10 ms·
Molly: An Improved Signal App
- worik 11mo agoWhat are the advantages of this?
- Mindless2112 11mo agoIt supports linking two Android devices.
- cowmix 11mo agoThis is huge. There's been 3rd party Signal library for this for years -- and for some reason I can't determine, the developers have opted NOT to do this.
- patchtopic 11mo agothis is why molly.im was a lifesaver for me.. trying to move a family member from VIBER to SIGNAL and ran into the annoying roadblock of not being able to link an Android tablet to an Android phone like Viber can - but molly does it fine.
- ahazred8ta 11mo agoIf you use Signal on your Android phone, can you link with Molly on another Android device (tablet) without Signal complaining?
- ThatPlayer 11mo agoI just tried it on a 2nd phone and it seems to work.
- gitaarik 11mo agoI got logged out of Signal after setting up Molly
- gitaarik 11mo agoNow reading this on the GitHub page: "If you wish to use the same phone number for both Molly and Signal, you must register Molly as a linked device. Registering the same number independently on both apps will result in only the most recently registered app staying active, while the other will go offline."
- ThatPlayer 11mo agoYeah, pretty sure that's what me and the other comment meant. Linked device, like using Signal on Desktop. Or Signal on iPad. Linking wasn't available on Signal for Android for some reason. Specifically I'm using Signal as the main device, with Molly as the linked device on 2nd phone.
- amelius 11mo ago> Protects database What database? This page is clearly written for developers that are already familiar with it. From this I can already predict this project is going nowhere.
- anonym29 11mo ago>What database? The local database used by Signal to organize every message, every contact, every profile photo, every attachment, every group, basically every dynamic piece of data you interact with in the app. Signal is basically a UI layer for a database. The in-transit encryption is genuinely good enough to be textbook study material for cryptographers, but the at-rest encryption became a joke the moment they stopped using your pin to encrypt the local DB and requiring it to open the app. As someone who's been enthusiastic about Signal since it was TextSecure and RedPhone, the changes made over the years to broaden the userbase have been really exciting from an adoption perspective, and really depressing from a security perspective. TL;DR of Molly is that it fixes/improves several of those security regressions (and adds new security features, like wiping RAM on db lock) while maintaining transparent compatibility with the official servers, and accordingly, other people using the regular Signal client.
- chc4 11mo agoSignal is an end-to-end encrypted messaging app. People continue to breathlessly mentioning the lack of database encryption as a problem, but that never made it a real security issue: its job is not, and has never been, dissuading an attacker who has local access to one of the ends, especially because that is an incoherent security boundary (just like the people who were very upset about Signal using the system keyboard which is potentially backdoored - if your phone is compromised, of course someone will be be able to read your Signal messages).
- franga2000 11mo agoDatabase encryption isn't comparable to the keyboard drama. Protecting against malware in your keyboard can be done by using a different meyboard and is of course out of scope. But if my phone gets taken and an exploit is used to get root access on it, I don't want the messages to be readable and there's nothing I can do about it. It's not like I can just use a different storage backend. It's also a very simple solution - just let me set an encryption password. It's not an open-ended problem like protecting from malware running on the device when you're using it.
- chipheat 11mo agoSeems interesting, but are there any screenshots?
- deleted 11mo ago[deleted]
- contact9879 11mo agoit looks just like signal with a purple theme
- g-mork 11mo agoExtra privacy features and named after UK slang for MDMA, hrm.
- sumuyuda 11mo agoMolly is the American slang, Mandy is the UK slang for MDMA.
- landr0id 11mo ago> Contains no proprietary blobs, unlike Signal What "proprietary blobs" does Signal have? I'll also just add: it's probably not a good idea to use any modifications to an E2EE messenger unless you are comfortable with those privacy/security guarantees possibly being violated by the 3rd party code. The only exception to this would be if I really trusted the goals of the 3rd party, like Graphene.
