Hacker News Reader

Comment by kome | Hacker News Reader

Signal Desktop is not really standalone, because you still need to pair it with your phone. And the phone should be turned on.

I am very privacy conscious, and I don't use a smartphone, at all, because it's basically a spying device in your pocket.

Why Signal is all about privacy and then it forces me to pair it with a telephone?

Telegram desktop is really standalone. They require a telephone number too (and that's very annoying), but they don't require having a smartphone or keeping your phone open. My phone number on telegram is not even my phone number anymore, and it doesn't make any difference... Privacy wise is far from being perfect, but it's already better. At least it's usable.

View on HN

Signal Desktop works without having your phone turned on. It acts like a full, independent client after linking it to your smartphone app (unlike WhatsApp, which does require your phone to be turned on).

wow, sorry. my bad.

So I guess there is a way to use signal without having a phone nowadays! That's a great news!

I will try right now.

You still need a phone with a registered Signal on iOS or Android initially to activate the desktop version (sorry if that wasn't clear), but you can turn your phone off after.

Edit: It actually has the option to register without smartphone, but it's only enabled in the debug versions.

About your edit: precious information, thanks!

Speaking of edits, you should probably edit the misinformation out of your original post, while you have time. It's ranked pretty high up the thread and it's completely inaccurate.

You're right, I clarified it a little.

Oh I meant the original poster, who claims you need a turned-on and present phone for Signal desktop to work. The person you originally corrected.

The original poster was correct though. Just because you only need to do it once doesn't mean it isn't required. As a person without a smart phone I can't use it.

Nor would I since it still requires a phone number to use.

They could correct this line: " keeping your phone open"

Where can you get the debug version? I can't find it.

The debug version uses a different server. Will not work.

You can build it yourself from source. While it's true that the debug version uses different servers, the functionality is there and can probably be enabled in a production build with little modifications.

This might get you started: https://github.com/WhisperSystems/Signal-Desktop/blob/d1f7f5...

You could always use it without the phone.

You can get a google voice number and just activate through that. On iOS you have to type a confirmation code in manually, so there is no need for a debug version there.

If only Google voice existed outside the US.

> I am very privacy conscious

How did you evaluate Telegram to decide that you trust it?

I don't trust them, it's just that I can use them. The real problem is requiring a smartphone.

I don't get you. You chose a secure messaging platform that you don't trust?

He's using a messenger app with lower security than he'd like, because he can't use his preferred platform.

Without having a smartphone, using Signal wasn't an option (at least previously).

Sadly, almost everything involves tradeoffs.

He (understandably) prefers to use a tool which doesn't require a phone, over one with a better security model.

The desktop version never required a running smartphone (one might even be able to complete signup using the app in an emulator and a dumbphone or a VoIP provider to receive the SMS, not sure)

Wire seems to have better security, and it’s desktop app doesn’t require a phone number and supports multiple logins. Client and server are open source.

It’s got a pretty bad case of kitchen-sink flat ui, but is otherwise not bad.

Wire has crazy usability issues after sending a few hundred messages. Clients just freeze up and crash. Another issue is centralized metadata collection.

I know it's open source, but modifying it and recompiling all the clients I'm using would be very annoying.

How can you be very privacy conscious yet lack ownership of the phone number that your Telegram account's registered on? Whoever takes ownership of that number can easily lock you out of your account while retaining access to everything you've ever posted.

Telegram is protected by an additional password. I hope that's the case for signal or whatsapp as well.

Is Telegram as secure as Signal though?

No.

This comment is not helpful.

Here you go: "One major problem Telegram has is that it doesn’t encrypt chats by default, something the FBI has advocated for. “There are many Telegram users who think they are communicating in an encrypted way, when they’re not because they don’t realize that they have to turn on an additional setting,” Christopher Soghoian, Principal Technologist and Senior Policy Analyst at the American Civil Liberties Union, told Gizmodo. “Telegram has delivered everything that the government wants. Would I prefer that they used a method of encryption that followed industry best practices like WhatsApp and Signal? Certainly. But, if its not turned on by default, it doesn’t matter.”"

source https://gizmodo.com/why-you-should-stop-using-telegram-right...

That's not entirely true. While Telegram's "cloud chats" are not end-to-end encrypted by default, they're encrypted at rest. They claim that "all data is stored heavily encrypted and the encryption keys in each case are stored in several other DCs in different jurisdictions."[0] It's not even close to perfect, but it's also not everything that the government wants.

For me, the problem with Signal is based mainly moxie's position on the LibreSignal fork, which aimed to be a Google-Free version of signal, but moxie said he was not OK with LibreSignal using the Open Whisper Systems servers and the name "Signal".[1] I kind of understand his position, but that's not what I'd expect of the free software community and definitely not what I expect from someone who's in the middle of my communications.

In the end, the hope's in matrix.org. It supports end-to-end encryption, works without a number and is fully federated. Maybe someday Telegram and Signal can even federate with matrix.

[0] https://telegram.org/privacy#2-storing-data [1] https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

Note that Signal supports Google-free itself now - I'm running it on AOSP without Google Play.

It may now support working on devices without Play Services, but being the same apk, Google's libraries are still inside the app. This way it's not entirely free and doesn't fit F-Droid's inclusion policy. (https://f-droid.org/en/docs/Inclusion_Policy/)

Ah, I did not know that - thanks for clarifying. Does that mean that library code is still executed, or is it just "there"?

(Oh, and worth noting: it has an integrated update checker, so not being in F-Droid is less of a problem.)

I'm not sure, maybe it is worth checking the source code.

An update checker is nice though! I wish firefox had one, but at least there's FFUpdater.

I think it's fair to not want a project whose quality you cannot control use your servers and your name to compete for users in a market whose focus should he keeping those users safe.

The issue with not encrypting in transit by default is that it makes profiling encrypted communications MUCH easier and can potentially defeat the purpose via the Streisand Effect.

Why do you trust the very large attack surface that is your personal computer less than the smaller attack surface that is your smartphone?

How do you define attack surface? I trust my personal computer more than my phone.

My personal computer runs an open source bios (coreboot) with an open source operating system (linux) and no closed source software (at least one of my PCs does). My phone on the other hand has many processors running on it (that I know about) that can interact with my device without me knowing and binary blobs (yes even with lineageos and with microg) that I can't control and many parts I can't update or update as fast/easy as my pc.

My point: for most people the attack surface of the smartphone is far larger than the attack surface of the PC

Can you expand more on your personal decision to be so privacy conscious?

No.

This is a very Ron Swanson style answer that I approve of.

Reply on news.ycombinator.com