Hacker News Reader

> I really don't get the direction of the Signal project. iMessage got a huge following because it allows you to trabnsparently send both SMS and encrypted messages (significantly lowering barrier to entry) and brings that functionality even to the desktop

And it does this. On Android. Where the API allows it to do so.

On iOS, where Apple shuts out everyone not them from the interesting APIs, this is not an option. I was severely surprised when I got an iPhone and discovered I had to relate to several messaging-apps due to this restriction.

Still though: This is IMO not Signal's fault. They're just being limited by what Apple is willing to support.

You are right. But lets not kid ourself. It would be better if everyone just moved away from SMS.

To what? A proprietary channel controlled by an US company?

Well, moving away from SMS doesn't mean you're stuck with just Signal of course... what about XMPP for example?

I consider Signal an imperfect but extremely useful option for a very specific use case: getting my family and friends to send me (and each other hopefully) encrypted messages, just cause.

And after having done that, I can say I see the genius of the approach Signal has taken.

XMPP is looking better these days than it did not long ago. OMEMO makes encrypted messaging a lot simpler, Conversations provides a reasonable mobile client, and Prosody makes deploying your own server easy. Still a ways to go on some things (push notifications), but a lot better than it used to be.

It doesn't (I use Android) - it hijacks the datastore (breaking other apps that read it and backups), it doesn't work well with MMS at all and it doesn't sync conversations with the desktop app. It's a significantly subpar experience in comparison to iMessage.

It's really quite easy to get. SMS is not secure. They want their app to be called secure. And iMessage is not secure either, and not just because of SMS, but because the whole protocol is flawed [1]. So you're basically comparing two classes of apps: one insecure, and one secure, and you wonder why they don't both work the same way.

[1] https://blog.cryptographyengineering.com/2016/03/21/attack-o...

I'm also really tired of seeing the SMS argument for all new chat applications that appear. SMS is a dinosaur and it deserves to disappear. A lot of people don't rely on it already (likely over a billion, or virtually all WhatsApp users, and there are more apps like it). New apps shouldn't be held back just because some users still rely on it.

SMS is the IE6 of the carrier world. To see the same people decry email insecurity, but at the same time want to use SMS by the carriers that are "tight partners" with intelligence agencies all over the world, and in a world where the police is increasingly using more phone-spying tools without a warrant is really mind-boggling.

I do fully agree with you that Signal needs a proper desktop application that works (I still can't seem to be able to import phone numbers from the phone to the Chrome app - it always fails for me).

This is the exact same issue PGP and other secure communicators face: noone will use them if they're INCONVENIENT. At this point Signal is just a worse version of proprietary WhatsApp and a significantly worse version of iMessage. It doesn't offer anything better or anything new. SMS might be insecure, but its integration offers convenience which makes for a great stepping stone to making Signal widely used and available.

If we actually take a moment to heed what history taught us is: noone gives a damn about security. It's a nice tick on the feature list, but it's a low-priority tick. It'll always be trumped by convenience and networking effets. Without understanding that, Signal is on its way to the garbage dump of history together with PGP, XMPP and countless other secure protocols.

SMS integration is a great trojan horse to make people use it - just replace the existing messenger and you can message to people via your computer! As the userbase grows, Signal switches to secure communication anyway until you can finall y drop the SMS support. But without that user growth, it's exactly what I wrote above - a shitty version of iMessage and WhatsApp.

But except for the shitty MMS support (MMS groups never seem to work for me), Signal's SMS support seems just fine.

UI is quite horrible, good luck forwarding whole conversation to someone else, you need to select all messages one by one

good luck sending more photos at once, you can send photos only one by one

these basic case scenarios really make it look like it's made by some teenager

I for one would love to finally move away from Skype. I even got my Mom to install and use Signal for texting between US<->EU, granted 98% of her friends use iMessage or the default SMS app, but at least our messages are secure. As soon as this update goes live, I can have her remove Skype.

Nobody in my country really uses SMS, because it costs. Instead, what I'd like from signal is an open source client library, so I could build bots and use Pidgin to talk to my contacts. Is that too much to ask?

https://github.com/WhisperSystems/libsignal-protocol-java or one of the other things at https://github.com/WhisperSystems would seem to be what you need.

That basically exists, but AFAIK you can't use it with OWS's servers, which means you can't interoperate with regular Signal users.

You'd have better luck with Matrix, which is designed for this kind of use case.

Yeah, the fact that you can't just text your Signal phone is really constraining :/

Matrix is great and I really hope it takes off, but security is bolted on, and the clients aren't really on par with Signal. I'm going to wait a bit before I switch to Matrix, but hopefully I will, at some point.

I guess they aim to be the next Skype. Which actually is a very good move as Skype has become so shitty after MS acquisition, that it's simply begging for replacement and even common users loathe it now. Signal can't remain "just another messenger" as it has no chance to stand against Facebook Messenger and Whatsapp among common users.

It sounds like you want Silence https://silence.im/

It's a fork from the old Signal (nee TextSecure) code that retains the SMS capability. It was called SMSSecure for a while, but the name was changed to avoid trademark confusion or something.

I use it for my main texting app every day. It's really nice! I think I'd still use it even without the crypto, just because the interface is nice and it doesn't upload my data into anybody's cloud. I only have secure sessions set up with a very small number of my contacts, but oh well. More and more of them are getting on Signal these days, so I do have a secure option for talking to them.

> they're wasting resources implementing video chat which noone really asked for

Could you expand on this? What data are you basing this on?

SMS and MMS are almost completely irrelevant outside of North America.

That's not even remotely true. It's the only common denominator on the mobile network that ensures delivery to everyone and it's still widely used everywhere.

I'm not saying it's not used, but it's mostly used one way (I receive SMS's but never send any) and irrelevant for modern instant messaging.

The common denominator where I live is Whatsapp. If you send an SMS to someone, they will very likely not reply. In other countries it can be WeChat, LINE, Kakaotalk, ... and Signal is competing in this space.

What the? ... Oh, you mean on that alternative Earth where America is the only country.

Well, where I live, in the Netherlands, SMS is indeed completely irrelevant.

is it no longer used by banks for mTAN transaction verification?

Some banks indeed do still use that option but it i s decreasing. Some have apps without 2FA (the use a separate code) or they have key generators that work with you bank pass (a form of 2FA.)

It's used widely all over the world each second. In Denmark, its used by everyone including public and private institutions for sending e.g. doctors visit notice, notice about garbage pick-up and so forth. I don't have statics on hand but in 2015 it was around 97% of Americans that send at least one SMS each day.

I still believe we should get rid of it and use something encrypted.

I live in Europe and SMS is very much relevant as unlimited number is included in my subscription fee. Data, on the other hand, is capped, so it definitely makes sense to use SMS.

Your country is an exception in Europe then, not the norm.

Not really. The GSMA did some research on this - see https://www.gsmaintelligence.com/research/2016/12/ip-messagi...

That study just proves my point :)

Dozens of my customers SMS me, as well as many friends and family, and several friends send me MMS from time to time. UK here.