Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal Secure Backups

signal.org

Post reply on HN
Print view View original

221–230 of 460 posts

Re: Signal Secure Backups

#221

Post by FergusArgyll »

blintz wrote: post #70
withinrafael wrote: post #64

Do backups get pruned over time? Is there an expiration? I don't think folks want old lost-key backups sitting around forever for quantum to catch up, right?

It’s symmetric keys, so quantum doesn’t matter.

"On the other hand, symmetric algorithms such as AES are believed to be immune to Shor. In most cases, the best-known quantum key recovery attack uses Grover’s algorithm which provides a generic square-root speed-up over classical exhaustion in terms of the number of queries to the symmetric algorithm. In other words, Grover would recover the 256-bit key for AES-256 with around 2^128 quantum queries to AES compared to around 2^256 classical queries for exhaustion. "

- https://csrc.nist.gov/csrc/media/Events/2024/fifth-pqc-stand...

the paper itself concludes "the practical security impact of Grover with existing techniques on plausible near-term quantum hardware is limited."

Re: Signal Secure Backups

#222

Post by tremon »

h4ck_th3_pl4n3t wrote: post #218
Sesse__ wrote: post #48

Earlier quoted context omitted.

There are a couple of problems with the existing backup: 1. It is non-incremental. This means you'll need about as much free space on your phone as your Signal database takes, and it may take many hours to make if your database is large (mine is 18GB). I used to wake up to find my phone had not even fully charged because it had been so busy writing Signal backups. 2. Once you have it on disk, how do you get it away f…

How can an encrypted backup be incremental if it's supposed to be never decrypted on-remote-machines? Ever thought about that?

Why would you need remote data to create an incremental backup?

Re: Signal Secure Backups

#223

Post by yc-kraln »

SwamyM wrote: post #214

While we are on the topic of Signal, does anyone know if it's possible to have a lock/PIN to open the Signal app itself that's different than your device lock/PIN? Threema has this feature and it's reassuring to know that people can't open my chats when I hand my phone to someone. Or if I give the device lock/PIN to someone I trust for backup purposes but don't want them to have access to chats themselves. Last I che…

Sounds like you want Molly

Re: Signal Secure Backups

#224

Post by Dunedan »

Sesse__ wrote: post #48
poisonborz wrote: post #39

Backing up Signal on Android for free and offline was ~always possible. The app creates a multi GB backup file on the phone memory under the Signal folder that you can just copy out and back on a new phone. The file is encrypted with the passcode and the database can be extracted. https://github.com/bepaald/signalbackup-tools

There are a couple of problems with the existing backup: 1. It is non-incremental. This means you'll need about as much free space on your phone as your Signal database takes, and it may take many hours to make if your database is large (mine is 18GB). I used to wake up to find my phone had not even fully charged because it had been so busy writing Signal backups. 2. Once you have it on disk, how do you get it away f…

> There are a couple of problems with the existing backup:

>

> 1. It is non-incremental.

I wonder if that's differently with the newly announced functionality. Their announcement doesn't sound like it:

> Once you’ve enabled secure backups, your device will automatically create a fresh secure backup archive every day, replacing the previous day’s archive.

Re: Signal Secure Backups

#225

Post by john01dav »

They need to add some free way to backup to my own server. I have my own raid array with backups sitting in my basement. I'll back up to that. I do not want to pay them for cloud storage.

Right now, theoretically, I can do this by backing up to my phone and then copying the file over. But, this has many issues. Firstly, it is manual, so it will happen way less. Secondly, it is not differential, so the storage requirements will explode. Thirdly, if my signal message archive is bigger than the free space on my phone (especially if it takes more than 50% of total space) then I'm just fucked — there's no way to back it up anywhere else. Fourthly, the backup system is EXTREMELY buggy, to the point that it takes me HOURS babysitting it every time I make a backup.

A good solution would be let me put FTP/FTPS/SFTP/SCP/WebDav/SMB/etc. credentials in the Signal app and have it do periodic differential backups to there. Let me decide if I want it to be encrypted or not based on my threat model. Tell my contacts if this is enabled and let me exclude and/or encrypt specific chats if you want to let other people apply their security model too.

