Signal app downloads spike as US protesters seek message encryption
qz.com
qz.com
* sub-par user experience: WhatsApp is just nicer and smoother, and people tend to like that
* very few people understand that Signal DOES NOT get your full contact list, while Facebook (through WhatsApp) does
Especially the second point is very relevant with the current situation — you do not necessarily want to expose your entire social graph to Facebook. But so few people understand this, and even fewer grasp that Signal can still work without doing the same thing.
The full contact list is uploaded to Signal servers by the phones. The only protection layer that users have is the questionable security of Intel's SGX.
It's still much better than what WhatsApp is doing, just not a black and white situation.
To add a point to your list: Signal does not have automatic cloud backup of messages, unlike WhatsApp. On WhatsApp, 30% of users have cloud backups enabled [1], meaning that you can basically assume that any reasonably sized group's messages can be accessed by people who have subpoena-power over Google (chance that there is no backup-enabled account in a group of n people is (1-0.3)^n... for 6 people it's already 12%).
Yes, it's hashes of phone numbers instead of the phone numbers themselves, but that's a detail. Phone numbers are easy to brute-force especially for people the protesters are worried about, as well as easy to build rainbow tables for.
If they were all individually salted, there would be no way to compare against new joiners.
I say theoretically because these schemes all have a core problem when they're not federated - you have no idea what your client is really doing and it's the client performing remote attestation with the enclave. You have no control over it. It could update tomorrow and switch every last bit of encryption off. Or it could do RA but not pin the enclave hash to anything audited (i.e. it accepts any enclave signed by Signal).
It's not a theoretical problem. Facebook say that WhatsApp is end to end encrypted, in the same way as Signal. That didn't stop them blocking people from forwarding links related to coronavirus. The literal and entire point of E2E cryptography is to stop them monitoring and interfering with people's communications, Facebook have been assuring governments for years they're powerless to do that, but of course the moment Facebook wanted to fight "misinformation" it all went out the window.
Fundamentally Signal and WhatsApp can never provide meaningful encryption or privacy. They don't allow alternative clients, so regardless of how much code they throw into the mix they control the entire pipe end to end and can just as easily switch it off again. And the moment their employees feel they have a sufficiently good motivation, it'll happen again.
Source?
Pick any version of the story. Or read their blog post:
https://blog.whatsapp.com/Keeping-WhatsApp-Personal-and-Priv...
How do they know a message is forwarded? The encryption is meant to make identical plaintexts encrypt to different ciphertexts, so obviously they must be leaking the forwarding status in unencrypted parts of the message. And why is an encrypted service trying to combat misinformation to start with - isn't that a contradiction in terms? These things raise difficult questions. You'd hope that once a service decides to go fully encrypted, its staff would believe that what kind of information going over it or how accurate that is, isn't any longer their concern.
Today, Signal is claiming their encryption means the only data they have to give to government is date of install and last use. In the past they also claimed WhatsApp uses the same cryptography as them, at least for messages. These two claims cannot both be true. If there's some incredibly subtle detail that means deliberately exposing forwarding metadata in WhatsApp but not Signal they should really clarify that because it's not something I've ever seen a discussion of, and it doesn't follow from the cryptography they're using.
That was exactly my point: few people know about this.
Why does it "really hurt" Signal that are sub-group of the population is ignorant of its features? I doubt that's going to stop people from downloading a privacy app, most people don't care about privacy anyway, and if they do, they will DL signal.
Having a slightly worse UX because that's just security considerations is one thing.
Having a slightly worse UX because reason that isn't related to security is another.
I've tried getting my wife onto signal, and while she's happy to try it out because I ask her to, she struggles to stay on it due to by day to day UX. I'm happy to deal with the issues, the general is not. And because they're not, I'm stuck with WhatsApp too.
If signal wants to have a shot at taking over WhatsApp and help with addressing the core issue at hand, specifically encryption between users, they need to address the UX. Sure if you can't address certain things because it weakens security fine, but if you're not addressing them because they think users won't mind because they're here for something else (i.e. security), it's gonna be a much harder sell, and it'll just stay a niche market.
Ive used both for a while and WhatsApp is aweful, at least on iOS by all standards I can find. Signal feels like iMessage with reactions, voice recordings, and handy tools. WhatsApp feels dated, clunky, and for groups it gets very very messy fast with out reactions.
[0]: https://www.militarytimes.com/flashpoints/2020/01/23/deploye...
