Hacker News Reader

I've been switching people to Matrix recently, mainly because they have a solution for losing your chat history (you don't, at least not with the new key backup system) and there's a lot of other features like bridging and federation. Matrix is far from perfect at the moment but I feel that it will end up being a much more complete solution than Signal (the new seven-word key verification system is really cool and much better than how verification works for Signal).

> Not both. Why? I don’t know. But Signal insists that it is more secure.

It's because the provisioning support is only implemented in the JavaScript "SDK" (in scare-quotes because we all know Moxie is very hostile to users using apps other than the one they publish).

Not only that, there were PRs that implemented the core functionality required and Moxie effectively said that the author was too inexperienced for the patch to even be worth reviewing[1]. There are third-party signal clients[2] which use that patch to allow for you to create "virtual devices" in your shell and thus (in theory) script signal chats or create Matrix bridges (I hope to do the latter at some point).

[1]: https://github.com/signalapp/libsignal-service-java/pull/21 [2]: https://github.com/AsamK/signal-cli

Keep in mind that some (though not all) of Signal's UX "weakness" is a deliberate consequence of tradeoffs Signal makes for end-user privacy. Signal didn't even have user profiles until relatively recently, when the team came up with a privacy-preserving way of implementing them. There are UX features that are relatively easy to build, and par for the course in chat applications, that are much harder in Signal's model because they don't keep server-readable directories of who's talking to who.

If you seriously care about privacy, when you look at chat app features, think "how would an ordinary developer be most likely to implement this feature, and what would that mean the application was tracking about me as a consequence?" One nice thing about Signal is that as a general rule, you can assume they're not trading privacy for convenience.

It is also reasonable not to care as much about privacy as Signal does. If you want something with more UX niceties, but something close to (and, in most cases, cribbed from) Signal's security model, Wire is a good bet. Just remember, Wire has a lot of metadata about who you're talking to that Signal would treat as hazmat.

Check out https://pyre.chat (pre-alpha) and signal-weechat for a non-electron based desktop client that won't nom all your ram.

https://github.com/thefinn93/signal-weechat

Signal makes for a decent SMS replacement, IMO they have put little effort into being a group chat competitor. Some bots like https://git.callpipe.com/yosl/repost4privacy can make groups more user friendly, but group management is still poor.

Edit: added last paragraph about groups.

For people using Windows, there is a C# unofficial client as well

https://github.com/signal-csharp/Signal-Windows

signal-weechat looks very interesting. do you have any idea how well it works?

Its seem much less development than pyre.chat, but it is a functional client (tho pictures all end up in a folder when sent your way, as images + ncurses doesn't really work).

Now try backing up your conversations and group memberships - I've rarely seen so convoluted and user hostile process which practically ensures people will lose their chat histories and just switch to FB Messenger in disgust.

I do admit the rest of the experience has improved, although the ban from binding more a single device to an account is still preventing me from using it more.

Check out my other comment about pyre.chat and signal-weechat, perhaps one of them will work for your use case?

Signal does need serious help on the backup/restore process, iOS users are left in the cold and Android backups often fail when one attempts to restore them.

I've followed up on issues on Signal Android about backups being borked (even getting Moxie to fix a bug at one point) but backups are obviously not a priority for the Signal Foundation. Very frustrating, and it has caused my friends and acquaintances to ragequit Signal in some cases.

what are other secure apps that are competition for Signal and do some of the other things right ?

WhatsApp uses the Signal Protocol and Wire uses a derivative of it (not the actual Signal Protocol). Both collect metadata that Signal doesn't (and I believe the last time I checked, WhatsApp stored unencrypted chat history to iCloud).

Wire uses a protocol derived from and related to Signal Protocol, but does not implement Signal Protocol.

Thanks for the correction; fixed. I had always thought that Wire implemented the protocol explicitly, but I guess not.

you are correct about chats being unencrypted in icloud as well as google drive.

So looks like signal is the least of all evils at the moment

Matrix is designed such that all of your chat history is preserved (as long as at least one of the servers involved in the chat wants to keep the logs). And the new ephemeral key backup system allows you to really simply get set up on a new device and have all of your old chat history available (if you want, you have to opt-in to it).

Matrix is not a reasonable Signal alternative. If you want something in the vicinity of the security model of Signal, but with more UX polish (and less privacy), Wire is your best bet.

In which aspect is it not a reasonable Signal alternative? I know that you have expressed a dislike of Matrix before, but I'm not sure if your point here is that it isn't a Signal alternative or that it isn't reasonable (in a crypto sense).

> It’s a problem with these security focused applications. They often sacrifice usability on the altar of best case security; making applications that are hard to use for anyone but the most ardent of folks.

I actually feel like Signal has done a better job than most in this respect. The interface is attractive, they make things like key resetting reasonably parseable, and there are nice mainstream features like built-in gif searching.

That said I've fought with syncing problems at times, mostly surrounding the desktop app. Presumably it has to do with the authoritative copy being phones in peer to peer mode, instead of a server, but it's still pretty annoying sometimes.

I couldn't agree more with this, the constant requests to restart drive me nuts. It wouldn't have been so bad if it happened once a day, but 2-3 times make the usage as annoying as it can get.

What platform are you encountering this on? I have yet to see this behaviour, though Signal Desktop will throw away all its data if the checksum on the database fails (eg: dying SSD/hard drive).

Take a peek at my other comment perhaps, signal-weechat & pyre.chat might be of use