Hacker News Reader

Comment by utf_8x | Hacker News Reader

Once again - Signal[0] as an alternative. It's fully Open-Source (including the backend) and their crypto is public and independently verified[1][2][3]...

[0] https://signal.org/en/

[1] https://en.wikipedia.org/wiki/Signal_(software)#Encryption_p...

[2] https://threatpost.com/signal-audit-reveals-protocol-cryptog...

[3] https://eprint.iacr.org/2016/1013.pdf [PDF]

View on HN

Social life is impossible without the mainstream technology. Sure you can find alternatives but if no one uses it other than you, you end up being sidelined. The technology gets enforced and leaves one with no choice but to accept it or be a red flag.

Shouldn't it be possible to delete your whatsapp chat and contacts data regularly from the cloud? Eg. one could delete the whatsapp account, clear data on cloud and make a new account again. Having more control over your data stored by Facebook would give more power to the users of enforced by the government.

Your mistake is believing those apps are for socializing.

They’re for aggregate metrics and attention collecting on the part of the company.

I do not have a Facebook empire, Twitter, TikTok or other social media presence.

I email academics I can’t visit.

I group text friends and family to make plans, and use the calendar built into my phone to remind myself of those events.

In many countries, WhatsApp equals texting, period. No one will use sms, among other things because they're not free (~20 cents per message, character limited, no multimedia).

The reality is that WhatsApp is a requirement for social life. Any solution that doesn't start from that point lacks any practicality.

HTTPs works with email, email works over data networks.

I get social inertia is a thing.

Somehow I’ve blown it off and life still works.

Summarizing it as “life begins and ends with WhatsApp” seems just as ridiculous to me.

Acquiesce and nothing changes.

Turn and face the strange.

Or realize the overwhelming majority have no interest in limiting their communication and social network due to "privacy concerns", and already have both a Facebook and Whatsapp account that are connected and sharing data. You can do this if you want, but don't preach it as if most people should care.

Most people in the UK use WhatsApp .. the fact that we have WhatsApp groups means Facebook can make this ultimatum with fairly good confidence we'll stomach it.

It strongly depends on what state of life you are currently at. If you are a 20 something individual and have to build a new life in a new city, being out of the "social apps" gives you next to no opportunities to build social connections.

If you are already well connected with your peers and friends and your social life doesn't depend on finding and exploring via the "social apps" sure you have the freedom to disconnect virtually and still remain connected socially.

Everybody has different scenarios. How many of your friend/family members can reach out to you using phone.

All my family members live in a different country and there is no good medium for communication than whatsapp.

https://protonmail.com/

Spike on iOS is a client that wraps email in a chat like UI if the people are free to chat real time. Not sure if it’s on Android.

There a numerous video chat sites not connected to Zoom, or FB properties

whereby, etc

I gave my family an ultimatum and being the tech savvy one they jumped to Signal

Social inertia is a thing conceptually, but it’s not gravity. It can be bent any which way

> I gave my family an ultimatum and being the tech savvy one they jumped to Signal

Not all families respond well to ultimatums.

On that note, if my family isn't willing to install another application and spend 5 minutes wrapping their head around how to use it - well, I guess I just accurately defined the value of our relationship.

From their point of view it may appear you value your communication preferences more than the relationship

> well, I guess I just accurately defined the value of our relationship.

While that is true, what you have not accurately determined is why that value is low, and how much of that is your doing vs theirs.

On Android there is an app called Delta Chat which is similar.

> Somehow I’ve blown it off and life still works.

If you're not in one of those countries, then I don't think you can speak for what a social life there is.

If I tell people they can only contact me via snail mail or in person (i.e. not have a phone at all), would you find it surprising that I will have a lot less of a social life?

Even 15 years ago I knew people in countries who had a difficult social life because they refused to use SMS - this was before the era of smart phones.

> HTTPs works with email, email works over data networks.

