191–200 of 301 posts
Earlier quoted context omitted.
Backwards compatibility against a previous set of features isn't easy but it's certainly not impossible and graceful degradation is a thing.
It isn't clear if graceful degradation is possible in a security app.
I love Signal and use it as much as I can, but I'm thinking of switching to Matrix solely because the desktop client is pretty bad. It won't show me messages until it syncs everything (so I can't even see old messages while things sync), and, what's worse, it skips messages, and multi-device just doesn't work. My laptop just shows "Message could not be decrypted" until I delete everything and reset. I'm not sure why…
But they have stickers! Who needs good sync when you have stickers! Oh, and arbitrary emoji reactions! Seriously... I do not understand how they keep investing in this gold-plating when the plumbing keeps getting clogged up.
My 6 year old son just discovered the augmented-reality tricks in the LINE app (adding a mustache, hair, glasses, sound effects etc). He got my mother (68) to install it and now they use it pretty much for all their video conversations. This replaced FaceTime, despite FaceTime having better sound and picture quality (edit: and even some effects).
He's in the age (and COVID-19 environment) where he starts speaking to cousins and friends online. So I imagine LINE spreading pretty quickly in similar circles based on those features alone. That's the stuff that drives adoption, as silly as it might be.
That said, yes, the plumbing needs to be in working order, or no silly feature can cover over the leaks (or smell, if we're going with the metaphor).
Earlier quoted context omitted.
> Meanwhile, yes, Matrix took years to add encryption, but it works much better than Signal, even with quite a few small bugs. I'm not sure which Matrix client you use, but clients like Riot don't even let you opt out of sending read receipts unless you edit `/etc/riot/config.json` to enable experiments and then go into the settings to disable read receipts. Problems like this (and issues like this [0]) give me the i…
I'm a massive Matrix fan and have high hopes for it but in experiments we've done with activist and journalist partners we've found the Riot.im client often gets a bit complicated for people to use. I think the main issue people have is related to keys. As I techie I love the options but I find many don't like having all the options. Signal of course is a lot easier as it hides many of those issues in the UI/UX.
Earlier quoted context omitted.
Assuming you’re using Signal for organizing something the government doesn’t want you organizing, if one member of the group gets rubber-hosed into unlocking their phone, the govt instantly gets a list of verifiably correct names of people involved. In contrast, with a service that lets you use usernames that maneuver would reveal nothing but those usernames (which are as pseudonymous as it gets).
One of the other problems with using phone numbers, is that it provides an opening for adversaries. Now they know your phone number, which can be used for social-engineering attacks to attempt to bypass 2FA for any other online services tied to your phone number. Either for 2FA or for account-recovery/i-forgot-my-password functionality. 2FA by SMS is wrong and broken and nobody should use it, but they do. Adversaries…
Earlier quoted context omitted.
Does this help? https://signal.org/docs/
It seems to be about the clients rather than the server. A level deeper than "how signal works" and more "how signal is made" For example, I'd expect a "how signal works" article to explain why they even need when an account was registered and when it was last used. "this phone number is using signal" is still a pretty large metadata leak. Especially when state actors and probably a fair few non state actors can remo…
>Especially when state actors and probably a fair few non state actors can remotely compromise devices via the stuff in the baseband processor.
A more accurate phrasing would be "this phone number was used to activate signal". If you only care about messaging other Signal users, you only need to have a baseband connection exactly once, when you receive the text message to confirm the number. After that you can toss the sim card and put in a different number, or run without a sim card at all and just use WiFi.
You don't even need to have the sim card in the same phone you will use with Signal when you receive the confirmation text.
Earlier quoted context omitted.
What alternative would you recommend?
I'm surprised Briar isn't coming up more in these discussions. Maybe it's locked down too tight for everyday use, but for protesters and individuals at risk it seems ideal. I admit I could be missing something though, as I've not used it heavily.
This is why a messenger needs an e2e contacts sync, whether Moxie wants to be responsible for it or not.
I love Signal and use it as much as I can, but I'm thinking of switching to Matrix solely because the desktop client is pretty bad. It won't show me messages until it syncs everything (so I can't even see old messages while things sync), and, what's worse, it skips messages, and multi-device just doesn't work. My laptop just shows "Message could not be decrypted" until I delete everything and reset. I'm not sure why…
Check out its network traffic sometime.
Earlier quoted context omitted.
But they have stickers! Who needs good sync when you have stickers! Oh, and arbitrary emoji reactions! Seriously... I do not understand how they keep investing in this gold-plating when the plumbing keeps getting clogged up.
anecdote time: My 6 year old son just discovered the augmented-reality tricks in the LINE app (adding a mustache, hair, glasses, sound effects etc). He got my mother (68) to install it and now they use it pretty much for all their video conversations. This replaced FaceTime, despite FaceTime having better sound and picture quality (edit: and even some effects). He's in the age (and COVID-19 environment) where he star…