10 ms·

Signal brought e2e encryption to the masses in a form that was and is usable. From signal having it came whatsapp asking the signal devs to "do that for whatsap

by harry8 4y ago

Signal brought e2e encryption to the masses in a form that was and is usable. From signal having it came whatsapp asking the signal devs to "do that for whatsapp" and a billion more got it. That is no small thing. Bitch all you want but make sure when you do you compare it to the success of literally ever other attempt to bring e2e to the masses and then if I'm gonna be snarky maybe compare it to your own achievements. It would have been fantastic if signal also achieved other things on top of what they did. Maybe. Knocking what they did? Forget it. Signal is an outstanding achievement and nothing else comes close. I will cheer you so, so hard if you beat it.

gonehome 4y ago
+1 though to his credit he does caveat it a bit and states it’s still worth talking about the issues given the technical audience. I do think Moxie is right though and the talk is wrong on the core issue which is federation doesn’t work as well unless you really boil the ocean to do it (urbit) and even that still has to prove itself. Signal is really good at doing what it does well and I’m grateful for that. Matrix is cool, but my family/friends will never use it (and element still sucked last I checked, especially to deal with encryption). Signal is easy to use, extremely secure, and I can actually use it with less technical people I care about. Like you said - these are major wins among an ocean of failure from technologists who have for years complained while failing to ship a solution with the right tradeoffs (normal) people would actually use. I don’t find his other arguments very convincing either.
- NoGravitas 4y ago
  > I do think Moxie is right though and the talk is wrong on the core issue which is federation doesn’t work as well unless you really boil the ocean to do it (urbit) and even that still has to prove itself. I'm not so sure about that. I feel like Matrix has pretty much solved the problems with federation, E2EE, and multi-device usage. I typically have Matrix clients running on three devices, talking to my self-hosted homeserver, with encrypted chats with people on different homeservers, and it's been... at least a year?... since I had any issues with encrypted messages. It's been really good at disproving Moxie's assertion that you have to have centralization to evolve a protocol, too. The introduction of Spaces (like Discord servers) was really smooth and backward-compatible. There are features it lacks that I miss (stickers, sending multiple images in one message), but they're not essential. I do still also use Signal with less technical people, and I think Signal has been very successful at making adoption very easy, but with serious trade-offs for anyone not on the happy path (changing devices is a nightmare, it's too easy to lose chat history, multi-device is a trainwreck).
godelski 4y ago
I love Signal, and I think you're spot on about what they did. But I've been having a difficult time with the direction Signal is currently going. It seems like they are just trying to create feature parity with WA and Telegram. Which, honestly they are pretty near that already and the differences aren't worthwhile. Worse, they'll always be playing catch-up, because those companies have 100-1000x the number of developers. Instead, I think Signal needs to do what it does best: protecting users. I don't think this needs decentralization, although I saw a user post a feature request that was about semi-decentralization/meshing and that seemed pretty useful.[0] If Signal can bring anonymity and censorship mitigation to the public that really gives us the full Monty. That's really what I want to see from Signal. It fits their mission and keeps their edge. The best thing Signal has done is made everyone else adopt E2EE. Signal shouldn't be playing catch-up, they should be pushing others to follow suit. Companies like Meta say that they need data to protect users but Signal ,,demonstrates'' that this is not necessary. So continue in this direction. I know many want to just keep Signal as it is (Signal purists) but Moxie is right. The ecosystem is moving. Staying still will just get you killed. [0] https://community.signalusers.org/t/signal-airdrop/37402 https://community.signalusers.org/t/signal-airdrop/37402
- OJFord 4y ago
  But in order to do 'bring privacy to masses', don't you think they need familiar features? Otherwise it's just 'oh that weird crypto privacy nerd chat app' that the masses don't want to use.
  - godelski 4y ago
    What "familiar features" is Signal missing? Honest question. It has reactions, groups, stickers (wish they linked signalstickers.org so you can get more from inside the app), replies, etc. I don't see anything that WA or iMessage has that Signal doesn't. I know WA has statuses, but every time I look at it none of my friends have posted one. Telegram has channels, but do we really need that? I honestly don't know what these features are. The only thing I hear from normal people is stickers and "but none of my friends are there." This is a genuine question because I can't figure out what others have that Signal doesn't.
