Hacker News Reader

Oh my gosh, you and me both. I'm so tired of the lame excuse that it's a "secure messaging platform". If the mindset were truly that having a copy of the message was insecure, why wouldn't they just set every chat to expire? Because it turns out people want a balance between security and functionality.

IOS has had filesystem access for going on 2 years now, there's literally no excuse beyond laziness for not letting us backup and restore the signal messages. I don't even care if it gets dumped into an insecure format if that's the only way it works. I'm far more concerned with someone intercepting my messages in-flight than any other vector. If someone has a backdoor on the phone itself, one signal backup is the least of my worries. Ignoring the fact that backup would be optional.

Incorporate SMS (with a red background or something obvious that the chat is insecure), incorporate backup, and just fully embrace being a messaging app. If they do that they'll make the world universally more secure because it will increase adoption 100 fold. I'll have a lot easier time convincing my dad to use signal if I don't have to try to walk him through "well when you're texting grandma, use this app, and when you're texting me, use this app".

> Incorporate SMS (with a red background or something obvious that the chat is insecure), incorporate backup, and just fully embrace being a messaging app. If they do that they'll make the world universally more secure because it will increase adoption 100 fold. I'll have a lot easier time convincing my dad to use signal if I don't have to try to walk him through "well when you're texting grandma, use this app, and when you're texting me, use this app".

You can already use SMS from within the Signal app on mobile. On desktop it makes sense that there is no SMS feature, unless you want to use the desktop client to send SMS from your phone (like Android messaging), or you want Signal to operate an SMS gateway?

Signal already does SMS on Android but on iOS thats forbidden so you can't replace SMS app. Quite convenient for Apple because same SMS app by default supports their imessages :))

Unfortunately you can't send SMS from Signal in the iOS version of the app. And yes, I also want to be able to send an SMS from my desktop through my phone (like android messaging or imessage).

https://support.signal.org/hc/en-us/articles/360007321171-Ca...

Sure, iOS doesn't allow you to intercept SMS but others have already figured out how to work around this by assigning a virtual phone number.

It isn't laziness. They go out of their way to prevent it.

Not allowing backup as you should be using email for things that are important is really a circular argument. If you can't even choose to backup / analyse with your own tools then you won't ever use chat for anything important. Ever since losing chat history moving phones with Signal I've been less inclined to use it overall.

+1. Switched from iPhone to Android, lost my message history. There were important content there stretching years that I wanted to preserve. Now, it is all lost.

Really I just want Signal to play my messaging history off to just regular files.

I can plug those into Syncthing and have them head off to my server or whatever. Just document the format so I can decrypt them with some tool to recover them later.

Yeah I honestly don't care how they do it. I just want to export an encrypted blob with a passphrase and import it when needed. Store it on my device so I have to manually move it or store it on iCloud or some other cloud service. I don't care I just want the option to backup and restore!

Not sure about iOS, but on Android it's in settings > chats > chat backup and it creates a backup periodically if enabled. When reinstalling signal one can point it at the backup and enter the code to restore messages.

Unfortunately I am on iOS where there is no such functionality :(

Kind of makes it worse in a way as it clearly shows they do care about backups just not doing it consistently.

Signal (just iOS strangely; Android has had exporting for years) has been completely anti-backup basically since it's inception. That's their prerogative, but I think it's something that needs to be made clear, front and center, before anyone starts using Signal (or asking anyone else to use Signal). Signal is the type of messaging that needs to be treated as a black hole.

Here's issue #905 from 2015, a request for transferring messages when moving phones, closed the same day: https://github.com/signalapp/Signal-iOS/issues/905

And #2542 (2017, when I was first looking for transferring my Signal to a new phone) https://github.com/signalapp/Signal-iOS/issues/2542

That issue was locked and I was told to create a thread on their forum instead: https://whispersystems.discoursehosting.net/t/ios-backup-kee... - 3.5 years and 400+ messages later, backup functionality still doesn't exist for iOS, and the best solution for archiving your old messages requires jailbreaking and extracting encryption keys from your keychain: https://cight.co/backup-signal-ios-jailbreak/

NOTE: last year, Signal introduced functionality for transferring messages to a new device, but that won't help you from data corruption or losing your device since backups and export are still not supported: https://signal.org/blog/ios-device-transfer/

I totally agree. That's the only big drawback I currently see with signal.

I would even be satisfied if i can regularly backup messages to plaintext.

I like to keep my messages and be able to look up stuff later. If I don't want to keep the log i switch on self deleting messages, which is quite cool.

Is it maybe possible that different people have different attack vectors they need to consider and backups are usually a weak-point for some of those people?

I understand it's frustrating when a (open source, forkable) application doesn't work the way you want it to, but you have to be able to see it from the other side as well.

Signal is signalling that chats are ephemeral and treating them as something else introduces security and privacy issues _in the way they are thinking about it_. It's very possible that's not an issue for you, but that doesn't make Signal wrong, is just make the two of you misaligned on why Signal exists. Signal is not for everyone and I think the team themselves make that pretty clear. Signal is for private and secure communications, and make no compromises that would lower either the privacy or the security, they rather compromise on other ends.

These kind of comments show the entitled parts of the internet, where open source software HAS to work a particular way otherwise ITS BROKEN AND HORRIBLE.

