What are your views about VoIP with ZRTP?
That's unrelated (off-topic) to Signal and what the blog post discusses, isn't it?
Why I won't recommend Signal anymore
11–20 of 350 posts
Re: Why I won't recommend Signal anymore
#12I am also very unhappy with the direction Signal has gone, but there's currently no alternative. I'd be interested in contributing to work attempting to replicate it, though.
I have some friends in an encrypted riot room right now. The olm could use a real good audit, but otherwise it is working right now. Federation is working, bridges are working, voice and video are working, it has Android and iOS clients. The only problem is the encryption doesn't apply to the voice / video or shared files yet, but they have made huge progress this last year from basically nothing so far.
Re: Why I won't recommend Signal anymore
#13What are your views about VoIP with ZRTP?
Nobody actually exchanges the initial words to avoid mitm. Hence, zrtp is actually no that secure in practice.
Re: Why I won't recommend Signal anymore
#14Any service that owns valuable user data is going to get compromised eventually, whether they do it themselves, or are the victims of an attack. I feel like the only way to not get swept up in the surveillance state is to never put your data on one of these services at all.
Re: Why I won't recommend Signal anymore
#15- Lack of federation
Use a federated secure protocol. Oh wait, there are none. Because if a problem appears you just can't fix it without breaking all federated clients. And then they will whine.
- Dependency on Google Cloud Messaging
Fair enough
- Your contact list is not private
Fair enough
- The RedPhone server is not open-source
While it would be nice that it was Open sourced I can understand them not releasing it (might be for IP issues)
tl,dr: "Signal does not work the way I wanted"
Re: Why I won't recommend Signal anymore
#16This. I didn't know much of the insides of Signal. But, When WhatsApp decide to go in bed with FB to share my contacts and usage, one of the alternatives I explored was Signal. Threw it out the moment it asked for ownership of my contacts (no way to opt out). I for one am not going to trust a guy's pinky promise to be good with my contacts and meta-data. If I'm going to give up the convenience of reaching anybody by…
I doubt you'd want to use it if it didn't use your contacts, though. Not many people are prepared to deal with a whole separate set of contact ids for the sake of a small amount of arguable extra privacy.
Re: Why I won't recommend Signal anymore
#17Wire (http://wire.com) has worked well on iOS for encrypted text/files/audio/video. Open-source client, no contact sharing neeeded. No phone number needed, you can register with email by using a desktop browser at http://app.wire.com, then logging into the mobile app. Group chat for text only. Timed/ephemeral messages for 1:1 text/files. Feature matrix, https://wire.com/privacy/. Could use more documentation (e.g. on retention of encrypted data) but a lot of questions are answered on Twitter or Github issues.
Re: Why I won't recommend Signal anymore
#18Unfortunately, Google has made it (almost) impossible to wake up the phone via some external event without using its proprietary GCM. Even though GCM is not part of AOSP, it has unique status on the platform that can't easily be replicated (without recompiling the kernel, etc like the article mentions). Before the days of doze mode & other battery optimizations, you could just listen & block on a socket, then let the…
> Before the days of doze mode & other battery optimizations, you could just listen & block on a socket, then let the phone go to sleep. Incoming 3G packets would wake up the phone, you grab a wakelock, then start doing things. From what I remember, at least a while ago Facebook Messenger did this using MQTT. But this is not possible any more. It's not a coincidence that the Facebook app was known for being an absolu…
That's still the case now, just for different reasons.
Re: Why I won't recommend Signal anymore
#19- Lack of federation Use a federated secure protocol. Oh wait, there are none. Because if a problem appears you just can't fix it without breaking all federated clients. And then they will whine. - Dependency on Google Cloud Messaging Fair enough - Your contact list is not private Fair enough - The RedPhone server is not open-source While it would be nice that it was Open sourced I can understand them not releasing i…
> Use a federated secure protocol. Oh wait, there are none. Because if a problem appears you just can't fix it without breaking all federated clients. And then they will whine.
That's why you have to design your protocol with backwards compatibility and versioning in mind, ala XMPP. I'm not going to pretend its perfect, but it works pretty well 90% of the time. It does mean clients have to implement versioning and feature negotiation and not just blindly assume everything else supports all the features they do; convincing client authors to do this is the tricky part.
Re: Why I won't recommend Signal anymore
#20Earlier quoted context omitted.
> Before the days of doze mode & other battery optimizations, you could just listen & block on a socket, then let the phone go to sleep. Incoming 3G packets would wake up the phone, you grab a wakelock, then start doing things. From what I remember, at least a while ago Facebook Messenger did this using MQTT. But this is not possible any more. It's not a coincidence that the Facebook app was known for being an absolu…
That's still the case now, just for different reasons.
That's why Facebook Lite is great way to get rid of battery draining Facebook app.