Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We can do better than Signal

icyphox.sh

Post reply on HN
Print view View original

61–70 of 290 posts

Re: We can do better than Signal

#61

Post by justapassenger »

Signal will have very hard time competing as a product with WhatsApp.

Their main value proposal is that they aren’t backed by Facebook, but other than that, there’s no real difference to end user.

That’s enough for geeks, but not very compelling argument to break to mainstream. To break into such a highly competitive market, they need more unique features.

Or they can count on Facebook to keep on shooting themselves into foot, which is possible, but historically risky bet (no matter what HN crowd says, they continue to be extremely successful and know how to grow products).

Re: We can do better than Signal

#62

Post by icy »

unstatusthequo wrote: post #26

It’s hard enough getting random non tech friends and family to move to Signal. Going even further from mainstream means they will encounter usability issues and they will eventually revert back to WhatsApp. I don’t want any of this. And if “we can do better than Signal,” go make it then and get wide adoption instead of bitching in a blog post about how it’s not as good as some fringe products.

Is suggesting that the status quo could be improved so bad? I wasn't even "bitching", heck I use Signal too.

Re: We can do better than Signal

#63

Post by walrus01 »

ehutch79 wrote: post #36
walrus01 wrote: post #15

My main complaint about Signal is its reliance on SS7/PSTN and ordinary phone numbers to identify a user. In an era of SS7 hijacks and social-engineering of mobile phone network customer service reps into SIM-hijacking a target's phone service, by no means should we ever rely upon a phone number as a guaranteed method of identifying an end point device's identity. These are basically the same reasons why other servic…

Doesn't the protocol detect device changes?

It does, and it warns the other users chatting with the person whose device has changed, but given the tendency of non technical users to click "yes/accept/okay" buttons in the GUI to bypass any error messages that come up on their mobile phone screens, I question how much value it has.

Two experiences: Among highly technical users in my peer group, when somebody upgrades or replaces their phone, if we're chatting with somebody who has a new signal device private key, I'll chat with them a bit by voice to confirm it really is them using a new phone. We've had a number of discussions about how it's apparently impossible to manually move ones' own signal private keys from disk storage on an android device onto a new android device. This works among people I know closely and recognize the sound of their voice.

Among non technical users, they'll just click the equivalent of "okay" and continue chatting without even thinking about what the error message means.

Re: We can do better than Signal

#64

Post by Evidlo »

bronco21016 wrote: post #18

The issues highlighted by the author, about Signal, and indeed nearly any messenger app or platform, are societal issues that we keep trying to fix with technology. There are promising solutions to decentralizing and anonymizing but there remain to be any real tech solutions to the ultimate de-platforming issue. Signal is at risk of having their hosting or connection removed. What prevents the same thing from happeni…

> What prevents the same thing from happening to decentralized services?

Nothing, but at least knocking a server offline doesn't bring down the whole network, which is indeed "better than Signal" on this front.

Re: We can do better than Signal

#65

Post by StavrosK »

xrisk wrote: post #44
StavrosK wrote: post #30

Earlier quoted context omitted.

Because you can never be sure that the other person's server or connection (or your connection) aren't being MitMed.

Yes, but I can get all the parties I want to talk to on my own server (if the need arises). About your point the connection itself being MITMed, I don't exactly understand how an active attacker sitting on my connection would undermine the connection? Presumably I have a way to verify the identify of my server. Please do elaborate if I'm missing something. Regardless an interesting thought.

If you're cryptographically checking that the connection you have is to your own server, sure, but I don't know any program that does that sort of thing. I guess if you're using TLS as a transport, the client handles that (if you have a self-signed certificate that you've told the client to trust exclusively).

Re: We can do better than Signal

#66

Post by Klasiaster »

I wonder if it's possible with some tricks to build a message box on top of a regular DHT (distributed hash table) as commonly found in many P2P network implementations. There is no need to guarantee that the message is stored for a certain amount of time as long as the protocol knows whether the other party has received it or not: you can just put it into the DHT again as long as it's not received.

Re: We can do better than Signal

#67

Post by wyager »

lukevp wrote: post #42
CuriouslyC wrote: post #38

Earlier quoted context omitted.

The solution is simple. Make the decentralized systems social, with reputation.

How do you prevent bots giving each other reputation?

Some strategies:

Make reputation scores the result of some sort of eigendecomposition-based algorithm (similar to PageRank) where the initial state vector is based on the people you trust. That way, you’ll only give credence to a bot to whatever degree you (indirectly) trust the bot.

Implement Sybil resistance with a combination of verifiable cost and blacklisting. Make it cost real verifiable resources to create an identity (hashcash or Bitcoin burning or something) and then have a system for blacklisting fake IDs.

Re: We can do better than Signal

#68

Post by creata »

Ericson2314 wrote: post #13

As I wrote in https://news.ycombinator.com/item?id=25795575 - WhatsApp: Oh wait, SMS etc. is completely insecure - Signal: Oh wait, WhatsApp is structurally unable to be a force for privacy - Matrix: Oh wait, even benevolent centralization is an unnecessary risk It's not that worse is better, but the general public's imagination can only grow so fast. We need to coax people along. As such, I do think all 3 serve a pu…

Matrix is merely federated, right? Why is it unlikely that a situation like email or the Internet will emerge, where the network still ends up massively centralized because that's just more convenient?

Re: We can do better than Signal

#69

Post by tombert »

Ericson2314 wrote: post #13

As I wrote in https://news.ycombinator.com/item?id=25795575 - WhatsApp: Oh wait, SMS etc. is completely insecure - Signal: Oh wait, WhatsApp is structurally unable to be a force for privacy - Matrix: Oh wait, even benevolent centralization is an unnecessary risk It's not that worse is better, but the general public's imagination can only grow so fast. We need to coax people along. As such, I do think all 3 serve a pu…

One thing that I think will always give Signal and WhatsApp an edge over something like Matrix is that it's simply tied to a phone number. You don't "make an account" and have to memorize a password or anything, it just falls into place like any other texting app. The barrier to entry is about as close to frictionless as possible.

Re: We can do better than Signal

#70

Post by sahkopoyta »

colecut wrote: post #40
tailspin2019 wrote: post #23

Earlier quoted context omitted.

Care to educate those of us who are confused by this?

Can you name anything that should have been fixed in Signal Server since April?

Can you name anything that should have been fixed in Signal Server before April? Probably not, but this doesn't look very good https://github.com/signalapp/Signal-Server/graphs/code-frequ...
Post reply on HN