about using these kinds of tools (IMO) is that it is effectively a giant flag waving at the NSA saying "hey: over here, I'm doing something worth keeping a close eye on!" That's why I use Signal to chat with my wife and parents, and pretty much no one else. Secure apps need to become mundane so they don't draw attention, so I prioritize using them for mundane things.
travisporter 6y ago
I use signal, but am a little bit at unease because it's free. What's in it for the developers? Whatsapp is e2e and all that but the reason it got bought by facebook for an obscene amount of money is what gave me pause
- Vinnl 6y ago
  They're currently funded by donations [1] by individuals and organisations - among whom one of the WhatsApp cofounders, who made a significant investment using his WhatsApp money. [1] https://signal.org/donate/ https://signal.org/donate/
- vesche 6y ago
  The Signal Foundation is a 501(c)(3) nonprofit. They're funded by Brian Acton (former co-founder of WhatsApp, net worth ~3 billion), donations, and the Freedom of the Press Foundation. They are not owned by Facebook not sure why you said that.
  - travisporter 6y ago
    Was referring to WhatsApp owned by FB not Signal.
- gravitas 6y ago
  > I use signal, but am a little bit at unease because it's free. What's in it for the developers? I feel your question subtly touches on one of the reasons people like open source and develop for it - there are many people who just enjoying doing their tech-nerdy things and giving it away for free. Before it was called Open Source it was Freeware, Public Domain and other words - the inherent desire to just do something and give it away for free is inherent in the nature of some folks, with no expectations on return (money, fame, etc.). Postcardware and Beerware were even a thing - "like my thing? send me a postcard from where you live" and I sent a bunch of postcards. :)
salex89 6y ago
I actually like Signal, and would use it a lot more, but don't because of one feature - link previews. I understand the technical reasoning why are they so slow to adopt it, but I (and a group of people I communicate on a daily basis) would probably accept even a half-baked solution like the one on WhatsApp.
- oblio 6y ago
  Why do you find WhatsApp's solution half baked?
  - salex89 6y ago
    Even though it's generated sender-side, AFAIK, you wound't even know it is there as a feature. You paste a link, wait some time, and a preview appears. If you send it immediately, there is no preview. Which is acceptable, but at least give some kind of indication that the preview is being generated. Or for some links there is just no preview, and you stay there like an idiot waiting for a preview to appear without any notice it failed. Sometimes the preview is just not that good, although it's also up to the link optimisation.
- pacemkr 6y ago
  You want your encrypted chat application to emit DNS queries to your ISP. As another Signal user, I do not want that. Nor do I want the bloat of this and other features that will make the core functionality worse. Next we'll want Memoji's and animated drawings and fireworks. My point is, there is already an app for that. Signal has a completely different purpose.
  - salex89 6y ago
    You can generate a preview on the sender side. I think WhatsApp does it like that. Since you're the one sending the link, you've already opened it/know what's behind it. The receiver would basically get a thumbnail, with no egress traffic. As for the DNS, if you're concerned with the DNS of your ISP, you shouldn't be using it anyway (I don't). Don't extrapolate what I said. I like link previews and don't like Memojis and bloatware. But more often than not I like to know what's behind the URL. Maybe I don't wan't to open the site, or already seen the article, or the preview is enough to get information (like weather?). If we're on the road to proliferate privacy-conscious behaviour, we need to give something to "the masses", so they can enjoy the experience. And I want my mom and dad using products such as Signal, so I can use it with them. I have no use of it if my friends are not using it, and I'm all alone on the whole network. I don't support bloatware, but some sugar is needed.
gnome_chomsky 6y ago
The more people that adopt Signal, the better. I've been using it for years due to privacy concerns and usually ask everyone that I regularly communicate with to adopt it. I don't think it indicates any subversive or illegal behavior, but merely a desire to have private communications remain private.
Andrex 6y ago
Really hope E2EE on RCS isn't just Google blowing smoke. https://9to5google.com/2020/05/26/google-messages-end-to-end-encryption-rcs/ https://9to5google.com/2020/05/26/google-messages-end-to-end... Clearly not a solution to the current crisis but would be beneficial in future situations.
ian-g 6y ago
A couple friends of mine are professional organizers, and I know their orgs use signal for pretty much anything sensitive. I dunno how much they like it, but it's something they all use regularly

