7 ms·

So you are going to move from one centralized, walled garden, privacy hostile platform that hard requires Google/Apple ecosystems to get signed updates... to an

by lrvick 6y ago

So you are going to move from one centralized, walled garden, privacy hostile platform that hard requires Google/Apple ecosystems to get signed updates... to another with identical drawbacks. I suggest something that lets you use any client/platform you want, uses the same crypto primitives, and lets you choose what server/country your data is hosted in and change your mind any time, e.g Matrix. How many times do centralized services like VK, WhatsApp, Instagram, Apple, etc need to get co-opted into enforcing the will of private entities or governments before we learn our lesson? The only network services this won't become true of at some point in the future are those with decentralized clients and servers obeying a common documented protocol.

chalst 6y ago
I don't like Signal's stance on forks (which is that they are allowed but may not use the official Signal network) but it hardly has identical drawbacks. Signal is open source, can be downloaded as an official APK and can be run on LineageOS without Google Play (notifications do require some emulation of Play Services calls, but that can be provided using MicroG).
- dessant 6y ago
  > forks ... may not use the official Signal network Is it technically prevented or just frowned upon? The former would be strange, because fixing a bug in your own private fork would also exclude you from the network.
  - csunbird 6y ago
    I actually do not find this unreasonable, maintaining and providing backwards support everyone's custom version with their own quirks would be a big technical burden.
    - dessant 6y ago
      Allowing modding and forks does not mean you have to provide support for them.
      - lucb1e 6y ago
        Exactly this. You don't have to prohibit homosexuality just because you don't want to deal with adding support to your database of married citizens / prohibit forks because you don't want to support them. The argument makes no sense. I can't decide if Moxie is a double agent with street cred or honestly trying to do good here.
        lrvick 6y ago
        I am generally a pretty decent read of people and in my observations and interactions with him I genuinely believe he believes a benevolent dictator building a centralized system is the only way to bring non-profit-motivated secure messaging to the masses, and that if one accepts this seemingly irrefutable truth, then the best candidate for the job is himself. He is charismatic, highly intelligent, and lives by his own moral compass, rejecting FOSS ethos and silicon valley capitalist ethos alike. This makes him especially dangerous.
    - selfhoster11 6y ago
      Then no support should be provided for these forks. Caveat emptor unless you use the official client.
    - lrvick 6y ago
      Moxie openly admits he centralized because it is easier and that decentralizing is too hard. We should all just give up and pick the least bad centralized service. With that thinking we would all be using AOL. Making a robust flexible protocol that can support a bunch of different client and service implementations is hard, but that is how we ended up avoiding email and web browsing being controlled by a single entity. Matrix is solving the hard problem of providing the core functionality of tools like Slack and Whatsapp without sacrificing user freedom or asking you to trust any one entity. This is what ethical engineering looks like, and I don't mind tolerating occasional growing pains in exchange for freedom.
  - chalst 6y ago
    There are forks of the Signal client that do use the OWS servers [1], but IIUC they are in violation of the OWS TOS. Certainly moxie has threatened to block forked clients, which is why F-droid won't host any of these forks [2]. [1]: https://github.com/tw-hx/Signal-Android https://github.com/tw-hx/Signal-Android [2]: https://forum.f-droid.org/t/we-can-include-signal-in-f-droid/7373 https://forum.f-droid.org/t/we-can-include-signal-in-f-droid...
- lrvick 6y ago
  Moxie highly discourages using the APK because it means turning on untrusted sources which is highly unsafe and bypasses signature verification. It is one BGP attack or compromised CDN admin way from compromising the masses. This is one of the few points I agree with moxie on. The only safe way to install software on an Android device requires you bootstrap trust via a system supplied package manager that enforces signature verification. Lineage grabs unsigned binary blobs from a separate account with little accountability ( https://GitHub.com/themuppets https://GitHub.com/themuppets ) to limit the blast radius of illegally distributing them and does not ship a package manager at all. They expect degoogled users to do disable system signature verification to use an alternative app store like F-droid. Lineage is great if you want to turn an old device into a game system or something, but it should not be used on a device you need to be able to trust. The only Google-free option to have a signed system-verified app supply chain on Android is use a ROM that bundles F-droid as a system trusted app manager like CalyxOS, RattlesnakeOS, or my projects, aosp-build, and #!os. While F-Droid is far from perfect it is the only alternative path and Moxie refuses to allow apps to be distributed there because he openly admits he wants the usage metrics that come from Google/Apple distribution. In effect, you either use Apple/Google ecosystems to run verified binaries, or compile yourself every week or two.
