Live data from Hacker News

Signal Secure Backups

signal.org

181–190 of 460 posts

Re: Signal Secure Backups

#181

Are backups really necessary? I have always regarded texts (over Signal or SMS) as ephemeral. No one is or should be sending valuable information over Signal, and if you happen to receive something you want to keep, you can always do so manually.

Why do you think our should not? Sincerely asking. And while I’m here, if you’re implying that Signal is Blut trustworthy, you should step out of the HN bubble and have a look around what everyone and their dog shares through less secure means

I did not mean to say that there are better options for encrypted communication. My point was that my use case is texts like "I'll be in the gym at 6:00 bro", not things that I really want to keep or backup. If someone sends a picture or a file that I want to keep, I can already do so manually.

Re: Signal Secure Backups

#182

Earlier quoted context omitted.

This BS is why I completely stopped donating to the signal foundation. The messages are mine, not theirs, and yet they refuse to allow me to handle them how I deem fit.

Have you read the article? They are working on it.

Their first cut at "working on it" is to require that we pay Signal to store our backups for us (45 days of media and 100MiB total is not a useful free tier; I have more than 1 GiB of messages/media spanning years), when that's an entirely unnecessary restriction.

Re: Signal Secure Backups

#183
post #168
post #132

Earlier quoted context omitted.

Anecdotally, I've not had any issues on iOS (not that I'm needing to download media files often, but I have saved quite a few photos and the occasional video over the years and don't recall any failures). Not that my experience invalidates that of people who have had problems, just sharing to say that the problems haven't been universal.

Thanks for calling this out. Apparently on iOS it's complicated, for some reason https://support.signal.org/hc/en-us/articles/360007317471-Vi... On Android I tap on the image in chat, 3 dots and save. Way more involved on iOS. But at least I'll be able to point this out to my iOS peers.

It's actually not more involved on iOS (unless you're unlucky and have problems with it not working - I've no idea if it's a tiny minority of people who have problems, or if I'm in a tiny minority of people for whom it works, or if it's somewhere in between). But for those of us who it does work for, it's just as simple as on Android.

You can hold down on the media, and after about a second it brings up a menu where one of the options is "Save", you tap this and it will be saved to your camera roll (ie open Photos app to see it). If it's a message with multiple photos/videos, you so the same thing and all of them will be downloaded at the same time.

Or instead of holding down to get the context menu, you can tap once to open full screen view of the media which has the iOS "share" button in the bottom left, which you can use if you either want to just save one thing from a message that had multiple photos/videos, or if instead of saving to the default place - it's the standard iOS share function, so you can choose from "save to photos" (ie a the default like above), or "save to files" (accessible from the iOS file manager or from other apps), or share directly to a different app (like an email client, or an FTP client if you have one installed, or to an app like DropBox, or any other app you have that supports the OS-wide share menu).

TLDR: The help page you linked to, the top part of that iOS section (that makes it seem complicated) is just explaining how to find an overview of all previously shared media for a contact/group, and then download from there, but you don't need to do that to download it if you're already looking at what you want to download in the main chat window. The bottom part on that page is my second option from above, which is basically identical to what you say about how to do it on Android - just 3 touches (press image, press 3 dots on Android or share icon on iOS, then press save image). But it's actually the more complicated way, with a 2 touch option available (hold down on image, then press "save" :)

(p.s. to any Signal devs reading this, if you'd like to offer a free backups subscription in return for me continuing to evangelise, or beta testing on my iPhone... feel free to reach out :P

And, although personally I'm more keen on the future feature or backing up either to iCloud or to my own server, may I make a suggestion that, if paying for you to backup media, I'd prefer to be able to pay for a "family" plan - as I've moved several family members onto Signal and would like to be able to gift them free backups rather than tell them all to start paying. I suspect I'm not the only person who would think an option to share storage with 5 or more family/friends would be worth paying a bit more than your current single-account price.)

Re: Signal Secure Backups

#184

> In the past, if you broke or lost your phone, your Signal message history was gone. this and completly useless multi-device support is the reason I don't use Signal... Telegram is not fully e2ee but it's way more convenient here. Even XMPP with PGP would be lightyears ahead.

Telegram has such a good UX, like really good. Using as many devices as you want is a breeze, having multiple accounts on the same device. Their bots API is so easy to use.

Yes, it's at the expense of security perhaps... But I tried to get my wife to use Signal, as well as many friends and it never stuck bar one or two. She had to use telegram to contact someone and decided she liked it and continued using it.

It is what it is.

Re: Signal Secure Backups

#185
post #174

I don't get this. The local-only backup option is already encrypted. Why can't they include an option for me to upload it somewhere of my choosing, like Google Drive, or even using Android's built-in backup system, so I can do it for free (my current backup file is well over a GB)? I already donate $5/mo to Signal Foundation; building a paid-only backup solution gives me a bad taste. I even wrote a small Android app…

Monetize first is their strategy given this included statement:

> Our future plans include letting you save a secure backup archive to the location of your choosing

Re: Signal Secure Backups

#186

> Losing it means losing access to your backup permanently, and Signal cannot help you recover it. Oof... That's going to be tough to explain to normal users. "Sorry you've been paying for backups all this time, but you should have written down this code that you will only ever use once somewhere safe and remembered where it is. All your data is gone." Not the right security trade-off for most people.

If you're using Signal, of all things, that's probably a reasonable security/usability trade off.

Granted, I'm sure there are a lot of people out there who just use Signal because one of their more security-conscious friends/family members told them to install it, and so you're probably right for those people.

But, frankly, I can't see how else they could do it. Offering an unencrypted option, or weakening the encryption (by storing a copy of the key on Signal's servers) would make Signal not Signal.

Re: Signal Secure Backups

#187
post #170
post #101

Earlier quoted context omitted.

Wireguard + syncthing (from F-Droid) work fine. Triggering it when the phone is on the charger makes it very easy to sync things from a computer to the phone, while next to the computer.

To be clear, Signal + Syncthing also works fine, that's what I have.

It absolutely does not work fine. Keeping 2x the size of my database in free space on my phone to let backups work it's no solution at all, which is why I stopped doing it. (The backup creates two files - current and previous, and Syncthing can't remove complete files to another location, so you need an actually rather difficult to write script to do it).

Re: Signal Secure Backups

#189
post #175

Earlier quoted context omitted.

> I do that and then sync that folder with another computer using SyncThing. AFAIK SyncThing only monitors for changes between files with matching names, and Signal stores each backup with a separate (timestamped) filename. Are you storing every day's backup individually, or do you have some tool for deduplicating?

Encrypted backups can't be deduplicated unless the encryption is flawed. There shouldn't be a way to tell that one Signal backup is somewhat related to another, unless you have the passphrase. That also means that Syncthing can't do better than sending the full backup. But if you're syncing via wifi (e.g. at home) it's not really a problem anyway.

> Encrypted backups can't be deduplicated unless the encryption is flawed

This isn't an encryption problem; each device can only have one instance of Signal installed, and the latest backup (assuming it has terminated successfully) is a superset of the previous ones (aside from any messages that have dropped from retention, which you presumably don't want to be preserving, by definition).

"Deduplicate" in this context means ensuring that you only have N backups in your remote storage, rather than cumulatively storing every day.

Re: Signal Secure Backups

#190
post #143

Earlier quoted context omitted.

Device queues need to expire at some point. At that point you aren’t “linked” anymore. What do you want them to do instead?

Give users control over expiration and allow longer timeout.

So make signal pay for the storage forever and just ignore that most people won't understand the security risk?
Post reply on HN