Hacker News Reader

Comment by sequoia | Hacker News Reader

In the authors table:

- Building an ecosystem: building for developers

- Building a product: building for users

This and this alone explains why people flocked to Signal rather than matrix or xmpp, which the average user couldn’t “flock to” even if they wanted to. Signal made a conscious choice to be user friendly rather than nerdy/wonky and that is why tons of people have more secure chat now.

The single “point of failure/compromise” point is valid and I like the authors idea of “balancing” the two approaches, though it sounds a bit like “we’re building a new protocol,” practically speaking. If I send a threaded reply and your XMPP client doesn’t support that, then what?

View on HN

I tried matrix lately. It created a security passphrase for me. I copied it into my password manager and made sure about surrounding whitespace etc. Then when it asked me for the first time to enter this passphrase I pasted it. It told me it was wrong. I had to go to the web version to reset the passphrase because the desktop variant would ask me for the passphrase to reset the passphrase. I created a new passphrase stored it in my password manager, this time making painstakingly sure it was exactly as displayed.

Guess what. I was asked to enter it immidiately after. It was wrong again.

Even if I am convinced of a decentralized, federated concept, software just needs to work. If I, as a programmer with a ton of patience can't get it to work, asking my non-programmer friends to use it is something I won't do.

I had the exact same experience with the pass phrase. Never could get it to work after spending a couple of hours on it. Gave up and uninstalled.

I think where it went wrong here is that when it asked you for your "passphrase" (which is called a recovery key) it's very likely it wanted your login password instead. (Because that is indeed needed to reset the recovery key).

The recovery key (whitespace doesn't matter btw, it's just a 48 char string) is only needed when you logout of all devices and subsequently want to restore your encrypted messages.

Even so, the fact that this could cause such confusion is a valid point, and more care need to be taken to differentiate the purpose and situation for each. It's a software problem, not a user problem.

Of course you might agree with this, and i personally find the key and password management quite problematic after using it with a few non technical people.

They should have taken a page out of Bitcoins/Ethereums book and used mnemoic phrases and clearly labelling them as "Recovery key" with big red bold letters everytime you enter it.

yeah, that would definitely help! I find it sad that so many high profile open source projects lack in UI, even though there's a lot of smart people working on them.

Maybe it's a question about prioritizing time for technical features and downgrading the importance of a good UI and onboarding. Since time is limited, but in the case of matrix, I would say UI is just as important as the technical part. If they get more funding, maybe it will change in the future.

This caught me out aswell, when it asked for "recovery key" I assumed it was looking for 12 words, rather than my matrix day-to-day password.

> If I send a threaded reply and your XMPP client doesn’t support that, then what?

I don't know how XMPP works, but a well designed protocol would be backwards compatible such that threaded messages would simply be normal messages in older clients. Here, those with the old clients would still get something useful while those with new clients get the full experience.

That's exactly how it works, yes.

I, on the contrary, disagree with the single point of failure point. Nothing prevents Signal to internally build n systems that federates together and can be down/broken independently.

If the the Signal Foundation gets acquired by Facebook, Singal as we know it will soon die.

Is this likely? No. Is this a single point of failure? Yes.

All the internal federation in the world does not allow me to pack up and move while still chatting with my old contacts.

Agreed. I was only thinking of technical failures :)

Can foundations even be acquired? If they can, isn't that a bit daft?

Foundations, like companies or any organization, are composed of people. People can and do get replaced, corrupted or bored and move on, they can eventually decide to take the organization in a direction unlike what was originally intended. Takes more time and effort than just throwing a pile of money at the founders and shutting it all down, of course.

Isn't think sort of zero sum thinking a bit uncreative? I'm not sure there is any law of nature that says you must pursue one to the exclusion of the other.

Reply on news.ycombinator.com