A lot of younger folks do not use email except for signing up for stuff and official work. When I left university a decade ago, many incoming freshmen were quite upset at the requirement to use email.

You can always have some social life, but in certain locales and circles, whether you use these apps or not will affect what type of social life you'll have.

> Acquiesce and nothing changes.

Sorry, but these types of statements are usually of little value, and only sound good. I could easily write:

Resist and nothing changes.

And it will likely be as true (and similarly lacking in entropy) as yours.

Thats fine. You can just accept that facebook is essential to the social life of your country, that the facebook eula is defacto legislation that you just obey. On the other hand, Signal works. My friends and I use it every day. We have not surendered, nor shall we.

A lot of people do use social media as their main method of socialising, especially during this pandemic.

Social life is impossible without the mainstream technology.

I've never owned a cell phone nor ever had a social media account in my life. Sure, it gets me the occasional eye roll but trust me, my social life is just fine.

Caveat: old person speaking.

yeah depends on which stage of life you are living in. Sadly doesn't work for everybody but doesn't hurt to give it a try if someone wants to.

It's not so much the stage of life, it's that these technologies have become the de facto standard way of interacting in today's younger part of the population.

In other words: even though cell phones and social media were around when I was younger, they didn't play the central role they do today, so presumably it was much easier for me to do without them and still have a normal social life than it would be today.

Here's a sad thought experiment though: if you can only remain an active part of your circle of friends if you use the same technology as they do, what does that say about the depth of that friendship?

Network effects are real. Financially independent adults can choose their friends among a large pool of candidates. Kids, broke college students, and those generally less well off may have fewer options.

The flaw in that way of thinking is that kids, broke college students, and those generally less well off had no social life or network before social media.

True, but that was because no one had social media. Now that a big majority of people have it and interact over it, if you don't have it the chances of being marginalized are higher.

When everyone was using SMSes to chat, how did the kid that did not have a phone felt? And people were social before phones existes too.

I think that being outside of the main mean of communication is going to have an impact on your social life, independently of what the medium is

I have never had a social media account (younger person here) and it has gotten me many eye rolls too, but I've never cared. However, whatsapp is different, everyone always treated it like internet texting where I'm from. I call my friends when I want to hear them and properly talk to them, but many things such as planning trips and talking about things that interest all of us are just way better done over some sort of text medium over longer periods of time.

> Caveat: old person speaking.

There you have it. Class of 1950 uses letters to organize itself. Class of 2000 uses e-mail. Class of 2010 uses Facebook. Class of 2020 uses Tiktok or idk snapchat.

And this issue isn't just about your class, it also includes any peer group of any kind. For me as a 20s something, the choice is quite binary.

Nowadays you can't even participate in free software communities without using proprietary services. Many free software projects have discords instead of community run matrix or IRC instances.

Nowadays...

Hey, I might be old, but I still live nowadays too!

Signal's not like... "tech for tech people." It's very much usable for nontechnical family members, etc.

While I agree with this 90% of the way, their backup, restore, and phone changing process is very much "tech for tech people".

I've had the joy of trying to explain to my elderly dad why his text message history is lost because he chose Signal as the default sms system, didn't make a backup, didn't sync that backup to the cloud or manually copy it to the new phone, and didn't write down the very long decryption code.

I really don't understand why Signal doesn't just keep a encrypted backup in Google Drive/iCloud. This seems like such a solved problem and yet they instead invented their own Bluetooth sync thing for iOS and manually copying files around for Android.

I'm hoping it will get there eventually. The backup mechanism on Android has improved a fair bit from what it was at the start. It used to be that you had to have the backup file in the correct magic path before starting Signal for the first time. Now at least there is a dialog and you can pick the file whenever.

The usability issues for non-tech people have been getting less and less in the past years which is keeping my hopes up.

Agreed. I understand they are reticent to allow backups for security reasons - but they're treating their users like idiots by doing this. Some people will have threat models where the ability to retain/export messages is worth the risk this may introduce. Let people make their own decisions.

