Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal Desktop

whispersystems.org

Post reply on HN
Print view View original

131–140 of 288 posts

Re: Signal Desktop

#131

Post by qrmn »

lewisl9029 wrote: post #101
deanclatworthy wrote: post #80

Earlier quoted context omitted.

What kind of things are impossible?

The two features I mentioned, automatic contact discovery and robust offline messaging, are examples of features that I have concluded to be impossible to build without some degree of centralization (there are probably more, but those two were the only ones I could recall off the top of my head). Though it is certainly possible that I simply haven't put enough thought into it. Toc's original goal was to be a decentra…

Automatic contact discovery is tricky, but the beginnings of one potential solution is I think explored in agl's Pond, using pairings on BN curves?: https://pond.imperialviolet.org/

To a point, so is offline messaging. Distributed datastores in general do that kind of thing - there are old implementations over Freenet in particular, and GNUnet as well and other things I think. The robust part is harder: if the client is offline, where's the disk space coming from? Volunteers' (nodes') cache? That needs to be opaque, and so do lookups. What's to stop spammers flooding the network? (Spam, and denial-of-service in general, is a Hard problem to deal with in general even in distributed systems.)

They're not among the hardest problems. Pseudonymity is a huge challenge as the latency gets lower against traffic correlation attacks, and a secure messenger is most definitely up against the kind of threat model that can and will try to pull those off in the wild. Perhaps mixing high and low-latency traffic may help, although it's going to need to be very carefully analysed how much (I believe I2P's design can do that, although I'm not sure if jrand0m ever implemented it in the router).

Re: Signal Desktop

#132

Post by patcon »

_jomo wrote: post #126
nemoniac wrote: post #116

Earlier quoted context omitted.

What is GcmCore? It doesn't show up on ddg or google.

It's GmsCore, moxie typo'd. However you can also install via F-Droid by adding this repo https://fdroid.eutopia.cz Moxie is probably going to hate you for it, but it works very well and doesn't require Google Services or anything else.

> Moxie is probably going to hate you for it

Overly dramatic...

Re: Signal Desktop

#133

Post by darklajid »

moxie wrote: post #127
darklajid wrote: post #111

Earlier quoted context omitted.

Thank you for your reply. I really appreciate it. As I stated earlier, I feel bad about 'expecting more' here - I certainly see the appeal of a popular ~decent~ option. Without trying to derail this further, let me look at those points: If I use throwaway numbers: What happens if I lose access? Do I _need_ the number for anything in the future (say, device died)? Can someone else mess with me if they get access to th…

That's a pretty big holiday wishlist. =) This is the world we live in: people do most of their communication on mobile devices running iOS or Android, use Chrome on the desktop, and expect contact discovery to be automatic in their social apps. The browser has won the desktop, iOS and Android have won mobile, and the velocity of the ecosystem is unlikely to make "distributed" communication mechanisms possible for som…

If we ever meet I'll buy you a beer for the year of the Linux desktop line.

But honestly: I understand mobile support for iOS/Android only. I don't understand Chrome as a platform (FF isn't dead. And the biggest reason for that is that I fail to understand why that client needs to be 'web based' and then again not. A web app in a silo)

Mobile numbers.. Why? I mean, if 90% of the population WANT mum to see that they use a service and when they're online (or whatever metadata you want to exchange for contacts), just because they happen to know the phone number: Fine. But why isn't it possible to sign up, hit a box that says 'no phone number associated' and .. add contacts manually? I don't want the 99.999% to change, to make it harder for them. I just wish that Christmas brings an option that lets me opt-out of that. Chat contacts don't need my phone number. People that know my phone number are not chat contacts.

I'll get back pretending that Linux has won and will try to surf the web in FxOS for 30min just .. to prove you wrong. :)

Re: Signal Desktop

#134

Post by newman314 »

mapgrep wrote: post #130
newman314 wrote: post #107

Earlier quoted context omitted.

Enh. Signal's UX is still not effortless. For example: * Does not make it clear it's a point to point mapping (on iOS) right now. I discovered this the hard way. * Unclear failure modes (see above). It's entirely possible to have messages be silently dropped. * Texting vs. call methods unclear. I.e. there's a phone icon but no text icon (select name instead). * Contacts list has some text only, some phone only, some…

What do you mean it's a point-to-point mapping? Genuinely curious. You mean that there is no server to buffer failed delivery attempts if one of the devices is off or disconnected? (Side note, I've hit that the same bug where the other person has to contact me first because they don't show up in my contacts, even though they should.)

It's one device to one device (as stated elsewhere in this thread. Apparently, only Android+Chrome combo is supported for multi-device).

Put differently, I can't register the same number to an iPad and iPhone simultaneously at this time and hope to communicate with someone. It apparently gets things all confused.

I was doing some more testing and it also appears that I'm unable to call someone with a greyed out name but with available phone icon. Once again, no clear indication if this is a bug (not supposed to happen) or a feature (can call but not text).

Re: Signal Desktop

#135

Post by mapgrep »

tptacek wrote: post #98
plusquamperfekt wrote: post #97

Earlier quoted context omitted.

Huh? Apple and MS have a record of communicating in sharing data with US government - plus as companies providing closed source software they are likely to introduce backdoors ... also something you might have heard of since Snowden.

I'm making an engineering point, and you're making a conspiracy-theoretic point.