nicoco 4y ago
E2EE in WhatsApp is here because Meta does not care about the content of your messages. Analyzing natural language is hard anyway, whereas determining who you are, what you aspire to, and how to trick you into thinking your life won't be whole until you buy $PRODUCT is scandalously easy given your (weighted) relational graph.
- jokowueu 4y ago
  That doesn't make sense . If they didn't care about the content of your message why would they ask signal to help them add ee2e in the first place . they could have left it on tls like it used to be.
  - nicoco 4y ago
    What I meant what "who you talk to and how often you do" is as valuable as "what you say". > If they didn't care about the content of your message I'm not saying they don't care, just that e2ee in a centralised platform whose business is data collecting does not accomplish as much as one can think. > why would they ask signal to help them add ee2e in the first place. "Marketing" is why.
alx__ 4y ago
I have a group chat in Signal of 12 people. Only me, and another person, have a moderately technical understanding of what Signal provides. Besides the obvious "secure chat". There is no path for non-tech users to start using Element/Matrix or some Fediverse thing. These are excellent concepts, but they will remain there, as nice ideas. Because they are not a quick three-step process of Download -> Setup -> Chat with Friend
- SahAssar 4y ago
  I'm guessing that most of those people have at least one account (on some sort of service) that uses the traditional email+password login. I don't think that adding one more thing (the server domain) to that is hard. Or they could just use the default (in basically every client it is matrix.org).
- natrys 4y ago
  I am not sure why you think of that for Matrix. I am the only technical person in my group who self-hosts the Matrix server. All that my friends had to do was download the client, copy/paste the instance url provided by me, and boom we were chatting.
  - navigate8310 4y ago
    Copy/paste of some URL in a specific field to get started will cause at least some non-nerd friends to question the ease of use and inherit distrust. "Why am I pasting a URL given by you in this app, will you be able to track all my private conversations as well? Hell, will you be able to hack into my phone now?"
    - mynameisvlad 4y ago
      You must have some horribly untrustworthy friends. Or, more accurately, your friends must not find you very trustworthy if they're constantly asking these questions whenever you suggest something. A healthy dose of skepticism is warranted, but at the end of the day this whole thread is about friend groups talking to each other. This just wouldn't be a realistic line of questioning in this scenario imo.
raxxorraxor 4y ago
I hate that it relies on phone numbers instead of usernames. Sure, for the masses it is easier and certainly a success formula. But I still like to have an alternative anonymous service.
- alexmingoia 4y ago
  Me too. At least you can use VoIP numbers with Signal. You can also get a prepaid SIM anonymously, use it to create a Signal account, and then not use it. So there wouldn’t actually be any cell network activity tied to the phone number.
  - jeroenhd 4y ago
    > You can also get a prepaid SIM anonymously That's actually harder than you may think in more and more countries. Even with VoIP it's hard to not associate your banking details with your phone number. It won't be long until anonymous phone numbers will disappear again.
    - kahnclusions 4y ago
      Yup. Travelling in an Asian country recently and in order to buy a prepaid SIM they needed to take scans of my passport and visa.
nadmone 4y ago
It is pretty easy to say it is good if you dismiss anyone saying it isn't as bitching. Signal was insisting everyone using a phone number as identifier. We now know there were zero-click iMessage exploits being used by oppressive governments to target politicians, journalists and activists. All they needed was your phone number. It is slightly more complex than that but still you do the math.
- harry8 4y ago
  Its even easier to criticise it and completely ignore "...but make sure when you do you compare it to the success of literally ever other attempt to bring e2e to the masses." Signal is a stunning success. If you or anyone does better I will cheer and yell about your success often. >We now know there were zero-click iMessage exploits being used by oppressive governments to target politicians, journalists and activists. Firstly citation needed please. Secondly, great, should they have been using email and pgp? Or google chat? Or are you saying the NSA should have just had all comms on their servers without going to any further and targeted effort. Any software project can be criticised. And _should_ be. Just when you do it don't overlook its success which for signal was the first one that actually worked after decades of efforts. Now go do better.