You can't go from iOS to android with WhatsApp without paid applications... definitely not friendly

Convenience vs Security - Pretty much any change made at the behest of convenience is at the expense of security. Honestly, once every 2 years having to move some files around...well, if that's the barrier that people aren't willing to push past, then we're pretty much screwed from the start.

> Social life is impossible without the mainstream technology.

If people won’t go to the trouble of using an alternate way of getting in touch with you then they’re not really your friends.

If seesawtron won't go to the trouble of using WhatsApp (an alternate way than Signal) of getting in touch with his friends, is seesawtron really their friend?

This is such a bullshit HN comment. I don’t like WhatsApp/FB either but critical mass is important.

It's more like:

If people won’t go to the trouble of using your preferred method of getting in touch with you then you don't have enough social clout.

Whatsapp is used (at least here in the EU) for a lot more than staying in touch with your friends. E.g. having a young kid, it's used for: the class' group, arranging playdates, etc. Not using Whatsapp makes it much harder to arrange your social life and that of your kids.

Then there are also many organizations/companies that use Whatsapp to set appointments, for chat support, etc.

In many EU countries Whatsapp is pretty much replaced SMS. Only a small minority of folks have Signal or Telegram. iMessage is probably the only other thing that shows as a blip on the radar, but only a portion of the population has iDevices.

I agree that this is a bad situation, but WhatsApp became popular when it was still independent and their profit model was charging 1 Euro per year (which was much cheaper than SMS). Now abandoning Whatsapp is difficult due to network effects.

> Sure you can find alternatives but if no one uses it other than you, you end up being sidelined.

Make it happen.

Be the change you want to see.

That's just moving from one silo to another though. Users of centralized services don't have much recourse when the company pulls the rug out from under them.

If the backend is open source then there is recourse.

https://github.com/signalapp/Signal-Server

Is there a readymade docker install ?

There's no point installing it as you can't use it. It's just provided for transparency. Not to run a home server like with matrix.

Yes it is: https://github.com/signalapp/Signal-Server

Telegram's backend is closed-source.

Yeah, but your instance can't communicate with other Signal server instances, so it's pointless.

No it's not pointless. It might just be pointless for the "socializing with random people" use case.

Yes it is, because you can't join two servers at the same time. You run your own server, I run mine and we can't communicate until one of us decides to drop our whole network and join the other server.

That's fine. As I mentioned, the use case you are talking about makes this pointless.

Someone that needs a special set of phones to be able to communicate securely and not be reliant on a publicly run server? Here's a non pointless use case.

I'll let imagine who might run something like that.

True but you have to consider the app needs to be user friendly to see any real adoption...

Don't get me wrong, I love Riot (or whatever it's called these days) but it's just not user-friendly for your average Joe...

Honestly if they just picked a different emoji collection, I would be happy.

Pssh ... kids these days.

Users want centralized services. Syncing across devices and shared history are mandatory features, and are basically impossible to do well in distributed models.

I have never lost a matrix message (but I am fed up with e2e warning and new session weird insecure messages) but I have come to the conclusion than Signal isn't reliable since it sometimes lose messages. It's no-no.

Yeah the e2e is way too complex in matrix. They really need to work on the UX and make it more like WA and Signal. The way it is now even a crypto geek like me gets annoyed and that means the mainstream will never touch it.

The problem isn't silos, it's lack of privacy. Signal solves that problem.

Signal isn't 100% private: you need a phone number, and you can't use on a computer unless you install the app on the phone first.

It’s not anonymous, but anonymity isn’t equivalent to privacy.

I have started to migrate from WhatsApp to iMessage with Apple and Signal with Android users. At least not a single silo...

Isn’t the problem profit motive? Wikipedia is a foundation, so it works the same way it always has. We need this for more basic services like messaging and identity

You can donate to Signal too. What has to happen until people realize they should be willing to pay a little money for a service?

