7 ms·

This is one of the biggest things that stops me from using Signal. I don't have a phone number really any more (I'm a digital nomad, and pick up regional sims)

by vertis 5y ago

This is one of the biggest things that stops me from using Signal. I don't have a phone number really any more (I'm a digital nomad, and pick up regional sims) I'm not really interested in the disappearing message either if I wanted that I could just use Slack Free edition :troll:. In all seriousness though, my messages are part of my memory. They're shared experience with my partner and a record of decisions. I understand they're useful for some people, but they're an anti-feature for me.

afiori 5y ago
> In all seriousness though, my messages are part of my memory. They're shared experience with my partner and a record of decisions. Thanks for saying this, I moved to Telegram[1] before I had a chance to learn about/suffer from Whatsapp take on backups, but it would have been devastating to lose years of messages with people over a bricked phone. [1] I know Telegram has a bad rep due to their home cooked crypto and maybe other stuff, but I like the app, I vaguely trust the author, and it works fine for me.
- lmm 5y ago
  > [1] I know Telegram has a bad rep due to their home cooked crypto and maybe other stuff, but I like the app, I vaguely trust the author, and it works fine for me. Is that because you assume the NSA aren't reading all your messages or you don't mind if they are? Because the whole problem with dodgy crypto is that it still seems to "work fine for me" even when it isn't.
  - theshrike79 5y ago
    My main chat platforms are IRC, Telegram and Discord. None of them are E2E encrypted and don't sell themselves as such. I keep that in mind when discussing things. If I want to start doing something shady, I can pick up something else than Signal, since I don't want my phone number ending up on random people's phones.
    - lmm 5y ago
      > My main chat platforms are IRC, Telegram and Discord. None of them are E2E encrypted and don't sell themselves as such. Telegram's initial marketing heavily emphasised privacy. If I search for Telegram then the very first search result blurb starts "Telegram messages are heavily encrypted". Maybe they don't explicitly claim to be E2E, but they absolutely are selling themselves as an encrypted, privacy-friendly messenger. > If I want to start doing something shady, I can pick up something else than Signal, since I don't want my phone number ending up on random people's phones. Completely agreed, I dislike the Signal hype as much as anyone. But I trust Telegram even less.
      - afiori 5y ago
        The heavily encrypted refers to server side storage. https://telegram.org/privacy#3-3-1-cloud-chats https://telegram.org/privacy#3-3-1-cloud-chats > All data is stored heavily encrypted and the encryption keys in each case are stored in several other data centers in different jurisdictions. This way local engineers or physical intruders cannot get access to user data.
        lmm 5y ago
        Wow, that's not at all clear from their marketing. That kind of misleading statement is definitely not what I'd want to see from a privacy/security-focused product - and yet Telegram's whole marketing is about privacy/security.
        afiori 5y ago
        The attack telegram is worried about is the russian army invading their datacenters, threatening employees, or forced buyout (what happend to the founder previous company vk.com).
  - skinkestek 5y ago
    In my case it is to a large degree because I don't care. Disappearing messages are to prevent my kids reading the messages between me and their mother ;-) If NSA actually read my messages that would be kind of funny. If they have such a hack I'm sure they won't spend it on me or any other Joe Sixpack. Maybe ФСБ reads it but I have a hard time believing that too. My threat model consists of (not in any particular order): - my kids, - random internet strangers, - Facebook (who'll sell you to whoever pays), - Google or a Google-like entity with runaway "AI" and arrogant customer support[1] (who can lock out from my accounts for no reason) Besides, despite all the talk about E2E-encryption being so important, Signal (which I cheer for) IIRC has had a nasty XSS-exploit in their desktop allowing remote control of the pc, their phone client has been sending pictures to others than the recipient and probably a couple more. Ad I and others have pointed out repeatedly: There is more to security than encryption. It doesn't matter if it is E2E-encrypted if it is delivered to the wrong contact. And it doesn't matter if it is E2E-encrypted if whoever knows the secret can send you a specially crafted message and take control over your machine. [1]: I originally wrote employees but I don't think the average Google employee is more arrogant than others, they just come across that way because of policies created far above them.
    - lmm 5y ago