  - misnome 4y ago
    > Firstly citation needed please Pegasus.
  - posterboy 4y ago
    Nowhere have you indicated how you measure the success. Number of users is no indicator for quality, for one. Code quality would be a rough guestimate because it is not open. Pick your poison.
    - harry8 4y ago
      Wha? Is it bad to quote yourself twice in the same thread? "... success of literally ever other attempt to bring e2e to the masses." Attempt to bring e2e to the masses. How many actually using it is that metric. Before open whisper & signal: how about number of people I knew with whom I could communicate securely with using pgp. 1. Total number of people in the world who could do it. A few thousand tops? You reckon it got to 10k, 100k. I can't imagine it got anywhere near a million... Today: Number of people doing it everyday without thinking about it. Over a billion. Sometimes metrics are so overwhelming that you have to tip your hat to it. This says nothing about any other dimensions of analysis other than "Number of people actually using e2e." It's a hell of a metric we can give credit to Moxie & co. for. That /one/ dimension is just wow. People tried before, for decades. It just didn't work out on that one metric. Something would have to be pretty bad to make that metric not dominate the discussion of overall success. But yeah, this is just the success of getting people using e2e and it's a massive achievement.
rvz 4y ago
> Signal brought e2e encryption to the masses in a form that was and is usable. The general users do not care, just like how no-one cares about the inventor of the smartphone and Apple repackaged it and brought out the iPhone to billions of users. Therefore, WhatsApp is the chosen one because in reality and contrary to what the herd believe here on HN, research [0] shows that even when Signal was boosted by some famous people, 'the masses' gave up using Signal when migrated and instead moved back to WhatsApp or Telegram. I think Signal has done a terrible job at selling itself and retaining its users migrated from other messengers and was only riding on the back of boosters that don't even use it, which allowed Signal to get distracted and rush and push in a private cryptocurrency project useful to criminals and scammers to execute a pump and dump scheme for the founders. The level of delusion in the comments about that so-called 'mass migration' or great 'messenger migration' to Signal seems to be as present as a haunted house. What a shame. And nope, anecdotes is not evidence. [0] https://medium.com/@carlagriggio/the-great-messaging-app-migration-that-didnt-really-happen-56af637bc5d8 https://medium.com/@carlagriggio/the-great-messaging-app-mig...
- zelphirkalt 4y ago
  But actually there were events, when millions of users migrated to Signal, from Whatsapp. Like the last time when Whatsapp was down. So it is not as onesided as you make it out to be.
- cycomanic 4y ago
  From your reference: > but only 0.5% uninstalled WhatsApp. Let me put these numbers into perspective: if we translated this result to the entire population of WhatsApp users (approx. 2 billion), we’d be talking about 500 million users trying to flee from WhatsApp, and only 10k uninstalling it 0.5% of 2 billion is 10 million not 10k, which incidentally corresponds quite closely (within order of magnitude) to the number of people who downloaded signal at the time. As a side note if someone argues with numbers and is 3 orders of magnitude of in their calculation are their conclusions still valid? It doesn't give a good look.
jeroenhd 4y ago
I have more contacts on Matrix than on Signal, and that's really saying something. WhatsApp brought encryption to the masses. Sure, they did so using Signal's code, but they could've picked any code base for E2EE. Even XMPP has secure encryption. Signal is "that alternate WhatsApp some people use".
- deleted 4y ago
  [deleted]
boesboes 4y ago
Google brought us some, a lot maybe even, of good stuff. May we not be critical of the things they could do better? Always this endless either you with us or against us shit . smh.
bayindirh 4y ago
> That is no small thing. Bitch all you want but make sure when you do you compare it to the success... Approaching valid criticism from that angle, with that attitude only throws a big jug of fuel to the already volatile fire. We are having these these kinds of arguments on another piece of software which I won't name, and it's leading to the same outcome. No productive discussion, no progress, nothing. Signal achieved good things, yes. Kudos for them coming that far. But if there is a considerable volume of same feedback, it's at least beneficial to listen to them intently, ponder and then sleep upon them, and draw some insight out of it. A kind reply and acknowledgement would be very fit and handsome jest, but it's not a must. You might be thinking that Signal is a flawless piece of software, even better than the sliced bread itself, but not everyone is on the same boat with you, and this is the way it should be. If this thing is an infrastructure for some people, and use it that much, the users have at least the right to make their opinions heard.
