6 ms·

Signal advises its users to install the app from the Play Store. While you can still get the .apk from Signal’s website, the developers warn against that. The E

Signal advises its users to install the app from the Play Store. While you can still get the .apk from Signal’s website, the developers warn against that. The EU can definitely exert pressure against what is hosted on the Play Store. Telegram famously lacks end-to-end encryption (unless you intentionally use its private-chat feature, which few people do) and shouldn’t be mentioned in the same context as Signal.

kzrdude 3y ago
If you enable private chat, you don't get notifications for new messages, that way the feature is self defeating, it seems to me at least. (Something could also have gone wrong?)
- CuriousCosmic 3y ago
  Notifications generally go through Google Firebase so by not running private messages through firebase they avoid potential leaks. At least that's my guess
  - kzrdude 3y ago
    That sounds pretty bad, a cloud service needs to see all notifications?
    - miohtama 3y ago
      A good question. I am not sure if notifications on iOS, Android, Google Chrome or Firefox are end-to-end encrypted.
      - nickphx 3y ago
        You can send whatever values you desire as long as your service worker handles it.
    - kube-system 3y ago
      Server side push messaging uses cloud infrastructure on both Android and iOS devices. Some applications choose to make these notifications more 'secure' by not sending any content through them, just the fact that you have a new notification, but that makes the UX a little less friendly. https://en.wikipedia.org/wiki/Apple_Push_Notification_service https://en.wikipedia.org/wiki/Apple_Push_Notification_servic... https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging
    - keep_reading 3y ago
      No, it can be encrypted and then you have a hook that decrypts the notification on-device. On iOS you need to get approval from Apple to do this though
  - daveoc64 3y ago
    A common way around this is to simply send a notification through Firebase/other push notification mechanism that tells the app there is a new message. The app can then retrieve the message and decrypt it. Most of them will then update the notification shown to the user with the full message content.
    - tux3 3y ago
      Maybe the concern is that Firebase still learns that user A and user B receive notifications back and forth at around the same time, interspersed with periods of no notifications for both If A and B talk regularly, there might not be many other C who by coincidence exchange notifications at the same time So you might be vulnerable to a sort of traffic analysis
- onli 3y ago
  With Telegram on Android you should still get notifications, even for encrypted messages. They just won't show the message's content.
- keep_reading 3y ago
  I don't have problems with notifications for secret chats ?
CuriousCosmic 3y ago
Molly is a just as good (if not better) fork of Signal that is distributed on FDroid. It's the same network and same chats/contacts, just a different front-end. And Signal avoids FDroid because they don't want someone else signing packages but they can always provide an FDroid repository like many others do and sign everything themselves. If push comes to shove they'll be fine and pressure to black box signal in the EU is unlikely to hold up if they can just move users to another app store.
- OfSanguineFire 3y ago
  Signal being restricted to F-Droid would be the end of the app as any kind of mass phenomenon. Sure, like my fellow nerds here on HN, I use F-Droid. But none of the ordinary friends and relatives I managed to convince to install Signal, since it was free from the Play Store with just a few taps, would continue using the app if it were relegated to that repository they have never heard of. Signal’s developers have spoken on a number of occasions about how their aim is to ensure encryption for the masses, not a techie elite.
  - zolbrek 3y ago
    Yeah, I communicate with way too many people on iPhones who will simply not switch to Android. If it disappears from the Apple App Store we will have to use a different messenger.
  - thisisabore 3y ago
    How is providing a F-Droid repo the same as being restricted to only being available via F-Droid?
    - bitvoid 3y ago
      It was in reply to: > If push comes to shove they'll be fine and pressure to black box signal in the EU is unlikely to hold up if they can just move users to another app store.
      - 3y ago
skyyler 3y ago
Telegram is a social media site pretending to be a messaging app. The secret chats were the biggest feature when it started, but now it's an after-thought.
yieldcrv 3y ago
Their point isn’t about Telegram end to end encryption or lack thereof, its that they don’t comply Nothing gets taken down from telegram and they ignore court orders they just go to null
- Moldoteck 3y ago
  And they store data on their servers in plain text so that ru state/arab investors can access it at will

kzrdude 3y ago

If you enable private chat, you don't get notifications for new messages, that way the feature is self defeating, it seems to me at least. (Something could also have gone wrong?)