[1]: https://www.theguardian.com/politics/2019/dec/17/tories-swit...
Or "The logo looks cool."
Or "It had 4 stars."
Of "It had lots of good reviews."
Once you're on the list of suspects from someone elses Signal chat, you're not going to persuade a suspicious official by bullshitting.
There have been lynchings in India based on this kind of data leaked by WhatsApp which resulted in them finally allowing joining groups anonymously.
It definitely needs to be more reliable, though. The last time I tried to call someone with Signal instead of just using it for messaging, I got a ringing indication but they heard nothing and then after a few seconds the call showed up as missed, and the same happened the other way around with them calling me. There seem to have been about 500 updates to the iOS app in the past 5 minutes via the app store, though, so many whatever caused that was a short-lived glitch.
Not a joke, for real.
They are experts at getting you to talk to them even if you know this. They are experts at getting you to say things that incriminate you or your friends -- that you or your friends have done nothing wrong (in your opinion/as far as you know) will not protect you.
The only answers you should be rehearsing or thinking of in advance are "I would like a lawyer" and "I would like to remain silent." They are rehearsing how to get you to say incriminating things, a lot. Rehearsing or thinking up any other answers only plays into their strengths. Even knowing this, I've been tricked into talking to them, to my detriment. They are really good at it.
If you're not arrested, you should be able to just leave the interrogation (emphasis on should, of course).
We made a relationship with one I found through family via estate planning (not his specialty) and land deals (not his specialty).
Now I have a name to say out loud when I interact with police. This has happened twice. The OP is right, they'll do everything they can to get you to talk, but understand that if a police officer is talking to you, they're digging for information to incriminate you. In my case, I was a witness to something, and they cuffed me and made me sit on the curb. No possible way I could've needed to be cuffed and questioned. And that was the approach my lawyer took when he came. Best $100 I ever spent.
Are you sure you're not exaggerating? I've totally seen incidents where cops were only talking to see if they've even found the right person. They lose interest pretty damn quickly when they realize they're talking to the wrong person (even to the point of rejecting extra evidence you might offer yourself). Whereas I'm pretty damn sure in these cases you cause yourself a lot of (short-term maybe, but still) grief if you suddenly go on the defensive and plead the 5th. It unnecessarily makes you look guilty, whereas a couple minutes of talking can make it crystal clear to them you're totally clueless.
I do not believe it is a good idea to speak to police unless they have a clear suspect, motive, evidence, and other indicators they are not fishing for you to be the suspect.
I firmly, firmly, firmly believe short-term hassle and a lawyer's bill are much better than the long-term ramifications of an arrest, even if you are not convicted ultimately.
Of course, they can arrest you even if you don't talk to them. It's ultimately up them whether to arrest you, not to you. You don't necessarily get out of getting arrested by not talking to them. (If they say you can get out of getting arrested by talking to them, they can be lying!). But you make it much worse by talking to them.
I spoke to a family friend who quit the police department I was dealing with over ethical concerns. He said that it was pretty standard practice, especially when dealing with a case they had zero suspects on. He said, "they'll bring you in, they'll tell you you failed, and they'll tell you that if you confess, they'll go easy on you because you're so young. It's not the results that matter on a polygraph, it's the answers you give. Don't lie, and don't incriminate yourself."
He was 100% correct. They brought me back to the station, into an interrogation room, and after about an hour of waiting, told me exactly what he said they would.
I lost all respect for law enforcement through that process.
If you’re in serious trouble like a murder, financial or computer crime you’ll probably be questioned before you’re arrested. That’s the time to be silent and request a lawyer. You may start out with a 1-800 lawyer who will come and tell you to keep quiet. Later you can find a new one if needed.
Even a last minute lawyer who may not turn out to be ideal is better than no lawyer. A public defender may also be an option in some cases.
When you say the 'magic' legal words "I want a lawyer", they should not talk to you anymore until you have one. In most cases, you are or will be at home with plenty of time to find a lawyer. In some cases you may find yourself detained/arrested ("Am I being detained? Am I free to go?" are other 'magic' words). They may try to tell you that if you would only talk to them, they would let you go -- they are VERY LIKELY lying.
Do not trust that you can tell or sense if they are lying or not. They are experts at tricking you, they are trained and have lots of practice in it. They are legally allowed to lie. (In my personal experience, they did lie about exactly this -- they said "if you just talk to us, you can be on your way", I talked to them, I got arrested anyway.).
