Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal AMA on Reddit

reddit.com

Post reply on HN
Print view View original

51–60 of 84 posts

Re: Signal AMA on Reddit

#51

Post by kitsunesoba »

shafyy wrote: post #50

I'm a bit worried that the CEO is so vehemently against federation [0]: > It is unlikely that we will ever federate with any servers outside of our control again, it makes changes really difficult. I think as long as there is no federation there will always be the "benevolent dictator" situation, which often doesn't end up well in the long run. At the same time, I'm sure that I couldn't convince my non-tech friends t…

Aside from network effects, UI/UX is really king when it comes to getting people to switch messengers. It's why Telegram has managed to stake as large of a following as it has, despite its glaring flaws when compared to Signal, Matrix, etc.

I understand wanting to focus on security and privacy at the cost of all else, but if the goal is to get as many people on a reasonably safe messenger app as possible, UI/UX is unavoidably going to be a focal point — it can't just be made an afterthought, or as is the case with many FOSS projects disregarded almost entirely.

Re: Signal AMA on Reddit

#53

Post by oehtXRwMkIs »

kitsunesoba wrote: post #51
shafyy wrote: post #50

I'm a bit worried that the CEO is so vehemently against federation [0]: > It is unlikely that we will ever federate with any servers outside of our control again, it makes changes really difficult. I think as long as there is no federation there will always be the "benevolent dictator" situation, which often doesn't end up well in the long run. At the same time, I'm sure that I couldn't convince my non-tech friends t…

Aside from network effects, UI/UX is really king when it comes to getting people to switch messengers. It's why Telegram has managed to stake as large of a following as it has, despite its glaring flaws when compared to Signal, Matrix, etc. I understand wanting to focus on security and privacy at the cost of all else, but if the goal is to get as many people on a reasonably safe messenger app as possible, UI/UX is un…

I would argue that Element on android is really good in terms of UI/UX. But I think the desktop experience is definitely behind others, and I have no idea how the iOS client is like.

Re: Signal AMA on Reddit

#54

Post by anjbe »

raylad wrote: post #46

Is it documented (and provable) what happens when the Signal app is given access to Contacts and then verifies which of them is a Signal user? It seems that some information would be revealed in that process that could be mined to eventually de-anonymize people based on relationship networks (assuming nothing easier is possible). Does anyone here know if there's any reason not feel that is a serious vulnerability?

>Is it documented

Yes, it’s documented: https://signal.org/blog/private-contact-discovery/

>(and provable)

As the post says, their non‐SGX method requires you to trust the server: “This has meant that if you trust the Signal service to be running the published server source code, then the Signal service has no durable knowledge of a user’s social graph if it is hacked or subpoenaed.”

To eliminate that requirement, they developed an SGX‐based method: “Since the enclave attests to the software that’s running remotely, and since the remote server and OS have no visibility into the enclave, the service learns nothing about the contents of the client request. It’s almost as if the client is executing the query locally on the client device.”

Of course, there are plenty of attacks on SGX (I’m not enough of a cryptographer to know how practical they are to apply to Signal’s methods or not); but at some level you are going to have to trust servers you don’t control, whether your system is federated or centralized. I’m mostly willing to give Moxie the benefit of the doubt here.

Re: Signal AMA on Reddit

#55

Post by m-p-3 »

shafyy wrote: post #50

I'm a bit worried that the CEO is so vehemently against federation [0]: > It is unlikely that we will ever federate with any servers outside of our control again, it makes changes really difficult. I think as long as there is no federation there will always be the "benevolent dictator" situation, which often doesn't end up well in the long run. At the same time, I'm sure that I couldn't convince my non-tech friends t…

One reason which I chose Matrix over Signal, other than being forced fo tie my identify to a phone number and depend on a smartphone for receiving mesaages.

Re: Signal AMA on Reddit

#57

Post by anjbe »

bluefox wrote: post #49

Why do Signal releases contain an expiration time bomb? That is, why is the user forced to update in order to use the application, even if no critical security issues arose? The passage of time is not a good excuse for a mandatory update.

> That is, why is the user forced to update in order to use the application, even if no critical security issues arose?

Because they’re adding new features, both security improvements and user‐facing sugar.

Moxie’s thoughts on this are well‐known: he believes he can build a better and more secure messenger by keeping deployed clients as closely aligned as possible. Even if you disagree (and plenty of people disagree, as we see in almost every Signal comment thread), it’s at least a valid opinion to hold. https://signal.org/blog/the-ecosystem-is-moving/

Re: Signal AMA on Reddit

#58

Post by kitsunesoba »

oehtXRwMkIs wrote: post #53
kitsunesoba wrote: post #51

Earlier quoted context omitted.

Aside from network effects, UI/UX is really king when it comes to getting people to switch messengers. It's why Telegram has managed to stake as large of a following as it has, despite its glaring flaws when compared to Signal, Matrix, etc. I understand wanting to focus on security and privacy at the cost of all else, but if the goal is to get as many people on a reasonably safe messenger app as possible, UI/UX is un…

I would argue that Element on android is really good in terms of UI/UX. But I think the desktop experience is definitely behind others, and I have no idea how the iOS client is like.

I haven't used Element on iOS extensively, but in my limited experience it's "ok" but not stellar. It has a number of papercuts like the registration and login screens not hooking the password manager API and thus not offering password generation services, ability to save/restore from password manager, etc. On that front I think the iOS version of Signal is probably better.

Re: Signal AMA on Reddit

#59

Post by godelski »

shafyy wrote: post #50

I'm a bit worried that the CEO is so vehemently against federation [0]: > It is unlikely that we will ever federate with any servers outside of our control again, it makes changes really difficult. I think as long as there is no federation there will always be the "benevolent dictator" situation, which often doesn't end up well in the long run. At the same time, I'm sure that I couldn't convince my non-tech friends t…

Honest question, I'm not a distributed person. Why can't someone turn Signal federated? Wouldn't the centralized server just be a different server? Sure, you'd need to roll a custom app but plenty of people do that. I constantly see people here complaining about it not being federated, but the server is open sourced, so what's the issue?

Side note: isn't it good to be centralized while the app is quickly rolling out new features? Then a switch to federation would be better when all the features are enabled?

Re: Signal AMA on Reddit

#60

Post by adammenges »

soupson wrote: post #27

All, Signal is a 501c3 nonprofit. Your company probably matches donations. If they don't, they are eligible to be added to your company's portal. I encourage you to throw some of your wealth their way and take the extra step to get matching. This is important.

good point
Post reply on HN