upofadown 4y ago
>Signal brought e2e encryption to the masses in a form that was and is usable. Not really. It has the same weakness that other E2EE schemes have when it comes to general usability. In a usability study involving Signal[1], 21 out of 28 computer science students failed to establish and maintain a secure end to end encrypted connection. The usability issue is a huge ongoing problem but there is a tendency to want to talk about everything but usability. We are having an animated discussion about the paint scheme while the barn is on fire. [1] https://www.ndss-symposium.org/wp-content/uploads/2018/03/09-when-signal-hits-the-fan-on-the-usability-and-security-of-state-of-the-art-secure-mobile-messaging.pdf https://www.ndss-symposium.org/wp-content/uploads/2018/03/09... | When SIGNAL hits the Fan: On the Usability and Security of State-of-the-Art Secure Mobile Messaging
- zaphar 4y ago
  This feels like moving the goal posts a bit. Before Signal, literally all the other options were orders of magnitude worse on either the privacy or the usability dimensions. Which is why there was essentially no mainstream E2E messaging app to speak of. After Signal there were multiple. For any system someone creates there will be weaknesses. The question isn't and shouldn't be did they create a system with no weaknesses? The question instead is did they meaningfully improve the privacy of of a large number of mainstream users and the answer there for Signal is Yes.
  - orangepurple 4y ago
    Does nobody remember Pidgin OTR? It has been around for decades.
    - zaphar 4y ago
      And none of the mainstream used it. Which only makes my point for me.
    - Forbo 4y ago
      I remember it being a broken cluster fuck. Hell, even early TextSecure was a usability mess.
bjoli 4y ago
Signal, as a means of developing the signal protocol, really brought encryption to the masses. Signal, WhatsApp, and RCS accounts for about 90% of my text communication. All encrypted by variations of the signal protocol.
deleted 4y ago
[deleted]
jvanderbot 4y ago
TFA acknowledged this specifically: > Criticizing a security-sensitive tool like Signal is tricky, as it might be misconstrued as a call to abandon it, and move to alternatives that might be in fact worse. But here, at a hacker conference and with little risk of causing confusion and diverting users towards less secure platforms, can we please have an honest conversation about Signal's problems? And how 5 years after that blogpost, moxie's centralization has not solved them?.. Apparently the good intent they assume in a hacker conference does not extend to a hacker forum. Their main complaints are 1) Lack of good clients, driven by a mostly closed ecosystem 2) Lack of good federation which brings down the whole network occasionally. These are hardly knocking anything related to the security that Signal provides, and definitely does not count as "Bitching", as these are real problems that are absolutely good things to fix on top of a fantastic product.
- ianbutler 4y ago
  > Apparently the good intent they assume in a hacker conference does not extend to a hacker forum. That would be because this isn’t a hacker forum in the sense the OP was using. The OP was using hacker in the classic sense, security folks, the culture is different within that space compared to this one. (Not better or worse mind you just different with different values and understandings)
  - commonlisper 4y ago
    > The OP was using hacker in the classic sense, security folks Really? I'd say that the classic meaning of "hacker" is what we have on HN. http://www.jargon.net/jargonfile/h/hacker.html http://www.jargon.net/jargonfile/h/hacker.html
    - serioussecurity 4y ago
      HN is mostly people trying to get rich selling themselves to VCs, so I'm not convinced that this is where the spirit of "hacker" is kept alive.
      - 4y ago
qweqwerwerwerwr 4y ago
the masses have never heard about it and people who need E2E and are sufficiently knowledgeable about it don't use it either, for a number of reasons it's a for-profit, centralized, closed-source product for privacy larpers
JeremyNT 4y ago
I don't understand the point of your comment. Are you saying that because Signal solved a problem in one way it should be immune from future criticism? This seems like a really narrow perspective, the opposite of the kind of curiosity and creativity this site tries to foster. I think it's good to take a look at Signal, recognize that it's better than what came before, and still come to the conclusion that it could be better. Signal is far from perfect despite its achievements, and today, years down the line from its original success, there is much room for improvement (or, barring that, replacement).