Only supporting any reasonable (meaning automatic and convenient) backup system with their paid cloud and not supporting my own server smells like a money grab to me. This is utterly unacceptable in a supposedly non-profit app. I have no problem with their paid cloud being an option, to be clear.

Another problem with Signal is that they only provide an official Linux package for Debian-based distributions. This forces people using other distributions to either do repeated manual effort to pull it out of their .deb files or build it themself (which is made way harder than it should be), or rely on sketchy third parties for packags. Given how much privatea information goes over Signal, such third party packages are an extremely tempting target for anyone from criminals to national spy agencies. This lapse in security due to not packaging for any Linux except Debian-based Linux (or even providing an ideally auto-updating portable binary!) is a much larger security lapse than letting me backup to my own server conveniently. So, their cries of security concerns relating to backups ring hollow.

Overall, it's quite a shitty app. I only use it because the alternatives are worse.

Re: Signal Secure Backups

#226

Post by john01dav »

greysonp wrote: post #54
chimeracoder wrote: post #20

I know plenty of people who have inadvertently lost their entire messaging history because their phone broke or was lots and they couldn't transfer messages directly from the old phone to the new one. Signal allows you to export backups of messages to a file, but only on Android - the iOS version does not. This is a great feature not only for users who are less technically inclined than the average HN reader, but for…

Hi there, Signal dev here. We are absolutely keeping the local backup feature. More than that -- we'll be improving it to also be cross-platform and incremental, meaning it'll be much faster to both create the backup as well as sync it if you use a third-party folder-syncing solution (like syncthing or something).

Please add some way to send it over FTP/FTPS/SFTP/SCP/WebDav/SMB/whatever so I can automatically backup to my own server that isn't on my phone. I need something fully automated or I won't often do it. This is also really important if the free space on my phone is less than the size of the Signal archive, and even more so if the Signal archive is more than 50% of the total space on my phone.

Re: Signal Secure Backups

#227

Post by john01dav »

jdthedisciple wrote: post #129

perhaps said too much on a whim, but why should I backup my Signal... or WhatsApp, or any other communications. live in the moment. let things pass. there is probably no fortune hidden in it anyway...

As an example that I experienced, I wanted a picture that someone took 2 years ago and sent to me on Signal. Since I am a data hoarder, I was able to retrieve it.

Re: Signal Secure Backups

#228

Post by ysnp »

greysonp wrote: post #54
chimeracoder wrote: post #20

I know plenty of people who have inadvertently lost their entire messaging history because their phone broke or was lots and they couldn't transfer messages directly from the old phone to the new one. Signal allows you to export backups of messages to a file, but only on Android - the iOS version does not. This is a great feature not only for users who are less technically inclined than the average HN reader, but for…

Hi there, Signal dev here. We are absolutely keeping the local backup feature. More than that -- we'll be improving it to also be cross-platform and incremental, meaning it'll be much faster to both create the backup as well as sync it if you use a third-party folder-syncing solution (like syncthing or something).

Will it be possible to backup messages and media to both Signal's cloud storage and local storage at the same time?

Re: Signal Secure Backups

#229

Post by john01dav »

rlpb wrote: post #167
drnick1 wrote: post #157

Are backups really necessary? I have always regarded texts (over Signal or SMS) as ephemeral. No one is or should be sending valuable information over Signal, and if you happen to receive something you want to keep, you can always do so manually.

How should users send valuable information then, if they require E2E encryption?

I sometimes SCP things directly between me and someone else's home.

Re: Signal Secure Backups

#230

Post by jacooper »

poisonborz wrote: post #39

Backing up Signal on Android for free and offline was ~always possible. The app creates a multi GB backup file on the phone memory under the Signal folder that you can just copy out and back on a new phone. The file is encrypted with the passcode and the database can be extracted. https://github.com/bepaald/signalbackup-tools

This trick never worked for me, the app just never restores this. People used to say the same about WhatsApp. Now both have direct migration features.
Post reply on HN