  - tremon 6y ago
    Moxie highly discourages using the APK because it means turning on untrusted sources which is highly unsafe and bypasses signature verification That's nice, but why should Moxie decide whether the Google Play Store is a trusted source for me?
    - lrvick 6y ago
      Right. They offer one option with signature verification and low privacy (Play store), and one option with higher privacy but low security (YOLO apk). If neither of these work for you, you are not wanted on the Signal network.
  - est31 6y ago
    > bypasses signature verification. APKs do not bypass signature verification. Android still requires all apks to be signed, and only installs updates to apks that were signed by the same original key. As for BGP attacks, the apk is distributed using TLS, so it needs more than that. That being said, CDN hacks are definitely an issue. But so is someone hacking their play store account or Google play itself.
- kekebo 6y ago
  Another key difference would be the business model. Signal being a non-profit[0] does not provide any guarantees for the app to not become 'hostile' in the future, but any such development motivated by personal profits would at least require a change of organization type, which I assume wouldn't go unnoticed. [0] https://en.wikipedia.org/wiki/Signal_Foundation https://en.wikipedia.org/wiki/Signal_Foundation
  - lrvick 6y ago
    It was well noticed when WhatsApp changed hands to Facebook, and yet the vast majority of users didn't move to anything else because of network effects. Once users are in an ecosystem it takes years to convince them to change and only after they hit a high discomfort tipping point. If Signal ran short on funding and got bought by Google or Facebook all the tracking would kick in and most users would stay. We must stop herding people into walled gardens. It is unethical and always backfires.
- Aachen 6y ago
  "hardly has drawbacks" My notes on Signal contain the following: + It usually just works + Reasonable desktop experience (needs to re-link once a month or so, but otherwise independent and not terrible UX), good mobile experience - Metadata handled by Amazon - Phone number is a hard requirement, and changing your phone number means re-connecting to everyone - Funding comes from Facebook from what I recall, and even with large amounts of their $100M invested, their expenses are 8 times larger than their income. + At least it's a foundation and their finances are not a black box! ~ With a build from an untrusted third party, you can make it work on Androids where Google Play Services are intentionally firewalled off. ~ No audit of the clients. The protocol, sure, but most bugs aren't introduced on a protocol level. These are only things they could solve, i.e. that others do better. That their contact discovery solution (where you upload your phone book) is broken isn't a downside because nobody else has that figured out either.
  - secfirstmd 6y ago
    "Funding comes from Facebook from what I recall." Not really. Original funding came from NGO sources such as the Open Tech Fund.
  - hiq 6y ago
    > - Metadata handled by Amazon That's rather broad, which metadata are you thinking about? Especially given the sealed sender feature. Assuming you have access to everything at Amazon, what can you deduce about Signal users? I can think of: - IP address (you can tell that this IP address sent some Signal message) - size of messages - timestamps of messages (when they were received by an Amazon server) IP address leaks a lot of information but there are still workarounds, and it seems reasonable if you're in a no-trust model (meaning Signal's servers wouldn't be any better than Amazon's). In any case, that's way less information than other mainstream messengers. On the other hand, one distinguishing feature regarding metadata is groups: group membership is not known by anyone outside of the group if I understand correctly, contrary to WhatsApp (and others).
- krageon 6y ago
  The author is a toxic dictator who hates the idea of ceding power so that they can have a constructive and open protocol for everyone. That means the app should never be used, by anyone. If you're going to use software like this, you may as well stay with whatsapp - at least that has a lot of users.
  - chalst 6y ago
    There is nothing wrong with the protocol, the client software or the server software; the problem is entirely with the OWS server TOS.
    - krageon 6y ago
