Hacker News Reader

I'm disappointed WhatsApp became the defacto solution for secure communication. I am also disappointed Signal became the defacto alternative. I also think Matrix is a better solution and I'm rooting for it. But I think your response is unreasonably pessimistic and, frankly, arrogant.

For all its problems, WhatsApp was an improvement to the status quo. User messages went from being fully public to only being accessible by Facebook. Signal was also an improvement. User messages were finally encrypted from end-to-end, even though Signal retained control of the infrastructure and kept some of it opaque. Things are improving and there is no reason to believe Signal will have any more staying power than WhatsApp or any other platform.

As for why Signal beat out Matrix, I think the technical hurdles are a relatively minor factor. After all, signing up with Element doesn't require hardly any technical understanding. I think Signal was just a better known brand with a larger established userbase, streamlined on-boarding process, and ubiquitous feature support across many platforms.

I don't think it's appropriate to call Signal's users or the techies who recommended it "stupid". I think most of them just realized a communication platform is only valuable if the people you communicate with actually use it and that Signal would be an easier short-term sell. I think the chaps at Element realize that and are trying to position themselves as the next logical alternative once Signal eventually has its own mass-exodus.

There is still hope for Matrix. Just keep championing it and show some patience to your fellow human.

That's such a nice response that i just want to thank you for it. Thank you, it really made my day! I'm just depressed from being stuck inside due to covid for such a long time, maybe that made me lose hope there..

No problem. With all the bad news out there, it's easy to get hung up on minor setbacks and loose track of how things are genuinely getting better overall.

> the bulk of users is either too stupid or unwilling to invest even the tiniest amount of effort into their privacy

This is an awful attitude. Not everyone understands computers at a technical level. Not everyone has the knowledge to install and troubleshoot Matrix.

Most users are non-technical, full stop. You can't expect them to use something that requires technical knowledge.

Then the reality is that those users cannot expect privacy anymore

This part I disagree with. They can (and should) lobby for laws that protect their privacy. Users don't want to give up convenience, but if the majority are using the services of BigCorp, and we push to force BigCorp to provide privacy through legislation, then society still wins.

Lobbying for privacy laws requires legal knowledge to know which proposals can actually be effective, otherwise one is merely lending their uninformed support to whatever the media tells them is a good idea today.

It all comes down to self actualization, no matter how you slice it. Installing Element instead of Signal (even with its @weird%identity.syntax) is quite technically easy, especially compared to politics! The issue is almost entirely social, in that it requires pushing back on friends who want you to install the proprietary stuff to communicate, and pushing them to the Free solutions.

They should but rarely do and even if a tiny victory like GDPR is won, it's immediately dismantled by big corps. Facebook hasn't been fined any significant amount yet it violates GDPR every day. As it stands right now, the average user has no privacy.

Just try this: Use a default browser without adblocking/tracking protection etc. for a week and look how the ads are targeting you more and more. That's the internet for the average user. We just don't see it as much because we default to protect ourselves.

> the bulk of users is either too stupid or unwilling to invest even the tiniest amount of effort into their privacy.

Those of us who have worked in security have known this for years. There are countless examples of massive security gains through minor inconvenience, and users rejecting them. Two factor auth is a big one. Yeah, it's a slight hassle. It gives major security improvements. Even security people don't like to use it. Even people who have been scammed multiple times, and told if they just turned on 2FA it help, would rather deal with being scammed again than use 2FA (I saw this at eBay and PayPal a few times, where the user rejected a free security token despite having been scammed multiple times).

Users hate friction. If it's not as easy as "download app, put in contacts" they aren't interested.

And of course, that's exactly why people were recommending Signal. Of all the practically frictionless apps it provided best encryption.

privacy isn't just encryption. Forcing users to link their phone number as an identifier like signal does is just one of the myriad of questionable choices signal has made. And with their coin based payment they just painted a large bullseye on them.

Sure, and if there had been a frictionless alternative that didn't require that, that would've been great - but there wasn't.

> I saw this at eBay and PayPal a few times, where the user rejected a free security token despite having been scammed multiple times.

People here downvote me for this but this is the issue. Those people cannot be helped and they don't want help. They chose this and have to live with the consequences. There's no right to easy computing.

I think you got downvotes for the way you presented your argument, not the content...

Yeah, i'm tired and hangry. you're right. I'm just happy SOMEONE understood my argument and saw the same issues i did

> To me this drives home one key issue: the bulk of users is either too stupid or unwilling to invest even the tiniest amount of effort into their privacy.