472 points by pera 6y ago

matheusmoreira 6y ago

I hope one day apps like Signal will be the default for everyone, not just protesters in a time of crisis.

senectus1 6y ago
will only happen if phone manufactures ship them by default rather than the unsecure by default ones they ship atm. Sounds crazy when I say it outloud...
- RL_Quine 6y ago
  iMessage is end to end encrypted by default. Perhaps not as strongly, but it's a good default to begin with.
  - Nextgrid 6y ago
    Key management is still centralized and controlled by Apple, so they can still MITM communications by messing with the key exchange. iCloud backups (enabled by default) are not end-to-end encrypted. So while it's technically E2E, in practice you get very little protection from it because it's broken by design. I still use iMessage because of the user experience, but let's not be fooled by their misleading E2E claims; it's all just marketing BS.
    - ciarannolan 6y ago
      If both parties disable iCloud on their phones, does Apple have any way to read messages sent via iMessage?
      - frisco 6y ago
        We have no idea and there’s no real way even in principle for us to know.
      - Nextgrid 6y ago
        They can still pull off an MITM attack by sending the MITM’s keys (pretending to be the other user’s keys) because they control they key exchange. It’s an active attack and can’t apply retroactively but within these constraints they can still do it.
      - sneak 6y ago
        Yes, if they add a wiretapping key to one or both of your key lists, which is silent/invisible to the sender.
  - sfifs 6y ago
    Whenever key management is centralized, there is basically no security from the legal authority in the jurisdiction that the messaging vendor is located in. The vendor can always push you an MITM key. They can even show you the "correct" recipient key when you physically verify but use a different one for the actual message transfer and this would be a trivial easy to obfuscate switch in the program binary. E2E with centralized key management is primarily to protect you from casual/private threats (vendor employees, snoopers in your or your recipients network) not from legal authority.
    - TheSpiceIsLife 6y ago
      The Signal Foundation is based in Mountain View and both Moxie Marlinspike and Brian Acton are US nationals... What’s stopping some US government agency from forcing them to insert code that causes the Signal app to a indicate it is behaving correctly but isn’t? And don’t say “laws”. If your threat model includes advanced persistent threats all bets are off.
      - deleted 6y ago
        [deleted]
  - driverdan 6y ago
    Regardless of its security features it's Apple device only which is a deal breaker.
- loyukfai 6y ago
  WhatsApp isn't installed by default AFAIK, but it is one of the first apps installed by millions, if not billions, on their phones. In Korea, Taiwan and Japan, LINE became the de facto IM. In China, WeChat. But ain't sure if these are usually/always preinstalled in those markets. Cheers.
  - bgee 6y ago
    In Korea I think the de facto IM is Kakao, LINE is only third (after FB messager) [0][1]. [0]: https://www.statista.com/statistics/898254/south-korea-most-popular-instant-messenger/ https://www.statista.com/statistics/898254/south-korea-most-... [1]: https://www.quora.com/Which-is-the-most-popular-messaging-app-in-South-Korea https://www.quora.com/Which-is-the-most-popular-messaging-ap...
    - loyukfai 6y ago
      Thanks.
AtHeartEngineer 6y ago
It's my default and over a few years I've pretty much converted everyone in my life except my mom
- sudofail 6y ago
  Same for me as well. All my friends and family have been on it for a few years now
- ViViDboarder 6y ago
  I convinced my parents because of full resolution images.
- nmfisher 6y ago
  Sadly, my (65 year old) mum is the only one I managed to convince to use to Signal. All my (mid-30s) friends won't budge from WhatsApp.
  - Abishek_Muthian 6y ago
    Having 'Message me on Signal' as status message on WhatsApp and not replying to non-urgent messages from Whatsapp helped to covert some of my contacts.
    - ClikeX 6y ago
      Nobody gave a shit about my status to contact me elswhwere. People just open the existing conversation and never see it anyway. And most don't care, or want to switch. Whatsapp is THE messaging standard in my country. Hell, even our politicans use it for communication. "Apping" is even used by news outlets to describe communication by Whatsapp. We used to have SMS and MSN. Now it's either Whatsapp or Messenger. Depending only on the fact if you have the others phone number or not.
