Just got a new phone and migrating Signal was a total disaster. The first thing I did was login to the new phone which is apparently the wrong thing to do because you lose all your old messages and there's no option to import after you login. You have to logout but there is no logout. Gotta uninstall and reinstall, or clear app data. Next I tried the account migration feature which requires using both phones simultaneously, hope you didn't erase your old phone yet. But it doesn't work anyway, it's just broken. So after failing at that several times, then I had to manually make a backup on the old phone, write down a 20 digit numeric code that's only displayed once on screen, transfer the backup file manually, type the code on the new phone, and then it logged me in but silently failed to import the backup. Had to uninstall again and did the exact same steps again and then it finally worked. What a travesty. Security shouldn't come with this kind of UX disaster.
Improving first impressions on Signal
21–30 of 100 posts
Re: Improving first impressions on Signal
#22Edit: I’m out of date for most of this. Way to go Signal team! See comments below my complainy post. Forcing me to recite my PIN every few weeks is one of the most irritating UX I’ve seen. I’m sure there’s some smart engineer explanation in terms of cryptography and being unable to recover it if lost. But just let me disable it if I’m okay losing my entire account if I forget it. Also last time I checked the binding…
Your last paragraph provides an insight I hadn't had; that is a serious problem. I personally appreciate the PIN repetition, as it encouraged me to use a code I had not used before, since I knew If be reminded to practice it now and then.
Re: Improving first impressions on Signal
#23Earlier quoted context omitted.
I think we may be talking about different PINs. I am not talking about the PIN you would have to enter when starting Signal, to get into Signal. I Googled a bit and found an approachable blog post from the time this all happened, here; https://blog.cryptographyengineering.com/2020/07/10/a-few-th... This has refreshed my memory of events. In short, Signal wanted to store what had been purely client-side information (c…
Fair. And I think I know what you're referring to. Yes, they do upload your contact list, but I believe there's a prompt at setup time that allows you to opt out? It might even be an OS-level prompt to the tune of "Signal would like to access your Contacts". Not 100% sure on that one as I haven't set up a brand new Signal installation in years. It's done to help their user acquisition. It uploads your contacts to mat…
> It's done to help their user acquisition. It uploads your contacts to match against other contact lists and let you know who's on Signal.
I may be wrong, but I think this functionality existed prior to the server-side state effort. I recall when people in my contact list joined Signal, I was notified.
However, these days I do not keep contacts in the phone contact list. It's too big and juicy a target.
> And besides, a 4-6 digit PIN would be a terribly insecure way to "encrypt" anything server-side :)
Very much so. That does seem odd.
Re: Improving first impressions on Signal
#24Is it strictly-true that anti-spam algorithms must be hidden to be effective? It would seem that initially, spammers would have the upper hand, but in the long run, coordinated and open effort against spammers has the potential to pay off. Furthermore, to have a closed algorithm that cuts off the ability for people to communicate opens the door to institutionalized censorship -- designating a political opponent's com…
I've fought spam in other contexts and found that to be true. A change stopped spam until spammers learned what the change was, which made them adapt. The adaption might not be perfect, but it would happen, so prolonging the blocked period was essential. If one can do something that's effective and that the spammers don't understand for months, that's great. If they can spam for days and then blocked for a longer per…
Do you think an eventually open style spam filter could work? One where the implemntation is released say 2 years after it was first written (including modifications)
Re: Improving first impressions on Signal
#25Just got a new phone and migrating Signal was a total disaster. The first thing I did was login to the new phone which is apparently the wrong thing to do because you lose all your old messages and there's no option to import after you login. You have to logout but there is no logout . Gotta uninstall and reinstall, or clear app data. Next I tried the account migration feature which requires using both phones simulta…
Sounds like you footgunned yourself. When starting Signal for the first time it gives the option to register OR migrate old account. There's no UI in the world that can totally protect users from themselves.
Re: Improving first impressions on Signal
#26Edit: I’m out of date for most of this. Way to go Signal team! See comments below my complainy post. Forcing me to recite my PIN every few weeks is one of the most irritating UX I’ve seen. I’m sure there’s some smart engineer explanation in terms of cryptography and being unable to recover it if lost. But just let me disable it if I’m okay losing my entire account if I forget it. Also last time I checked the binding…
To send an SMS to a signal contact, press and hold the send button then from the popup select `Insecure SMS`.
Re: Improving first impressions on Signal
#27These all seem like useful changes, but I've never received spam over Signal. I'm glad that solves a problem for someone.
What I have received were creepy messages from long-lost acquaintances who had been suddenly reminded, by virtue of my having installed the Signal app, that I existed and that I was attending a security-focused event at the time.
And last I heard, Signal was adamantly opposed to removing these notifications. That's a big problem, IMHO.
Re: Improving first impressions on Signal
#28Edit: I’m out of date for most of this. Way to go Signal team! See comments below my complainy post. Forcing me to recite my PIN every few weeks is one of the most irritating UX I’ve seen. I’m sure there’s some smart engineer explanation in terms of cryptography and being unable to recover it if lost. But just let me disable it if I’m okay losing my entire account if I forget it. Also last time I checked the binding…
Huh? You can disable the PIN reminder in the settings if you want to. Or is that not available everywhere? It's working for me on Android and Windows.
I've disabled it as I store my PIN in my password manager.
Re: Improving first impressions on Signal
#29Edit: I’m out of date for most of this. Way to go Signal team! See comments below my complainy post. Forcing me to recite my PIN every few weeks is one of the most irritating UX I’ve seen. I’m sure there’s some smart engineer explanation in terms of cryptography and being unable to recover it if lost. But just let me disable it if I’m okay losing my entire account if I forget it. Also last time I checked the binding…
To send an SMS to a signal contact, press and hold the send button then from the popup select `Insecure SMS`.
Cool!
Is there a way to say “always use SMS because this signal contact isn’t on signal anymore”
Re: Improving first impressions on Signal
#30Signal's message requests is a major selling point for me. I recently created a Signal account after having a bad experience in which someone used my phone number to harass me with SMS/calls (every time, from a different VOIP number). It's frustrating that, even in this era, there is no good way to filter out malicious actors from SMS/call. P.S. You can sign up with Signal via a VOIP number to avoid sharing your real…
I've not had this problem with iMessage really. Are you SURE its not possible to block out bad actors on messaging?