We've actually witnessed that people _are_ willing to pay for streaming services like Spotify and Netflix after a long time of illegal torrents. How can we spread this sentiment towards services like email and chat too?

People were willing to pay for WhatsApp. It was exactly that simple, honest, high quality independent paid chat app you are alluding to, back in 2010 or so.

Iirc, it was 1€, and maybe it was even only on iOS.

I remember vaguely getting convinced by a friend, "you just payed [200,300,idk]€ for that new phone, can't pay one euro for this one app?"

> How can we spread this sentiment towards services like email and chat too?

We can't, because those two things are in direct opposition. Piracy was less convenient and offered fewer features that people wanted, so they moved to platforms that were more convenient. The current giants (Gmail, Facebook, WhatsApp...) are more convenient than their alternatives (generic email, Mastodon, Signal...) and so the pressure is not to move, but in fact to stay.

In general, the pressure is always decentralised->centralised, which is exactly what torrents->Netflix was. Even if we had infinite funds to offer people distributed services for free forever, we would still need to make them more convenient than their current centralised ones - if on top of not being more convenient, we also want to charge them, I see no reason why the average person would ever want to switch.

Paid still needs to answer to shareholders

I think part of the problem is the network effect. Social networks want to maximize the number of users so that anyone can connect to you on Facebook, Twitter, etc. The lowest barrier to entry is free, and that usually means ad supported (and personalized ads for the most revenue).

Maybe there's some space for a freemium model (IIRC one of the questions asked during the Facebook hearing was whether they could add a paid ad-free option) but so far that hasn't happened.

The motives could be many. While Wikipedia is a so called non-profit foundation it has its one biases and various groups use it to push various agendas including political agendas.

But this is all transparent thanks to edit logs, and there are plenty of tireless editors patrolling to revert excessive agenda pushing.

The foundation is (mostly) not responsible for content moderation though. They mostly do software development.

I've always thought the solution should be an open federated IM standard, like email but for conversations rather than correspondence. If that were the widely adopted solution, you'd end up with large free providers that work perfectly fine for most regular users (like gmail), paid services that fully respect your privacy, and the more technical folks would be free to host their own servers.

I guess Matrix is doing this, but unfortunately, the way history has played out, centralized IM had first mover advantage by a huge margin and that's what people are used to now - that a messenger is an application on your phone that you can only use to contact other users of that same application.

Can you clarify what you mean by a "silo"? Do you mean once you start using Signal you're stuck in Signal, and you can't export all your messages into another app?

https://matrix.org

And what's nice is the multitude of clients you can use, from rather feature-complete (official app) to relatively user-friendly (ex: Pattle)

https://matrix.org/clients/

And unlike Signal, you can host your own server (Synapse) instance and be truely independent with the ability to join the federated network.

Stop promoting services with no federation, they'll just end up in the same spot 10 years from now.

EDIT: To the people downvoting this: I said the same thing a long time ago about whatsapp before Facebook bought them.

Facebook messenger and Google hangouts actually had federation. So even that doesn't mean a lot.

However I'd also promote federation-first services like Matrix. Only issue with Matrix is the e2e being so clumsy IMO

Getting people off of WhatsApp onto Signal means taking power away from a closed platform that makes billions from manipulating its users, which is already a win. Signal is not only not that, but is in fact a completely open non-profit project, so it's basically impossible for it to turn into that.

Even moving from Fb to Telegram is an improvement in almost all respects and it's sure as hell a lot easier to do than going straight to Matrix/Riot/whatever it is these days. Don't be a purist and let people have their compromises, lest you end up like the "GNU/" part in front of "Linux".

I don't read a lot about it on HN, but at least the threema client[0] is open-source, too, and the servers are in Switzerland.

[0]: https://threema.ch/en/open-source

“Open source” is sold to the people as “you have the most control”, but in reality once your data reaches their end, you have no idea what is deal with it. Open source centralized solution does not an will not solve the problem. They can not.

