4 ms·

What Does It Mean to Be a Signal Competitor?

39 points by Ozarkian 2y ago

teekert 2y ago
I got most of my family and some friend groups on Signal, because of the simple fact that it is just like WhatsApp. It should even be a little more like WA because all said family use it with that pincode pop-up open... None of them understand it, and all of them expect to loose all their conversations when they loose their phone so who cares. For some I turned it off, but that should be easier. That said, I wish WA would have Signal's way of sending Gifs (or Jifs as some people call them). I fully agree with this article by the way. Got my brother on Matrix and it was pain (he lost access quickly). I Started a Matrix group on fosdem, within a day people were complaining that I should turn of encryption because they had issues (from their own server probably), I never managed to do that... I love Matrix and use it a lot for communities, but Signal just works.
- kuschku 2y ago
  > within a day people were complaining that I should turn of encryption because they had issues (from their own server probably), I never managed to do that Obviously you weren't able to do that - contrary to what OOP's article wrote, in Matrix it's not possible to deactivate E2EE for a room after it has ever been enabled. The closest thing to that you could do would probably be creating a new room without encryption and closing (tombstoning) the old room with a link to the new room.
darkest_ruby 2y ago
Would like to hear opinions on Briar
- teekert 2y ago
  From a Signal user: Sounds good! Never heard of it before, nor has anyone I know probably, no iOS app, not an option I'm afraid.
- smeej 2y ago
  It's been about 4 years since I've used Briar, so take this with a grain of salt, but I found it extremely useful at an event where I was normally within WiFi distance of my friends, but we didn't have cell service. Like, we might be in the same conference room, just not actually near each other, and the site had shoddy internet service. If we could connect to each other's phones as "hotspots," we could send messages over Briar that wouldn't get through any other way. It also worked well with a local mesh net set up around the conference location for file sharing, but that didn't have internet access. Not the intended use case from what I understand, but it worked surprisingly well, and better than the goTennas we tried the year before!
  - darkest_ruby 2y ago
    Thanks for your response, I was more interested to hear on the security part of Briar, as a signal competitor, in light of linked article.
issafram 2y ago
I agree with what he's saying, but I think he has one thing wrong. Video chat is a feature that Signal has had for a while now and is also E2EE.
amedvednikov 2y ago
Signal is openly against third party clients, they basically killed LibreSignal: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... Also how easy is it to run a custom Signal server?
- ambicapter 2y ago
  If they believe that uncontrolled 3rd-party clients would make it easier to breach their protocol (because they know their protocol's weaknesses), it would make sense to be openly hostile to 3rd-party clients.
  - littlestymaar 2y ago
    If there's no third party client then the e2e is completely moot because Signal could be forced to push a backdoor to their customers and they would never know e2e has been removed.
    - ambicapter 2y ago
      Fair point, I guess it goes both ways.
  - zeendo 2y ago
    The strength and security of any good protocol, especially Signal's, does not come from obscurity. See https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity
  - SahAssar 2y ago
    How would a third party client make it easier to breach the protocol? You can still study the source of the client, the protocol, make a fork of it and modify it, etc. The official client is fully open source. The argument for security for disallowing other clients would be being able to modify the protocol to patch out security issues without worrying about compatibility with other clients.
- deleted 2y ago
deleted 2y ago
[deleted]
pjs_ 2y ago
They are missing an additional factor which is - who is running it, and how are they incentivized. This is really the reason I trust signal more than the alternatives, over and above any technical details. Basically I want the ship to be steered by someone who is maximally inoculated against selling out. Spending a decade of your life publicly railing against capitalism and sellouts, building a big community of active crusty friends who will call you out for turning evil, that’s valuable. It’s not perfect but I believe that it works better than various alternatives moxies “bad business models create evil companies” thing resonates a lot also
oezi 2y ago
After a couple of years on Signal, I am starting to migrate back to WhatsApp for most usage, because Signal doesn't care about normal people who want to share family pictures with each other and expect those to be part of your photo stream.
- cactusplant7374 2y ago
  Isn't the photo quality better on Signal? My goal is to preserve memories with photos at high fidelity. Usually I just link photo albums.
  - oezi 2y ago
    I can link photo albums, but relatives will just continue to message photos. I can't save them easily and lose date/time stamps, so that the high quality pictures do not benefit me. Again, this is my experience after 4 years of Signal use. My photo library is just missing so many memories because of this.
- teekert 2y ago
  I find this a big + haha, no more stupid pics from friend groups in between my nice pictures. And if I want one in there it's two taps away.
  - oezi 2y ago
    Could be easily solved by enabling saving to Photo Stream by Chat or Person.
- OutOfHere 2y ago
  Signal does have photo sharing, in HD quality too.
  - oezi 2y ago
    Great, but the photos are stuck in a Chat and have no metadata.
ziofill 2y ago
I’ve been using and recommending Signal for years now. Recently I have learned that Signal relies on AWS. What are the implications from a security perspective?
- from-nibly 2y ago
  If signal cant see your messages on their own hardware what's the difference with aws?
kuschku 2y ago
Even Signal doesn't match the requirements set by this blog post. It too has frequently prioritized features and usability over security. For example: - Relying on SGX-based security for some of their features (e.g., gif search) while SGX has been thoroughly broken again and again - Using phone numbers as account ids, which allows nation states to capture just one phone and immediately unmask the IRL identities of all other group chat members and contacts Signal's authors have previously argued that it's better to give a some security to 100% of people than 100% of security to some people. Which is why they cooperated with WhatsApp on their encryption, or why they used phone numbers to ease adoption. Matrix for example is doing exactly the same, just with a slightly different focus. This narrow view of "Signal competitor" is more harmful than good.
- pluto_modadic 2y ago
  unmasking the other people in the group is news to me, you got a source for that? lol
  - kuschku 2y ago
    Signal uses phone numbers as identifiers. Due to KYC laws phone numbers are closely bound to real-world identities. If the police is able to unlock one person's phone, even if that person used self-deleting messages, they immediately know the identity of every other person that person chatted with. Signal might as well have used your SSN as your account ID, that would have been just as private. Luckily Signal has finally started fixing that in the past few weeks.
- ThePowerOfFuet 2y ago
  >Using phone numbers as account ids, which allows nation states to capture just one phone and immediately unmask the IRL identities of all other group chat members and contacts Incorrect. Accounts can be set to not make the registration phone number either visible or findable by (or both) contacts.
  - crtasm 2y ago

