Live data from Hacker News

Signal WhatsApp Chats Import

github.com

231–240 of 283 posts

Re: Signal WhatsApp Chats Import

#231
post #193

Earlier quoted context omitted.

This is exactly why Telegram is beating Signal. They're singularly focused on the user experience and what users want. Uninstall / reinstall / multiple-devices works flawlessly.

I fundamentally distrust any program which claims E2E encryption and is capable of recovering my chat history onto a new device. This means that Telegram is technically able to recover my chat history, making the "E2E" bit of the encryption smoke-and-mirrors.

Telegram only has E2E if you enable it. "Normal" chats are not E2E encrypted.

Re: Signal WhatsApp Chats Import

#232
post #19

I have been using Signal for two years now and I love it. However I really, really hope they can work on a good backup and restore process as losing my message history because I have to reinstall the app on my desktop[1] or have to reset my phone is a horrible experience. Just build an encrypted blob and zip it up and pop it on my iCloud or Google Drive or leave it local and let me deal with it but I need something .…

Why would you want this? You don't save history for other types of chats, like in person conversations or phone calls (even though you could, with your phone recording in your pocket or call recorder apps). If something important comes up, like an address or recipe, copy/paste it into your notes app. Otherwise set your messages to expire after a month and be done with it. I used to be a message-hoarder too, but I rec…

> Why would you want this?

Because I have repeatedly dug out useful information from chats, days, weeks, months, or years later.

> If something important comes up, like an address or recipe, copy/paste it into your notes app.

You're assuming that 1) you know what's important at the time, rather than realizing later, and 2) you want to take the time, at the time, to figure out somewhere to file it.

> I used to be a message-hoarder too, but I recently realized it was all utterly useless

That's your choice, but that doesn't make it the right choice for everyone. Your preferences are not universal. (And descriptions like "hoarder" deride the choices of others.)

> Signal isn't email.

People advocate using Signal in place of email, for security.

I cannot advocate Signal to anyone I know until it learns to treat user data as incredibly valuable and irreplaceable.

If people want to mark their messages as transient, or even mark all their messages as transient, so be it; that's their choice. But if a message is not marked as transient, it must be possible to securely and easily preserve that message for longer than the lifetime of any one device.

Re: Signal WhatsApp Chats Import

#233
post #19

I have been using Signal for two years now and I love it. However I really, really hope they can work on a good backup and restore process as losing my message history because I have to reinstall the app on my desktop[1] or have to reset my phone is a horrible experience. Just build an encrypted blob and zip it up and pop it on my iCloud or Google Drive or leave it local and let me deal with it but I need something .…

Same here. I used Signal a lot. Then it started crashing and I lost all my message history.

Re: Signal WhatsApp Chats Import

#234

Earlier quoted context omitted.

Chat history isn't immediately at odds with PFS. As I see it PFS first and foremost is for protecting messages in transit. This is to prevent dragnet-style surveillance. Chat history means giving up some measure of at-rest security, but it has no impact on the in transit part. Personally I also think some compromise of at-rest is a reasonable trade-off for a lot of consumer contexts because physical capture of your d…

But PFS is specifically about including "my adversary may, at a later date, compromise my private key" in your threat model without giving up plaintext. If we assume that calculating a private key from the public key is ~impossible (which I hope you agree we can do), and we further assume the private key never leaves the device, then forward secrecy is what lets us know the only way to get plaintext is by stealing it…

> But PFS is specifically about including "my adversary may, at a later date, compromise my private key" in your threat model

I'm no crypto expert but that "later date" when talking about PFS is to avoid an external dragnet recording all your ciphered streams and then deciphering them once they have your non-PFS secret key.

I mean, in your definition basically all the messages should be ephemeral on your device and on each recipient device to have PFS.