Getting arrested sucks; talking to the police without a lawyer can make it much much worse.
tldr; no, you don't need a lawyer in advance, you can ALWAYS say "I would like to remain silent, I would like a lawyer", and you always have this right, and they can not talk to you (or use anything from talking to you) without a lawyer once you've said this.
I agree with some of the other commenters that you really should say the word "want", not "wish" or "would like". You need to be clear and emphatic about having a lawyer present.
There are others. Do a search for "prepaid legal services". Most of them have similar prices (~$20 a month) and provide similar services (wills, traffic tickets, document review, etc). Like I said, if you get into serious trouble, you will have to pay for a lawyer. This is like insurance. In my opinion, if it helps you avoid saying something stupid to a cop, it's probably worth it.
"[...]nor shall be compelled in any criminal case to be a witness against himself[...]
> [W]hen a suspect in an interrogation told detectives to “just give me a lawyer dog,” the Louisiana Supreme Court ruled that the suspect was, in fact, asking for a “lawyer dog,” and not invoking his constitutional right to counsel.
https://www.washingtonpost.com/news/true-crime/wp/2017/11/02...
> Not a joke, for real.
Obligatory link to the fantastic "Don't Talk to the Police" lecture from the Regent University School of Law.
Watch the whole thing:
(fair warning, this will autoplay the word 'Fuck' in the first 10 seconds)
You (or your friends) can go through serious inconvenience and pain, from lengthy and expensive legal battle (during which you may not be allowed to leave the state etc), to conviction and sentance, even if you don't think you've done something wrong. Innocent people and/or people who didn't realize they were breaking a law get convicted all the time.
Talking to the cops will not help your situation. Not even when they say "Look, we may have it wrong, if you just tell us what happened we can get this all cleared up." Not without a lawyer.
"I am happy to help and will do so as soon as my lawyer gets here."
... And just hope there are no records that I've been using it since the days when it was 2 apps,- Red Phone & TextSecure, before becoming Signal.
1. Sharing videos/pictures/memes is terrible in an SMS group chat 2. One person in the group has bad cell service, so we needed something that would send messages over Wifi 3. Half the people are on Android, so no iMessage 4. 1/4 of the people aren't on Facebook, so no messenger
I was the one who suggested Signal. I did so because I like the end to end encryption, but that was not a selling point for anyone else. They just cared that it solved the problems above.
I am not sure about the situation in the US, but in Europe almost all phone numbers are directly linked to a certain person and address by the provider.
One of the points which, yes, I agree with, but I mainly responded to this:
> I can add phone numbers by enumeration into my contacts and Signal will show who among my contacts is on it.\
> I am not sure about the situation in the US, but in Europe almost all phone numbers are directly linked to a certain person and address by the provider.
Or you can go to a corner shop and buy a Lyca or Lebara SIM with cash. No need to give them your address. You can buy top ups in cash as well. At least in Western Europe this is available everywhere, pretty much.
(I'd still prefer if Signal didn't require phone number to sign up though.)
This is not legal in Norway.
[1] https://privacyinternational.org/long-read/3018/timeline-sim...
Off the top of my head, I think it was easier in France (although this was 16 years ago), Iceland, UK. I also recall it being easy in Aus/NZ. Fairly easy in the US as well, I believe, but as I'm a resident, I don't think too much about what address to use when having a prepaid SIM shipped to me, nor do I ever expect to have to show my papers for something like this. (although, of course, a postpaid account usually involves a credit inquiry, so ID docs would be used privately, not for government reasons, for what that's worth).
Which is still a stable identifier that other people know you by, so you will likely keep it a long time and amass a trail of location data. Also its trivial to tie to the IMEI, so if you actually want to change nyms you have to buy a new phone as well.
Everything about the legacy phone system is a liability. Contact discovery is difficult, but tying into phone numbers should be optional and only for the duration of setting up a contact. Using phone numbers for long-lived identifiers is insane.
This is fairly simply implemented in OTR. Rather than signing the message with an asymmetric keypair (as you would with PGP), you sign it with a HMAC. Thus both the sender and recipient could create a valid message from the sender (giving you the property that only the two people in the conversation can be sure what was actually said by the other party, without being able to prove it to a third party cryptographically).
You don’t need half as much identification to get stabbed by a weirdo...