39 points by Ozarkian 2y ago

I got most of my family and some friend groups on Signal, because of the simple fact that it is just like WhatsApp. It should even be a little more like WA because all said family use it with that pincode pop-up open... None of them understand it, and all of them expect to loose all their conversations when they loose their phone so who cares. For some I turned it off, but that should be easier. That said, I wish WA would have Signal's way of sending Gifs (or Jifs as some people call them). I fully agree with this article by the way. Got my brother on Matrix and it was pain (he lost access quickly). I Started a Matrix group on fosdem, within a day people were complaining that I should turn of encryption because they had issues (from their own server probably), I never managed to do that... I love Matrix and use it a lot for communities, but Signal just works.

kuschku 2y ago
> within a day people were complaining that I should turn of encryption because they had issues (from their own server probably), I never managed to do that Obviously you weren't able to do that - contrary to what OOP's article wrote, in Matrix it's not possible to deactivate E2EE for a room after it has ever been enabled. The closest thing to that you could do would probably be creating a new room without encryption and closing (tombstoning) the old room with a link to the new room.

darkest_ruby 2y ago

Would like to hear opinions on Briar

teekert 2y ago
From a Signal user: Sounds good! Never heard of it before, nor has anyone I know probably, no iOS app, not an option I'm afraid.
smeej 2y ago
It's been about 4 years since I've used Briar, so take this with a grain of salt, but I found it extremely useful at an event where I was normally within WiFi distance of my friends, but we didn't have cell service. Like, we might be in the same conference room, just not actually near each other, and the site had shoddy internet service. If we could connect to each other's phones as "hotspots," we could send messages over Briar that wouldn't get through any other way. It also worked well with a local mesh net set up around the conference location for file sharing, but that didn't have internet access. Not the intended use case from what I understand, but it worked surprisingly well, and better than the goTennas we tried the year before!
- darkest_ruby 2y ago
  Thanks for your response, I was more interested to hear on the security part of Briar, as a signal competitor, in light of linked article.

