Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy is priceless, but Signal is expensive

signal.org

Post reply on HN
Print view View original

391–400 of 965 posts

Re: Privacy is priceless, but Signal is expensive

#391

Post by toast0 »

Analemma_ wrote: post #278
itslennysfault wrote: post #180

Earlier quoted context omitted.

If only someone would release a universal protocol that the app's native messaging apps could utilize to eliminate the need for these 3rd party messaging apps. Oh, right, it's called RCS and Apple refuses to support it.

Literally nobody wants RCS except Google and a handful of HN commenters. It’s so unwanted that Google had to scrap their original plan of making the carriers host the infrastructure and do it themselves, because the carriers didn’t give a shit. (And even Google doesn’t really have any love for RCS, they crawled back to it as a fallback plan with their tail between their legs when their own proprietary lock-in messagi…

> It’s so unwanted that Google had to scrap their original plan of making the carriers host the infrastructure and do it themselves, because the carriers didn’t give a shit.

To be fair, that wasn't Google's plan, that was the GSMA's plan. GSMA created the RCS spec, failed to get more than a handful of their members to use it, and kind of abandoned it to the wolves. For reasons I don't quite understand, Google decided it'd be a good idea to take it up, and then push it harder than any of their previous messaging services; but it's not like they came up with it.

Re: Privacy is priceless, but Signal is expensive

#392

Post by contact9879 »

greyface- wrote: post #317

An entirely peer-to-peer instant messaging network, which doesn't rely on a central authority, is technically possible. A $50M/yr burn rate to implement that authority as an act of charity is simply unsustainable. Why do we insist on continuing down this path? Attempts to decentralize or federate Signal are met with hostility. The Signal Foundation tells us that this is the only possible way; "the ecosystem is moving…

Because peer-to-peer messaging is not a solved issue. People want asynchronous conversations and not have to expose their location to everyone they talk to.

There are other platforms that are working on federated e2ee services (it's not easy. matrix was completely broken a year ago).

Re: Privacy is priceless, but Signal is expensive

#393

Post by autoexec »

Sol- wrote: post #371
ActorNightly wrote: post #49

Has anyone tried setting up their own Signal server? Be cool to do this, and then give all your friends the ip for truly private messaging. https://github.com/signalapp Seems like all their stuff is open source.

Offering self-hosted servers would probably just degrade the security guarantees of Signal if people misconfigure them. Doesn't seem to be worthwhile for the Signal foundation to run into this risk of undermining their own reputation for a niche user base who cares about self-hosting.

> Doesn't seem to be worthwhile for the Signal foundation to run into this risk of undermining their own reputation

It's a bit too late for that. They undermined their reputation when they started permanently keeping sensitive user data in the cloud (like a list of every person you contact), and then again when they refused to update their privacy policy which lies to users about their data collection practices, and then again when they killed off the ability to get both "secure" communications and unsecured SMS, and then again when they started adding weird cryptoshit nobody asked for. Signal seems to be telling people as loudly as they can not to use/trust them.

Re: Privacy is priceless, but Signal is expensive

#394

Post by BlueTemplar »

rglullis wrote: post #373
Canada wrote: post #88

Seriously consider setting up a recurring donation if you prefer Signal. They have delivered consistently over the years. I set the $20/month back when they introduced the option. I'm curious what the breakdown of donations is. I only have 1 contact with a $10/month and 1 with a $5/month badge. Of course there could be others not displaying the badge. Signal really needs 500,000 people giving $20/month and plus the r…

I fail to understand the point of supporting an organization that is completely against self-sovereignty like Signal is. Why would I want to pay someone to develop something that traps me into their platform and does not offer a way out?

Not completely ? Their server seems to be open source too now (with the exception of the spam filter) ?

Re: Privacy is priceless, but Signal is expensive

#395

Post by toast0 »

rezonant wrote: post #306
dexwiz wrote: post #221

Earlier quoted context omitted.

You can't send an sms yourself like you can an email. Instead of setting up a server, you have to work with a telco provider (an aggregator specifically). Any SMS service eventually hands off to one of these. Many SaaS SMS providers are just frontends for legacy telco services. They charge insane fees because they can, that is all there is to it. Sending mass email is still difficult. Its probably easier to pay a pro…

> Many SaaS SMS providers are just frontends for legacy telco services. I worked on an automated SMS marketing system back in the day so I have seen this in action, at scale. This would be stuff like "text LAKERS to 12345 for Lakers updates"- we didn't handle the Lakers but we did handle many sports teams. Though I wasn't privvy to the financial side, I got the sense that the per-text cost ended up being manageable a…

> Additionally, Twilio does not purchase short codes (ie 12345) which means its harder for the carriers to track bad behavior across their network. There is an initial cost (fairly high) to acquiring a short code, though you can also share short codes across customers in some cases. Acquiring a single short code and sending all messages from that short code would likely reduce costs.

