Was happy to play around with Delta Chat today. Very nice progress. That was until one of our friends tried to logon with Gmail on her iPhone. Too much hassle unfortunately.
We can do better than Signal
261–270 of 290 posts
Re: We can do better than Signal
#262I feel like Signal is held to a ridiculously high bar when it comes to anything. Is it perfect? No. But come on now; I see other threads on HN where people are debating/bashing their use of Intel SGX, really? Assuming you trust the client builds (or use a verified build) and verify the public key, all of these arguments go out the window with the exception of exposing your phone number. This situation seems like a pr…
> I feel like Signal is held to a ridiculously high bar when it comes to anything. Maybe I can help: I feel Signal is doing a lot right and if I need to send a message right now and be 99.999% sure nobody except the recipient can read it, Signal is my choice. My criticism is mainly directed not at Signal, but at the people trying to promote Signal by trying to trash every other messaging technology. The reason is tha…
I want none of this stuff in a messaging app, it's not a social media platform.
Re: We can do better than Signal
#263Earlier quoted context omitted.
> Moxie, why haven’t you put Signal on F-Droid yet? There's no security benefit in having Signal on F-Droid instead of using https://signal.org/android/apk/ . I don't think Signal would say much if F-Droid distributed this APK directly (instead of a recompiled version with a different signature). It's just complicated to set up, which is why (I think) nobody has done it. > But we have to trust that Moxie is running t…
The benefit of running Signal on F-Droid is its secure update mechanism. Do you really think a homebrewed self-update mechanism is superior to the battle tested F-Droid? Moxie has a complete stranglehold on the Signal system. You are completely at his mercy for all decisions affecting the platform See: https://github.com/LibreSignal/LibreSignal/issues/37#issueco... The solution is federation, like email has always be…
> Do you really think a homebrewed self-update mechanism is superior to the battle tested F-Droid?
I don't think it makes a practical difference.
> both users have to be online at the same time for their messages to be delivered to each other
Not only online but one has to be directly reachable, e.g. ping $IP works. With mobile connections it's rarely the case.
> on my own hardware where I am in control of the logs
That still means the users of your server trust you, you've just moved the problem. It only solves the problem for you as a user.
> This distributes the security risks across hundreds of operators in many countries with various data extradition laws.
I don't understand this argument: if a piece of (meta)data goes through one server and you think it's bad because this server can monitor this piece of data, then having multiple servers with various levels of accountability is arguably worse.
> those are all really convenient excuses for an argument which allows him to design systems which serve his own interests
You are still not discussing why his reasons are bad according to you, so it's hard for people that have found the blog post convincing to change their mind.
I'm also curious as to which interests you're referring to, especially when we're talking about a non-profit that develop FOSS software.
Re: We can do better than Signal
#264I wish Delta Chat would get more mentions during this period
It is nicely decentralised. Nice UI. Run your own server. Deserves more love!
Re: We can do better than Signal
#265Earlier quoted context omitted.
It's my understanding that the main concern about a compromised Signal server is that metadata of which phone numbers are registered as user IDs could be compromised. Basically the same threat model the Signal people themselves address when talking about court orders and subpoeanas received by their corporation for "customer" data.
That's not true afaik. Signal days that they don't store phone numbers beyond the initial setup/verification. See here: > Does Signal send my number to my contacts? Signal does not send your phone number to anyone unless you send them a message or make a call to them. The Signal service does not have any knowledge of your contacts. Data is all owned by your phone. Registration notifications are never transmitted by a…
> truncated cryptographically hashed phone numbers
These would be equivalent to phone numbers, for all intents and purposes. The number space is trivially small.
This kind of obscurity makes it unnecessarily hard to understand what the argument really is.
Re: We can do better than Signal
#266Earlier quoted context omitted.
Speaking as project lead for Matrix (and Element), I'm trying to understand the mixed feedback we've had this week, and somehow channel all the negativity into improving things. While some folks are clearly using it successfully and seem to like it, another bunch of people say "it was a huge pain in the butt to get E2EE working, and if it two software engineers struggled this much..." etc. When did this E2EE failure…
For me, this was a month or two ago. I don't remember exactly now, but my friend and I tried to verify each other, but one of us quit the device verification (with the five emojis) half-way through and uninstalled the app, so now there is a half-verified device that we can never remove. My icon with him always shows up red because of this device, and there's nothing we can do. UPDATE: I just checked now, there's a "m…
Another solution is for them to just delete that old device.
Settings -> Security & Privacy -> Check the box next to the old device -> Delete Session
Re: We can do better than Signal
#267For the longest time, Signal wouldn’t work without Google Play Services, but Moxie (the founder of Open Whisper Systems and maintainer of Signal) finally fixed this in 2017. There was also a long time when Signal was only available on the Google Play Store. Why do I make a big deal out of Google Play and Google Play Services? Well, some people might trust Google, the company. But up against nation states, it’s no con…
> Moxie, why haven’t you put Signal on F-Droid yet? There's no security benefit in having Signal on F-Droid instead of using https://signal.org/android/apk/ . I don't think Signal would say much if F-Droid distributed this APK directly (instead of a recompiled version with a different signature). It's just complicated to set up, which is why (I think) nobody has done it. > But we have to trust that Moxie is running t…
> There's no security benefit in having Signal on F-Droid instead of
I don't know about Signal specifically but there is absolutely security benefits to hosting apks on F-Droid instead of your own home page.
F-Droid supports reproducible builds, so you can actively check that their build infrastructure is not compromised.
Signal seems to support some kind of reproducible builds on their own. Why that has not been integrated into the F-Droid build process I don't know. It seems like a large enough application to warrant the work.
But I suspect no one has stepped up to do the work, and given that Moxie has been quite clear that Signal is not to be distributed on F-Droid, that seems not likely to change.
Re: We can do better than Signal
#268Earlier quoted context omitted.
For me, this was a month or two ago. I don't remember exactly now, but my friend and I tried to verify each other, but one of us quit the device verification (with the five emojis) half-way through and uninstalled the app, so now there is a half-verified device that we can never remove. My icon with him always shows up red because of this device, and there's nothing we can do. UPDATE: I just checked now, there's a "m…
Another solution is for them to just delete that old device. Settings -> Security & Privacy -> Check the box next to the old device -> Delete Session
That helps, thanks. We searched a lot but couldn't find it a few months ago, is it new? Or maybe it didn't exist on the web app?
Re: We can do better than Signal
#269Earlier quoted context omitted.
If they're transparent, why don't they expose their commits to server code to the public?
Huh? I googled "signal server" and got https://github.com/signalapp/Signal-Server
if you look at the changes, there havent been any updates since April 2020. Seems odd for it to have no changes in close to a year, esp after what we know happened last weekend ( when we know feature flags were added )
The forum has posts of people who cant even run their own instance of Signal.
So why arent they sharing what is happening server side
Re: We can do better than Signal
#270Earlier quoted context omitted.
I can share the bugs that happened to me. All of these happened in the last 6 months: - A message would get "pinned" to the bottom in Element. Basically, you could send new messages but a specific message would always look like it was the most recent message (even though it was not). This was a purely visual bug and the other party wouldn't have the issue. - Messages send/receive slowly compared to other services. It…
> - A message would get "pinned" to the bottom in Element. Basically, you could send new messages but a specific message would always look like it was the most recent message (even though it was not). This was a purely visual bug and the other party wouldn't have the issue. Is this in Element Android? I've had that issue happen there too, but only there.
I don't actually remember unfortunately, I haven't had it happen in a while. It's either the Linux client or the Android client though as those are the only two I use.