Signal for Beginners
medium.com
medium.com
Right now I am testing with Wire, and waiting for proper pasting from clipboard. Although I am concerned with privacy, and I applaud the efforts from OWS, usability is more important to me. It will always be some sort of a tradeoff I guess. Although things seem to be getting better I am saddened by the lack of federation.
(edited for clarification)
http://support.whispersystems.org/hc/en-us/articles/21507785...
__________________
What do I need?
1. Register and set up Signal Android or Signal iOS
2. Download and install Google Chrome or use Chromium
+++++++ EDIT: Having to buy and throw away a phone to use a service that's intent is to provide privacy is what it is; worth noting you revised your comment after I posted mine.
That said, registration independent of a phone number comes up a lot here. Signal is primarily a mobile messenger, so the assumption that its users have a smart phone running Android or iOS is a valid one imho. It would be nice if people without a smart phone could use it, too, but implementing this in a way that maintains Signal's ease of use for all participants isn't exactly trivial (contact discovery is a big one). I'd appreciate it, but I can also understand why it's not #1 on OWS' list of priorities.
I disagree, as long as it's an OPTIONAL and non-default method. Many people (billions?) have been registering to various messaging services (from email to Skype and all kinds of IMs) and finding each other just fine, without using a phone/phone number.
Phone based authentication has a couple of advantages too, but when a "privacy oriented" messaging app has this as the only option it's fair to point it out.
I have been toying with this idea, I haven't actually done it myself but I know people that have.
1) get a VOIP provider to give you a free iNum number
2) download signal to your smartphone or ipod of choice
3) during the registration phase, delete the number that it suggests, replace it with the iNum number from step 1.
4) make sure to have the registration process do the "voice call" method where it calls you and reads you off the registration number.
5) register.
Assuming that you already own a cellphone and you use a free voip app like csipsimple or linphone. iNums are free from most voip providers. Then this process costs nothing.
That's my biggest issue with Signal as well. I very recently (as in, over the past two days) completely dropped Google from my life[1]. I switched from Gmail to FastMail for email, calendar, and contacts, and FastMail also offers 10GB of file storage at their middle tier, which is about five times as much space as I was using in Google Drive. I switched from Chrome/Chromium to Firefox, and I'm currently trying to decide which photo backup service to use to replace Google Photos. I'll probably run CollaboraOnline via a local Nextcloud server for a good Google Docs replacement. I'm using StartPage for search, as I find its results to be more relevant than DDG.
All of that said to say this: It's absolutely refreshing to break out of the Google tar pit, and I'm very interested in a secure messaging app that doesn't depend on them at all. Being free from 24/7/365 tracking, no matter if it's "just for advertising purposes", is a breath of fresh air, as is knowing that all my eggs are spread out among several baskets now.
[1] I do still have an Android phone (Nexus 6) but I switched from the official Google ROM to the latest stable Cyanogenmod, and opted to not install the Google apps bundle. My battery life has gone from about 30 hours between charges to nearly 70 hours (as predicted by the battery meter; I haven't had to charge it since I installed CM on Monday night and I'm at 81% as of Wednesday morning). I've been using F-Droid for some great replacements for many of my everyday apps, and the Amazon App Store for a few necessities like Paypal and Fing. As on the desktop, I'm using Firefox on the phone mostly for the syncing capability, though I will say the built-in browser on CM is fantastic. Of course, I'm actively seeking a non-Android, non-Apple alternative for a mobile phone, and right now the DragonBox Pyra is a front-runner, with the Neo900 a close second.
This is what i want (and what i'm actively working towards)! The "banned from Google" talk has really harmed them in my eyes.. at least for people like me. I hadn't really questioned Google in the past, but now i'm looking to spread out my eggs as much as possible. Very important to me.
Be aware that if your Mozilla account password is not a fully-secure, unmemorable, random string then it is possible to break into Sync: unlike previously, the only thing securing your Sync data is your password.
