Live data from Hacker News

Signal Secure Backups

signal.org

271–280 of 460 posts

Re: Signal Secure Backups

#271
post #91

I am happy to see Signal charging for premium features. From a product perspective, being able to switch between two iOS devices without a 3rd iOS device shouldn’t be a premium feature. Please consider enabling local backup and restore for a single Signal instance on iOS.

> being able to switch between two iOS devices without a 3rd iOS device

I have moved Signal from an iOS device to a new iOS device multiple times. Why do you need a 3rd one?

Re: Signal Secure Backups

#272
post #48

Earlier quoted context omitted.

There are a couple of problems with the existing backup: 1. It is non-incremental. This means you'll need about as much free space on your phone as your Signal database takes, and it may take many hours to make if your database is large (mine is 18GB). I used to wake up to find my phone had not even fully charged because it had been so busy writing Signal backups. 2. Once you have it on disk, how do you get it away f…

> Once you have it on disk, how do you get it away from your phone? plug your phone into a computer? Install Termux and use one of the countless command line programs designed to transfer bits over a network?

I think GP was talking about how to transfer the backup 1) daily, 2) in an automated manner, and 3) reliably and in time (before, 48h later, Signal overrides the existing backup on your phone later with a new one).

This is not trivial when each backup archive is in the order of 20 GB.

Re: Signal Secure Backups

#273

I already pay Apple for storage, please just back up my chats/media to iCloud.

This BS is why I completely stopped donating to the signal foundation. The messages are mine, not theirs, and yet they refuse to allow me to handle them how I deem fit.

> The messages are mine, not theirs, and yet they refuse to allow me to handle them how I deem fit.

"They refuse to allow me" meaning "they don't add the features I want for free to the app they provide for free, so I complain".

The messages are yours, of course. But don't forget that you use their work for free. If you're not happy, go use the free work of someone else, I guess?

Re: Signal Secure Backups

#274
post #48

Earlier quoted context omitted.

There are a couple of problems with the existing backup: 1. It is non-incremental. This means you'll need about as much free space on your phone as your Signal database takes, and it may take many hours to make if your database is large (mine is 18GB). I used to wake up to find my phone had not even fully charged because it had been so busy writing Signal backups. 2. Once you have it on disk, how do you get it away f…

USB transfer is by far the best way to transfer large amounts of data to and from phones.

Really? Ever since Android devices ceased to be regular USB storage devices and switched to MTP, this has never worked well for me. MTP is incredibly slow.

Re: Signal Secure Backups

#275
post #48

Earlier quoted context omitted.

There are a couple of problems with the existing backup: 1. It is non-incremental. This means you'll need about as much free space on your phone as your Signal database takes, and it may take many hours to make if your database is large (mine is 18GB). I used to wake up to find my phone had not even fully charged because it had been so busy writing Signal backups. 2. Once you have it on disk, how do you get it away f…

How can an encrypted backup be incremental if it's supposed to be never decrypted on-remote-machines? Ever thought about that?

I'm sure if borgbackup can pull this off, Signal can, too?

The solution is to split up your data into encrypted chunks, and only upload the new ones.

Re: Signal Secure Backups

#276

Am I still required to add a phone number to use signal? What's the point of that. Every single person in the USA (and probably world) is quickly and trivially de-anonymized with a phone number.

nobody has access to your phone number from your account, and when subpoenad they are unable to provide it: https://signal.org/bigbrother/ 'the point' is spam protection, alas

That article is out of date. It says things like "Signal still knows nothing about you", but Signal collects every user's name, phone number, photo, and a list of their contacts and permanently stores that data in the cloud.

That data is only protected by a pin (which can be brute forced) and SGX which has a history of being leaky. Researchers even demonstrated that data could be collected from Signal at one point. There are very likely side channel attacks that would allow Signal, or the government to collect the data stored in the cloud.

https://web.archive.org/web/20250117232443/https://www.vice....

https://web.archive.org/web/20230519115856/https://community...

Re: Signal Secure Backups

#277
post #233

Earlier quoted context omitted.

Sounds like you want Molly

For anyone else that's not familiar, this is referring to https://molly.im/ which looks like it's a fork of Signal. And looks like it interops with Signal, so you can talk to your regular Signal contacts as well. That's very interesting. My only concern with it would be how sustainable it is in the long term. I am using Threema currently, which has a plan for enterprises, so that seems more reliable but it's lacking…

> My only concern with it would be how sustainable it is in the long term.

Another concern should be: can you trust molly? Cryptographers have been auditing Signal... who is auditing molly?

Re: Signal Secure Backups

#278
post #196

Earlier quoted context omitted.

Hi there, Signal dev here. We are absolutely keeping the local backup feature. More than that -- we'll be improving it to also be cross-platform and incremental, meaning it'll be much faster to both create the backup as well as sync it if you use a third-party folder-syncing solution (like syncthing or something).

Will the secure backups also be incremental? I've gotten to the point where the backup takes quite a while to generate.

Isn't it what they mean with "we'll be improving it to also be [...] incremental"?

Re: Signal Secure Backups

#279
post #177

Earlier quoted context omitted.

Yeah, didn't see it mentioned, I trust it will still be available?

I bet they'll phase it out and try to force their worse service, wherein your data is stored on their servers, like they tried to do with PINs. It took enormous pushback to get them to stop mandatory PINs, and even then they made it nagware for a year or two. I didn't trust their rationale about PINs and remote attestation somehow meaning your data is secured by a small passphrase, just like I won't trust them to not…

While I understand (and share) your criticism, it does sound like they'll continue to support local backups:

https://news.ycombinator.com/item?id=45171576

https://news.ycombinator.com/item?id=45172188

Re: Signal Secure Backups

#280
post #199

Are backups really necessary? I have always regarded texts (over Signal or SMS) as ephemeral. No one is or should be sending valuable information over Signal, and if you happen to receive something you want to keep, you can always do so manually.

Why should information on Signal be ephemeral on Signal? Signal is one of the few "privacy-first" services. But it is not just about privacy, it is also about having as many users as possible, which is actually important for privacy. If only people who really have "something to hide", then just using the app makes you a target. If instead it is used by millions of people for grocery shopping and dinner planning, then…

My friends and family chats are on Signal because they're seamlessly cross platform. Not feeding Facebook is just a bonus.
Post reply on HN