      How would we know? The signal app as most people understand it cannot be built in a reproducible manner. This means that most people will be using something that may as well be compromised. The author does not care. It doesn't matter what the source code behind it is, as an entity signal is hostile to everything a good messaging app should be.
      - chalst 6y ago
        The Java classes making up the application proper have had reproducible builds since 2016 [1]. The Play Services Signal relies on don't, but there are open source alternatives. [1]: https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/
        krageon 6y ago
        If you can't produce the app as you download it, it's not reproducible. Saying part of it is is disingenuous.
  - 72deluxe 6y ago
    I see mention of the toxic dictator stuff and non-reproducible builds mentioned through this thread - do you have info on that you can point me to? I am asking because a guy at work wanted me to install Signal as voice call quality on Duo was appallingly bad. Thanks in advance.
Aachen 6y ago
Matrix is riddled with bugs. While I agree with you that signal isn't all that great (they do some really good stuff and then make some really weird trade-offs), I've recently compared Signal, Wire, Threema, Jami, Briar, Element/Matrix, and Keybase. The most mature app is Signal. It has the best usability to privacy trade-off. Threema is the better choice if you don't mind not having a usable desktop client. For me that's a total deal breaker. It costs a one-time 5 bucks and it's totally worth that, if only it had so much as a usable web client (you need to open your phone and navigate two menus to enable the web client every time your phone changes WiFi or anything). Wire is the better choice if you can sacrifice a tiny bit of usability for better privacy. It's sluggish is all, and (like Signal and most other services) uses AWS. Full disclosure: I was involved in a paid audit of Wire so I know more about the encryption protocol than I do about the other clients'. Element/Matrix is the better choice if you'd rather make a trade-off towards privacy. Presumably the clients will mature, and between two years ago and one year ago they've made good progress. It's going less fast today but I still see things getting slowly better, and the decentralization works very well and fairly easy to setup. If all you really want is a better privacy policy and want to ensure people stick around and don't uninstall it, Telegram is by far the usability winner and has a large network effect already. But it's a trade-off with the devil because there is zero encryption. They could ransom or sell our chat logs any time. Briar and Jami have limitations that make it unusable for general purposes use with your mom. Facebook and Google's messengers I didn't look at for obvious reasons. Keybase was never end to end encrypted to begin with and now Zoom bought them so they'll probably shut down soon (also, bugs). Rocket.chat seems only aimed at business users. You can also do OTR over any platform you like, and I still have to try this overlay encryption system on Android (I forgot its name). Pick your poison...
- tao_oat 6y ago
  > Wire is the better choice if you can sacrifice a tiny bit of usability for better privacy. Do you mean better privacy than Signal? I was under the impression that Signal was significantly ahead of Wire in this regard with features like private groups and private contact discovery.
  - 6y ago
jmnicolas 6y ago
> I suggest something that lets you use any client/platform you want I lost about half of my contacts when migrating to Signal, do you really think I can make them install some random app that may or may not work? They already complain that Signal isn't as polished as Whatsapp.
- lrvick 6y ago
  Those that won't respect your ethics are not your friends. I lost many of my contacts moving to Matrix but earned a lot of new high value ones that share my worldview to continue building a decentralized censorship resistant internet.
  - lrvick 6y ago
    I would also add that Matrix, unlike any of the other networks discussed, offers the ability to bridge to all other networks being discussed so if you so desire you can have your open network cake and communicate with people on walled garden networks too. Not worth the trouble for me and I don't even want to have accounts in these platforms or let them collect my conversations, but the path at least exists.
  - jmnicolas 6y ago
    > Those that won't respect your ethics are not your friends. Yeah right. I am not RMS, with lock-downs, curfews, social distancing etc I'm already isolated enough so I'm not losing my remaining contacts for some moral high-ground.
  - 542354234235 6y ago
    > Those that won't respect your ethics are not your friends. This is kind of an unreasonable, one sided, stance. You exact everyone to simply follow you and your preferences with no regard for their preferences. Maybe you not respecting them and their worldview makes you the bad friend, not the other way around. > I lost many of my contacts moving to Matrix but earned a lot of new high value ones that share my worldview I don’t know if isolating yourself from anyone that doesn’t’ think and act the exact same way is a good thing.
