Hacker News Reader

Comment by jjeaff | Hacker News Reader

I mean, your choice is between an app owned by Facebook or an app owned by the creators of the largest social network in Russia.

I'm surprised more aren't using Signal, open source, and I believe funded by a non-profit organization. With founders that are known to care about organizational transparency and user privacy.

View on HN

> owned by the creators of the largest social network in Russia

Another way to describe them is people who lost the largest social network in Russia and are now Russian expats and dissidents.

> Signal, open source [...] With founders that are known to care about organizational transparency and user privacy.

Not open source, only partly, just like Telegram. And founders are known to have a radical position on trading privacy for centralizing as much control over the app as they can, tying identity to phone numbers, etc. They have exactly as much control over the app as Telegram has. But they are not dissidents or expats and who knows what they are going to do or did with covert or overt government backdooring attempts. Still, despite all the flaws both Signal and Telegram are in a bit better situation wrt privacy than Facebook owned Whatsapp, being in a business of compromising privacy and all.

> Not open source, only partly, just like Telegram.

Signal is completely open source. I'm not sure why you think it's only partly open source.

Quoting Wikipedia[1]:

> All Signal software are free and open-source. The clients are published under the GPLv3 license, while the server code is published under the AGPLv3 license.

[1] https://en.wikipedia.org/wiki/Signal_(software)

It's not even on f-droid. You install the binary they control and connect to the servers they run, it's literally a proprietary app, just like Telegram.

App being open-source means you can compile and build it yourself.

They've also gone to extreme lengths to prove that the software running on their servers has not been tampered with: https://signal.org/blog/private-contact-discovery/#trust-but...

I think your doubts create very unreasonable expectations for Signal.

Telegram can be built locally too, and there are independent apps for it, and they have taken efforts within the security community to prove that it is secure.

Can you build and run the server locally?

You may be able to run Signal server from your build, but you won't be able to talk to users on Signal.org. Signal's official position is that it will never federate with others. So I don't understand how building and running a server locally is a step up in any way.

You can run your own signal server and compile the app to point to your own server instead of theirs.

It doesn't get much more open source than that.

I like the concept of Signal but Telegram has some great features like usernames and public chat groups. In the end, better encryption by itself (Telegram rolled their own) loses out over function.

Also, the owners of Telegram are not on good terms with the Russian government (its been banned before).

My routine reminder that Signal doesn't have these features because they genuinely care about privacy and metadata security, and will withhold basic messaging app features until they know how to provide them without (a) creating a database of every pair of communicating users that they retain serverside and (b) leaking information about conversations to traffic analysis. See: user profiles, GIF sharing, both with really interesting explanations of how Signal ultimately figured out how to implement these features.

It does make Signal a little less usable than some other messengers, and I'd be lying if I said I didn't use Slack a lot more than Signal. But this is also why Signal is what I use when the secrecy of what I'm talking about actually matters.

> But this is also why Signal is what I use when the secrecy of what I'm talking about actually matters.

Which is fine but will never work with the average WhatsApp/Telegram user. First, they have to be educated, they have to care, they have to decide if what they are typing affords that extra level of protection, if the inteded destination is on Signal, etc. It's too much.

I've tried to convert friends and family to Signal but not a single one continued to use it after a few days.

But I think it's fine that Signal is making these compromises in favor of security and privacy. Maybe we don't really need mass adoption, as long as the people that really need it know where to look.

If they care about privacy then why do they require a phone number which is linked to identity and location? If they worry about bot registrations, they could require a small fee in Bitcoins to sign up.

Careful conflating privacy and anonymity

I really like the idea of Signal and try to use it as much as I can, but man it’s an ugly app. There must be a way to design the UI a bit better without compromising security and privacy.

Signal might care about the privacy of my information with respect to themselves or eavesdroppers but it is not very effective at protecting my privacy with respect to people I might want to talk to because I have to give them my phone number, which reveals my location and potentially my identity if it is linked to Facebook or something similar.

The Telegram founder is hated by the Russian government, and does not live in Russia. There have been some futile attempts to block Telegram in Russia.

Signal may be open source, but it's still as centralized as Telegram is. Signal.org will never federate with other servers running Signal (this is the official position). Signal also lags behind a lot in UX and convenience, when compared to Wire or Telegram.

I don't get the Russia hate. Sure they have problems as a country, but how does that affect the average user? I would think that since I don't live there I can trust Russian companies more than I can ones in the US.

> I'm surprised more aren't using Signal

It's just no polished like Telegram. It's painful to use compared to other apps.

I think it is worth noting that the creator of VK (Russia’s Facebook equivalent; overtaken by the Russian state), is actually a known libertarian dissident.

Yes, politically Telegram is in the best position between all three.

By the way, Signal requires a phone number which is linked to the passport. It means that the government can scan it for all possible phone numbers and get a list of people using it, and maybe even their nicknames and profiles.

Signal could help themselves by making their product a bit more accessible. And I'm not buying the "e2e encryption would get compromised" arg, other have figure it out. I'm talking about the fact that some of us can't install their desktop app on our work machines, or use Chromebooks, or use tablets. Give us a web interface ffs!

Reply on news.ycombinator.com