  - deleted 6y ago
    [deleted]
- jwr 6y ago
techntoke 6y ago
The Signal app experience leaves a lot to be desired compared to Telegram or Matrix.
- themodelplumber 6y ago
  I was about to ask about this. Signal was comparatively annoying. Can I keep using Telegram or am I postponing the inevitable? Curious.
  - techntoke 6y ago
    As far as I am aware E2E only works on mobile and I think Mac for Telegram, although there may be third-party apps that support it. As long as you use E2E then I believe it has a lot more active users and probably has received an equal amount of security validation, so you should be fine.
  - fossuser 6y ago
    Is Telegram at all trustworthy? I feel like I’ve repeatedly seen on HN that they’re not a good choice for secure messaging (though I don’t remember the specifics around it). Signal and Matrix are the two options I’ve settled on. [Edit]: Looks like the main issues with Telegram are that it doesn't use end to end encryption by default and that they rolled their own encryption protocol that's likely not secure. They also used to leak a ton of metadata, but from searching around it looks like they may have made improvements. Either way seems like something to avoid when there are obviously better alternatives.
    - est31 6y ago
      Telegram is not E2E per default. They claim to not turn over data to authorities but I doubt that claim. Signal on the other hand is fully end to end encrypted.
    - input_sh 6y ago
      Telegram only end-to-end encrypts "secret messages", which I assume are rarely used.
enraged_camel 6y ago
I would ditch WhatsApp in a heartbeat if Signal had a browser client.
- hcurtiss 6y ago
  Not in the browser, but it does have pretty decent desktop applications for most operating systems.
- atoav 6y ago
  In my opinion Desktop Clients > Browser Clients when it comes to messengers. If you have more than ten tabs open it is annoying to always have to switch tabs or break out a window. Having a desktop application that remembers where you want to save stuff people send you is a plus too.
  - aspenmayer 6y ago
    Just make a new browser profile for your browser client. It will have its own window, and different profiles prevent windows of the same browser from being collapsed onto each other on some platforms.
  - plerpin 6y ago
    If you really like having app-like websites, you can do that in Chrome by clicking "Create Shortcut" then click the box that says "Open In Window". Voila. It behaves like a native app, and you can embed it in your Windows taskbar with a favicon and everything. Electron isn't as safe as Chromium. Last I checked it's based off a vintage build of Chromium with some very important features like the sandbox turned off (!)
  - hjek 6y ago
    My opinion is the opposite, because Electron is quite heavy (which is an issue for Signal Desktop at least), and because you can't use browser containers to use multiple accounts.
    - sorenjan 6y ago
AnonC 6y ago
I don't think that's a great idea until Signal stops exposing the phone number of the user to everyone else (for all the bashing that Telegram gets on cryptography, it has mechanisms to hide one's phone number and even the fact that one has a Telegram account from others).
- 0xy 6y ago
  Absolutely agree. I really wish Telegram would get off the phone number system, especially after the embarrassing hack in Brazil. It's not explicitly Telegram's fault, but if your primary authentication method is insecure it's at least a little bit your fault. Phone numbers are NOT safe. I don't know why SMS MFA is even a thing, they're worse than passwords. When you use phone numbers or SMS for security, you are putting the fate of your entire company's security on an underpaid customer service rep at Verizon.
  - nickik 6y ago
    Telegram should maybe just use proper encryption first.
    - bjoli 6y ago
      And by default.
    - xerxesaa 6y ago
      Can someone explain to me why MtProto is not considered proper encryption? Genuinely asking, not challenging. At least since version 2.0 it seems it's using AES encryption: https://core.telegram.org/mtproto/description https://core.telegram.org/mtproto/description
      - nickik 6y ago
        By default its not e2e encrypted and if you want to use e2e you lose lots of capability. That is simply not acceptable in a modern messenger.
deleted 6y ago
[deleted]

