We can do better than Signal

It turns out that decentralization closes the door on top-down censorship, but at the same time, invites spam and abuse of the system for personal gain. It's very easy to do this in a decentralized model, and every single decentralized service suffers from this. IRC, Email, Mastodon, you name it. It's all bad.

This is the same for any piece of crypto. If you've been provided someone else's encryption keys, and they're not either from the person themselves, or from a trustworthy intermediary, then your channel could be getting intercepted.

It's a philosophical/conceptual problem with encryption, not one restricted to signal.

For the longest time, Signal wouldn’t work without Google Play Services, but Moxie (the founder of Open Whisper Systems and maintainer of Signal) finally fixed this in 2017. There was also a long time when Signal was only available on the Google Play Store.

Why do I make a big deal out of Google Play and Google Play Services? Well, some people might trust Google, the company. But up against nation states, it’s no contest - Google has ties to the NSA, has been served secret subpoenas, and is literally the world’s largest machine designed for harvesting and analyzing private information about their users. Here’s what Google Play Services actually is: a rootkit. Google Play Services lets Google do silent background updates on apps on your phone and give them any permission they want. Having Google Play Services on your phone means your phone is not secure.

Moxie, why haven’t you put Signal on F-Droid yet?

Truly secure systems do not require you to trust the service provider. This is the point of end-to-end encryption. But we have to trust that Moxie is running the server software he says he is. We have to trust that he isn’t writing down a list of people we’ve talked to, when, and how often. We have to trust not only that Moxie is trustworthy, but given that Open Whisper Systems is based in San Francisco we have to trust that he hasn’t received a national security letter, too (by the way, Signal doesn’t have a warrant canary). Moxie can tell us he doesn’t store these things, but he could. Truly secure systems don’t require trust.

One of the root causes for centralization is that we lost the ability to make our devices talk directly to each other.

Before the Internet, people could contact each other directly by just making phone calls, and the phone network was neutral, so any phone or any network could call any other (even internationally) provided they pay the fee. Same with SMS and MMS.

With the early Internet, every computer had an IP address and could send packets to any other one.

With the late Internet, because of NAT and unwillingness of ISPs to make progress on this issue, we've now lost that ability and now always require some kind of central coordination server for devices to be able to talk (through it).

There is no reason why Signal (or any other messenger) requires a central server if it wasn't for this. Provided you have the person in your contacts (by having their IP address + a crypto fingerprint for authenticity) they should be able to talk directly.

Until we solve this issue, decentralized alternatives (such as Matrix, Mastodon, and others) are just bad workarounds that will never catch on because people aren't willing (and shouldn't have to) host a server (or use a sometimes unreliable benevolent one or a paid one) when they've already got a smartphone and are paying their phone/Internet bill.

No, you cannot do better than Signal at the moment. You do not have people picking your service of choice en masse. A chat app is only useful if people you want to talk to are on it.