      Secure systems are all alike; every insecure system is insecure in its own way. A messenger that has E2E encryption might not be secure, but a messenger that doesn't have E2E encryption is definitely insecure. Not caring about your messages being read, or being willing to trust the operator of the service, is fine, but in that case I struggle to see why you'd pick Telegram, given that their whole selling point was about privacy and encryption when their encryption didn't actually work.
      - afiori 5y ago
        > when their encryption didn't actually work. what are referring to here? I vaguely know about delivery bugs and protocol patches
        5y ago
  - afiori 5y ago
    For that same reasoning I support telegram more than signal. I simply do not see signal ever get to a widespread adoption, I do not see signal trying to get to a widespread adoption either; signal is not a messaging app it is a secure comunication app and for this they make a lot of tradeoffs. An example is E2EE, it is a nice property but today it has significant UX implications that makes it bad default in my opinion for a popular personal messagin app; in other places it is essential, just not there. Moreover the main threat model is not NSA hacking my device or the app's servers, it is app developer selling my data and governments making "lawful" requests to service providers. In both these metrics signal ranks better as far as I understand, but it is more of an individual choice. If we are worried about the NSA the best thing to do is to move out of SMS/phone calls as fast as possible on mediums that do not allow passive monitoring and are likely to resist government pressure.
    - lmm 5y ago
      > For that same reasoning I support telegram more than signal. I simply do not see signal ever get to a widespread adoption, I do not see signal trying to get to a widespread adoption either; signal is not a messaging app it is a secure comunication app and for this they make a lot of tradeoffs. But Telegram's whole selling point is privacy and security. If security is not your priority (which is totally reasonable!) there are plenty of other messaging apps that are much more established than Telegram, and much more honest about not being particularly privacy-oriented. > An example is E2EE, it is a nice property but today it has significant UX implications that makes it bad default in my opinion for a popular personal messagin app Doesn't seem to have been a problem for e.g. WhatsApp. > Moreover the main threat model is not NSA hacking my device or the app's servers, it is app developer selling my data and governments making "lawful" requests to service providers. In both these metrics signal ranks better as far as I understand, but it is more of an individual choice. > If we are worried about the NSA the best thing to do is to move out of SMS/phone calls as fast as possible on mediums that do not allow passive monitoring and are likely to resist government pressure. Both these points seem like complete non sequiturs. If you want to avoid the app developer selling your data or providing it to governments, you need E2EE, there is no other way. Passive monitoring hasn't been a thing for about a decade, any non-joke messenger is at least using TLS, and it's not like people were using SMS/phone calls until Telegram came along with the revolutionary new idea of an internet messaging app.
jacoblambda 5y ago
Honestly you might want to look into Google Fi (Even though google is evil and just being under their umbrella makes me consider leaving) since their plans automatically work in most countries [1]. I want to find a better cell plan with a company I am not ethically opposed to but Fi is so good that it makes it really really hard to beat. [1]: https://fi.google.com/about/international-rates/ https://fi.google.com/about/international-rates/
- vertis 5y ago
  Google Fi has actually been reasonably useful despite the fact that I can't get it to work because I'm not in the US. They have a web messaging interface that I can collect 2FA from. I avoid phone based 2FA where possible, but the few that I have are sent there. But it's not really for non-US, and they've really started cracking down on people that use it exclusively internationally. Which is a real shame. It's absolutely the service I want/need as digital nomad.
vineyardmike 5y ago
If you don't mind me asking, how do you handle 2FA and companies that require a phone number(eg. my bank)? Do you have to constantly cycle through numbers, do you have a VOIP number?
- thefr0g 5y ago
  > If you don't mind me asking, how do you handle 2FA and companies that require a phone number(eg. my bank)? I'm note vertis, but I wont give out my cell phone number, so: Companies that require 2FA via phone just don't get my business and about all banks in germany offer chipTAN. The chipTAN devices are all made by shady companies and are less than open but I still trust them more than any smartphone or the mobile network.
  - vertis 5y ago
    Yeah, for the most part I use either time based tokens or my Yubikey. Where that's not possible and I can't avoid dealing with the provider as you mentioned it's Google Fi since they have a web gateway I can retrieve them on.