There are tradeoffs to everything. In this case, Signal made tradeoffs that you feel are wrong. You have a couple of choices, none of them include screaming that Signal should change their priorities based on your opionion: 1) continue using it anyways, start treating chats as ephemeral, 2) try to fork Signal and show us you can do it better or 3) dump Signal for a messenger that works the way you want it to.

In the end, there are multiple chat apps, use the right app for the right use case. Signal is definitely not a app for one-size-fits-them-all and it's pretty clear they are not trying to either.

Realistically none of these are very good options. Starting a competitive messenger application is likely to be impossible - Signal got to where it is thanks in large part to 50mn USD from Whatsapp's founder. The fact that it's very difficult means that there aren't a huge number of competitive choices, and none that are "Signal but you can access your data". So even though complaining is not a great option, it might be the most likely way to get what is wanted, whether by someone from Signal seeing the request and agreeing, or someone else seeing there is a market for this.

If you have a choice between Whatsapp (metadata not private, but has backup) versus Signal (metadata private but no backup), if you need backup (or anyone you communicate with does), you lose privacy because you're forced to use Whatsapp. Arguably because of Signal's refusal to "compromise" on privacy by allowing backups you have lost privacy anyway.

A better option may simply be to fork and add the additional features, not necessarily create a new client.

This raises an interesting question.

Can one fork the Signal iOS app, add features then publish to the App Store while using Signals infrastructure?

They changed the license so you can publish forks. They're opposed to forks using Signal's infrastructure though.

If you do this you would not get push notifications.

> Is it maybe possible that different people have different attack vectors they need to consider and backups are usually a weak-point for some of those people?

If backups are a weak point/risk don't enable the backups then? How is denying it for all a good solution?

> Signal is not for everyone and I think the team themselves make that pretty clear.

If Signal don't want to be a WhatsApp competitor they need to stop acting like one and jumping on every opportunity to point out how they are not Facebook/are better than WhatsApp.

All I have seen from Signal on social media for the past month is how they are the perfect alternative to WhatsApp.

Signal has disappearing messages so if a sender doesn't want their messages captured in a backup they can easily get that. Of course that doesn't stop the recipient exporting that one message or even just taking a screenshot so it isn't perfect but better than nothing.

> These kind of comments show the entitled parts of the internet

Comments like this piss me off. It is not "entitled" to want to protect my data. I have been telling people to protect their data for the twenty years I have worked in IT. But now for chat conversations apparently backups are pointless and we shouldn't be doing them??? Come on. This flies in the face of literally two plus decades of the tech community pushing for "normal people" to do backups!

> If backups are a weak point/risk don't enable the backups then? How is denying it for all a good solution?

Why enable something that could introduce additional security risks when it's both cheaper and safer not to develop that feature in the first place?

> All I have seen from Signal on social media for the past month is how they are the perfect alternative to WhatsApp.

Huh, I've not gotten that vibe at all after speaking with some of the people at Signal. They know that their product is not for absolutely everyone and quick glance at their Twitter doesn't seem to paint the picture you're seeing either. You have any specific examples you could point me to?

> It is not "entitled" to want to protect my data

Of course not and that was also not my point... The entitlement comes from you declaring that Signal is wrong here while not actually understanding the other perspective that they are operating from (which is different from yours, obviously).

> But now for chat conversations apparently backups are pointless and we shouldn't be doing them???

Again, if you are subscribing to the same worldview as the team of Signal is subscribed to, then yes, you shouldn't backup your ephemeral chat conversations. If you're instead interested in persisting your conversations, Telegram/Whatsapp/whatever probably fits your use case better and you feel free to use those instead.

Either you use a chat application that makes absolutely zero compromises on security and privacy but might have worse UX, or you chose a chat application that does compromise on those things but have a better UI. Your entitlement is that you think you can change Signals whole mission because you actually should be using a different chat application.

If Signal want maximum security / privacy, why not just make all messages auto-delete after a week (rather than their current stance that you lose them when you decide to use Android when you're currently using iPhone or if you lose your phone)?

4/5 of their last few tweets all seem to be pitching themselves as an alternative to WhatsApp / Facebook / targeted advertising? Realistically though their current position is you have to choose privacy or backups.

"We believe in targeted admirizing, not targeted advertising. Happy Valentine's Day from all of us at Signal."

"We've discovered that @tecnomobile devices (some of the most popular phones in Africa) enable notifications for @Facebook apps like @WhatsApp, but block Signal notifications by default. Privacy should be the default."

"Facebook, Instagram, and WhatsApp trying to collect your data when you're on Signal" (confused guy gif)

"If you see the shadow of looming advertisements in your current messaging app, make an early Spring to something better."

"January just ended, but if one of your New Year's Resolutions was to break up with Facebook there is still plenty of time."

> Huh, I've not gotten that vibe at all after speaking with some of the people at Signal. They know that their product is not for absolutely everyone and quick glance at their Twitter doesn't seem to paint the picture you're seeing either. You have any specific examples you could point me to?

https://i.imgur.com/bdUhqth.png

https://twitter.com/signalapp/status/1358903379515199488

Literally the first thing on their Twitter feed!

Sorry but if you are unable to see that Signal are clearly trying to position themselves as a WhatsApp alternative there is no point in continuing this conversation.

What exactly is the sevurity compromise by allowong backups?