Here's a description of how it worked in Telegram before they added a setting to disable it last year: https://medium.com/adamant-im/telegrams-anonymity-hole-how-t...
By using phone numbers as IDs signal can rely on your phone's local contacts (meaning they don't have to send your social graph to their servers). This way they can keep very little metadata on you.
There's pretty much nothing for them to turn over except the fact that your phone number has the signal app.
Most of the other secure apps could turn over your entire contact list (which could be damaging for people in a protest that are being targeted).
Confirming a single phone number has the app is not nearly as big of a deal (I'd argue it doesn't matter at all).
There's nothing inherent in phone numbers here. Both iOS and Android also allows you to add e-mail addresses (and other identifiers) to your local contacts. I'm yet to hear an argument as to why e-mail addresses or other identifiers can't be used in addition to phone numbers, or why it would be a complicating factor.
I think they are working on non-phone number IDs though (Moxie was in an earlier signal thread on HN recently and mentioned it).
It will take the authorities a bit more time (i.e. someone throws away their burner phone and authorities hack it)(with the assumption that phone numbers/SIM activations are provided using valid ID as it happens in many countries).
https://en.wikipedia.org/wiki/Global_surveillance#Infiltrati...
Edit: And that from netzpolitik (highly trusted german source) under 'A global passive adversary' that's the interesting part: https://netzpolitik.org/2017/secret-documents-reveal-german-...
There is also I2P network, which is even harder to break (unless someone owns practically all nodes there).
And no you can trace it thru the ISP's, the problem is the latency, Connection from here to there in that millisecond trace one...and so on.
Edit: GnuNet, RetroShare and ZeroNet should also be mentioned
But that doesn't help much if the entire contact list is a list of trash mail adresses (in the case of Wire) or a list of random IDs (in the case of Threema). And at least Threema does not store any information about your contacts on their servers.
Can you obtain a phone number without any ID in the US? Because you can't in large parts of Europe.
Yes. About 10 years ago, before Google Voice, I needed a local area-code number to work with my apartment buzzer. I bought a $15 Tracphone with cash at Walmart and activated it at a payphone (mainly just to see if I could).
If it’s the latter, I suspect that won’t happen in practice for the majority of users.
I haven’t heard of threema, I guess users have to share their IDs manually with each other in that case?
Still, having a signal account doesn't make you a chargeable protester more than owning a gun makes you a chargeable assassin.
why not? Wire[1] doesn't tie your identity to your phone number. OpenWhisper devs too are aware of Signal's limitation (it was even discussed here on HN recently).
What's wrong with email logins?
Personally I liked the way ICQ did it back in the day, they used a uniq ID just for their service decoupling it from a phone number.
If Signal wanted to avoid long numbers, they could use a CorrectBatteryHorseStaple approach which is what Xbox does for their usernames if you don't pick one.
Easier to remember,
https://telegram.org/blog/scheduled-reminders-themes#new-pri...
> same level of e2e security
Step 2: Get Signal and register using virtual phone number.
Step 3: Protest!
[0] https://apt.izzysoft.de/fdroid/index/apk/tk.giesecke.disaste...
It does not require a number to setup an account and communicate.
Sounds crazy when I say it outloud...
iCloud backups (enabled by default) are not end-to-end encrypted.
So while it's technically E2E, in practice you get very little protection from it because it's broken by design.
I still use iMessage because of the user experience, but let's not be fooled by their misleading E2E claims; it's all just marketing BS.
It’s an active attack and can’t apply retroactively but within these constraints they can still do it.
E2E with centralized key management is primarily to protect you from casual/private threats (vendor employees, snoopers in your or your recipients network) not from legal authority.
What’s stopping some US government agency from forcing them to insert code that causes the Signal app to a indicate it is behaving correctly but isn’t?
And don’t say “laws”.
If your threat model includes advanced persistent threats all bets are off.
In Korea, Taiwan and Japan, LINE became the de facto IM. In China, WeChat. But ain't sure if these are usually/always preinstalled in those markets.
Cheers.
[0]: https://www.statista.com/statistics/898254/south-korea-most-...
[1]: https://www.quora.com/Which-is-the-most-popular-messaging-ap...
Whatsapp is THE messaging standard in my country. Hell, even our politicans use it for communication. "Apping" is even used by news outlets to describe communication by Whatsapp.
We used to have SMS and MSN. Now it's either Whatsapp or Messenger. Depending only on the fact if you have the others phone number or not.