Twilio offers short codes, but short codes are country specific, and the costs for sending to the US are low anyway < ~ $0.01/message for most services, lower with volume; IIRC, short code messaging costs were half, but then you've got some overseas destinations where it's $0.10/message and that's real money.

Re: Privacy is priceless, but Signal is expensive

#396

Post by hotnfresh »

slaw wrote: post #72
supriyo-biswas wrote: post #25

Earlier quoted context omitted.

> we can rent server infrastructure from a variety of providers like Amazon AWS, Google Compute Engine, Microsoft Azure Moving off cloud services to lower-cost provider like Hetzner, Vultr and DigitalOcean might provide a lot of cost savings. I also imagine they're using managed SMS services from one of these clouds, and moving off them to a combination of local SMS gateways in each country can also further reduce co…

Any idea what prevents Signal from using cheaper alternatives? Edit: I meant moving off cloud to Hetzner, Vultr, DigitalOcean.

DO, at least, has bad peering agreements that will cause you noticeable, unfixable (if you stay on DO…) persistent problems at large enough scale.

Re: Privacy is priceless, but Signal is expensive

#397

Post by NoGravitas »

jzb wrote: post #382

I'll probably donate, but I find it annoying that Signal only offers Linux packages for Debian-based distros. I've had headaches with the Flatpak. I would think that the Linux desktop audience - while not huge - would be the most interested in Signal. That is, might not be a lot of Linux users but percentage-wise I'd bet more Linux users are interested in Signal than macOS or Windows users. Even an AppImage would be…

The Flatpak works fine for me on Fedora, though of course it's an Electron app, and it periodically has to be re-connected if I don't use it much.

Re: Privacy is priceless, but Signal is expensive

#398

Post by Aachen »

ruffrey wrote: post #85

I would pay for a few signal features: 1. encrypted backups or backup integration of my chats, photos and videos. 2. business features (backup, directory integration, search) I have not used: 1. voice and video Incredible that SMS costs so much. I wonder if it's worth it because it _saves_ so much in spam and other sorts of fraud or bad behavior?

I have some good news: go into the settings and turn on encrypted backups. The clients also all come with a search function, even if it only matches against start-of-word (which includes URLs, so you can't search for domain names which regularly bothers me).

Directory integration, as in, importing a vcard with everyone's phone number into your device such that you can tap on anyone's name and message them on Signal if they've got Signal installed?

Re: Privacy is priceless, but Signal is expensive

#400

Post by godelski »

groby_b wrote: post #349
2OEH8eoCRo0 wrote: post #256

Earlier quoted context omitted.

Definitely reasonable but the ultra privacy-conscious/paranoid can't easily donate or pay privately.

Sure, but privacy isn't black or white. A donation to signal does not compromise the content of your messaging. So what you've leaked is the information that you have an interest in private conversations. This might be a problem in some countries, but I think it's fair to ask folks in affluent countries with working (sorta) democracies to shoulder that burden. I.e. you don't donate if there's elevated threat to your…

There's never enough talk like this and I'm not sure why. It's always about the threat model. In this respect I always like to think of it in terms of probability. Probabilities and likelihoods aren't just about capturing randomness like quantum fluctuations or rolling dice, they are fundamentally about capturing uncertainty. Your threat model is your conditions and you can only calculate likelihoods as you don't know everything. There are no guarantees of privacy or security. This is why I always hated the conversations around when Signal was discussing deleting messages and people were saying that it's useless because someone could have saved the message before you deleted them. But this is also standard practice in industry because they understand the probabilistic framework and that there's a good chance that you delete before they save. Framing privacy and security as binary/deterministic options doesn't just do a poor but "good enough approximation" of these but actually leads you to make decisions that would decrease your privacy and security!

It's like brute forcing, we just want something where we'd be surprised if someone could accomplish it within the lifetime of the universe though technically it is possible for them to get it on the very first try if they are very very lucky. Which is an extreme understatement. It's far more likely that you could walk up to a random door, put the wrong key in, have the door's lock fall out of place, and open it to find a bear, a methhead, and a Rabbi sitting around a table drinking tea, playing cards, and the Rabbi has a full house. I'll take my odds on 256 bit encryption.

Post reply on HN