Re: Signal WhatsApp Chats Import

#235
What if companies like apple take signal out of their store like they plan to do now with parler? I'd rather use whatsapp because it belongs to facebook and since them and twitter are the new leaders of the world and decide what speech is deemed worthy, there is less chance they will cancel it

Re: Signal WhatsApp Chats Import

#236
post #148

Signal is not an open alternative. It's not federated, but most importantly, they don't allow 3rd party clients: https://github.com/LibreSignal/LibreSignal/issues/37#issueco... So you are stuck with their Electron junk without any options. Matrix should be promoted as an open alternative instead.

Are these things so important that we should give up the easier maintainability (and potentially, security) that comes from centralization and the standardization of user clients? I absolutely think projects like Matrix are worthwhile, but it seems foolish to me to argue that there are no benefits that come from doing things the way Signal does. Besides, as sexy as decentralization is, in the wild it is not really pr…

Note that the plan for Matrix is to implement support for full decentralisation by bundling a lightweight server with a client. A longer term plan is to also decouple accounts from servers, so that you can migrate an account to a different server even after creation.

Both of these will probably have a further decentralising effect.

Re: Signal WhatsApp Chats Import

#237

Earlier quoted context omitted.

I fundamentally distrust any program which claims E2E encryption and is capable of recovering my chat history onto a new device. This means that Telegram is technically able to recover my chat history, making the "E2E" bit of the encryption smoke-and-mirrors.

I can be wrong, but on Telegram E2E is not default. Those are used only in 'secret chats', which I believe are not recoverable. So you can use regular texting for everything you don't care much about, like sending youtube videos and memes to your friends, and use the secret chat to things that re more sensitive. That's great for most people that currently use Whatsapp

How is that great? On whatsapp everything you do is E2E by default.

Re: Signal WhatsApp Chats Import

#238
post #161

Earlier quoted context omitted.

This. Signal devs should understand that different people have different use cases as well as different tolerances for (theoretical) secrecy/privacy. Some convos/groups are worth keeping history for, others probably not. Signal does not have anyway to know which so should let the user decide and allow for an easy(ier) backup/restore option.

You imply that they don't understand this. Are you sure this is the case? It could be that their priorities are simply elsewhere. Things will take time, even with funding because any crypto/security mistake will be so incredibly more damaging for them than for any other software shop. This goes especially for conversation backups.

[deleted]

Re: Signal WhatsApp Chats Import

#239
post #147

Earlier quoted context omitted.

> For example, in the classic case when a user adds a new device and wants history to be available on both you can't let the devices controlled by one person simply sync with one another. > To do so would be making a security concession to the other members of the chat in that they no longer verify every destination of their message. You can't "verify every destination" with Signal anyway. Maybe the message is going…

Are you sure about this? > With Signal I can already add a new device and continue existing conversations without the other participants being notified that I've added a new device. Just today I had a group chat notification that said: "More than one member of this group is no longer marked as verified. Tap for options" Tapping brought me to a menu that said: "Safety Number Changes -- The following people many have r…

Signal still had a single primary device, your phone. What you describe happens when someone installs Signal on a new phone (or reinstalls on the current one).

Linked devices are different. There is no notification when someone adds a new linked device. That's because the only way to add a linked device is to scan a QR code on the device with your phone, then confirm you want to add the device. The device is implicitly trusted, because only a trusted device can add it. (It is also possible to trigger the re-verification from the desktop manually by clicking "reset secure season" in the conversation menu, but that's separate from adding a device.)

Aside: Implicit trust like this is a great trade-off, because otherwise you'd have to verify each of their devices from each of your devices, which means approximately nobody will ever do it. Ask anybody who used Matrix/Element E2EE prior to a couple months ago ;D.

Re: Signal WhatsApp Chats Import

#240

Earlier quoted context omitted.

> I'd like to have a Signal client library that I could use to write my own custom lightweight client. You already have that. Signal-cli is based on a standalone Java library distributed as part of the Signal codebase. Of course it is an unofficial client and the Signal team would really prefer you not use it, but if the Signal-cli team can develop something from that library, you probably could too.

I didn’t know that existed. Is there some way to use that to create a backup solution?

Did a quick skim and dont see why not. There's examples to receive the message. It's up to you what you want to do with it afterward.
Post reply on HN