- anonym29 11mo agoFirebase, GMS (Google Mobile Services). The Alphabet Corporation is part of many security and privacy conscious users' threat model, and these users aren't generally thrilled about leaking even limited message metadata like timing to their adversary, particularly when that adversary is known to cooperate with global passive adversaries. There are actually two builds of Molly: Molly and Molly-FOSS. IIRC Molly uses regular Firebase, which can be faster and more reliable but comes with the above tradeoffs, while Molly-FOSS uses UnifiedPush. Your point about exercising caution with forks of encrypted messaging apps is a great rule of thumb, and in general, social proof should NOT substitute for competent software security specialists reading and evaluating source code, but given you seem to trust GrapheneOS, it's worth noting that they've formally endorsed Molly: https://xcancel.com/GrapheneOS/status/1769277147569443309 https://xcancel.com/GrapheneOS/status/1769277147569443309
- landr0id 11mo ago> Your point about exercising caution with forks of encrypted messaging apps is a great rule of thumb, and in general, social proof should NOT substitute for competent software security specialists reading and evaluating source code Also a great point :) And thank you for the reference.
- t0bia_s 11mo agoUnifiedPush not works if you not use Molly exclusively on one device. So of you sync between Signal on Win desktop and Android device, your battery drain faster.
- grishka 11mo ago
- jdironman 11mo agoWhat about the server portion? that's the thing I would like to have forked / open source.
- some_furry 11mo agoGood news! https://github.com/signalapp/Signal-Server https://github.com/signalapp/Signal-Server
- einpoklum 11mo agoBut is there federation between instances of this and the official signal servers?
- tptacek 11mo agoThere will likely never be federation between Signal's official servers and any other servers. Signal introduces privacy features semiregularly; we all saw with Matrix how difficult that is in a highly-federated environment.
- loeg 11mo agoWell, obviously not. Official Signal does not support federation.
- godelski 11mo agoNo. But iirc Molly can connect to a federated version. You just have to pick. It's one or the other
- slurrpurr 11mo agoWhat is the point of this? Just use the regular signal app. It may be more safe, but are the developers trustworthy enough?
- Tepix 11mo agoIt has various improvements and you can also use your private signal server. I believe it also lets you backup your data! How about that for digital sovereignty.
- slurrpurr 11mo agoSignal also lets you backup your data, for a small subscription
- Tepix 11mo agoNo, it won't let me backup my data. It lets them backup my data and I still cannot access it outside of the Signal app.
- dtj1123 11mo agoWasn't aware you could run your own signal server. How do you go about setting one up?
- wakawaka28 11mo agoAre Signal developers trustworthy enough? What about this push for "cloud backups"? There are other flaws in Signal too like being able to monitor people's phone usage and stuff through the notification system. I can't find it now but Signal and WeChat have the same issues, and both received a disclosure. Only WeChat did anything about it. Sad... Edit: Found it! "Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers" https://arxiv.org/abs/2411.11194 https://arxiv.org/abs/2411.11194
- slurrpurr 11mo ago[dead]
- Jeff-Collins 11mo ago[dead]
- issafram 11mo agoSays it's on F-Droid and it isn't. Search turns up no results
- TheChaplain 11mo agoTry scanning the QR-code. It works.
- gitaarik 11mo agoIt's in a third party repo that you need to add first
- deleted 11mo ago[deleted]
- deleted 11mo ago[deleted]
- throawayonthe 11mo agoi use it only because it happens to have a convenient 'supply trust chain' on GrapheneOS: (built-in) App Store -> Accrescent[0] -> Molly (seems to ship the 'FOSS' version) i don't use any of the enhancements, but it does receive notifications over the websocket it keeps open in the background vs only waking up on an FCM push notification like the regular app i wonder if the supply chain risk of having a second entity (that signs the apks!) involved is really worth it to anyone... hope signal can be published on Accrescent or similar someday :p [0] https://accrescent.app/ https://accrescent.app/
- crtasm 11mo agocan you install fdroid from the graphene store? signal is available in there: https://news.ycombinator.com/item?id=46082592 https://news.ycombinator.com/item?id=46082592
- foresto 11mo agoTo be clear, Signal is not available from F-Droid. The above link is about a fourth party publishing a Signal build in an f-droid-compatible repository.
- LtWorf 11mo agof-droid ships libre software only. 3rd party repositories ship whatever.