Also be aware that at any time Mozilla can push a piece of targeted JavaScript to you alone, which would reveal your password to them.
The first issue is solvable by using an appropriately-secure password, e.g. apQzICxawJKkU0t7SNqnPd; the second issue is unsolvable unless you fully trust Mozilla the organisation, all its employees and every government which is able to compel its actions.
That battery life sure is impressive
The battery life surprised the hell out of me, especially since I spent a couple of hours getting the launcher set up the way I like it. It's telling how much battery and data are used when your phone is constantly in contact with the mothership versus a device that only connects to a service when you strictly allow it.
[1] https://riot.im
If a user is willing to put up with a less useful and usable version of Signal - they should be allowed to use it without identifying themselves.
Beyond this issue, there are others that me show a troubling pattern. For example, Moxie has refused to post a "warrant canary" for US National Security Letters.
In spirit, I like Moxie, in practice, I feel like he's the captain of ship flying a false flag.
OWS recently received a subpoena and fought to be able to publish it (and their response), the only data they could provide were registration and last contact timestamps.
And if it is face2face, scanning a barcode like e.g. Threema supports is even quicker.
Different apps for different categories of users.
I'm not convinced that "just put my phone number 0394859489 in" is so much easier than "I don't have my phone number in there, just type in horse-battery-staple" that not having the second option is a large usability win. Or "give me your phone number and i'll add you" ;)
It's very laudable that Signal tries to be perfectly easy, with as few options as possible, but on the other hand I feel the overdo it in many cases where a slightly more manual, hidden way would help to mitigate issues. If it works for you it's fine, if it doesn't (either through convention or actual bugs, the latter ones are a bigger issue for me) you are out of luck. That's not great for adoption either.
I think signal:wtbob works just as well as tel:+15551212, if we want to continue to rely on OWS as a central identity provider.
I think that 'mom's dad's sister June' also works, if we want decentralised identity.
That doesn't work as well for auto-discovery of other Signal users, though. The latter enables auto-discovery based on people whose phone numbers are already in one's contact books. With the former, one needs to collect other people's usernames. It's not a tough thing to do, but it does make auto-discovery difficult.
It does if one's Contacts app stores Signal contact information for one's contacts; then one could simply query using non-Signal information as the key (e.g. one could ask, 'give me Signal contact information for tel:+15551212, mailto:fizzbuzz@barquux.org and http://plus.google.com/SomeUserName').
That doesn't seem like a very good tradeoff because then it requires Signal to store/compare _more_ personally identifying information (though I guess you could make many of those things pseudo-anonymous).
Actually, it's possible to do even better that that: one can execute a private set intersection protocol so that you & each of your contacts can discover mutual contacts without revealing others.
Signal aren't required to store any personally identifying information: they choose to do so.
Can you expand on that? I'm not sure quite what you mean.
Also, my great aunt is called June.
Sure! It derives from the SDSI/SPKI work of the late 90s, which demonstrated how one can use petnames (i.e., local nicknames) for people, and then refer to a contact's petnames via one's petname for that contact.
So you might refer to a name (mom dad June).
Did you fudge the last example though? My mum's dad is not called June. Or am I misunderstanding?
You can just get a VOIP number or burner phone somewhere in a relatively anonymous manner, register it with Signal on your android phone, and go about your business if anonymity is an important requirement for you.
Definitely a hassle, but for anyone for whom a phone number is insufficiently anonymous I would imagine they're used to it.
I admittedly don't know as much about the options for VOIP but I've got to to believe there's a way to get a phone number on the internet where you can receive SMS and keep it active indefinitely.
My question is..why do you need a phone number (which imo is way more personal, than say an email?). Being security focused...would it not make sense to have as much less info on the person as possible?
We have settled on kik for now. (although call support is lacking, i feel like it'll be added eventually)
It's an sms/ MMS end to end app.
*I don't really have a horse in this as I use none of them