Last time I tried to use it it on my android didn't work without google play services. And they really bury the apk download, which means it's useless(or heavily discouraged) for people without a google account.

(Edit: this is rather a negative comment but its out of frustration -- I want to use it!)

The APK is really not that hard to find... https://signal.org/android/apk/

That page also states "Advanced users with special needs can download the Signal APK directly. Most users should not do this under normal circumstances." which IMO is a very good point. Downloading random APKs from the internet is rarely a good idea...

Yeah you can search for it but it's not obvious from the site. I just think it's a shame that it's touted as open source but they don't appear to have given much thought to the open source demographic. It's not on f-droid.

It's always been the first hit when I search for "signal apk" from ddg, bing or google

They have given it thought, and have purposely decided not to distribute it through f-droid [0]. Yes you have to search for it, but if you are savvy enough to use un-googled android, you will be likely able to find it.

0. https://github.com/signalapp/Signal-Android/issues/9044#issu...

How is it compared to telegram?

IMO it works just as well and unlike Telegram it's actually credible... The telegram crypto is an absolute disaster and they have been pretty shady and defensive when asked about it in the past. Not to mention the back-end is closed-source. Also, the desktop clients still don't support encryption, many years after it's been first requested.

Do you have some links regarding their disastrous encryption? The security guys i know speak highly of telegram and AFAIK it has been open sourced recently, but i am open to new information.

The Telegram backend is still closed-source as far as I know. The problem with their crypto is that nobody really knows if it's secure or not because it's closed and unverified.

Ever heard the first rule of encryption? "Never roll your own crypto". Well they broke the rule and they won't let anyone check if the crypto is secure or not.

Not to mention encryption is off by default and your plaintext messages are stored on their servers...

Cite some sources. They clearly do not store your messages in plaintext on their servers

https://telegram.org/privacy#3-3-your-messages https://telegram.org/privacy#4-1-storing-data

> in plaintext

They have the encryption key, so the difference is not huge.

Stored on different servers in different jurisdictions, right? Sure it's not ideal if you want maximum security of your data, but it _is_ a huge difference from simply storing plain text.

I do apologize, i had Threema in my mind and mixed them up.

Telegram's MTProto 2.0 encryption protocol was recently proved correct, but I haven't seen any peer review or discussion on the paper yet.

https://arxiv.org/abs/2012.03141

not as good in terms of UI/ux but compared to pgp emails much simplier ps telegram is no more secure than Whatsapp unless u use secret chats

Better security, worse UX.

IMHO, Signal main advantage is that you can sell it to your parents and friends like "WhatsApp, but safe".

It tries to have feature-parity to WhatsApp; looks the same, works the same. All this while researching innovations on cryptography that doesn't compromise user experience too much.

In my experience, doing exactly what WhatsApp does (but safer) makes it an easy sell to people around me.

True, though Signal annoyingly wants the user to also enable it as SMS app. From my own experience with relatives this can lead to a lot of confusion among non-technical users, for example when they try to send a picture to a contact and it fails because that contact does not use Signal. From what I've seen Signal does not clearly show a difference between those two groups.

Other than that it's definitely a great alternative.

Telegram has had several security and privacy issues in the past. It also stores your messages unencrypted on their server by default.

Telegram is only end-to-end encrypted in a feature called secret chats. Groups and channels and individual chats are not end-to-end encrypted.

In other words, Telegram doesn't even deserve to be in the same conversation. Even if it had the best encryption out there (however you define that), that wouldn't mean anything when it's not used in like 98% of the cases (percentage pulled out of my ass).

It's like comparing Signal to Facebook's Messenger, and I'd still say Messenger over Telegram because at least it uses Signal's protocol under the hood (I believe the feature is called hidden conversations) instead of inventing its own thing and ignoring the expert opinions.

Telegram not having e2e by default is a feature; It allows great multi-device usage.

What kind of multi-device issues do Signal and WhatsApp have exactly?