johnchristopher 6y ago
> I suggest something that lets you use any client/platform you want, uses the same crypto primitives, and lets you choose what server/country your data is hosted in and change your mind any time, e.g Matrix. I'll bite. Who's paying for my johnchristopher@whatever.tld and for the data (avatar pictures, transfered files, chat logs) associated with it ? Will the Matrix foundation let me use their services forever and for free ? Will there be discussion on HN in ten years about getting your own custom domain and own federated server ? For one account only ? Like we have for mail regularly ?
- lrvick 6y ago
  You can think of it like email. Maybe you started on AOL and later realized AOL is terrible. You could export your address book and move to a client/server you trust more and notify all your contacts from the new location. This is the same story on Matrix and what I mean when I say it is a freedom respecting decentralized service. You are also free to run your own DNS to a dedicated EMS instance then later point to your own self hosted server later much like the freedom you have using your own domain and MX records on Google Apps allowing you to later move to a new email provider without having to update your social graph to change your address. On Signal, there is no such option. You use their clients and servers forever, or GTFO.
  - raziel2p 6y ago
    Following the e-mail analogy: Inevitably, there will be contacts of yours who didn't get or read your notification, or contacts of yours who aren't in your contacts list.
    - lrvick 6y ago
      True. It is up to you to point your own domain day one with either email or matrix if you wish to avoid this discomfort. Signal offers no such choice. Even if you don't do this, you can still reach contacts on the old server and middle through. If you switch from walled garden to walled garden like WhatsApp to signal there is no migration path at all.
jamaicahest 6y ago
> The only network services this won't become true of at some point in the future are those with decentralized clients and servers obeying a common documented protocol. You mean like SMS?
- lrvick 6y ago
  I didn't say all decentralized services are good. Just that decentralization is a prerequisite for something to avoid complete control by a single party long term. A better example would be HTTP/HTML/JS. Sure it is not perfect and protocol updates are hard and slow due to endless implementations but we got a working decentralized internet out of the deal that is very hard for any single party to take over now, so I call that worth it over a single party enforcing proprietary protocols like AOL having a total monopoly.
Tepix 6y ago
> So you are going to move from one centralized, walled garden, privacy hostile platform that hard requires Google/Apple ecosystems to get signed updates... to another with identical drawbacks. Ideally we'd have a polished, decentralized app. Signal is a compromise. I don't think the drawbacks are identical: Facebook's business model depends on violatings the privacy of the users. The Signal Foundation has no such need. The client is open source. I see no reason to call Signal "privacy hostile".
- lrvick 6y ago
  * There is no OS verified path to install Signal or updates without being in Google/Apple proprietary ecosystems and submitting some usage metrics to them. * You can't use signal on minority market share platforms even if they offer higher assurances of freedom, privacy, and security (RISC-V, OpenPOWER, etc.) * Getting a phone number requires KYC in over 200 countries and carriers will happily sell you out as extensively documented and demonstrated by journalists buying owner info and GPS coordinates for any given phone numbers. Any service that hard requires a phone number is not prioritizing privacy. * All metadata and TCP/IP metadata flows to a SPOF where signal employees, the ISP, or another entity inline could use network heuristics to deanonymize users, of dump the weak keys in SGX and get actual contact lists directly. * If you want to use a privacy respecting signature verifying app store solution like F-Droid you are SOL. Moxie threatened to fight F-Droid or any other parties compiling/signing binaries from source code or doing forks or alternative implementations. He wishes to have complete control and the ability to rapidly push updates to all users quickly, be they benign or malicious. If someone coerces the signing key out of them, all signal conversations globally could be decrypted likely before anyone noticed. I call all of this behaviour very privacy hostile. Published source code is moot if you are not allowed to use it or empower third parties like f-droid to hold it accountable.
  - Tepix 6y ago
    Signal provides a SHA256 checksum on their download page at https://signal.org/android/apk/ https://signal.org/android/apk/ Signal works on platforms such as GrapheneOS without the Google ecosystem. You're right regarding the phone number. I consider it a necessary compromise. Look at the spam problem that email has.

