3 ms·

I dumped signal less over the data collection they've started doing and more for the fact that they've been less than transparent about it. Nearly a year ago th

I dumped signal less over the data collection they've started doing and more for the fact that they've been less than transparent about it. Nearly a year ago their forums were filled with objections, security concerns, and questions and for months they went ignored. When they finally made setting a pin optional they were equally unclear that it would just set a random one for you and that this didn't prevent your data from being uploaded to the cloud. I took it as a sign that they were telling us not to trust them as clearly as they were allowed. For secure communications I'm using Jami now and I've been very impressed. For SMS/MMS in general I'm still looking. I've tried a few alternatives and frankly I'm not really happy with any of them.

rzz3 6y ago
They’re trying to unwind Signal from phone numbers. Also who uses SMS anymore?:)
- autoexec 6y ago
  The phone number is not even the worst part really. Signal's privacy policy says they don't collect and store sensitive info, but how is a list of everyone you've been in contact with not sensitive? Sadly I've had very little luck getting my family to move to Signal and less luck getting them to use Jami. The bulk of my communications are unsecured SMS/MMS. It's such a basic function that I'm surprised open source solutions aren't better. Whatever they've become Signal had a pretty great interface.
  - tmp538394722 6y ago
    it’s hard for me to read something like this and believe you aren’t being deliberately misleading. All this stuff is only stored in an encrypted form that signal never has the keys for.
    - autoexec 6y ago
      The fact that's encrypted doesn't matter. There are a number of potential issues with collecting it in the first place. You can see some of the security concerns which were brought up on their forums here: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu...
    - jerry1979 6y ago
      As far as I know, they encrypt the data in sgx enclaves which are notoriously leaky.
- laretluval 6y ago
  They've been trying since 2014. Somehow it never seems to happen.
  - goatsi 6y ago
    That's because (secure) messaging using phone numbers as identifiers is literally the core feature of the product. Signal was marketed from day one as a drop in SMS replacement. Initially it even used SMS as the transport for encrypted messages. It was even originally called "TextSecure". This is why I have always found the attacks on it using phone numbers to be amusing.

rzz3 6y ago

They’re trying to unwind Signal from phone numbers. Also who uses SMS anymore?:)

autoexec 6y ago
The phone number is not even the worst part really. Signal's privacy policy says they don't collect and store sensitive info, but how is a list of everyone you've been in contact with not sensitive? Sadly I've had very little luck getting my family to move to Signal and less luck getting them to use Jami. The bulk of my communications are unsecured SMS/MMS. It's such a basic function that I'm surprised open source solutions aren't better. Whatever they've become Signal had a pretty great interface.
- tmp538394722 6y ago
  it’s hard for me to read something like this and believe you aren’t being deliberately misleading. All this stuff is only stored in an encrypted form that signal never has the keys for.
  - autoexec 6y ago
    The fact that's encrypted doesn't matter. There are a number of potential issues with collecting it in the first place. You can see some of the security concerns which were brought up on their forums here: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu...
  - jerry1979 6y ago
    As far as I know, they encrypt the data in sgx enclaves which are notoriously leaky.
laretluval 6y ago
They've been trying since 2014. Somehow it never seems to happen.
- goatsi 6y ago
  That's because (secure) messaging using phone numbers as identifiers is literally the core feature of the product. Signal was marketed from day one as a drop in SMS replacement. Initially it even used SMS as the transport for encrypted messages. It was even originally called "TextSecure". This is why I have always found the attacks on it using phone numbers to be amusing.