Engineering and corporate behavior aren't really orthogonal topics, are they, when the actual engineering you want to inspect is unavailable (closed source) and you have to rely on observed behavior and trust?

If Apple actually did have a history of, say, pushing customized "iOS update" binary blobs at USG targets that undermined all the security features they describe in their white papers and in their (other) marketing, that would actually be entirely relevant to claims about the security of iOS, would it not? Even without such on-device updates, a system like iMessage can potentially be thwarted if Apple itself decides to cooperate with MiTMing, at least in certain scenarios.

(Btw I'm not actually endorsing OPs point that Apple is too close with the U.S. government. That does not seem accurate given the public heat brought down on Apple by entities like the FBI recently. But if it were Microsoft, there would be a point there.)

Re: Signal Desktop

#136

Post by mapgrep »

newman314 wrote: post #134
mapgrep wrote: post #130

Earlier quoted context omitted.

What do you mean it's a point-to-point mapping? Genuinely curious. You mean that there is no server to buffer failed delivery attempts if one of the devices is off or disconnected? (Side note, I've hit that the same bug where the other person has to contact me first because they don't show up in my contacts, even though they should.)

It's one device to one device (as stated elsewhere in this thread. Apparently, only Android+Chrome combo is supported for multi-device). Put differently, I can't register the same number to an iPad and iPhone simultaneously at this time and hope to communicate with someone. It apparently gets things all confused. I was doing some more testing and it also appears that I'm unable to call someone with a greyed out name…

Oh I see. That is indeed annoying. So I guess this bit from the desktop announcement is a stretch: "....all incoming and outgoing messages are displayed consistently on all your devices." I mean I guess if you ONLY have one phone and a desktop that would be true? And I guess if Signal only allows you to register those two things, it is TECHNICALLY true, in the sense that "all" <= 2

Re: Signal Desktop

#137

Post by kazazes »

sigmar wrote: post #25

I don't understand why it prompts me to invite other people after putting me in line. Why would I email/tweet my friends to join this service if it isn't even ready for me? Seems rude to bother a friend with joining an internet line just so that I can get a better position in the line. I love signal on android and have been looking forward to this, kind of rubs me the wrong way when I'm put in "line"

In the same vein, the signup form allows you to trivially tell who and roughly when someone has signed up for the beta.

Re: Signal Desktop

#138

Post by qrmn »

newman314 wrote: post #107
fweespeech wrote: post #72

Earlier quoted context omitted.

Tbh, Signal's UX on Android is pretty good. Is Telegram just better on iOS or am I missing something when you say it has better UX?

Enh. Signal's UX is still not effortless. For example: * Does not make it clear it's a point to point mapping (on iOS) right now. I discovered this the hard way. * Unclear failure modes (see above). It's entirely possible to have messages be silently dropped. * Texting vs. call methods unclear. I.e. there's a phone icon but no text icon (select name instead). * Contacts list has some text only, some phone only, some…

I do have an "invite" prompt on my SMS contacts that don't yet have Signal: "Invite to Signal: Take your conversation with %s to the next level.". Perhaps it's a function in the beta version that isn't in the live version yet?

I haven't seen a message with a double-tick that's been dropped yet, at least not on a recent version. It can sometimes behave poorly with Android battery-saving mode - however, so does plain SMS. Turning off sync is part of the actual point of battery-saving, but conversely, I never want to not get messages. That's arguably Android's problem, not Signal's. Still, it uses GCM, so at least there's hope for the deep sleep (which I haven't tried yet).

Re: Signal Desktop

#139

Post by tptacek »

mapgrep wrote: post #135
tptacek wrote: post #98

Earlier quoted context omitted.

I'm making an engineering point, and you're making a conspiracy-theoretic point.

Engineering and corporate behavior aren't really orthogonal topics, are they, when the actual engineering you want to inspect is unavailable (closed source) and you have to rely on observed behavior and trust? If Apple actually did have a history of, say, pushing customized "iOS update" binary blobs at USG targets that undermined all the security features they describe in their white papers and in their (other) marke…

I think Apple has gone through a lot of trouble to avoid being forced to compromise iMessage, but I am not recommending iMessage. iMessage is orthogonal to Apple's platform security, which is simply better than Android's.

That's all I'm saying.

Re: Signal Desktop

#140

Post by nextos »

moxie wrote: post #127
darklajid wrote: post #111

Earlier quoted context omitted.

Thank you for your reply. I really appreciate it. As I stated earlier, I feel bad about 'expecting more' here - I certainly see the appeal of a popular ~decent~ option. Without trying to derail this further, let me look at those points: If I use throwaway numbers: What happens if I lose access? Do I _need_ the number for anything in the future (say, device died)? Can someone else mess with me if they get access to th…

That's a pretty big holiday wishlist. =) This is the world we live in: people do most of their communication on mobile devices running iOS or Android, use Chrome on the desktop, and expect contact discovery to be automatic in their social apps. The browser has won the desktop, iOS and Android have won mobile, and the velocity of the ecosystem is unlikely to make "distributed" communication mechanisms possible for som…

I like the fact that Signal makes good cryptography available to the masses. But I also share the OP concern about Chromium (and about a central server, but this is technically much harder to fix).

Perhaps it would be possible to have a simple CLI app that is free from these dependencies (which should also be quite simple to develop).

Post reply on HN