- throawayonthe 11mo agoNo, and I don't want to rely on f-droid for anything important due to their shoddy security practices (+ as a sibling comment says there's no official signal binaries on fdroid) For apps i do install from f-droid repos (official or otherwise) i prefer https://github.com/Droid-ify/client https://github.com/Droid-ify/client
- OneDeuxTriSeiGo 11mo ago> vs only waking up on an FCM push notification like the regular app FWIW you can actually do the FOSS version of this now with UnifiedPush support (rolled out in Molly a while back). It's a massive saver on battery life but it does require that you have a server set up to forward notifications to your unifiedpush distributor.
- mid-kid 11mo agoThis app's killer feature for me is that it's actually available on F-Droid, unlike its upstream. Happy user for many years now, thanks for the support!
- EffrafaxOfWug 11mo agoThere is also a signal build in the fdroid repo of the Guardian Project
- crtasm 11mo agowhich is easily enabled in f-droid: settings > repositories > toggle it on
- g-b-r 11mo ago"fdroid repos" have little to do with what people consider F-Droid, they can host any whatsoever binary. In fact, that's not a build by the Guardian Project, but (when I tried) a redistribution of Signal's https://github.com/signalapp/Signal-Android/releases https://github.com/signalapp/Signal-Android/releases builds. I'm not sure why they're doing it; anyhow, I'd at least avoid doing the initial installation through that repo, you're trusting an additional party for no gain that I could think of (updates are ok because the signature needs to match the one of the installed version).
- DANmode 11mo agoDidn’t know this was in there, thanks!
- deleted 11mo ago[deleted]
- marssaxman 11mo agoGood to know - that would make my life a little easier.
- godelski 11mo agoAPKs are available btw https://signal.org/android/apk/ https://signal.org/android/apk/
- immibis 11mo agoCan't wait to see how the lawsuit goes. Moxie is infamously protective of Signal.
- jsiepkes 11mo agoMoxie hasn't been affiliated with Signal for years. He stepped back years ago.
- Tepix 11mo agoThe Signal Android app is AGPL licensed. What should the lawsuit be about?
- singpolyma3 11mo agoSignal used to threaten people for trademark infringement because the word "signal" was in the protocol on the wire. I think they've relaxed this quite a bit more recently
- gkbrk 11mo agoOracle, Nintendo and Apple have all tried this "copyrighted text / logo / poem" thing, never works out for them. For interoperability you're allowed to replicate those parts.
- sneak 11mo agoThere is nothing legally stopping people from forking the signal app and distributing it (even configured to talk to the official signal.org servers) so long as they don’t use the Signal trademarks. Also, as others pointed out, Moxie isn’t part of Signal any longer and hasn’t been for a while.
- IshKebab 11mo agohttps://github.com/mollyim/mollyim-android/blob/285650e38613a91d3ddea09cc010f8c7d8fc09b5/app/src/main/java/org/thoughtcrime/securesms/service/WipeMemoryService.java https://github.com/mollyim/mollyim-android/blob/285650e38613... I'm pretty unconvinced that this is a sane or useful thing to do.
- saghm 11mo agoIs there a specific part you're referring to? For those of us who don't read or write Java frequently, it's not clear whether it's worth it to spend time reading the code without at least having some sense of whether you might be making a compelling point or not.
- wakawaka28 11mo agoYou need to be more specific. Lots of security-conscious apps wipe their memory. Memory contains, among other things, the decrypted text and private keys for the app. RAM is known to hold data longer than you'd want, and it can be swapped out onto persistent storage like the internal SSD. If you don't know that wiping memory is a basic and common feature for apps like this, then you're not qualified to have an opinion. Now if you think wiping the memory is ineffective, inefficient, or superceded by a bigger issue, then we might have something to talk about.
- k_bx 11mo ago> multi-device Can someone explain, is this different from adding (up to 5) devices to your Signal account? Are these devices all "primary" or something?
- jeltz 11mo agoSignal's official Android app does not support being linked, only the iOS and desktop apps support that. This is why I use Molly. I would ideally want to not have one device being the master and the rest linked to it (e.g. Element can do that for Matrix) but that might be a too big change. And as far as I know Molly does not try to solve that.
- automathematics 11mo agoI just saw a blog post they’re working on this in the official app, though! Finally. Fingers crossed.