issafram 2y ago

I agree with what he's saying, but I think he has one thing wrong. Video chat is a feature that Signal has had for a while now and is also E2EE.

amedvednikov 2y ago

Signal is openly against third party clients, they basically killed LibreSignal: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... Also how easy is it to run a custom Signal server?

ambicapter 2y ago
If they believe that uncontrolled 3rd-party clients would make it easier to breach their protocol (because they know their protocol's weaknesses), it would make sense to be openly hostile to 3rd-party clients.
- littlestymaar 2y ago
  If there's no third party client then the e2e is completely moot because Signal could be forced to push a backdoor to their customers and they would never know e2e has been removed.
  - ambicapter 2y ago
    Fair point, I guess it goes both ways.
- zeendo 2y ago
  The strength and security of any good protocol, especially Signal's, does not come from obscurity. See https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity
- SahAssar 2y ago
  How would a third party client make it easier to breach the protocol? You can still study the source of the client, the protocol, make a fork of it and modify it, etc. The official client is fully open source. The argument for security for disallowing other clients would be being able to modify the protocol to patch out security issues without worrying about compatibility with other clients.
deleted 2y ago

deleted 2y ago

[deleted]

pjs_ 2y ago

They are missing an additional factor which is - who is running it, and how are they incentivized. This is really the reason I trust signal more than the alternatives, over and above any technical details. Basically I want the ship to be steered by someone who is maximally inoculated against selling out. Spending a decade of your life publicly railing against capitalism and sellouts, building a big community of active crusty friends who will call you out for turning evil, that’s valuable. It’s not perfect but I believe that it works better than various alternatives moxies “bad business models create evil companies” thing resonates a lot also

oezi 2y ago

After a couple of years on Signal, I am starting to migrate back to WhatsApp for most usage, because Signal doesn't care about normal people who want to share family pictures with each other and expect those to be part of your photo stream.

cactusplant7374 2y ago
Isn't the photo quality better on Signal? My goal is to preserve memories with photos at high fidelity. Usually I just link photo albums.
- oezi 2y ago
  I can link photo albums, but relatives will just continue to message photos. I can't save them easily and lose date/time stamps, so that the high quality pictures do not benefit me. Again, this is my experience after 4 years of Signal use. My photo library is just missing so many memories because of this.
teekert 2y ago
I find this a big + haha, no more stupid pics from friend groups in between my nice pictures. And if I want one in there it's two taps away.
- oezi 2y ago
  Could be easily solved by enabling saving to Photo Stream by Chat or Person.
OutOfHere 2y ago
Signal does have photo sharing, in HD quality too.
- oezi 2y ago
  Great, but the photos are stuck in a Chat and have no metadata.

ziofill 2y ago

I’ve been using and recommending Signal for years now. Recently I have learned that Signal relies on AWS. What are the implications from a security perspective?

from-nibly 2y ago
If signal cant see your messages on their own hardware what's the difference with aws?

kuschku 2y ago

Even Signal doesn't match the requirements set by this blog post. It too has frequently prioritized features and usability over security. For example: - Relying on SGX-based security for some of their features (e.g., gif search) while SGX has been thoroughly broken again and again - Using phone numbers as account ids, which allows nation states to capture just one phone and immediately unmask the IRL identities of all other group chat members and contacts Signal's authors have previously argued that it's better to give a some security to 100% of people than 100% of security to some people. Which is why they cooperated with WhatsApp on their encryption, or why they used phone numbers to ease adoption. Matrix for example is doing exactly the same, just with a slightly different focus. This narrow view of "Signal competitor" is more harmful than good.

pluto_modadic 2y ago
unmasking the other people in the group is news to me, you got a source for that? lol
- kuschku 2y ago
  Signal uses phone numbers as identifiers. Due to KYC laws phone numbers are closely bound to real-world identities. If the police is able to unlock one person's phone, even if that person used self-deleting messages, they immediately know the identity of every other person that person chatted with. Signal might as well have used your SSN as your account ID, that would have been just as private. Luckily Signal has finally started fixing that in the past few weeks.
ThePowerOfFuet 2y ago
>Using phone numbers as account ids, which allows nation states to capture just one phone and immediately unmask the IRL identities of all other group chat members and contacts Incorrect. Accounts can be set to not make the registration phone number either visible or findable by (or both) contacts.
- crtasm 2y ago