Signal Secure Backups • Hacker News Board

Re: Signal Secure Backups

#341

Post by CobrastanJorji » Tue, Sep 09, 2025, 5:37 AM UTC

halyconWays wrote: post #234

CobrastanJorji wrote: post #216

> This has been a challenge for people whose most important conversations happen on Signal. Think family photos, sweet messages, important documents-- --or, of course, Joint Chiefs military coordination. I bet that was a fun surprise for the team.

And in that case it turns out the weakness was the device itself and the rest of the stack

The weakness was carefully going through the menus and manually adding a reporter to your group chat. There's not much the Signal team could have done about that.

Re: Signal Secure Backups

#342

Post by chithanh » Tue, Sep 09, 2025, 5:46 AM UTC

It's a self inflicted problem. Rather than using some standard message format for backups (like eml / RFC 822), and putting them in a standard encrypted container if so desired, Signal chose to use some proprietary database format. Also they apparently changed encryption formats some time ago, and the current version can no longer decrypt the old messages.

After moving devices I can no longer access/decrypt my oldest image/video messages, they failed to import properly.

Re: Signal Secure Backups

#343

Post by sunaookami » Tue, Sep 09, 2025, 5:52 AM UTC

cyphar wrote: post #207

Zambyte wrote: post #192

Earlier quoted context omitted.

Why?

Presumably they're referring to Google's plans to roll out developer signing requirements for all apps[1], which will affect F-Droid-installed apps. [1]: https://news.ycombinator.com/item?id=45017028

FWIW, adb install will continue to work: https://www.notebookcheck.net/Android-s-app-sideloading-bloc...

Re: Signal Secure Backups

#344

Post by Y-bar » Tue, Sep 09, 2025, 5:59 AM UTC

palata wrote: post #273

vigilans wrote: post #47

Earlier quoted context omitted.

This BS is why I completely stopped donating to the signal foundation. The messages are mine, not theirs, and yet they refuse to allow me to handle them how I deem fit.

> The messages are mine, not theirs, and yet they refuse to allow me to handle them how I deem fit. "They refuse to allow me" meaning "they don't add the features I want for free to the app they provide for free, so I complain". The messages are yours, of course. But don't forget that you use their work for free . If you're not happy, go use the free work of someone else, I guess?

They are somewhat correct though, Signal has written code explicitly to prevent iOS users from including Signal data in Apple’s encrypted local and/or cloud backups.

Allowing encrypted backups was free for Signal, but they spent time and money to prevent it for iOS users.

Part of the code the wrote to prevent backups in question:

https://github.com/signalapp/Signal-iOS/blob/5590f09c3643f12...

Re: Signal Secure Backups

#345

Post by halyconWays » Tue, Sep 09, 2025, 6:08 AM UTC

CobrastanJorji wrote: post #341

halyconWays wrote: post #234

Earlier quoted context omitted.

And in that case it turns out the weakness was the device itself and the rest of the stack

The weakness was carefully going through the menus and manually adding a reporter to your group chat. There's not much the Signal team could have done about that.

AKA deliberate or a compromised device

Re: Signal Secure Backups

#346

Post by MrDresden » Tue, Sep 09, 2025, 6:18 AM UTC

Personally I've never understood the need some have for keeping chat histories. So this isn't a feature I'll use, but am sure others will.

And remember, Signal is a nonprofit. If you use it, and if you can, you should be donating.

Re: Signal Secure Backups

#347

Post by XorNot » Tue, Sep 09, 2025, 6:27 AM UTC

roywiggins wrote: post #321

XorNot wrote: post #187

Earlier quoted context omitted.

It absolutely does not work fine. Keeping 2x the size of my database in free space on my phone to let backups work it's no solution at all, which is why I stopped doing it. (The backup creates two files - current and previous, and Syncthing can't remove complete files to another location, so you need an actually rather difficult to write script to do it).

I never really grokked Syncthing. I recently vibe-coded a crappy Windows Go GUI to grab files off my phone via rclone & sshd4a and then optionally delete them, but it's a very manual process since sshd4a has to be running on the phone before I initiate the pull.

Syncthing is just open source Dropbox, self hosted.

It's entire purpose is "make two folders identical".

It's very good at that: so good that I frequently wish it did other things - i.e. if it had some notion of minimum seeding levels so it would destage files off a device provided they were replicated elsewhere (e.g. automatically clearing old photos off your phone would be a good use of it).

Re: Signal Secure Backups

#348

Post by max_ » Tue, Sep 09, 2025, 6:32 AM UTC

Signal has over $50m in endowments.

But their desktop app is built with electron.

It's extremely clunky (over 200 MB) very slow and probably inherits all electron's security issues.

I have noticed the same issue with desktop apps from Proton Mail.

Why is it that rich corporations with lots of money like shortcuts and don't care about the quality of thier software?

Re: Signal Secure Backups

#349

Post by prmoustache » Tue, Sep 09, 2025, 6:34 AM UTC

rogerkirkness wrote: post #2

The main way I specialize messages at this point is basically 'Am I going to want this later'? If the answer is yes, I use email. If not I use Signal. It's interesting this was the most requested feature... it wouldn't be for me even though I love Signal.

so do you email yourself messages/conversations you want to keep?

Also unless everyone use gpg, email isn't very secure nor confidential.

I tend to use notes on my smartphone for information I want to keep that are encrypted and synchronized on my desktop when reaching home. Having said that I often forget to copy a message to a note because it is a manual process and it is sometimes not trivial to anticipate that an info will be important enough in the future that you need it again.

Re: Signal Secure Backups

#350

Post by pfix » Tue, Sep 09, 2025, 6:57 AM UTC

MrDresden wrote: post #346

Personally I've never understood the need some have for keeping chat histories. So this isn't a feature I'll use, but am sure others will. And remember, Signal is a nonprofit. If you use it, and if you can, you should be donating.

I just had a use case the other day: my mom sent me a photo of a handwritten recipe from my great grandmother a year ago. I only remembered asking about asking, not about the response, so I was happy to still have that pic in my history. Had I downloaded the Pic, it would be lost among all the other crap I store all ocer the place. This way it was preserved with the context and even a voice message from my grandmother (not great grandmother) remarking on it.