11–20 of 50 posts
> The ability to register for Signal without a phone number is a frequently requested feature. I wonder if Signal missed the forest for the trees with a paid registration. I imagine privacy is the primary reason for registering without phone number and yet they ask one to register by giving them money which 99% of the case involves means of payment tied even tighter to one's identity than a phone number.
Earlier quoted context omitted.
If we're just throwing around straw men, then a good example of "opinionated" is websites repeatedly hassling you with CAPTCHA "security checks". They're really concerned that you suffer their exact intended "experience", rather than being able to use your chosen software tools to view/analyze per your own needs. Open clients/protocols/ecosystems create individual freedom and choices at the edges. One size does not f…
We've had a lot of open systems and protocols, SIP, XMPP, Matrix, desktop Linux, Mastodon. It only gains adoption from the technologically savvy and fails to capture a regular user base. My mother, a 70 year old retired special education teacher, got me and my extended family (21 people) on Signal. I didn't tell her about it, I didn't encourage her to use it, I didn't step her through the process. She doesn't know ho…
One such mechanism I often lament is that closed systems attract investment dollars seeking to capture a market then eventually enshittify, and that investment can be spent on marketing/polish/etc to drive adoption. I don't think this is the dynamic around Signal though, per se.
I can envision a world in which Signal still did everything they did to promote themselves, while also not binding themselves to mobile phones, Google Play, phone numbers as identity, secure enclaves, etc - where they were just as successful at gaining "normie" adoption, while also having a free foundation. This is where my criticism is coming from.
> The ability to register for Signal without a phone number is a frequently requested feature. I wonder if Signal missed the forest for the trees with a paid registration. I imagine privacy is the primary reason for registering without phone number and yet they ask one to register by giving them money which 99% of the case involves means of payment tied even tighter to one's identity than a phone number.
> Signal Login, one-time payment, price unknown Of course price is unknown, because it doesn’t matter, what matters is linking your real identity to signal. As I mentioned before, many times, that the main purpose of the phone requirement isn’t to fight “spam”, is to fight privacy and always have the option to expose the real person behind that account whenever needed. Most countries around the world require an ID to…
Centralized comms that force you to identify yourself and use proprietary software are an enemy of a free society.
I do not understand the true goals of Signal, but their actions are inconsistent with their stated ones.
This is not even getting started on their Mobilecoin premine scam that was a blatant conflict of interest and a wildly blatant violation of their non-profit charter given Moxies financial ties to Mobilecoin.
> Signal Login, one-time payment, price unknown Of course price is unknown, because it doesn’t matter, what matters is linking your real identity to signal. As I mentioned before, many times, that the main purpose of the phone requirement isn’t to fight “spam”, is to fight privacy and always have the option to expose the real person behind that account whenever needed. Most countries around the world require an ID to…
This is why as a security engineer and researcher even I do not have a Signal account. My conversation with Moxie about Signal convinced me that Signal cannot be trusted as they are obsessed with centralized control and user tracking, via app store stats. Privacy assurances come from enclaves internet randos can freely manipulate as they chose not to implement full source bootstrapped remote attestation. Also relying…
Not sure about that. You do not need Google Play Store to download or update Signal. I use Obtainium to update directly via signal.org for a very long time now.
If this works without proprietary software, it might actually convince me to use Signal. I already have a VoIP phone number through JMP and would be happy to use it for Signal, but I've read that registration isn't an option on the desktop client, even if I also have a phone number. I looked for a fork or alternate compatible client that allows registration but didn't find one.
If this works without proprietary software, it might actually convince me to use Signal. I already have a VoIP phone number through JMP and would be happy to use it for Signal, but I've read that registration isn't an option on the desktop client, even if I also have a phone number. I looked for a fork or alternate compatible client that allows registration but didn't find one.
It's an absolute pain, but you can use signal-cli to do it (or at least you could a few months ago when I did). Just an FYI if you ever have time to burn.
I notice the README file for signal-cli [1] says registration "may require solving a CAPTCHA challenge", which might involve running proprietary software. I found a forum post that says this also sometimes happens on sign-in [2], which might make it difficult to use Signal without proprietary software. I might try it anyway at some point because it does say "may" :)
[1] https://github.com/AsamK/signal-cli [2] https://community.e.foundation/t/signal-and-hcaptcha/83470
Earlier quoted context omitted.
This is why as a security engineer and researcher even I do not have a Signal account. My conversation with Moxie about Signal convinced me that Signal cannot be trusted as they are obsessed with centralized control and user tracking, via app store stats. Privacy assurances come from enclaves internet randos can freely manipulate as they chose not to implement full source bootstrapped remote attestation. Also relying…
> [Signal is] obsessed with [...] user tracking, via app store stats. Not sure about that. You do not need Google Play Store to download or update Signal. I use Obtainium to update directly via signal.org for a very long time now. JSON: https://updates.signal.org/android/latest.json
Moxie -knew- this was a path almost no one has time to use safely and liked it that way. He actively blocked attempts by the community to put Signal in f-droid, so in cases where it is the system package manager, automated signed reproducible builds can be updated painlesssly. By his own admission, moxie blocked convenient and secure community package managers because he wants most installs to happen from Google Play or the App Store so he gets analytics.
In the end Molly made it to f-droid anyway and Signal has no way to stop it, but they actively discourage the use of any binaries they did not compile and cannot track and modify at any time.
> Signal Login, one-time payment, price unknown Of course price is unknown, because it doesn’t matter, what matters is linking your real identity to signal. As I mentioned before, many times, that the main purpose of the phone requirement isn’t to fight “spam”, is to fight privacy and always have the option to expose the real person behind that account whenever needed. Most countries around the world require an ID to…
This is why as a security engineer and researcher even I do not have a Signal account. My conversation with Moxie about Signal convinced me that Signal cannot be trusted as they are obsessed with centralized control and user tracking, via app store stats. Privacy assurances come from enclaves internet randos can freely manipulate as they chose not to implement full source bootstrapped remote attestation. Also relying…
Earlier quoted context omitted.
> [Signal is] obsessed with [...] user tracking, via app store stats. Not sure about that. You do not need Google Play Store to download or update Signal. I use Obtainium to update directly via signal.org for a very long time now. JSON: https://updates.signal.org/android/latest.json
You can sideload (for now) but that forces you to enable "unknown sources" and increase the attack surface on your device, forcing you to reproduce every new release from source by hand to verify it was not compromised... or blindly sideload binaries and just hope your IP address was not served an extra special one. Moxie -knew- this was a path almost no one has time to use safely and liked it that way. He actively b…
Enabling "unknown sources" does not make my device less secure. The setting is also disingenuously named: It is in fact "known sources" I am installing (not "sideloading") software from. It is just not a source Google wants to know of.
I also do not need to reproduce every new release from source. It is a signed APK I'm getting from signal.org.
If the antagonists in my threat model are so capable they could serve a tailored, signed APK from signal.org for the IP I'm using, I should absolutely not use a messenger whose identifier is my phone number, aka my real world identity AND permanent location marker. That feels absurd. A threat actor that capable could just locate me, pick me up and shake me until I unlock the device.
You are saying Molly exists and works fine, so I'm not really sure the whole problematization of Signal holds up. Does the existence of Molly not disprove your criticism that users would have to use the mainline Signal app from the Play Store?
I think it might be a good sign that criticism of Signal tends to presuppose absurdly capable threat actors. It suggests there is little low-hanging fruit left to criticize.