Granted I've never used WhatsApp, but I've been using Signal for like 5 years now on my phone and on my laptop with absolutely no issues.

I don't think you can even use the same Signal account on two different iOS devices, much less desktop. Their desktop apps just link to the phone's app.

WhatsApp is a total joke, it loses media (IIRC this includes audio messages as well) people send you after a very short time even when you use it on a single device, so talking about multi-device usage is completely out of the overton window.

WhatsApp does not have multi-device, so technically it has no issues with it.

(for any sensible definition of multi-device)

Signal none, WhatsApp still cannot be used without being activated on a smartphone/tablet, and cannot be activated on more than one mobile device.

Seriously? Both only have crappy web apps that you basically tunnel messages through your phone (at least that's what I remember) and are tied to a specific mobile device with entire companies being built around the apparently extremely complicated task of moving WhatsApp messages around.

Meanwhile, the Telegram desktop client is at feature-parity with the phone app with both running entirely independently on as many devices as you want.

Signal messages are not routed through your phone. Reach has it's own independent queue and the phone can be off and you'll still receive messages on the desktop client.

I would also state that it is unfair to compare an app that doesn't have to worry about your privacy and solving real engineering problems vs basically making a web app that can easily sync your data because it's all stored on someone else's computer.

If that's the level of privacy you're setting you may as well use email for communicating. It's federated, it's easy to use, and everybody has one.

All that said, I do agree the Signal desktop app needs some work, but they'll get there eventually, and in the meantime I don't have to wonder if any of my data will be leaked to anyone outside of my intended recipient.

> basically making a web app

Funny you say that because Signal is the one with a crappy Electron app which is definitely a deal breaker for me. I mean I lose E2E with Telegram but gain really well designed and featureful platform apps that are native and non-gimped desktop apps (and a functional linux client. Signal's Ubuntu client just crashed for me).

Good point. I use irc more than any other IM and nobody ever complained about lack of e2e there. When the usecase is more about meeting new people it doesn't apply as much.

Well, matrix can to multi-device usage great and has E2E, so I don't see why that would be a hard requirement or even any kind of requirement.

Because at least according to the Threema devs, doing e2e multi device in a secure and anonymous way is not trivial.[1] Maybe matrix solved that problem, maybe they don't care...

[1] https://threema.ch/en/blog/posts/md-architectural-overview-i...

I guess it depends what you need and what is "secure and anonymous". Matrix probably leaks a ton of metadata.

In practice it works by each device having their own encryption key and then those devices are bound together with a cross signing key, so your peer can robustly identify all your devices at once (and the list of devices can change as long as they are bound by the cross signing key). Certainly the server is able to correlate device ids (and thus keys) and IPs.

The way threema does it sounds a bit how room encryption works in Matrix amond multiple clients.

One thing to note about Telegram's secret chats is that they're device-specific. That is, if you start a conversation on your phone, you can't pick up that conversation on your laptop: https://telegram.org/faq#secret-chats

Hardly comparable in terms of usability. But then, WhatsApp isn't that good compared to Telegram either. In fact, I wouldn't use WhatsApp at all if various communities wouldn't host there group-chats I belong to. So I don't think usability has that much to do with your ability to switch. And supposed "security" has almost nothing to do with it whatsoever.

So I personally don't even know if I'll keep fighting for my privacy and stuff or if I'm going to give up now. I don't want to, but I honestly don't imagine how on Feb08 I will be telling people who aren't my close friends or co-workers, but communication with whom is really valuable to me, that I refuse to join any WhatsApp group chats anymore, so they will have to notify me about anything important (important to me, in he first place!) personally via SMS, Telegram, email, whatever. Especially now, when people are forced to communicate remotely and stuff gets cancelled/renewed/delayed because of another round of idiotic government regulations, so if I'll fall out of these communities, I'm pretty much left in the vacuum and won't know about anything that happens.

Reply on news.ycombinator.com