by lrvick 6y ago

chalst 6y ago

I don't like Signal's stance on forks (which is that they are allowed but may not use the official Signal network) but it hardly has identical drawbacks. Signal is open source, can be downloaded as an official APK and can be run on LineageOS without Google Play (notifications do require some emulation of Play Services calls, but that can be provided using MicroG).

dessant 6y ago
> forks ... may not use the official Signal network Is it technically prevented or just frowned upon? The former would be strange, because fixing a bug in your own private fork would also exclude you from the network.
- csunbird 6y ago
  I actually do not find this unreasonable, maintaining and providing backwards support everyone's custom version with their own quirks would be a big technical burden.
  - dessant 6y ago
    Allowing modding and forks does not mean you have to provide support for them.
    - lucb1e 6y ago
      Exactly this. You don't have to prohibit homosexuality just because you don't want to deal with adding support to your database of married citizens / prohibit forks because you don't want to support them. The argument makes no sense. I can't decide if Moxie is a double agent with street cred or honestly trying to do good here.
      - lrvick 6y ago
        I am generally a pretty decent read of people and in my observations and interactions with him I genuinely believe he believes a benevolent dictator building a centralized system is the only way to bring non-profit-motivated secure messaging to the masses, and that if one accepts this seemingly irrefutable truth, then the best candidate for the job is himself. He is charismatic, highly intelligent, and lives by his own moral compass, rejecting FOSS ethos and silicon valley capitalist ethos alike. This makes him especially dangerous.
  - selfhoster11 6y ago
    Then no support should be provided for these forks. Caveat emptor unless you use the official client.
  - lrvick 6y ago
    Moxie openly admits he centralized because it is easier and that decentralizing is too hard. We should all just give up and pick the least bad centralized service. With that thinking we would all be using AOL. Making a robust flexible protocol that can support a bunch of different client and service implementations is hard, but that is how we ended up avoiding email and web browsing being controlled by a single entity. Matrix is solving the hard problem of providing the core functionality of tools like Slack and Whatsapp without sacrificing user freedom or asking you to trust any one entity. This is what ethical engineering looks like, and I don't mind tolerating occasional growing pains in exchange for freedom.
- chalst 6y ago
  There are forks of the Signal client that do use the OWS servers [1], but IIUC they are in violation of the OWS TOS. Certainly moxie has threatened to block forked clients, which is why F-droid won't host any of these forks [2]. [1]: https://github.com/tw-hx/Signal-Android https://github.com/tw-hx/Signal-Android [2]: https://forum.f-droid.org/t/we-can-include-signal-in-f-droid/7373 https://forum.f-droid.org/t/we-can-include-signal-in-f-droid...
lrvick 6y ago
Moxie highly discourages using the APK because it means turning on untrusted sources which is highly unsafe and bypasses signature verification. It is one BGP attack or compromised CDN admin way from compromising the masses. This is one of the few points I agree with moxie on. The only safe way to install software on an Android device requires you bootstrap trust via a system supplied package manager that enforces signature verification. Lineage grabs unsigned binary blobs from a separate account with little accountability ( https://GitHub.com/themuppets https://GitHub.com/themuppets ) to limit the blast radius of illegally distributing them and does not ship a package manager at all. They expect degoogled users to do disable system signature verification to use an alternative app store like F-droid. Lineage is great if you want to turn an old device into a game system or something, but it should not be used on a device you need to be able to trust. The only Google-free option to have a signed system-verified app supply chain on Android is use a ROM that bundles F-droid as a system trusted app manager like CalyxOS, RattlesnakeOS, or my projects, aosp-build, and #!os. While F-Droid is far from perfect it is the only alternative path and Moxie refuses to allow apps to be distributed there because he openly admits he wants the usage metrics that come from Google/Apple distribution. In effect, you either use Apple/Google ecosystems to run verified binaries, or compile yourself every week or two.
- tremon 6y ago
  Moxie highly discourages using the APK because it means turning on untrusted sources which is highly unsafe and bypasses signature verification That's nice, but why should Moxie decide whether the Google Play Store is a trusted source for me?
  - lrvick 6y ago
    Right. They offer one option with signature verification and low privacy (Play store), and one option with higher privacy but low security (YOLO apk). If neither of these work for you, you are not wanted on the Signal network.