They don't care that they are uploading their entire contact list to Facebook — "death before inconvenience".
- message delivery was not very reliable when your connection is poor and intermittent (think wifi in the underground between stations)
- when you need to resend a message in a group, you need to tap "retry" once for every recipient in the group
Issues that my friends complained about, justifying their non-use of Signal:
- you cannot create links to allow people to join groups (obviously this is a nonstarter, without first allowing people to be in groups pseudonymously)
I applaud the direction they've taken. These are the kinds of features that will acquire and retain a broader user base.
I feel like I’ve repeatedly seen on HN that they’re not a good choice for secure messaging (though I don’t remember the specifics around it).
Signal and Matrix are the two options I’ve settled on.
[Edit]: Looks like the main issues with Telegram are that it doesn't use end to end encryption by default and that they rolled their own encryption protocol that's likely not secure. They also used to leak a ton of metadata, but from searching around it looks like they may have made improvements. Either way seems like something to avoid when there are obviously better alternatives.
They're also making moves to make the phone number requirement unnecessary. What privacy features does Telegram have? It sounds like they don't even have encryption on by default and people have also dismissed their security? Why would anyone use them?
Only the expert's opinions are of any value IMO, and I've never seen anyone showing an attack on Telegram's encryption. Telegram themselves seem to claim that it's never broken. I often see vague criticism over the fact that they use their own protocol, but never anything more detailed than that.
https://core.telegram.org/techfaq#q-i-39m-a-security-expert-...
I’m looking forward to it as well as my only Telegram use case is using it as a notification service for my servers. All my chats are transitioned to Signal.
Do you mean message history when setting up a new device? They are working on that, but it’s not so easy to do without storing all your chats with a server side encryption key. Apparently something coming soon though.
https://support.signal.org/hc/en-us/articles/360007062012-Ne...
Maybe this is an okay trade-off for you, but Signal's phone number as ID requirement means they can rely on the local contacts kept on your device and keep very little metadata about you on their servers.
https://github.com/signalapp/Signal-Android/issues/6898
https://github.com/signalapp/Signal-Android/issues/9194
Other apps like Threema or Telegram might delay messages sometimes, but at least they keep my device operational. If I'm punished for opting out of Google's spying, I at least want to choose the punishment.
The desktop app takes several minutes to open (at least on Linux), so I find that the only way to use it is to start it at boot and always leave it open. I'm still hoping that someone may create other clients, e.g. a Pidgin backend.
The mobile apps, on the other hand, work really well. Been using them for years now, both on Android and iOS.
Signal is really annoying with all the things it wants me to do. Re-linking a mobile device. Re-entering a PIN/password for no reason other than to prove that I still know the password.
And when I'm finally logged in it shows me a completely useless selection of mostly obsolete contacts.
You can turn off the PIN reminders in Settings → Privacy.
Ah, that's good to know. Thanks!
I also see that the other issues I noticed previously (high latency when typing, “compose key” not working) have now been fixed as well.
Signal, Wickr, WhatsApp and others do not have this experience. They all have drawbacks and do not feel Telegram fast.
Muted chat, chat groups, draw on photos, stickers on photos, quiz / polls, dice rolls.
Signal does cover the basics well through (GIFs, voice messages, video, photo, replies) and it has a clean interface.
Signal has all of these
> quiz / polls, dice rolls.
Not these, as far as I know.
Electron isn't as safe as Chromium. Last I checked it's based off a vintage build of Chromium with some very important features like the sandbox turned off (!)
There's one big drawback though that's relevant here, and that is that it doesn't support E2E encrypted chats, those are confined to the phone app. I guess it's a security feature, I haven't looked into it too much, but I don't think it would be that difficult to share keys locally between devices you own.
Obviously that'd be better to have a configurable data folder.
Phone numbers are NOT safe. I don't know why SMS MFA is even a thing, they're worse than passwords.
When you use phone numbers or SMS for security, you are putting the fate of your entire company's security on an underpaid customer service rep at Verizon.
At least since version 2.0 it seems it's using AES encryption: https://core.telegram.org/mtproto/description
- Multi Device
Seems to me that are some of the most useful things about modern chat.
Also, why not just use a chat app that is save by default. The whole concept of private chat is insane to me.
What happened?
Telegram on the other hand is better for issues like this, where large numbers of people need to communicate anonymously without prying eyes.