by harry8 4y ago

gonehome 4y ago

+1 though to his credit he does caveat it a bit and states it’s still worth talking about the issues given the technical audience. I do think Moxie is right though and the talk is wrong on the core issue which is federation doesn’t work as well unless you really boil the ocean to do it (urbit) and even that still has to prove itself. Signal is really good at doing what it does well and I’m grateful for that. Matrix is cool, but my family/friends will never use it (and element still sucked last I checked, especially to deal with encryption). Signal is easy to use, extremely secure, and I can actually use it with less technical people I care about. Like you said - these are major wins among an ocean of failure from technologists who have for years complained while failing to ship a solution with the right tradeoffs (normal) people would actually use. I don’t find his other arguments very convincing either.

NoGravitas 4y ago
> I do think Moxie is right though and the talk is wrong on the core issue which is federation doesn’t work as well unless you really boil the ocean to do it (urbit) and even that still has to prove itself. I'm not so sure about that. I feel like Matrix has pretty much solved the problems with federation, E2EE, and multi-device usage. I typically have Matrix clients running on three devices, talking to my self-hosted homeserver, with encrypted chats with people on different homeservers, and it's been... at least a year?... since I had any issues with encrypted messages. It's been really good at disproving Moxie's assertion that you have to have centralization to evolve a protocol, too. The introduction of Spaces (like Discord servers) was really smooth and backward-compatible. There are features it lacks that I miss (stickers, sending multiple images in one message), but they're not essential. I do still also use Signal with less technical people, and I think Signal has been very successful at making adoption very easy, but with serious trade-offs for anyone not on the happy path (changing devices is a nightmare, it's too easy to lose chat history, multi-device is a trainwreck).

godelski 4y ago

I love Signal, and I think you're spot on about what they did. But I've been having a difficult time with the direction Signal is currently going. It seems like they are just trying to create feature parity with WA and Telegram. Which, honestly they are pretty near that already and the differences aren't worthwhile. Worse, they'll always be playing catch-up, because those companies have 100-1000x the number of developers. Instead, I think Signal needs to do what it does best: protecting users. I don't think this needs decentralization, although I saw a user post a feature request that was about semi-decentralization/meshing and that seemed pretty useful.[0] If Signal can bring anonymity and censorship mitigation to the public that really gives us the full Monty. That's really what I want to see from Signal. It fits their mission and keeps their edge. The best thing Signal has done is made everyone else adopt E2EE. Signal shouldn't be playing catch-up, they should be pushing others to follow suit. Companies like Meta say that they need data to protect users but Signal ,,demonstrates'' that this is not necessary. So continue in this direction. I know many want to just keep Signal as it is (Signal purists) but Moxie is right. The ecosystem is moving. Staying still will just get you killed. [0] https://community.signalusers.org/t/signal-airdrop/37402 https://community.signalusers.org/t/signal-airdrop/37402

OJFord 4y ago
But in order to do 'bring privacy to masses', don't you think they need familiar features? Otherwise it's just 'oh that weird crypto privacy nerd chat app' that the masses don't want to use.
- godelski 4y ago
  What "familiar features" is Signal missing? Honest question. It has reactions, groups, stickers (wish they linked signalstickers.org so you can get more from inside the app), replies, etc. I don't see anything that WA or iMessage has that Signal doesn't. I know WA has statuses, but every time I look at it none of my friends have posted one. Telegram has channels, but do we really need that? I honestly don't know what these features are. The only thing I hear from normal people is stickers and "but none of my friends are there." This is a genuine question because I can't figure out what others have that Signal doesn't.