by vertis 5y ago

afiori 5y ago

> In all seriousness though, my messages are part of my memory. They're shared experience with my partner and a record of decisions. Thanks for saying this, I moved to Telegram[1] before I had a chance to learn about/suffer from Whatsapp take on backups, but it would have been devastating to lose years of messages with people over a bricked phone. [1] I know Telegram has a bad rep due to their home cooked crypto and maybe other stuff, but I like the app, I vaguely trust the author, and it works fine for me.

lmm 5y ago
> [1] I know Telegram has a bad rep due to their home cooked crypto and maybe other stuff, but I like the app, I vaguely trust the author, and it works fine for me. Is that because you assume the NSA aren't reading all your messages or you don't mind if they are? Because the whole problem with dodgy crypto is that it still seems to "work fine for me" even when it isn't.
- theshrike79 5y ago
  My main chat platforms are IRC, Telegram and Discord. None of them are E2E encrypted and don't sell themselves as such. I keep that in mind when discussing things. If I want to start doing something shady, I can pick up something else than Signal, since I don't want my phone number ending up on random people's phones.
  - lmm 5y ago
    > My main chat platforms are IRC, Telegram and Discord. None of them are E2E encrypted and don't sell themselves as such. Telegram's initial marketing heavily emphasised privacy. If I search for Telegram then the very first search result blurb starts "Telegram messages are heavily encrypted". Maybe they don't explicitly claim to be E2E, but they absolutely are selling themselves as an encrypted, privacy-friendly messenger. > If I want to start doing something shady, I can pick up something else than Signal, since I don't want my phone number ending up on random people's phones. Completely agreed, I dislike the Signal hype as much as anyone. But I trust Telegram even less.
    - afiori 5y ago
      The heavily encrypted refers to server side storage. https://telegram.org/privacy#3-3-1-cloud-chats https://telegram.org/privacy#3-3-1-cloud-chats > All data is stored heavily encrypted and the encryption keys in each case are stored in several other data centers in different jurisdictions. This way local engineers or physical intruders cannot get access to user data.
      - lmm 5y ago
        Wow, that's not at all clear from their marketing. That kind of misleading statement is definitely not what I'd want to see from a privacy/security-focused product - and yet Telegram's whole marketing is about privacy/security.
        afiori 5y ago
        The attack telegram is worried about is the russian army invading their datacenters, threatening employees, or forced buyout (what happend to the founder previous company vk.com).
- skinkestek 5y ago
  In my case it is to a large degree because I don't care. Disappearing messages are to prevent my kids reading the messages between me and their mother ;-) If NSA actually read my messages that would be kind of funny. If they have such a hack I'm sure they won't spend it on me or any other Joe Sixpack. Maybe ФСБ reads it but I have a hard time believing that too. My threat model consists of (not in any particular order): - my kids, - random internet strangers, - Facebook (who'll sell you to whoever pays), - Google or a Google-like entity with runaway "AI" and arrogant customer support[1] (who can lock out from my accounts for no reason) Besides, despite all the talk about E2E-encryption being so important, Signal (which I cheer for) IIRC has had a nasty XSS-exploit in their desktop allowing remote control of the pc, their phone client has been sending pictures to others than the recipient and probably a couple more. Ad I and others have pointed out repeatedly: There is more to security than encryption. It doesn't matter if it is E2E-encrypted if it is delivered to the wrong contact. And it doesn't matter if it is E2E-encrypted if whoever knows the secret can send you a specially crafted message and take control over your machine. [1]: I originally wrote employees but I don't think the average Google employee is more arrogant than others, they just come across that way because of policies created far above them.
  - lmm 5y ago
    Secure systems are all alike; every insecure system is insecure in its own way. A messenger that has E2E encryption might not be secure, but a messenger that doesn't have E2E encryption is definitely insecure. Not caring about your messages being read, or being willing to trust the operator of the service, is fine, but in that case I struggle to see why you'd pick Telegram, given that their whole selling point was about privacy and encryption when their encryption didn't actually work.
    - afiori 5y ago
      > when their encryption didn't actually work. what are referring to here? I vaguely know about delivery bugs and protocol patches
      - 5y ago
- afiori 5y ago
  For that same reasoning I support telegram more than signal. I simply do not see signal ever get to a widespread adoption, I do not see signal trying to get to a widespread adoption either; signal is not a messaging app it is a secure comunication app and for this they make a lot of tradeoffs. An example is E2EE, it is a nice property but today it has significant UX implications that makes it bad default in my opinion for a popular personal messagin app; in other places it is essential, just not there. Moreover the main threat model is not NSA hacking my device or the app's servers, it is app developer selling my data and governments making "lawful" requests to service providers. In both these metrics signal ranks better as far as I understand, but it is more of an individual choice. If we are worried about the NSA the best thing to do is to move out of SMS/phone calls as fast as possible on mediums that do not allow passive monitoring and are likely to resist government pressure.
  - lmm 5y ago
    > For that same reasoning I support telegram more than signal. I simply do not see signal ever get to a widespread adoption, I do not see signal trying to get to a widespread adoption either; signal is not a messaging app it is a secure comunication app and for this they make a lot of tradeoffs. But Telegram's whole selling point is privacy and security. If security is not your priority (which is totally reasonable!) there are plenty of other messaging apps that are much more established than Telegram, and much more honest about not being particularly privacy-oriented. > An example is E2EE, it is a nice property but today it has significant UX implications that makes it bad default in my opinion for a popular personal messagin app Doesn't seem to have been a problem for e.g. WhatsApp. > Moreover the main threat model is not NSA hacking my device or the app's servers, it is app developer selling my data and governments making "lawful" requests to service providers. In both these metrics signal ranks better as far as I understand, but it is more of an individual choice. > If we are worried about the NSA the best thing to do is to move out of SMS/phone calls as fast as possible on mediums that do not allow passive monitoring and are likely to resist government pressure. Both these points seem like complete non sequiturs. If you want to avoid the app developer selling your data or providing it to governments, you need E2EE, there is no other way. Passive monitoring hasn't been a thing for about a decade, any non-joke messenger is at least using TLS, and it's not like people were using SMS/phone calls until Telegram came along with the revolutionary new idea of an internet messaging app.