They're addressing the same issue for different markets. That's all it is.
EDIT: and would you then also review every commit to make sure nothing bad gets introduced? No, at some point you have to place trust in the vendor, the developers, independent audits, etc.
https://tests.reproducible-builds.org/debian/reproducible.ht...
We're making great strides into software being completely deterministic. The Bitcoin project for many years has had completely deterministic binaries and a ceremony process for GPG signing the output with many individual parties.
Trying to get a bit-to-bit equivalent of a binary lifted from the app store sounds challenging to say the least.
See also Guix, which provides tools to challenge servers providing binary packages to see if they match a locally-built version: https://guix.gnu.org/manual/en/html_node/Invoking-guix-chall...
Assuming all three match, you know that the binary matches the source.
Someone who is more technically inclined can probably go into more detail on this.
For the curious: we actually were intentional about finding these, by compiling many programs with the same parameters on different machines. One with a 32 bit OS and toolchain, the other one on a 64 bit machine, and we would get alerted when we produced binaries with a different checksum.
How do you know you're not living in a computer simulation in which the operators can access your data without any backdoors whatsoever?
[1]: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
Cartesian doubt becomes pointless at some point. If you're worried that the deep state has implanted microchips in your brain to prevent you from analyzing signal, it probably doesn't matter because at that point they wouldn't need to hack signal to get to you.
A less snarky and more realistic answer is: threat models and risk assesment. (Non-divine) adversaries generally have limited resources. The limit may be high, but its still there. You can realistically worry about a government coercing a service to hand over keys, because that's easily within their power. On the other hand, having a giant conspiracy-trusting trust style-where every compiler & microchip has a backdoor that is inserted into every tool ever compiled, is a bit unrealistic. It would take thousands of people to be in on it to pull it off, spread across many countries (who hate each other) over at least 50 years. Having that many people, especially academics, keep that type of secret for that long is basically impossible. If they could do that, it would be child's play to have most of the protestors be gov agents, so if you think this is realistic, worry about that first. Anyways, in my judgement governments don't have that kind of power, so its probably not something to worry about.
So, to conclude, estimate the level of power and influence you think your enemies have, and then take steps to rule out the possibilities that your enemies have done the things that are theoretically in their power to do. Start with the possibilities that are most likely multiplied by how bad it would be for you (liklihood*severity = risk)
https://github.com/signalapp/Signal-iOS
Are there any “certs”/keys you would need to talk to your contacts?
Then after that get a phd in cryptography.
Certainly not required. A PhD will teach you a lot about methodology but not necessarily the technical details required and involved in secure multi-party or P2P messaging.
tptacek regularly endorses Signal (compared with alternatives) on HN.
In general, forward secrecy can't work if you insist on keeping the messages. If you truly want the messages to be gone for others you have to have to make them gone for you as well.
My point is, there is already an app for that. Signal has a completely different purpose.
As for the DNS, if you're concerned with the DNS of your ISP, you shouldn't be using it anyway (I don't).
Don't extrapolate what I said. I like link previews and don't like Memojis and bloatware. But more often than not I like to know what's behind the URL. Maybe I don't wan't to open the site, or already seen the article, or the preview is enough to get information (like weather?).
If we're on the road to proliferate privacy-conscious behaviour, we need to give something to "the masses", so they can enjoy the experience. And I want my mom and dad using products such as Signal, so I can use it with them. I have no use of it if my friends are not using it, and I'm all alone on the whole network. I don't support bloatware, but some sugar is needed.
https://github.com/signalapp/Signal-Android/blob/0ef01cc620c...
If you opened a PR with the websites you're missing, I'm sure they'd be open to it.
I see sibling comments mentioning that they wouldn't want this feature (which is already there) because of its privacy implications, but I think that it basically works like gifs, with a proxy controlled by Signal.
I tried with Telegram after failing with Signal and that worked for many. For whatever reason (I assume the user experience is nice and more compatible with Whatsapp etc), non-techie people do prefer Telegram to Signal in my experience.
I've gotten my girlfriend (now wife) and parents to switch. My siblings use it sporadically, but I think mostly to talk to me.
Additionally, taking the initiative for fun activities (or always being eager to join), which -besides being fun- gives people without Signal FOMO, haha.
Edit: Well, "switching" is a big word. They've got it installed, use it to contact me, and some have started using it as the primary means of communication with others who also have it. Most of them will still use WhatsApp even for contacts who are also on Signal though.