nicoco 4y ago

E2EE in WhatsApp is here because Meta does not care about the content of your messages. Analyzing natural language is hard anyway, whereas determining who you are, what you aspire to, and how to trick you into thinking your life won't be whole until you buy $PRODUCT is scandalously easy given your (weighted) relational graph.

jokowueu 4y ago
That doesn't make sense . If they didn't care about the content of your message why would they ask signal to help them add ee2e in the first place . they could have left it on tls like it used to be.
- nicoco 4y ago
  What I meant what "who you talk to and how often you do" is as valuable as "what you say". > If they didn't care about the content of your message I'm not saying they don't care, just that e2ee in a centralised platform whose business is data collecting does not accomplish as much as one can think. > why would they ask signal to help them add ee2e in the first place. "Marketing" is why.

alx__ 4y ago

I have a group chat in Signal of 12 people. Only me, and another person, have a moderately technical understanding of what Signal provides. Besides the obvious "secure chat". There is no path for non-tech users to start using Element/Matrix or some Fediverse thing. These are excellent concepts, but they will remain there, as nice ideas. Because they are not a quick three-step process of Download -> Setup -> Chat with Friend

SahAssar 4y ago
I'm guessing that most of those people have at least one account (on some sort of service) that uses the traditional email+password login. I don't think that adding one more thing (the server domain) to that is hard. Or they could just use the default (in basically every client it is matrix.org).
natrys 4y ago
I am not sure why you think of that for Matrix. I am the only technical person in my group who self-hosts the Matrix server. All that my friends had to do was download the client, copy/paste the instance url provided by me, and boom we were chatting.
- navigate8310 4y ago
  Copy/paste of some URL in a specific field to get started will cause at least some non-nerd friends to question the ease of use and inherit distrust. "Why am I pasting a URL given by you in this app, will you be able to track all my private conversations as well? Hell, will you be able to hack into my phone now?"
  - mynameisvlad 4y ago
    You must have some horribly untrustworthy friends. Or, more accurately, your friends must not find you very trustworthy if they're constantly asking these questions whenever you suggest something. A healthy dose of skepticism is warranted, but at the end of the day this whole thread is about friend groups talking to each other. This just wouldn't be a realistic line of questioning in this scenario imo.

raxxorraxor 4y ago

I hate that it relies on phone numbers instead of usernames. Sure, for the masses it is easier and certainly a success formula. But I still like to have an alternative anonymous service.

alexmingoia 4y ago
Me too. At least you can use VoIP numbers with Signal. You can also get a prepaid SIM anonymously, use it to create a Signal account, and then not use it. So there wouldn’t actually be any cell network activity tied to the phone number.
- jeroenhd 4y ago
  > You can also get a prepaid SIM anonymously That's actually harder than you may think in more and more countries. Even with VoIP it's hard to not associate your banking details with your phone number. It won't be long until anonymous phone numbers will disappear again.
  - kahnclusions 4y ago
    Yup. Travelling in an Asian country recently and in order to buy a prepaid SIM they needed to take scans of my passport and visa.

nadmone 4y ago

It is pretty easy to say it is good if you dismiss anyone saying it isn't as bitching. Signal was insisting everyone using a phone number as identifier. We now know there were zero-click iMessage exploits being used by oppressive governments to target politicians, journalists and activists. All they needed was your phone number. It is slightly more complex than that but still you do the math.