killswitched 6y ago

One has to wonder about behind the scenes heuristics as it pertains to taking a chance distributing a backdoored version sideloaded into the App Stores. One also wonders about whether the encryption or app are possibly compromised generally (even if the source is vetted and distributions are verified) Perhaps most of interest though would be how many phones are owned otherwise, to give access to the protester Signal comms anyway And also metadata must still fly around anyway, no?

raspyberr 6y ago
Signal does a pretty good job at minimizing the metadata it has access to. For example, the app can tell you who of your contacts has Signal installed but the Signal service itself never gets to see your contacts (https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/).
- RL_Quine 6y ago
  It doesn't, logically, know who sent messages either.
- Mediterraneo10 6y ago
  The problem is that in many countries, one's phone number is already killer metadata: it is linked to your identity, because you cannot purchase a SIM card without showing ID (a copy of which is made and sent to the authorities). Consequently, a repressive state can determine which of its citizens has installed Signal, and merely using an app known for privacy might already be grounds for persecution. Apparently Signal is working on identifiers different from a user's phone number, but it is not clear how many people will actually take advantage of this feature.
  - ViViDboarder 6y ago
    Presumably those that need to will use that feature. The value is still there as the only way for someone to find out if you have Signal remains the same: brute force. If people who need to keep their Signal use private are using an identifier not tied to their identity, brute forcing will not be useful. The uncertainty as to how many would use it is likely why it’s been back burnered for so long, but it shouldn’t impact effectiveness. I realize that you may not have been implying it would though.

monksy 6y ago

I'm not seeing it. I've only had 1 of my friends convert to signal in the last week. The rest of them: they've always have been on signal.

CGamesPlay 6y ago
So 100% of the people you know who were not on signal are now on signal?
- monksy 6y ago
  Not sure I said that right. I have some friends on signal. Of the other platforms out there, I've only seen 1 sign up. I'm saying anidotically, I'm not seeing a massive wave of people sign on to signal.

zaroth 6y ago

Just an anecdote, I live close to the town I grew up in, which happens to have a large high-end mall. Over the weekend there have been large peaceful protests (“protest” perhaps isn’t even the right word, more like a show of solidarity) in the town common, a 2-acre square at the center of town. Police apparently got a tip on Monday night that a separate group was planning on looting the mall. They intercepted a convoy of cars many with out of state plates gathering in the empty parking lot and which fled when they saw the police. I guess that’s one thing that works in favor of suburban malls being only reachable via car, versus the destruction inflicted upon urban malls in my State. Apparently there had been public social media posts calling for the looting which got passed along to local police which deployed ahead of time to close the mall and clear out the parking lots. Op sec is particularly difficult I guess when these groups do not have pre-formed networks and are just sending out public recruitment posts to commit crimes. Anecdote aside, I think that Signal isn’t going to support the many-to-many broadcast messaging that large groups would need to organize effectively (whether peaceably or otherwise) and a system which allowed mass coordination is that much more likely to be infiltrated (see e.g. Project Veritas’ latest work against Antifa).