Something tells me you've never given tech support to non-technical family members. (And that's being generous – because outright considering everyone non-technical "stupid" would be a pretty sad worldview.)

> or unwilling to invest even the tiniest amount of effort into their privacy.

> highly secure alternative exists in the form of matrix

At least for metadata, as of now, Signal seems to provide better guarantees than Matrix.

I can imagine Matrix competing with Discord and Slack, but I don't think they'll ever be able to compete with WhatsApp and Signal. You can blame "stupid" users and the media all you want, that won't change the path of least resistance. I really like Matrix as an IRC replacement though.

> At least for metadata, as of now, Signal seems to provide better guarantees than Matrix.

Agree here. Matrix servers log everything by default. If somebody cares about protecting metadata, I don't know why they'd choose Matrix over Signal.

The people screaming the loudest about how signal is bad for x reason always seem to be the ones recommending y(usually matrix) that suffers the same issue.

Matrix is still broken though. I find XMPP to be sufficient at least until matrix fixes their group encryption

Got a source for matrix group encryption issues?

EDIT:

From their [FAQ](https://matrix.org/faq/)

> End-to-End Encryption is fully supported in Matrix. New rooms have encryption enabled by default, and all existing rooms can optionally have End-to-End Encryption turned on.

What exactly do you think is broken here?

In group chat constantly there are members who you cannot decrypt.

ux is seriously broken. i run my own instance and even i cant verify my encrypted sessions. Like i already have some three security codes that i have no idea when to use and verification of my own devices often randomly fails.

its just mess and i think it works properly maybe on main instance.

its nowhere near encryption on signal

This is an unhelpful attitude, IMHO.

Your best chance, as a privacy-conscious, tech-savvy individual is to push for mass-market adoption of strong encryption and good government privacy regulations that will help everyone.

Lacking those, you will stand out like a sore thumb as one of a tiny number of "weirdos" using Matrix, or Brave, or Tor or GrapheneOS or whatever other hardcore self-hosted, federated niche tools you favour. Any interested spooks can focus their considerable resources on the user base for these tools. Merely having these things installed becomes suspicious in a way that WhatsApp or Signal is not.

> This is an unhelpful attitude, IMHO.

I agree. I gave up fighting for privacy for other people because they don't care. I'm now fighting for my privacy because it's a war that the normies don't care to fight. They never did. Give them a shiny app and they'll sign away their firstborn.

> Your best chance, as a privacy-conscious, tech-savvy individual is to push for mass-market adoption of strong encryption and good government privacy regulations that will help everyone.

Governments, at least the one here in Germany, are already pushing for mandatory backdoors in all messengers and so far they have been hugely successful in pushing for all anti-privacy anti freedom laws they want with the only hindrance being our highest court. Just this week our NSA equivalent, the BND was granted sweeping new rights to hack messenger services around the world, to install rootkits and trojans on people's devices and listen into large parts of the internet.

WE. FUCKING. LOST.

This was all done in the open, the mass media didn't object, normies didn't object, no one cared. Heck my parent's are still using whatsapp despite my best efforts and my father is an IT Professional himself.

> any interested spooks can focus their considerable resources on the user base for these tools. Merely having these things installed becomes suspicious in a way that WhatsApp or Signal is not.

bullshit, it's massively easier to force signal/whatsapp/whatever to hand over user data then to hack my Graphene OS phone (yes, really it's my main phone), backdoor into my qubes OS notebook (yes really, i'm writing this comment using it) or attack my raspberry pi hosted matrix instance. Sure it's possible. If they want to get me they don't have to do much, just threaten me with a rubberhose. But they can't fuck me over by legally attacking large cloud infrastructure that hosts everyone.

i can't save those that don't care but i can build a fucking cyberbunker and host my own stuff in the vain hopes that it protects me from the worst, and it certainly protects me from facebook, google and co. Sure the NSA can hack me if they want to. We lost that fight before we knew we had to fight it. But at least the cost of doing it is slightly higher then using the government mandated backdoors in whatsapp, android and co.

Cheers for fighting the good fight. Quixotic idealists almost never get anything done... and yet they're still the only ones who do manage it ;P

With high-variance results, but heck, that's nature.

But if you are promoting something that is opaque and in some situations worse than an already-existing alternative, is it really the right path to recommend the problematic tool because it is more popular?

Especially if your interest is in not necessarily your personal privacy, but that of lawyers, journalists, whistleblowers, etc.

I wish i could show you what lawyers in germany did with their lawyer-specfic mail service. I don't have any non-german sources but they are a security nightmare and e2e encryption was deemed "unnecessary". Even vulnerable groups don't care anymore.