harry8 4y ago
Its even easier to criticise it and completely ignore "...but make sure when you do you compare it to the success of literally ever other attempt to bring e2e to the masses." Signal is a stunning success. If you or anyone does better I will cheer and yell about your success often. >We now know there were zero-click iMessage exploits being used by oppressive governments to target politicians, journalists and activists. Firstly citation needed please. Secondly, great, should they have been using email and pgp? Or google chat? Or are you saying the NSA should have just had all comms on their servers without going to any further and targeted effort. Any software project can be criticised. And _should_ be. Just when you do it don't overlook its success which for signal was the first one that actually worked after decades of efforts. Now go do better.
- misnome 4y ago
  > Firstly citation needed please Pegasus.
- posterboy 4y ago
  Nowhere have you indicated how you measure the success. Number of users is no indicator for quality, for one. Code quality would be a rough guestimate because it is not open. Pick your poison.
  - harry8 4y ago
    Wha? Is it bad to quote yourself twice in the same thread? "... success of literally ever other attempt to bring e2e to the masses." Attempt to bring e2e to the masses. How many actually using it is that metric. Before open whisper & signal: how about number of people I knew with whom I could communicate securely with using pgp. 1. Total number of people in the world who could do it. A few thousand tops? You reckon it got to 10k, 100k. I can't imagine it got anywhere near a million... Today: Number of people doing it everyday without thinking about it. Over a billion. Sometimes metrics are so overwhelming that you have to tip your hat to it. This says nothing about any other dimensions of analysis other than "Number of people actually using e2e." It's a hell of a metric we can give credit to Moxie & co. for. That /one/ dimension is just wow. People tried before, for decades. It just didn't work out on that one metric. Something would have to be pretty bad to make that metric not dominate the discussion of overall success. But yeah, this is just the success of getting people using e2e and it's a massive achievement.

rvz 4y ago

> Signal brought e2e encryption to the masses in a form that was and is usable. The general users do not care, just like how no-one cares about the inventor of the smartphone and Apple repackaged it and brought out the iPhone to billions of users. Therefore, WhatsApp is the chosen one because in reality and contrary to what the herd believe here on HN, research [0] shows that even when Signal was boosted by some famous people, 'the masses' gave up using Signal when migrated and instead moved back to WhatsApp or Telegram. I think Signal has done a terrible job at selling itself and retaining its users migrated from other messengers and was only riding on the back of boosters that don't even use it, which allowed Signal to get distracted and rush and push in a private cryptocurrency project useful to criminals and scammers to execute a pump and dump scheme for the founders. The level of delusion in the comments about that so-called 'mass migration' or great 'messenger migration' to Signal seems to be as present as a haunted house. What a shame. And nope, anecdotes is not evidence. [0] https://medium.com/@carlagriggio/the-great-messaging-app-migration-that-didnt-really-happen-56af637bc5d8 https://medium.com/@carlagriggio/the-great-messaging-app-mig...

zelphirkalt 4y ago
But actually there were events, when millions of users migrated to Signal, from Whatsapp. Like the last time when Whatsapp was down. So it is not as onesided as you make it out to be.
cycomanic 4y ago
From your reference: > but only 0.5% uninstalled WhatsApp. Let me put these numbers into perspective: if we translated this result to the entire population of WhatsApp users (approx. 2 billion), we’d be talking about 500 million users trying to flee from WhatsApp, and only 10k uninstalling it 0.5% of 2 billion is 10 million not 10k, which incidentally corresponds quite closely (within order of magnitude) to the number of people who downloaded signal at the time. As a side note if someone argues with numbers and is 3 orders of magnitude of in their calculation are their conclusions still valid? It doesn't give a good look.

jeroenhd 4y ago

I have more contacts on Matrix than on Signal, and that's really saying something. WhatsApp brought encryption to the masses. Sure, they did so using Signal's code, but they could've picked any code base for E2EE. Even XMPP has secure encryption. Signal is "that alternate WhatsApp some people use".

deleted 4y ago
[deleted]

boesboes 4y ago

Google brought us some, a lot maybe even, of good stuff. May we not be critical of the things they could do better? Always this endless either you with us or against us shit . smh.

bayindirh 4y ago

> That is no small thing. Bitch all you want but make sure when you do you compare it to the success... Approaching valid criticism from that angle, with that attitude only throws a big jug of fuel to the already volatile fire. We are having these these kinds of arguments on another piece of software which I won't name, and it's leading to the same outcome. No productive discussion, no progress, nothing. Signal achieved good things, yes. Kudos for them coming that far. But if there is a considerable volume of same feedback, it's at least beneficial to listen to them intently, ponder and then sleep upon them, and draw some insight out of it. A kind reply and acknowledgement would be very fit and handsome jest, but it's not a must. You might be thinking that Signal is a flawless piece of software, even better than the sliced bread itself, but not everyone is on the same boat with you, and this is the way it should be. If this thing is an infrastructure for some people, and use it that much, the users have at least the right to make their opinions heard.

