Hacker News Reader

Comment by dmix | Hacker News Reader

This is finally what allowed me to get rid of Telegram/Whatsapp. The lack of desktop integration is what held me back from using and recommending Signal with most of my friends. It's nice being able to use the same app for SMS, IM, and now desktop IM.

We've been using it for the last week and I've personally found it pretty flawless so far.

The only complaint I've heard from other people is that they couldn't sign-up when their phone was offline. But not a big deal given the security advantage of routing through a local device.

That is Telegram's biggest security/UX compromise which I hope they address, since I'm sure 90% of people using Telegram aren't really using E2E encryption the majority of the time - due to the fact encryption is not enabled by default in the UI, the lack of syncing conversations between devices for "secret" chats, and the fact a few official Telegram desktop GUI clients don't even support secret chats at all (including on Linux).

View on HN

How does giving away a known end point make a system more secure?

To me, it's the opposite, and makes Signal less secure.

A big problem with some E2E messaging systems is that your conversations aren't synced across devices. By routing messages through your phone, the way WhatsApp does in their desktop app, you can have the same conversation synced across both devices. (EDIT: additionally a server in between could sync the various client conversations as it seems Signal is doing).

Otherwise you end up with a situation, such as with Telegram secret chats, where encrypted chats are initiated on your phone<>friend, then you switch to your desktop and create a second secret chat channel with the same friend. You could then potentially miss messages that are still going to your phones secret channel - as your friend won't be able to know which secret chat is mobile/desktop or the "right" one to use at that moment. You'd have to close the existing secret chat on your phone when switching machines, which we often forgot to do in practice.

Signal Desktop messages aren't routed through your mobile device, so it's the best of both worlds. Once you've installed Signal Desktop, you can use it when your mobile device is turned off, and vice versa.

Ah, I assumed it was similar to WhatsApp. Even better.

The messages are being synced automatically between chrome client <> mobile clients, which is the key feature.

Fantastic work Moxie, thank you. My best to you and the team. Let us know how we can help contribute to the project (code/$/etc).

Not Moxie, but the desktop beta announcement[0] carried a link to a donations and grants page[1] and a link to their Github org[2] for anyone to verify their code and implementation, but not any request for or details about code submissions.

[0]: https://www.whispersystems.org/blog/signal-desktop/

[1]: https://freedom.press/bundle/encryption-tools-journalists

[2]: https://github.com/WhisperSystems

(@Moxie) Are there docs on how & why phone numbers are used, and what if any risks/threats/weaknesses are known to exist?

I'd love to see Keybase support for contact management and addressing, perhaps by hooking into OpenKeychain that's already got it integrated (OpenKeychain has an API)

Don't hold your breath - moxie isn't the biggest fan of GPG.

http://www.thoughtcrime.org/blog/gpg-and-me/

From the keybase developers: https://saltpack.org/

You should update your knowlage of keybase. They are more then just a GPG public directory. They try to have multi device end to end encryption capability distributed by a smart system of public key infrastruture. This gives them the basis to have multi client archtecture for messanging and file sharing. It is very cool because it allows you to revoke individual devices and thus also 'solves' the GPG problem of having one 'holy' key.

See:

- https://keybase.io/blog/keybase-new-key-model

- https://saltpack.org/

So does the Desktop client have its own set of keys? Do you encrypt every message for each device registered? Can I somehow revoke a device when I lose my phone/laptop?

Are you considering something like the Keybase Device registry? It would be fantastic if I could somehow add my phone number to keybase and integrate with Keybase. It would be a total hit, Keybase providing filesharing while Signal adds the messenging part, all backed up by a clever PKI that works for the online world.

I saw the desktop client mentioning something about generating keys after scanning the QR code. Afaik it works similarly to group chat[0], but instead of clients with their own keys belonging to different accounts they belong to the same one.

Open Settings > Linked devices and tap an a device to unlink on Android. Seems there's no way to revoke (yet) in the Chrome app.

[0]: https://whispersystems.org/blog/private-groups/

I see. Thats pretty cool. Its better then whatsapp web client.

I'm assuming the SMS integration is only for Android... But, yeah, this is great! I love Signal. Now I need to get more people I know to care enough to use it and not FB Messenger.

Reply on news.ycombinator.com