And once they get sufficiently interested, they can crack pretty much anything the market can come up with.
So if you're trying to hide stuff - old school is probably best, innocuous code-word language stuff, keep communication to a minimum, leave phone at home, etc, etc.
That's why I use Signal to chat with my wife and parents, and pretty much no one else. Secure apps need to become mundane so they don't draw attention, so I prioritize using them for mundane things.
https://9to5google.com/2020/05/26/google-messages-end-to-end...
Clearly not a solution to the current crisis but would be beneficial in future situations.
I feel your question subtly touches on one of the reasons people like open source and develop for it - there are many people who just enjoying doing their tech-nerdy things and giving it away for free. Before it was called Open Source it was Freeware, Public Domain and other words - the inherent desire to just do something and give it away for free is inherent in the nature of some folks, with no expectations on return (money, fame, etc.). Postcardware and Beerware were even a thing - "like my thing? send me a postcard from where you live" and I sent a bunch of postcards. :)
Police apparently got a tip on Monday night that a separate group was planning on looting the mall. They intercepted a convoy of cars many with out of state plates gathering in the empty parking lot and which fled when they saw the police.
I guess that’s one thing that works in favor of suburban malls being only reachable via car, versus the destruction inflicted upon urban malls in my State.
Apparently there had been public social media posts calling for the looting which got passed along to local police which deployed ahead of time to close the mall and clear out the parking lots.
Op sec is particularly difficult I guess when these groups do not have pre-formed networks and are just sending out public recruitment posts to commit crimes.
Anecdote aside, I think that Signal isn’t going to support the many-to-many broadcast messaging that large groups would need to organize effectively (whether peaceably or otherwise) and a system which allowed mass coordination is that much more likely to be infiltrated (see e.g. Project Veritas’ latest work against Antifa).
https://boston.cbslocal.com/2020/06/01/police-respond-to-nat...
https://twitter.com/benlorber8/status/1268596748198596608?s=...
Perhaps most of interest though would be how many phones are owned otherwise, to give access to the protester Signal comms anyway
And also metadata must still fly around anyway, no?
Apparently Signal is working on identifiers different from a user's phone number, but it is not clear how many people will actually take advantage of this feature.
The uncertainty as to how many would use it is likely why it’s been back burnered for so long, but it shouldn’t impact effectiveness. I realize that you may not have been implying it would though.
Often this answer is accompanied by pure sarcasm where if you are concerned about this feature, you are told that Signal is not for you and "you can go play at being a spy and sharing a secret decoder ring with your friends", as these people regard PGP to be. I wish those Signal advocates could lay off the sarcasm, it just makes the project look bad.
[1] https://www.signal.org/blog/private-contact-discovery/
Of course, this feature is Android only as iOS doesn’t allow default alternatives.
Jami.net
It does not have Signals problems
Matrix is 100% open source, has a larger community maintaining it and is federated.
If you're worried about backdoors then you should have more eyes on the code.
That is, it is not end-to-end-encrypted (E2EE) — which is the whole point of apps like this.
You can easily find others by searching. You can also use pre-paid credit cards if you must pay.
You can disable them there.
Oh and it’s hosted outside the jurisdiction of 5-eyes!
Telegram is great for public things like huge groups or newsletters. But no encryption by default is a no go for me.
Of course, Keybase's main idea is to have a verifiable public identity which might not be what you want.
Idk after learning about the Snowden revelations I assume every computer is compromised. I mean didn’t x86 have unpatched vulnerabilities for like two decades? It’s really hard for me to imagine that apps like Signal running on iphone or android can offer enough security to keep out the NSA. But I’d be very curious what folks think about that. I’ve told my drug dealer friends “signal is fine for selling weed but if you commit a murder they will probably find a way to get your messages.”
'You have to go back in history, at least to the time when the devs dropped sms encryption and even earlier.
The main developer, in a matter of weeks, had turned from someone harassed by the TSA into a receipient of a major government grant ($13 mln). Then he received lucrative contracts with the “greatest” bastion of privacy, Facebook and affiliates. You don’t get that by accident. You get that by providing your own significant part of the bargain.'
https://forum.f-droid.org/t/we-can-include-signal-in-f-droid...
Just saying it's not the most unfounded theory out there.
I'm saying anidotically, I'm not seeing a massive wave of people sign on to signal.