upofadown 4y ago

>Signal brought e2e encryption to the masses in a form that was and is usable. Not really. It has the same weakness that other E2EE schemes have when it comes to general usability. In a usability study involving Signal[1], 21 out of 28 computer science students failed to establish and maintain a secure end to end encrypted connection. The usability issue is a huge ongoing problem but there is a tendency to want to talk about everything but usability. We are having an animated discussion about the paint scheme while the barn is on fire. [1] https://www.ndss-symposium.org/wp-content/uploads/2018/03/09-when-signal-hits-the-fan-on-the-usability-and-security-of-state-of-the-art-secure-mobile-messaging.pdf https://www.ndss-symposium.org/wp-content/uploads/2018/03/09... | When SIGNAL hits the Fan: On the Usability and Security of State-of-the-Art Secure Mobile Messaging

zaphar 4y ago
This feels like moving the goal posts a bit. Before Signal, literally all the other options were orders of magnitude worse on either the privacy or the usability dimensions. Which is why there was essentially no mainstream E2E messaging app to speak of. After Signal there were multiple. For any system someone creates there will be weaknesses. The question isn't and shouldn't be did they create a system with no weaknesses? The question instead is did they meaningfully improve the privacy of of a large number of mainstream users and the answer there for Signal is Yes.
- orangepurple 4y ago
  Does nobody remember Pidgin OTR? It has been around for decades.
  - zaphar 4y ago
    And none of the mainstream used it. Which only makes my point for me.
  - Forbo 4y ago
    I remember it being a broken cluster fuck. Hell, even early TextSecure was a usability mess.

bjoli 4y ago

Signal, as a means of developing the signal protocol, really brought encryption to the masses. Signal, WhatsApp, and RCS accounts for about 90% of my text communication. All encrypted by variations of the signal protocol.

deleted 4y ago

[deleted]

jvanderbot 4y ago

TFA acknowledged this specifically: > Criticizing a security-sensitive tool like Signal is tricky, as it might be misconstrued as a call to abandon it, and move to alternatives that might be in fact worse. But here, at a hacker conference and with little risk of causing confusion and diverting users towards less secure platforms, can we please have an honest conversation about Signal's problems? And how 5 years after that blogpost, moxie's centralization has not solved them?.. Apparently the good intent they assume in a hacker conference does not extend to a hacker forum. Their main complaints are 1) Lack of good clients, driven by a mostly closed ecosystem 2) Lack of good federation which brings down the whole network occasionally. These are hardly knocking anything related to the security that Signal provides, and definitely does not count as "Bitching", as these are real problems that are absolutely good things to fix on top of a fantastic product.

ianbutler 4y ago
> Apparently the good intent they assume in a hacker conference does not extend to a hacker forum. That would be because this isn’t a hacker forum in the sense the OP was using. The OP was using hacker in the classic sense, security folks, the culture is different within that space compared to this one. (Not better or worse mind you just different with different values and understandings)
- commonlisper 4y ago
  > The OP was using hacker in the classic sense, security folks Really? I'd say that the classic meaning of "hacker" is what we have on HN. http://www.jargon.net/jargonfile/h/hacker.html http://www.jargon.net/jargonfile/h/hacker.html
  - serioussecurity 4y ago
    HN is mostly people trying to get rich selling themselves to VCs, so I'm not convinced that this is where the spirit of "hacker" is kept alive.
    - 4y ago

qweqwerwerwerwr 4y ago

the masses have never heard about it and people who need E2E and are sufficiently knowledgeable about it don't use it either, for a number of reasons it's a for-profit, centralized, closed-source product for privacy larpers

JeremyNT 4y ago

I don't understand the point of your comment. Are you saying that because Signal solved a problem in one way it should be immune from future criticism? This seems like a really narrow perspective, the opposite of the kind of curiosity and creativity this site tries to foster. I think it's good to take a look at Signal, recognize that it's better than what came before, and still come to the conclusion that it could be better. Signal is far from perfect despite its achievements, and today, years down the line from its original success, there is much room for improvement (or, barring that, replacement).