- est31 6y ago
  > bypasses signature verification. APKs do not bypass signature verification. Android still requires all apks to be signed, and only installs updates to apks that were signed by the same original key. As for BGP attacks, the apk is distributed using TLS, so it needs more than that. That being said, CDN hacks are definitely an issue. But so is someone hacking their play store account or Google play itself.
kekebo 6y ago
Another key difference would be the business model. Signal being a non-profit[0] does not provide any guarantees for the app to not become 'hostile' in the future, but any such development motivated by personal profits would at least require a change of organization type, which I assume wouldn't go unnoticed. [0] https://en.wikipedia.org/wiki/Signal_Foundation https://en.wikipedia.org/wiki/Signal_Foundation
- lrvick 6y ago
  It was well noticed when WhatsApp changed hands to Facebook, and yet the vast majority of users didn't move to anything else because of network effects. Once users are in an ecosystem it takes years to convince them to change and only after they hit a high discomfort tipping point. If Signal ran short on funding and got bought by Google or Facebook all the tracking would kick in and most users would stay. We must stop herding people into walled gardens. It is unethical and always backfires.
Aachen 6y ago
"hardly has drawbacks" My notes on Signal contain the following: + It usually just works + Reasonable desktop experience (needs to re-link once a month or so, but otherwise independent and not terrible UX), good mobile experience - Metadata handled by Amazon - Phone number is a hard requirement, and changing your phone number means re-connecting to everyone - Funding comes from Facebook from what I recall, and even with large amounts of their $100M invested, their expenses are 8 times larger than their income. + At least it's a foundation and their finances are not a black box! ~ With a build from an untrusted third party, you can make it work on Androids where Google Play Services are intentionally firewalled off. ~ No audit of the clients. The protocol, sure, but most bugs aren't introduced on a protocol level. These are only things they could solve, i.e. that others do better. That their contact discovery solution (where you upload your phone book) is broken isn't a downside because nobody else has that figured out either.
- secfirstmd 6y ago
  "Funding comes from Facebook from what I recall." Not really. Original funding came from NGO sources such as the Open Tech Fund.
- hiq 6y ago
  > - Metadata handled by Amazon That's rather broad, which metadata are you thinking about? Especially given the sealed sender feature. Assuming you have access to everything at Amazon, what can you deduce about Signal users? I can think of: - IP address (you can tell that this IP address sent some Signal message) - size of messages - timestamps of messages (when they were received by an Amazon server) IP address leaks a lot of information but there are still workarounds, and it seems reasonable if you're in a no-trust model (meaning Signal's servers wouldn't be any better than Amazon's). In any case, that's way less information than other mainstream messengers. On the other hand, one distinguishing feature regarding metadata is groups: group membership is not known by anyone outside of the group if I understand correctly, contrary to WhatsApp (and others).
krageon 6y ago
The author is a toxic dictator who hates the idea of ceding power so that they can have a constructive and open protocol for everyone. That means the app should never be used, by anyone. If you're going to use software like this, you may as well stay with whatsapp - at least that has a lot of users.
- chalst 6y ago
  There is nothing wrong with the protocol, the client software or the server software; the problem is entirely with the OWS server TOS.
  - krageon 6y ago
    How would we know? The signal app as most people understand it cannot be built in a reproducible manner. This means that most people will be using something that may as well be compromised. The author does not care. It doesn't matter what the source code behind it is, as an entity signal is hostile to everything a good messaging app should be.
    - chalst 6y ago
      The Java classes making up the application proper have had reproducible builds since 2016 [1]. The Play Services Signal relies on don't, but there are open source alternatives. [1]: https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/
      - krageon 6y ago
        If you can't produce the app as you download it, it's not reproducible. Saying part of it is is disingenuous.
- 72deluxe 6y ago
  I see mention of the toxic dictator stuff and non-reproducible builds mentioned through this thread - do you have info on that you can point me to? I am asking because a guy at work wanted me to install Signal as voice call quality on Duo was appallingly bad. Thanks in advance.