jacoblambda 5y ago

Honestly you might want to look into Google Fi (Even though google is evil and just being under their umbrella makes me consider leaving) since their plans automatically work in most countries [1]. I want to find a better cell plan with a company I am not ethically opposed to but Fi is so good that it makes it really really hard to beat. [1]: https://fi.google.com/about/international-rates/ https://fi.google.com/about/international-rates/

vertis 5y ago
Google Fi has actually been reasonably useful despite the fact that I can't get it to work because I'm not in the US. They have a web messaging interface that I can collect 2FA from. I avoid phone based 2FA where possible, but the few that I have are sent there. But it's not really for non-US, and they've really started cracking down on people that use it exclusively internationally. Which is a real shame. It's absolutely the service I want/need as digital nomad.

vineyardmike 5y ago

If you don't mind me asking, how do you handle 2FA and companies that require a phone number(eg. my bank)? Do you have to constantly cycle through numbers, do you have a VOIP number?

thefr0g 5y ago
> If you don't mind me asking, how do you handle 2FA and companies that require a phone number(eg. my bank)? I'm note vertis, but I wont give out my cell phone number, so: Companies that require 2FA via phone just don't get my business and about all banks in germany offer chipTAN. The chipTAN devices are all made by shady companies and are less than open but I still trust them more than any smartphone or the mobile network.
- vertis 5y ago
  Yeah, for the most part I use either time based tokens or my Yubikey. Where that's not possible and I can't avoid dealing with the provider as you mentioned it's Google Fi since they have a web gateway I can retrieve them on.