ShamelessC 6y ago
Can you please cite a source for these claims?
- zaroth 6y ago
  Family members of mine were at the town center to show support for BLM. The town police spokesperson was interviewed on the local news and there is video of the police response at the mall. https://boston.cbslocal.com/2020/06/01/police-respond-to-natick-mall-south-shore-plaza/ https://boston.cbslocal.com/2020/06/01/police-respond-to-nat...

aerophilic 6y ago

Honest question for those in the know: If I wanted to run my own personal “analysis” to verify the security of Signal, where would I start? Is it even possible? Just curious if there was a way to “know” rather than “trust”.

raspyberr 6y ago
Learn cryptography to a high level then read the source code?
- drdrey 6y ago
  How do you know that the binary you run actually corresponds to the source code you read? EDIT: and would you then also review every commit to make sure nothing bad gets introduced? No, at some point you have to place trust in the vendor, the developers, independent audits, etc.
  - RL_Quine 6y ago
    Determinism. https://tests.reproducible-builds.org/debian/reproducible.html https://tests.reproducible-builds.org/debian/reproducible.ht... We're making great strides into software being completely deterministic. The Bitcoin project for many years has had completely deterministic binaries and a ceremony process for GPG signing the output with many individual parties.
    - drdrey 6y ago
      See my other comment about determinism: https://news.ycombinator.com/item?id=23424925 https://news.ycombinator.com/item?id=23424925 Trying to get a bit-to-bit equivalent of a binary lifted from the app store sounds challenging to say the least.
      - ryukafalz 6y ago
        Yes, this is more difficult than it sounds - but GP linked to the reproducible builds project which has gotten there already for a lot of software. See also Guix, which provides tools to challenge servers providing binary packages to see if they match a locally-built version: https://guix.gnu.org/manual/en/html_node/Invoking-guix-challenge.html https://guix.gnu.org/manual/en/html_node/Invoking-guix-chall...

epistasis 6y ago

To paraphrase Lenin, there are years where no one has Signal, then weeks where everyone gets Signal. https://twitter.com/benlorber8/status/1268596748198596608?s=21 https://twitter.com/benlorber8/status/1268596748198596608?s=...

0xADEADBEE 6y ago

Long-time Signal user but I'm on the verge of moving I think. There are several UX shortcomings but the new PIN nag is a bridge too far. What are my options for alternatives? I imagine Telegram is the next best bet but very open to suggestions.

stevehawk 6y ago
oof the pin nag is brutal, i hear that. as someone who doesn't back up or transfer their message is completely unnecessary to me to even have it.
- 0xADEADBEE 6y ago
  Same. How hard is it to make it optional?
  - stevehawk 6y ago
    well it took them like 2 years to add an option to drop the "invite this contact" nag so I reckon pretty difficult /s
drannex 6y ago
Settings -> privacy -> Pin Reminders You can disable them there.
- 0xADEADBEE 6y ago
  I tried that but that just makes you set a PIN which I don't want to do! I appreciate the help though, thank you.
meitham 6y ago
Threema. Don’t provide your phone number when signing up, and don’t permit it to access your address book. Set a recovery password. It’s not free, but a one small fee per app is worth getting my privacy back. Oh and it’s hosted outside the jurisdiction of 5-eyes!

TaylorAlexander 6y ago

While I assume Signal is very good at keeping your neighbors and the like out of your business, I feel like the NSA must have some ways of getting in to signal if they want. Like if they have backdoors to get in to iPhones I assume they can replace the binary and get at your info. Idk after learning about the Snowden revelations I assume every computer is compromised. I mean didn’t x86 have unpatched vulnerabilities for like two decades? It’s really hard for me to imagine that apps like Signal running on iphone or android can offer enough security to keep out the NSA. But I’d be very curious what folks think about that. I’ve told my drug dealer friends “signal is fine for selling weed but if you commit a murder they will probably find a way to get your messages.”

RMPR 6y ago
> While I assume Signal is very good at keeping your neighbors and the like out of your business, I feel like the NSA must have some ways of getting in to signal if they want. 'You have to go back in history, at least to the time when the devs dropped sms encryption and even earlier. The main developer, in a matter of weeks, had turned from someone harassed by the TSA into a receipient of a major government grant ($13 mln). Then he received lucrative contracts with the “greatest” bastion of privacy, Facebook and affiliates. You don’t get that by accident. You get that by providing your own significant part of the bargain.' https://forum.f-droid.org/t/we-can-include-signal-in-f-droid/7373 https://forum.f-droid.org/t/we-can-include-signal-in-f-droid... Just saying it's not the most unfounded theory out there.