Aachen 6y ago

Matrix is riddled with bugs. While I agree with you that signal isn't all that great (they do some really good stuff and then make some really weird trade-offs), I've recently compared Signal, Wire, Threema, Jami, Briar, Element/Matrix, and Keybase. The most mature app is Signal. It has the best usability to privacy trade-off. Threema is the better choice if you don't mind not having a usable desktop client. For me that's a total deal breaker. It costs a one-time 5 bucks and it's totally worth that, if only it had so much as a usable web client (you need to open your phone and navigate two menus to enable the web client every time your phone changes WiFi or anything). Wire is the better choice if you can sacrifice a tiny bit of usability for better privacy. It's sluggish is all, and (like Signal and most other services) uses AWS. Full disclosure: I was involved in a paid audit of Wire so I know more about the encryption protocol than I do about the other clients'. Element/Matrix is the better choice if you'd rather make a trade-off towards privacy. Presumably the clients will mature, and between two years ago and one year ago they've made good progress. It's going less fast today but I still see things getting slowly better, and the decentralization works very well and fairly easy to setup. If all you really want is a better privacy policy and want to ensure people stick around and don't uninstall it, Telegram is by far the usability winner and has a large network effect already. But it's a trade-off with the devil because there is zero encryption. They could ransom or sell our chat logs any time. Briar and Jami have limitations that make it unusable for general purposes use with your mom. Facebook and Google's messengers I didn't look at for obvious reasons. Keybase was never end to end encrypted to begin with and now Zoom bought them so they'll probably shut down soon (also, bugs). Rocket.chat seems only aimed at business users. You can also do OTR over any platform you like, and I still have to try this overlay encryption system on Android (I forgot its name). Pick your poison...

tao_oat 6y ago
> Wire is the better choice if you can sacrifice a tiny bit of usability for better privacy. Do you mean better privacy than Signal? I was under the impression that Signal was significantly ahead of Wire in this regard with features like private groups and private contact discovery.
- 6y ago

jmnicolas 6y ago

> I suggest something that lets you use any client/platform you want I lost about half of my contacts when migrating to Signal, do you really think I can make them install some random app that may or may not work? They already complain that Signal isn't as polished as Whatsapp.

lrvick 6y ago
Those that won't respect your ethics are not your friends. I lost many of my contacts moving to Matrix but earned a lot of new high value ones that share my worldview to continue building a decentralized censorship resistant internet.
- lrvick 6y ago
  I would also add that Matrix, unlike any of the other networks discussed, offers the ability to bridge to all other networks being discussed so if you so desire you can have your open network cake and communicate with people on walled garden networks too. Not worth the trouble for me and I don't even want to have accounts in these platforms or let them collect my conversations, but the path at least exists.
- jmnicolas 6y ago
  > Those that won't respect your ethics are not your friends. Yeah right. I am not RMS, with lock-downs, curfews, social distancing etc I'm already isolated enough so I'm not losing my remaining contacts for some moral high-ground.
- 542354234235 6y ago
  > Those that won't respect your ethics are not your friends. This is kind of an unreasonable, one sided, stance. You exact everyone to simply follow you and your preferences with no regard for their preferences. Maybe you not respecting them and their worldview makes you the bad friend, not the other way around. > I lost many of my contacts moving to Matrix but earned a lot of new high value ones that share my worldview I don’t know if isolating yourself from anyone that doesn’t’ think and act the exact same way is a good thing.