- trizuz 11mo ago[dead]
- ahazred8ta 11mo agoThere's a deliberate nit in Signal that you can't have it on both an Android phone and a no-sim Android tablet; both take turns trying to seize the role. Apparently Molly can handle both.
- jeltz 11mo agoYeah, that is why I started using Molly.
- qmr 11mo agoAre you sure about that? I used both desktop and android with no issues.
- 11mo ago
- n3dm 11mo agoI've used Molly for over a year. Overnight it lost the device registration and will not contact the servers to re-register. The backup feature also does not work which left me dead in the water for several days with no fix. I switched back to signal and had to start a new database. It was a disaster. YMMV
- jeltz 11mo agoSounds pretty much like my experience with the official Signal app. It is a mess too and I only use Signal/Molly because I have friends who use it. But sadly the competitors are as bad, just in different ways. Why has nobody yet managed to build a good IM client? It does not seem like we have come far from what we had back in the Pidgin days.
- stackghost 11mo agoBeeper is pretty good. I daily drive it on multiple protocols.
- geoah 11mo agoI love beeper and have been using it for a very long time at this point, but I wouldn’t go as far as calling it a good client. Whatsapp mentions don’t work (just show the name of the mention to the other users), and polls or albums don’t work. Messenger disconnects every couple of days at this point. Pasting links won’t always expand. Attachments are always hit or miss. So many small other things. Still love it.
- prmoustache 11mo agoconversations (xmpp) and deltachat work pretty well in my experience.
- fao_ 11mo agoConversations has an issue where the main tool for reading a backup on a computer (ceb2txt (so, say, I can properly and correctly archive a text dump archive of a person I loved who died)), will not work for me. I filed a support request and there's been no movement on it whatsoever and it genuinely seems like nobody gives a shit. Restoring a backup even with all the images and media files in the correct place with the correct filenames will then refuse to show any filenames. This is par for the course with chat backups, though. Messenger - Bad - No way to save chat responses of people you have talked to. This means you only ever have one side of a conversation, making it meaningless. Twitter DMs - Bad - See Messenger. Jami - Ehhhh - Saves a git local repository of messages. The only problem is message syncing is effing abysmal. Dino (XMPP) - Bad - Does not allow backing anything up, this is "intentional". Depending on which protocol you use, as soon as you move to another device all the messages you _had_ are retroactively converted to Cannot Decrypt. They're my effing messages! Discord - Good - Discord History Tracker (tedious to use but slurps everything up into a sqlite3 database that is itself, an official archival format) WhatsApp - Good - Dumps a text record + files/images/etc. onto the phone's filesystem. This is reasonably easy to archive. Signal - Mediocre - If you have an old Signal backup from 2018? That you could only transfer off your phone by deleting old messages? lmao you're effed. Load up a version from ten years ago, gradually update it and then maybe, MAYBE you can extract the sqlite3 archive? These days you have a .signalbackup or whatever which is an encrypted archive, and I assume that there's a tool to decrypt it, but uhhhhhh. Last I tried to use it it required way more RAM than I had accessible.
- analogpixel 11mo agoDoes it lock me out of the app like signal if I don't update the app every few weeks? I'm looking for an app that never needs to be updated; Oh, I guess that is email.
- some_furry 11mo agoEnjoy getting pwned by zero-click exploits that have been widely patched elsewhere and disclosed publicly, I guess?
- analogpixel 11mo agoweird, I have never been pwned via email which has been updated 0 times in the last 20 years. I guess Signal is just so poorly made it needs to be constantly re-written every 2 weeks.
- aeturnum 11mo agoEmail has been updated many times in the last 20 years. All of the major sender authentication protocols (SPF, DKIM, DMARC) were created and deployed over the last 20 years. Email is also famously insecure and lacking a standard way of managing encryption - so the reason you never see updates is because the features signal is changing do not exist in email at all.
- upofadown 11mo agoSPF, DKIM, DMARC are all about server reputation. They don't count as any sort of update to email and don't affect the protocol. These days regular non E2EE email is as secure as any other messaging protocol that relies on trusted servers. Since it is federated over multiple servers it is better than systems with just one server. You can choose who to trust and can even host it yourself. Compare with Signal where there is only one allowed server entity and hardly anyone verifies identities making man in the middle attacks trivial.