AnonC 6y ago

The biggest drawback with Signal for protesters is that it exposes the user's phone number to everyone else in groups (just like WhatsApp does). There is no way to even hide the fact that you have an account on Signal. I can add phone numbers by enumeration into my contacts and Signal will show who among my contacts is on it. If the authorities don't use tactics like they did in Hong Kong, the protesters may be safe from being spied on (or worse).

hjek 6y ago
Signal is not only used by protesters[0][1] so discovering that a phone number is connected to a Signal account by no means implies that the phone is used by a protester. [0]: https://www.militarytimes.com/flashpoints/2020/01/23/deployed-82nd-airborne-unit-told-to-use-these-encrypted-messaging-apps-on-government-cellphones/ https://www.militarytimes.com/flashpoints/2020/01/23/deploye... [1]: https://www.theguardian.com/politics/2019/dec/17/tories-switch-to-messaging-app-signal-to-curb-whatsapp-leaks https://www.theguardian.com/politics/2019/dec/17/tories-swit...
- m12k 6y ago
  Yeah, if you're ever asked why you're on Signal, just say you wanted to stay in touch with a programmer friend who's not on Facebook/WhatsApp, and they suggested Signal (that is now literally true as well - I suggest you try Signal, friend)
  - pwdisswordfish2 6y ago
    Couldn't you just say "I really like the user interface." Or "The logo looks cool." Or "It had 4 stars." Of "It had lots of good reviews."
    - Blaiz0r 6y ago
      no one would believe you...
      - 6y ago

_pmf_ 6y ago

Cell tower association should be enough. Maybe not recording videos of yourself and others committing felonies would be a start.

bzb3 6y ago
That would require an IQ of over 85.

lordnacho 6y ago

I like signal, mainly because it's open source. One minor annoyance though, perhaps someone knows how to fix it: when I use Signal on either my phone or my laptop, going back to the other device makes it sync the messages. But it does this really slowly, making a notification noise for each message, sometimes for several minutes. How do you either coalesce them or just do it fast? Doesn't seem like it's really a speed issue.

kome 6y ago

Signal exposes the user's phone number, better alternative is to use burner phones or Telegram.

Evidlo 6y ago
Or an open standard like Matrix
- RMPR 6y ago
  I was wondering why nobody seemed to mention Matrix here
- 0x49d1 6y ago
  First time hearing about Matrix standard. But in case the clients are maintained by some individuals - why should we trust them that there are no backdoors in their compiled binaries? Seems like a nice project! But probably it will take it's small niche, probably for now it is not wide spreaded, haven't heard any noise about the standard.
  - INTPenis 6y ago
    The signal server has 10 maintainers out of which 5 are signal employees. Matrix is 100% open source, has a larger community maintaining it and is federated. If you're worried about backdoors then you should have more eyes on the code.
soziawa 6y ago
Telegram doesn't have encryption for groups though.
- 0x49d1 6y ago
  Actually they do: https://telegram.org/faq#q-so-how-do-you-encrypt-data https://telegram.org/faq#q-so-how-do-you-encrypt-data , but since group chats are using Telegram's servers the encryption is not client-to-client. Here is the actual specification of how does their srever-client encryption work: https://core.telegram.org/mtproto https://core.telegram.org/mtproto

upofadown 6y ago

>Signal and other encrypted messaging apps offer limited protections. If police have access to an unlocked phone, they can still read any messages on it that haven’t been deleted. In general, forward secrecy can't work if you insist on keeping the messages. If you truly want the messages to be gone for others you have to have to make them gone for you as well.

jwr 6y ago

What really hurts Signal are two things: * sub-par user experience: WhatsApp is just nicer and smoother, and people tend to like that * very few people understand that Signal DOES NOT get your full contact list, while Facebook (through WhatsApp) does Especially the second point is very relevant with the current situation — you do not necessarily want to expose your entire social graph to Facebook. But so few people understand this, and even fewer grasp that Signal can still work without doing the same thing.