CuriousCosmic 3y ago
Notifications generally go through Google Firebase so by not running private messages through firebase they avoid potential leaks. At least that's my guess
- kzrdude 3y ago
  That sounds pretty bad, a cloud service needs to see all notifications?
  - miohtama 3y ago
    A good question. I am not sure if notifications on iOS, Android, Google Chrome or Firefox are end-to-end encrypted.
    - nickphx 3y ago
      You can send whatever values you desire as long as your service worker handles it.
  - kube-system 3y ago
    Server side push messaging uses cloud infrastructure on both Android and iOS devices. Some applications choose to make these notifications more 'secure' by not sending any content through them, just the fact that you have a new notification, but that makes the UX a little less friendly. https://en.wikipedia.org/wiki/Apple_Push_Notification_service https://en.wikipedia.org/wiki/Apple_Push_Notification_servic... https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging
  - keep_reading 3y ago
    No, it can be encrypted and then you have a hook that decrypts the notification on-device. On iOS you need to get approval from Apple to do this though
- daveoc64 3y ago
  A common way around this is to simply send a notification through Firebase/other push notification mechanism that tells the app there is a new message. The app can then retrieve the message and decrypt it. Most of them will then update the notification shown to the user with the full message content.
  - tux3 3y ago
    Maybe the concern is that Firebase still learns that user A and user B receive notifications back and forth at around the same time, interspersed with periods of no notifications for both If A and B talk regularly, there might not be many other C who by coincidence exchange notifications at the same time So you might be vulnerable to a sort of traffic analysis
onli 3y ago
With Telegram on Android you should still get notifications, even for encrypted messages. They just won't show the message's content.
keep_reading 3y ago
I don't have problems with notifications for secret chats ?

CuriousCosmic 3y ago

Molly is a just as good (if not better) fork of Signal that is distributed on FDroid. It's the same network and same chats/contacts, just a different front-end. And Signal avoids FDroid because they don't want someone else signing packages but they can always provide an FDroid repository like many others do and sign everything themselves. If push comes to shove they'll be fine and pressure to black box signal in the EU is unlikely to hold up if they can just move users to another app store.

OfSanguineFire 3y ago
Signal being restricted to F-Droid would be the end of the app as any kind of mass phenomenon. Sure, like my fellow nerds here on HN, I use F-Droid. But none of the ordinary friends and relatives I managed to convince to install Signal, since it was free from the Play Store with just a few taps, would continue using the app if it were relegated to that repository they have never heard of. Signal’s developers have spoken on a number of occasions about how their aim is to ensure encryption for the masses, not a techie elite.
- zolbrek 3y ago
  Yeah, I communicate with way too many people on iPhones who will simply not switch to Android. If it disappears from the Apple App Store we will have to use a different messenger.
- thisisabore 3y ago
  How is providing a F-Droid repo the same as being restricted to only being available via F-Droid?
  - bitvoid 3y ago
    It was in reply to: > If push comes to shove they'll be fine and pressure to black box signal in the EU is unlikely to hold up if they can just move users to another app store.
    - 3y ago

skyyler 3y ago

Telegram is a social media site pretending to be a messaging app. The secret chats were the biggest feature when it started, but now it's an after-thought.

yieldcrv 3y ago

Their point isn’t about Telegram end to end encryption or lack thereof, its that they don’t comply Nothing gets taken down from telegram and they ignore court orders they just go to null

Moldoteck 3y ago
And they store data on their servers in plain text so that ru state/arab investors can access it at will