- 11mo ago
- raphman 11mo agoThe Whisperfish [1] project (a Signal messenger for Sailfish OS) maintains an independent Signal client library written in Rust [2]. It works quite well - unless Signal decides to change their protocols or kick non-standard clients. [1] https://gitlab.com/whisperfish/whisperfish https://gitlab.com/whisperfish/whisperfish [2] https://github.com/whisperfish/presage https://github.com/whisperfish/presage
- hiq 11mo agoTo be clear this library depends on libsignal.
- NewJazz 11mo agoWhisperfish appears to be an app, not a library.
- raphman 11mo agohiq's comment was not about Whisperfish but about the presage library. My comment can be read as "Whisperfish wrote their own implementation of the signal protocol" - which is wrong. (Sorry, can't edit it anymore) With presage, Whisperfish has a high-level Rust library that wraps the official libsignal libraries (which are also written in Rust) and makes it much easier to write clients. The official Signal repo only contains Java/Typescript/Swift wrappers. As presage is rather obscure, I thought that some HN readers might appreciate the link.
- preisschild 11mo agoI'd just wish Molly had a live-tracking feature, similar to Telegram-FOSS. But not sure if even the upstream Signal client has this.
- some_furry 11mo agoWhy would privacy apps have this feature?
- attila-lendvai 11mo agoto share your location with trusted people when e.g. you are in a dangerous situation. or to set up a timed SOS signal if you don't disarm it within a given deadline.
- preisschild 11mo agoTo make it easy to meet friends/family in crowded places Its not permanent, you just enable it for a few minutes until you find each other
- tamimio 11mo agoSo, you still need a phone number? It doesn’t mention anywhere that’s not a requirement
- Y-bar 11mo agoAn iOS version would be lovely in the future!
- seany 11mo agoNow we just need to drop the phone number requirements and signal would be "done" for all practical purposes
- wakawaka28 11mo agoPhone numbers aren't required now. But there are flaws in Signal. Your phone usage can be tracked in high resolution through constant pinging of malformed status messages. I can't find the paper right now but researchers found that they could track their own data about when the phone was on, unlocked, and had Signal on the screen. That can be correlated between users, to see who is talking to who. It can be used to try to ambush you while the phone is unlocked. You don't even have to have a connection to the spies, if I remember right. Signal devs have done nothing about this issue since being notified like a year ago. Edit: Found it! "Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers" https://arxiv.org/abs/2411.11194 https://arxiv.org/abs/2411.11194
- toastal 11mo ago> Phone numbers aren't required now. Signal still requires a phone number for registration.
- karlzt 11mo agoUnfortunately...
- singpolyma3 11mo agoThey also require running the app on a "real phone" for registration. Most emulators put you in captcha hell
- wakawaka28 11mo agoDamn, what a shame... Another vote for Session, I guess. Idk what flaws that one has but it seems to be the leading alternative to Signal.
- sabjut 11mo agoMy main grievances with the Signal app are mainly centered around UI and UX, and features. Without trying to be mean, I think it's plain ugly and clunky. Features like live location or persistent multi-device messages etc will probably never be implemented with the current strategy of Signal. The fact that this "improved" version does not show a single screenshot of the UI on their own website, signals to me (pun intended) that this app will address none of my wishes.
- elaus 11mo agoI searched so long for a single screenshot, looking at the app stores (in my browser) and Github with no success. It really is weird not to show a single screenshot when the 4th listed feature is design ("Material You | Extra theme that follows your device palette").
- gitaarik 11mo agoJust installed it, it looks exactly the same, just a bit more purple theme
- panzi 11mo agoReally? Signal does everything I want from a messaging app. I can't imagine what could be better about its GUI. But I'm no GUI designer.
- hdb385 11mo ago[dead]
- vitorgrs 11mo agoCame here to comment exactly this. Even opened github expecting to see something...
- c249709 11mo agoplease include a screenshot of your app somewhere on your website or repo. why would I download an app if I don't even know what it looks like?