sekai 6y ago
Telegram is a great alternative also, offers encrypted chat's also.
- outadoc 6y ago
  Not encrypted by default afaik.
  - partyboat1586 6y ago
    Yeah you have to manually start an encrypted chat. I always thought that increased the sense of security since you have the lock symbol and all but apparently people prefer encryption by default.
  - theshrike79 6y ago
    They're all encrypted, but only specifically created Secret Chats are end-to-end encrypted.
    - CultOfSkaro 6y ago
      Encrypted in transit... But stored plain-text accessible in Telegram’s cloud. They store all your metadata, full contact list, all conversations, all media and attachments, etc. If you value your privacy, Telegram is the absolute worst and one of the most dangerous messengers out there. Telegram should never be recommended as a secure alternative. It’s insecure right to their core. Heck, even their secret chat crypto is a joke. Telegram should be avoided at all costs for private and/or sensitive communication. Even WhatsApp is wayyy more secure.

LongHalloween 6y ago

Has anyone here successfully convinced their non-techie friends to switch to Signal? How have you done it? I've been trying on and off with my closest friends, but no luck.

akerro 6y ago
Yesterday my non-technical colleagues a whatsapp group just said "I'm switching to signal, see you there" and suddenly a few people switched.
caoilte 6y ago
I got my family group chat setup in Signal. The biggest problem was how long it takes signal to sync your contacts. WhatsApp can do it in seconds but signal was taking an hour or more (this was on Xmas day).
markosaric 6y ago
I tried but couldn't. It just wasn't sticky enough for people to continue using it. Perhaps something like this latest growth could help? I tried with Telegram after failing with Signal and that worked for many. For whatever reason (I assume the user experience is nice and more compatible with Whatsapp etc), non-techie people do prefer Telegram to Signal in my experience.
josefresco 6y ago
I've convinced less than 3 clients to send me their sensitive credentials via Signal. I've instructed and asked dozens to use the service but most just use email.
ardy42 6y ago
> Has anyone here successfully convinced their non-techie friends to switch to Signal? How have you done it? I've been trying on and off with my closest friends, but no luck. I've gotten my girlfriend (now wife) and parents to switch. My siblings use it sporadically, but I think mostly to talk to me.
Vinnl 6y ago
Yep (or at least, less techie friends). Strategy is to not have WhatsApp - which leaves plenty of other alternatives (SMS, email, calling, Twitter DMs, whatever) for people who do need to contact me, but Signal is just considered easier by some. I just made sure that I've got groups chats for all my social circles that I add everyone who joins Signal to. Additionally, taking the initiative for fun activities (or always being eager to join), which -besides being fun- gives people without Signal FOMO, haha. Edit: Well, "switching" is a big word. They've got it installed, use it to contact me, and some have started using it as the primary means of communication with others who also have it. Most of them will still use WhatsApp even for contacts who are also on Signal though.

Markoff 6y ago

even after spike lower than already extremely obscure (in US) Telegram

maverick74 6y ago

Jami, anyone? Jami.net It does not have Signals problems

grandinj 6y ago

The thing about using these kinds of tools (IMO) is that it is effectively a giant flag waving at the NSA saying "hey: over here, I'm doing something worth keeping a close eye on!" And once they get sufficiently interested, they can crack pretty much anything the market can come up with. So if you're trying to hide stuff - old school is probably best, innocuous code-word language stuff, keep communication to a minimum, leave phone at home, etc, etc.

ardy42 6y ago
> The thing about using these kinds of tools (IMO) is that it is effectively a giant flag waving at the NSA saying "hey: over here, I'm doing something worth keeping a close eye on!" That's why I use Signal to chat with my wife and parents, and pretty much no one else. Secure apps need to become mundane so they don't draw attention, so I prioritize using them for mundane things.

