Earlier quoted context omitted.
This is exactly why Telegram is beating Signal. They're singularly focused on the user experience and what users want. Uninstall / reinstall / multiple-devices works flawlessly.
I fundamentally distrust any program which claims E2E encryption and is capable of recovering my chat history onto a new device. This means that Telegram is technically able to recover my chat history, making the "E2E" bit of the encryption smoke-and-mirrors.
Signal WhatsApp Chats Import
231–240 of 283 posts
Re: Signal WhatsApp Chats Import
#232I have been using Signal for two years now and I love it. However I really, really hope they can work on a good backup and restore process as losing my message history because I have to reinstall the app on my desktop[1] or have to reset my phone is a horrible experience. Just build an encrypted blob and zip it up and pop it on my iCloud or Google Drive or leave it local and let me deal with it but I need something .…
Why would you want this? You don't save history for other types of chats, like in person conversations or phone calls (even though you could, with your phone recording in your pocket or call recorder apps). If something important comes up, like an address or recipe, copy/paste it into your notes app. Otherwise set your messages to expire after a month and be done with it. I used to be a message-hoarder too, but I rec…
Because I have repeatedly dug out useful information from chats, days, weeks, months, or years later.
> If something important comes up, like an address or recipe, copy/paste it into your notes app.
You're assuming that 1) you know what's important at the time, rather than realizing later, and 2) you want to take the time, at the time, to figure out somewhere to file it.
> I used to be a message-hoarder too, but I recently realized it was all utterly useless
That's your choice, but that doesn't make it the right choice for everyone. Your preferences are not universal. (And descriptions like "hoarder" deride the choices of others.)
> Signal isn't email.
People advocate using Signal in place of email, for security.
I cannot advocate Signal to anyone I know until it learns to treat user data as incredibly valuable and irreplaceable.
If people want to mark their messages as transient, or even mark all their messages as transient, so be it; that's their choice. But if a message is not marked as transient, it must be possible to securely and easily preserve that message for longer than the lifetime of any one device.
Re: Signal WhatsApp Chats Import
#233I have been using Signal for two years now and I love it. However I really, really hope they can work on a good backup and restore process as losing my message history because I have to reinstall the app on my desktop[1] or have to reset my phone is a horrible experience. Just build an encrypted blob and zip it up and pop it on my iCloud or Google Drive or leave it local and let me deal with it but I need something .…
Re: Signal WhatsApp Chats Import
#234Earlier quoted context omitted.
Chat history isn't immediately at odds with PFS. As I see it PFS first and foremost is for protecting messages in transit. This is to prevent dragnet-style surveillance. Chat history means giving up some measure of at-rest security, but it has no impact on the in transit part. Personally I also think some compromise of at-rest is a reasonable trade-off for a lot of consumer contexts because physical capture of your d…
But PFS is specifically about including "my adversary may, at a later date, compromise my private key" in your threat model without giving up plaintext. If we assume that calculating a private key from the public key is ~impossible (which I hope you agree we can do), and we further assume the private key never leaves the device, then forward secrecy is what lets us know the only way to get plaintext is by stealing it…
I'm no crypto expert but that "later date" when talking about PFS is to avoid an external dragnet recording all your ciphered streams and then deciphering them once they have your non-PFS secret key.
I mean, in your definition basically all the messages should be ephemeral on your device and on each recipient device to have PFS.
Re: Signal WhatsApp Chats Import
#235Re: Signal WhatsApp Chats Import
#236Signal is not an open alternative. It's not federated, but most importantly, they don't allow 3rd party clients: https://github.com/LibreSignal/LibreSignal/issues/37#issueco... So you are stuck with their Electron junk without any options. Matrix should be promoted as an open alternative instead.
Are these things so important that we should give up the easier maintainability (and potentially, security) that comes from centralization and the standardization of user clients? I absolutely think projects like Matrix are worthwhile, but it seems foolish to me to argue that there are no benefits that come from doing things the way Signal does. Besides, as sexy as decentralization is, in the wild it is not really pr…
Both of these will probably have a further decentralising effect.
Re: Signal WhatsApp Chats Import
#237Earlier quoted context omitted.
I fundamentally distrust any program which claims E2E encryption and is capable of recovering my chat history onto a new device. This means that Telegram is technically able to recover my chat history, making the "E2E" bit of the encryption smoke-and-mirrors.
I can be wrong, but on Telegram E2E is not default. Those are used only in 'secret chats', which I believe are not recoverable. So you can use regular texting for everything you don't care much about, like sending youtube videos and memes to your friends, and use the secret chat to things that re more sensitive. That's great for most people that currently use Whatsapp
Re: Signal WhatsApp Chats Import
#238Earlier quoted context omitted.
This. Signal devs should understand that different people have different use cases as well as different tolerances for (theoretical) secrecy/privacy. Some convos/groups are worth keeping history for, others probably not. Signal does not have anyway to know which so should let the user decide and allow for an easy(ier) backup/restore option.
You imply that they don't understand this. Are you sure this is the case? It could be that their priorities are simply elsewhere. Things will take time, even with funding because any crypto/security mistake will be so incredibly more damaging for them than for any other software shop. This goes especially for conversation backups.
Re: Signal WhatsApp Chats Import
#239Earlier quoted context omitted.
> For example, in the classic case when a user adds a new device and wants history to be available on both you can't let the devices controlled by one person simply sync with one another. > To do so would be making a security concession to the other members of the chat in that they no longer verify every destination of their message. You can't "verify every destination" with Signal anyway. Maybe the message is going…
Are you sure about this? > With Signal I can already add a new device and continue existing conversations without the other participants being notified that I've added a new device. Just today I had a group chat notification that said: "More than one member of this group is no longer marked as verified. Tap for options" Tapping brought me to a menu that said: "Safety Number Changes -- The following people many have r…
Linked devices are different. There is no notification when someone adds a new linked device. That's because the only way to add a linked device is to scan a QR code on the device with your phone, then confirm you want to add the device. The device is implicitly trusted, because only a trusted device can add it. (It is also possible to trigger the re-verification from the desktop manually by clicking "reset secure season" in the conversation menu, but that's separate from adding a device.)
Aside: Implicit trust like this is a great trade-off, because otherwise you'd have to verify each of their devices from each of your devices, which means approximately nobody will ever do it. Ask anybody who used Matrix/Element E2EE prior to a couple months ago ;D.
Re: Signal WhatsApp Chats Import
#240Earlier quoted context omitted.
> I'd like to have a Signal client library that I could use to write my own custom lightweight client. You already have that. Signal-cli is based on a standalone Java library distributed as part of the Signal codebase. Of course it is an unofficial client and the Signal team would really prefer you not use it, but if the Signal-cli team can develop something from that library, you probably could too.
I didn’t know that existed. Is there some way to use that to create a backup solution?