johnchristopher 6y ago

> I suggest something that lets you use any client/platform you want, uses the same crypto primitives, and lets you choose what server/country your data is hosted in and change your mind any time, e.g Matrix. I'll bite. Who's paying for my johnchristopher@whatever.tld and for the data (avatar pictures, transfered files, chat logs) associated with it ? Will the Matrix foundation let me use their services forever and for free ? Will there be discussion on HN in ten years about getting your own custom domain and own federated server ? For one account only ? Like we have for mail regularly ?

lrvick 6y ago
You can think of it like email. Maybe you started on AOL and later realized AOL is terrible. You could export your address book and move to a client/server you trust more and notify all your contacts from the new location. This is the same story on Matrix and what I mean when I say it is a freedom respecting decentralized service. You are also free to run your own DNS to a dedicated EMS instance then later point to your own self hosted server later much like the freedom you have using your own domain and MX records on Google Apps allowing you to later move to a new email provider without having to update your social graph to change your address. On Signal, there is no such option. You use their clients and servers forever, or GTFO.
- raziel2p 6y ago
  Following the e-mail analogy: Inevitably, there will be contacts of yours who didn't get or read your notification, or contacts of yours who aren't in your contacts list.
  - lrvick 6y ago
    True. It is up to you to point your own domain day one with either email or matrix if you wish to avoid this discomfort. Signal offers no such choice. Even if you don't do this, you can still reach contacts on the old server and middle through. If you switch from walled garden to walled garden like WhatsApp to signal there is no migration path at all.

jamaicahest 6y ago

> The only network services this won't become true of at some point in the future are those with decentralized clients and servers obeying a common documented protocol. You mean like SMS?

lrvick 6y ago
I didn't say all decentralized services are good. Just that decentralization is a prerequisite for something to avoid complete control by a single party long term. A better example would be HTTP/HTML/JS. Sure it is not perfect and protocol updates are hard and slow due to endless implementations but we got a working decentralized internet out of the deal that is very hard for any single party to take over now, so I call that worth it over a single party enforcing proprietary protocols like AOL having a total monopoly.

Tepix 6y ago

> So you are going to move from one centralized, walled garden, privacy hostile platform that hard requires Google/Apple ecosystems to get signed updates... to another with identical drawbacks. Ideally we'd have a polished, decentralized app. Signal is a compromise. I don't think the drawbacks are identical: Facebook's business model depends on violatings the privacy of the users. The Signal Foundation has no such need. The client is open source. I see no reason to call Signal "privacy hostile".

lrvick 6y ago
* There is no OS verified path to install Signal or updates without being in Google/Apple proprietary ecosystems and submitting some usage metrics to them. * You can't use signal on minority market share platforms even if they offer higher assurances of freedom, privacy, and security (RISC-V, OpenPOWER, etc.) * Getting a phone number requires KYC in over 200 countries and carriers will happily sell you out as extensively documented and demonstrated by journalists buying owner info and GPS coordinates for any given phone numbers. Any service that hard requires a phone number is not prioritizing privacy. * All metadata and TCP/IP metadata flows to a SPOF where signal employees, the ISP, or another entity inline could use network heuristics to deanonymize users, of dump the weak keys in SGX and get actual contact lists directly. * If you want to use a privacy respecting signature verifying app store solution like F-Droid you are SOL. Moxie threatened to fight F-Droid or any other parties compiling/signing binaries from source code or doing forks or alternative implementations. He wishes to have complete control and the ability to rapidly push updates to all users quickly, be they benign or malicious. If someone coerces the signing key out of them, all signal conversations globally could be decrypted likely before anyone noticed. I call all of this behaviour very privacy hostile. Published source code is moot if you are not allowed to use it or empower third parties like f-droid to hold it accountable.
- Tepix 6y ago
  Signal provides a SHA256 checksum on their download page at https://signal.org/android/apk/ https://signal.org/android/apk/ Signal works on platforms such as GrapheneOS without the Google ecosystem. You're right regarding the phone number. I consider it a necessary compromise. Look at the spam problem that email has.