travisporter 6y ago

I use signal, but am a little bit at unease because it's free. What's in it for the developers? Whatsapp is e2e and all that but the reason it got bought by facebook for an obscene amount of money is what gave me pause

Vinnl 6y ago
They're currently funded by donations [1] by individuals and organisations - among whom one of the WhatsApp cofounders, who made a significant investment using his WhatsApp money. [1] https://signal.org/donate/ https://signal.org/donate/
vesche 6y ago
The Signal Foundation is a 501(c)(3) nonprofit. They're funded by Brian Acton (former co-founder of WhatsApp, net worth ~3 billion), donations, and the Freedom of the Press Foundation. They are not owned by Facebook not sure why you said that.
- travisporter 6y ago
  Was referring to WhatsApp owned by FB not Signal.
gravitas 6y ago
> I use signal, but am a little bit at unease because it's free. What's in it for the developers? I feel your question subtly touches on one of the reasons people like open source and develop for it - there are many people who just enjoying doing their tech-nerdy things and giving it away for free. Before it was called Open Source it was Freeware, Public Domain and other words - the inherent desire to just do something and give it away for free is inherent in the nature of some folks, with no expectations on return (money, fame, etc.). Postcardware and Beerware were even a thing - "like my thing? send me a postcard from where you live" and I sent a bunch of postcards. :)

salex89 6y ago

I actually like Signal, and would use it a lot more, but don't because of one feature - link previews. I understand the technical reasoning why are they so slow to adopt it, but I (and a group of people I communicate on a daily basis) would probably accept even a half-baked solution like the one on WhatsApp.

oblio 6y ago
Why do you find WhatsApp's solution half baked?
- salex89 6y ago
  Even though it's generated sender-side, AFAIK, you wound't even know it is there as a feature. You paste a link, wait some time, and a preview appears. If you send it immediately, there is no preview. Which is acceptable, but at least give some kind of indication that the preview is being generated. Or for some links there is just no preview, and you stay there like an idiot waiting for a preview to appear without any notice it failed. Sometimes the preview is just not that good, although it's also up to the link optimisation.
pacemkr 6y ago
You want your encrypted chat application to emit DNS queries to your ISP. As another Signal user, I do not want that. Nor do I want the bloat of this and other features that will make the core functionality worse. Next we'll want Memoji's and animated drawings and fireworks. My point is, there is already an app for that. Signal has a completely different purpose.
- salex89 6y ago
  You can generate a preview on the sender side. I think WhatsApp does it like that. Since you're the one sending the link, you've already opened it/know what's behind it. The receiver would basically get a thumbnail, with no egress traffic. As for the DNS, if you're concerned with the DNS of your ISP, you shouldn't be using it anyway (I don't). Don't extrapolate what I said. I like link previews and don't like Memojis and bloatware. But more often than not I like to know what's behind the URL. Maybe I don't wan't to open the site, or already seen the article, or the preview is enough to get information (like weather?). If we're on the road to proliferate privacy-conscious behaviour, we need to give something to "the masses", so they can enjoy the experience. And I want my mom and dad using products such as Signal, so I can use it with them. I have no use of it if my friends are not using it, and I'm all alone on the whole network. I don't support bloatware, but some sugar is needed.

gnome_chomsky 6y ago

The more people that adopt Signal, the better. I've been using it for years due to privacy concerns and usually ask everyone that I regularly communicate with to adopt it. I don't think it indicates any subversive or illegal behavior, but merely a desire to have private communications remain private.

Andrex 6y ago

Really hope E2EE on RCS isn't just Google blowing smoke. https://9to5google.com/2020/05/26/google-messages-end-to-end-encryption-rcs/ https://9to5google.com/2020/05/26/google-messages-end-to-end... Clearly not a solution to the current crisis but would be beneficial in future situations.

ian-g 6y ago

A couple friends of mine are professional organizers, and I know their orgs use signal for pretty much anything sensitive. I dunno how much they like it, but it's something they all use regularly