Long-time Signal user but I'm on the verge of moving I think. There are several UX shortcomings but the new PIN nag is a bridge too far. What are my options for alternatives? I imagine Telegram is the next best bet but very open to suggestions.
Signal app downloads spike as US protesters seek message encryption
51–60 of 367 posts
Re: Signal app downloads spike as US protesters seek message encryption
#52Earlier quoted context omitted.
How do you know that the binary you run actually corresponds to the source code you read? EDIT: and would you then also review every commit to make sure nothing bad gets introduced? No, at some point you have to place trust in the vendor, the developers, independent audits, etc.
You can build the source locally, then compare the MD5 hash value of your build to (1) the hash value they post publicly for their build and (2) the actual hash value of their build once you download it. Assuming all three match, you know that the binary matches the source. Someone who is more technically inclined can probably go into more detail on this.
MD5 is not safe for this use case. Assuming the provider is malicious, this is exactly the scenario where MD5 is broken (i.e. it is possible to make source code that compiles a certain way so that you can make another binary that has the same hash but is different. The bright side is the attack would have evidence as there would be certain patterns in the binary that could be detected if you knew how/where to look. That said, just use sha256)
Re: Signal app downloads spike as US protesters seek message encryption
#53Honest question for those in the know: If I wanted to run my own personal “analysis” to verify the security of Signal, where would I start? Is it even possible? Just curious if there was a way to “know” rather than “trust”.
The first step would probably involve getting a PhD in cryptography...
There's a lot more than just crypto. Its much more common for systems to fail in the supporting code then it is for the crypto to be wrong. So first step is probably learn reverse engineering and verify the crypto is being used correctly.
Then after that get a phd in cryptography.
Re: Signal app downloads spike as US protesters seek message encryption
#54One has to wonder about behind the scenes heuristics as it pertains to taking a chance distributing a backdoored version sideloaded into the App Stores. One also wonders about whether the encryption or app are possibly compromised generally (even if the source is vetted and distributions are verified) Perhaps most of interest though would be how many phones are owned otherwise, to give access to the protester Signal…
Signal does a pretty good job at minimizing the metadata it has access to. For example, the app can tell you who of your contacts has Signal installed but the Signal service itself never gets to see your contacts ( https://signal.org/blog/private-contact-discovery/ ).
Signal absolutely could do better in minimizing metadata by simply not requiring a phone number. Despite this obvious, huge, and dangerous shortcoming, I have never seen a single explanation of why Signal needs a phone number for signup.
Re: Signal app downloads spike as US protesters seek message encryption
#55Long-time Signal user but I'm on the verge of moving I think. There are several UX shortcomings but the new PIN nag is a bridge too far. What are my options for alternatives? I imagine Telegram is the next best bet but very open to suggestions.
oof the pin nag is brutal, i hear that. as someone who doesn't back up or transfer their message is completely unnecessary to me to even have it.
Re: Signal app downloads spike as US protesters seek message encryption
#56Earlier quoted context omitted.
Signal does a pretty good job at minimizing the metadata it has access to. For example, the app can tell you who of your contacts has Signal installed but the Signal service itself never gets to see your contacts ( https://signal.org/blog/private-contact-discovery/ ).
Signal absolutely could do better in minimizing metadata by simply not requiring a phone number. Despite this obvious, huge, and dangerous shortcoming, I have never seen a single explanation of why Signal needs a phone number for signup.
They give an explanation literally every single time this subject is brought up, but of course on the Internet there's someone who against all possible odds manages to completely ignore years and years of the reasoning being linked to or given by a person at Signal in every single possible thread on Signal possible anywhere on the Internet, but what can you do?
Re: Signal app downloads spike as US protesters seek message encryption
#57Earlier quoted context omitted.
Signal does a pretty good job at minimizing the metadata it has access to. For example, the app can tell you who of your contacts has Signal installed but the Signal service itself never gets to see your contacts ( https://signal.org/blog/private-contact-discovery/ ).
Signal absolutely could do better in minimizing metadata by simply not requiring a phone number. Despite this obvious, huge, and dangerous shortcoming, I have never seen a single explanation of why Signal needs a phone number for signup.
That feature is coming and should be released shortly according to the team.
Re: Signal app downloads spike as US protesters seek message encryption
#58Earlier quoted context omitted.
I would ditch WhatsApp in a heartbeat if Signal had a browser client.
In my opinion Desktop Clients > Browser Clients when it comes to messengers. If you have more than ten tabs open it is annoying to always have to switch tabs or break out a window. Having a desktop application that remembers where you want to save stuff people send you is a plus too.
Just make a new browser profile for your browser client. It will have its own window, and different profiles prevent windows of the same browser from being collapsed onto each other on some platforms.
Re: Signal app downloads spike as US protesters seek message encryption
#59Long-time Signal user but I'm on the verge of moving I think. There are several UX shortcomings but the new PIN nag is a bridge too far. What are my options for alternatives? I imagine Telegram is the next best bet but very open to suggestions.
Settings -> privacy -> Pin Reminders
You can disable them there.
Re: Signal app downloads spike as US protesters seek message encryption
#60I hope one day apps like Signal will be the default for everyone , not just protesters in a time of crisis.
will only happen if phone manufactures ship them by default rather than the unsecure by default ones they ship atm. Sounds crazy when I say it outloud...
WhatsApp isn't installed by default AFAIK, but it is one of the first apps installed by millions, if not billions, on their phones.
In Korea, Taiwan and Japan, LINE became the de facto IM. In China, WeChat. But ain't sure if these are usually/always preinstalled in those markets.
Cheers.