- singpolyma3 11mo agoIt looks like signal
- kyledrake 11mo agoOne thing that would be really nice from a new user perspective would be to have some screenshots so people can visually see the interface. Just giving some "get new users" feedback, not criticizing at all.
- VladVladikoff 11mo ago$50 says this is some nation state trying to sow seeds of discord into the Signal user base. Signal is actually becoming so well adopted most of my friends are on it now. Trying to convince them all to use yet another app is going to be pretty tough, especially since there isn’t really any decent evidence that Signal is insecure.
- o999 11mo agoIt is a Signal client that uses same servers (i.e Users of Molly and Signal's official app can message and call each othera normally).
- toastal 11mo agoWhy should we be trusting this centralized service? I regret getting my family onto Signal as I would love to get there somewhere where we control our data & aren’t reliant on US-based service. When you look at the EU’s Chat Control law that’s trying to be pushed, the easiest target is going to be big, centralized services in jurisdictions friendly to the EU—it’s gonna be real hard doing this with a decentralized protocol. Signal deserves just as much criticism as any other thing operating out of California.
- DANmode 11mo agoBecause they’re multi-region AWS! /s
- seanieb 11mo ago- Signal is built in such a way that you do not need to trust the server. They’ve invented several novel encryption protocols beyond the messaging protocol that protects group membership and privacy. - they’re open source and people like me regularly read parts of their code and in some cases use their code elsewhere. Also several undergraduates and PhD’s have written research papers on the signal protocol. It’s also the subject of a lot of security research (there was a good talk at defcon this year that found some minor privacy issues with signal notifications) - no one has built a decentralized e2ee messaging app that’s actually secure and has privacy anything like the bar Signal sets. Matrix are getting close, they’ve recently made some encouraging changes, but it will take some time to verify. - Moxie the founder of Signal gave a talk about the challenges of building something like signal in a decentralized environment - https://youtu.be/1W5fuqySBnE https://youtu.be/1W5fuqySBnE - Signal is a nonprofit. They have stated repeatedly they will shutdown the app in regions or countries that make backdoors required by law.
- alexnewman 11mo agoI’ve never trusted signal. Signal desktop does not seem reproducible . It’s not clear to me how its infrastructure is deployed. The servers buffer messages to a large degree
- qmr 11mo agoThat's great news but I just switched to iOS.
- supareya 11mo ago[flagged]
- throwawayk7h 11mo agoDoes it add back the killer feature of SMS fallback? If not, I'll stick with Matrix. It's got privacy at least as good as signal, with Discord's UX.
- quickslowdown 11mo agoWhat client app are you using for Matrix? I really love the idea of switching over to it, or something similar, after Discord's IPO. We tried Revolt, which is now apparently called Stoat Chat, but the 2 killer features with Discord are its screen sharing & noise cancelling. Some of the screen sharing "extras" I could do without, but using Element we found that background noise cancelling is awful. You can hear every seat readjustment, things in other rooms in the person's background, loud breathing, people eating...it's awful.
- throwaway19343 11mo agoNo, Matrix privacy is in no way comparable with signal.
- t3estabc 11mo ago[dead]
- shellpipe 11mo agothis is great. having a few screenshots would be sweet.
- SomeHacker44 11mo agoAndroid Signal does not support being a companion tablet app to a primary phone Signal. So you have to use Molly if you want to have Signal on your Android tablet. It has been reliable for me in that role since the Pixel Tab came out and I switched from an iPad.
- max_ 11mo agoThe Signal discourages the use of Molly.
- throwaway19343 11mo agoone more reason to use Molly
- ewenquim 11mo agoI don't want a new chat app, I want an unified protocol and bring my own client
- Zambyte 11mo agoThere is no way to use the Signal app on a device without a camera (USB cameras are even explicitly blocked!), and sync it with another computer. I use a Daylight computer as my primary mobile machine, which does not have a camera. The Molly app is the only way I am able to use Signal on multiple devices.
- pavlov 11mo agoThe name immediately makes me think of 1990s raves, since it’s a nickname for ecstasy (the drug). I guess that’s a generational thing.
- tdrz 11mo agoThe fact that Signal gets bad publicity or "improved" alternatives pop up tells me that they are a real threat to the mainstream apps.