Live data from Hacker News

Signal Secure Backups

signal.org

91–100 of 460 posts

Re: Signal Secure Backups

#91
I am happy to see Signal charging for premium features.

From a product perspective, being able to switch between two iOS devices without a 3rd iOS device shouldn’t be a premium feature.

Please consider enabling local backup and restore for a single Signal instance on iOS.

Re: Signal Secure Backups

#93
> Losing it means losing access to your backup permanently, and Signal cannot help you recover it.

Oof... That's going to be tough to explain to normal users. "Sorry you've been paying for backups all this time, but you should have written down this code that you will only ever use once somewhere safe and remembered where it is. All your data is gone."

Not the right security trade-off for most people.

Re: Signal Secure Backups

#94
post #48

Backing up Signal on Android for free and offline was ~always possible. The app creates a multi GB backup file on the phone memory under the Signal folder that you can just copy out and back on a new phone. The file is encrypted with the passcode and the database can be extracted. https://github.com/bepaald/signalbackup-tools

There are a couple of problems with the existing backup: 1. It is non-incremental. This means you'll need about as much free space on your phone as your Signal database takes, and it may take many hours to make if your database is large (mine is 18GB). I used to wake up to find my phone had not even fully charged because it had been so busy writing Signal backups. 2. Once you have it on disk, how do you get it away f…

On Linux KDE connect can mount your phones filesystem as FUSE filesystem and then you can use desktop file explorer like dolphin. It's even integrated and automatically apears as an option. Quite convenient, I would say. Performance is pretty good too.

Re: Signal Secure Backups

#95

> Losing it means losing access to your backup permanently, and Signal cannot help you recover it. Oof... That's going to be tough to explain to normal users. "Sorry you've been paying for backups all this time, but you should have written down this code that you will only ever use once somewhere safe and remembered where it is. All your data is gone." Not the right security trade-off for most people.

there are more than a few backup providers that do this security trade off with user acceptance of the risk. if this trade off isn't good for the user, they can use any other number of insecure backups.

Re: Signal Secure Backups

#96

> Losing it means losing access to your backup permanently, and Signal cannot help you recover it. Oof... That's going to be tough to explain to normal users. "Sorry you've been paying for backups all this time, but you should have written down this code that you will only ever use once somewhere safe and remembered where it is. All your data is gone." Not the right security trade-off for most people.

It's this way, or it's not encrypted. The whole premise of their privacy model requires this.

Signal opens themselves up to government coercion and ruined reputation otherwise.

Re: Signal Secure Backups

#97

> Losing it means losing access to your backup permanently, and Signal cannot help you recover it. Oof... That's going to be tough to explain to normal users. "Sorry you've been paying for backups all this time, but you should have written down this code that you will only ever use once somewhere safe and remembered where it is. All your data is gone." Not the right security trade-off for most people.

The implementation feels uncharacteristically crude for Signal. Instead of seamless protections, you just get handed 64 characters you’re told to “store securely.” That’s not realistic: most people will screenshot it, and those screenshots will end up in unencrypted cloud backups.

Re: Signal Secure Backups

#98

Earlier quoted context omitted.

Only on Android, not iOS.

It's not Signal's fault that Apple does not let you access the most basic feature of an operating system - the filesystem.

They do and have done for years now. There’s been a files app since 2017. They’ve had Advanced Data Protection available for iOS backups since 2022. Signal has just been lazy and found maintaining the Android backups to be a pain, so they refused to implement it for iOS.

Re: Signal Secure Backups

#99

Am I still required to add a phone number to use signal? What's the point of that. Every single person in the USA (and probably world) is quickly and trivially de-anonymized with a phone number.

nobody has access to your phone number from your account, and when subpoenad they are unable to provide it:https://signal.org/bigbrother/

'the point' is spam protection, alas

Re: Signal Secure Backups

#100

Earlier quoted context omitted.

I don't think it's appropriate to call someone you're talking to with disappearing messages turned off making a backup of the conversation so they have the (non-disappearing) message history if they drop their phone in a lake as "adversarial behavior". If you don't want them to have a history only communicate via disappearing messages.

This post says disappearing messages are included in the backups. You have to enable disappearing messages with a timer of less than 24 hours to ensure that you can opt out.

Sure but the backup happens each day and then gets overwritten/deleted when the next days backup happens (which then deletes the disappearing messages that are expiring express the next backup). It just ensures you have access to any messages that you’re supposed to have access to according to the timers on said messages.
Post reply on HN