Improving first impressions on Signal
signal.org
signal.org
Signal presents both a "create account" or a "migrate account" option on a fresh install, which seems like the best compromise for UX flow.
Also, considering their guarantee is to keep your messages secure, of course you need your old phone. If you wipe your phone that securely contains all your old messages they are gone. That is security.
That said, if you have the backup of your messages and the code, then the developers might be able to debug what caused the migrations to fail if you submit a bug.
I've learned this lesson before though. Always keep your old phone around while transitioning to a new device in case you need to pull anything off of it.
It's easier to get seduced by tall sounding words like "cryptography", censorship, "security", anonymity etc. Those are just buzz words.
Try something that works seamlessly across platforms.
Privacy used to be the default mode for human existence. You had to go out of your way to attract enough interest, positive or negative, to have that privacy curtailed, even in minor ways.
In the information age, privacy is liberty. Unless you take specific action to prevent it, all of your information is surveilled.
Encryption allows you to protect the content of your communications from intrusion. Ephemerality removes the traces of your communications to prevent future intrusion. Those two features reset human communication to the state of nature, allowing people the room to think and communicate difficult things in a context of trust.
When people are monitored, they limit themselves to thoughts and discussions that are socially acceptable. This leads to groupthink, siloing people within a collectively imagined social ideal which is readily shaped by the ones doing the surveillance. The outrage mobs, public ridicule, and notorious cancelations are communicated far and wide, and the narratives conveyed about the context of those moralistic social displays are the levers of power being moved to influence social momentum. Marketing, politics, religion, social movements, and all manner of ideologies use the violation of privacy to amplify their reach and influence without the benefit of rational discussion and tests of validity that would have prevented such memes from gaining traction in the past.
Authoritarianism seeks the destruction of privacy. Whether it's a dictatorship, a cult, an invasive workplace, or platform, they degrade privacy as much as they can in order to exploit the resulting loss of individual liberty and agency.
So no, censorship is real. Cryptography is a tool that sets people in their proper place as sovereign human beings. Privacy, security, and anonymity give people the ability to speak on equal footing with any group or organization or fellow human.
By using apps and platforms and services that don't respect privacy, you're willingly accepting a second class status, ceding your right to express ideas that don't conform.
Buzz words my ass.
Briar is the best choice on phones, and it is also available on desktop which is under development. For now, Ricochet is the best choice on desktop (only). I get that it would be nice to have a piece of software working on both desktop and phone, but still. For that I just use Element.
Forcing me to recite my PIN every few weeks is one of the most irritating UX I’ve seen.
I’m sure there’s some smart engineer explanation in terms of cryptography and being unable to recover it if lost. But just let me disable it if I’m okay losing my entire account if I forget it.
Also last time I checked the binding of a phone number to Signal was really bad. I had a friend abandon Signal and I could never sms them ever again.
I've disabled it as I store my PIN in my password manager.
A simple one page screen on first install that asks a few questions would be a nice:
1. "Would you like to be nagged for your pin every few days?" - Yes/No
2. Are you moving from another device and would you like to restore from a backup? - Yes/No
etc...
Is there a way to say “always use SMS because this signal contact isn’t on signal anymore”
As far as I know, Signal offers no such option on their website.
I recently created a Signal account after having a bad experience in which someone used my phone number to harass me with SMS/calls (every time, from a different VOIP number). It's frustrating that, even in this era, there is no good way to filter out malicious actors from SMS/call.
P.S. You can sign up with Signal via a VOIP number to avoid sharing your real phone number. See: https://theintercept.com/2017/09/28/signal-tutorial-second-p...
Really, I don't want to give out a phone number to everyone.
Phone numbers, for most people, only work within a certain part of the world and aren't easily accessible worldwide.
To me Telegram is superior to Signal because it gives you both options, use your phone numbers with people that already have you in the contacts, and don't share your number with strangers in a group.
More seriously, it does compromise security for usability, which can be ok in some cases – as long as you don‘t make bold claims stating the exact opposite. Telegram has done just that.
For phones: Briar
For desktop: Ricochet
Yes, I get it, Ricochet lacks a lot of goodies Telegram has, but having stickers != secure. For secure chatting only, Ricochet does the job. No one will even know that you are using it. :)
Apart from all the red flags you're raising by using tor though..
The problem with tor is that it's associated with a lot of malicious stuff. The same way that IRC was for a while. Using it on a VPS for example was forbidden at many providers. Though since the rise of Freenode (and its fall and re-emergence as Libera) it has re-established itself as a platform for serious communication.
Though this kind of legitimate use is exactly what Tor needs to get out of the "dark" corner in many people's eyes, I do think it's there at the moment.
I have no idea why Tor is associated with malicious stuff. I mean sure, I do know, but people are people. Cash is associated with malicious stuff, too, or can be, because people buy all sorts of illegal stuff off the streets with cash. People are just being people, they always find a way. I hate it when things are ruined because of people who may do malicious stuff. Tor represents freedom to me. There has been anonymous chatting websites anyway, and it has nothing to do with malicious stuff. Or well, it may have, similarly to say, Omegle. If we banned everything that is associated with malicious stuff, we would have literally nothing, we would have no Internet, we would have no cash, we would not have anything for real. In any case, I hate this kind of thinking, that is for sure. :/
> Apart from all the red flags you're raising by using tor though..
Yep, I wish this was not the case. I am on IRC to which I connect using Tor. Now, both IRC and Tor is (or was) associated with malicious stuff! Imagine being on a shit list for this. :D I do it for my own privacy and security, but the reason is not that I am doing anything malicious. Sometimes I even use OTR on IRC just because I do not want the server to possibly know what I am talking about (no clue about the protocol right now, so I am not sure if they can actually read it, but I do not think it's P2P).
So yeah, people should stop with the false assumptions and silly heuristics. I mean, come on, I bought coffee and groceries with Bitcoin before, and many people bought illegal stuff with cash. Thus, I will never understand the argument against Bitcoin related to "Bitcoin is used for illegal stuff" bullshit. Both Bitcoin and cash has been used to buy illegal stuff, so what?! People are being people, stop blaming the technology that has benefits to many people who are not doing illegal stuff.
Signal does not.
Apple backs up iMessage plaintext contents to Apple, via non-e2e iCloud Backup, bypassing iMessage's end to end encryption.
Signal does not.
It would seem that initially, spammers would have the upper hand, but in the long run, coordinated and open effort against spammers has the potential to pay off.
Furthermore, to have a closed algorithm that cuts off the ability for people to communicate opens the door to institutionalized censorship -- designating a political opponent's communication as spam could limit their ability to be heard.
Let me try an argument other than "it's been my experience", though.
Suppose that it's not true. In that case, the anti-spam filter provides a publicly visible definition of spam in its code, and it's one that isn't grounded in the recipients' opinions. If the filter is to be effective, spammers must not be able to adapt their behaviour in a way that users consider spam but isn't according to the definition. Many people have tried to provide such a definition since 1995 and AIUI all have failed. I think the persisten failure indicates that it's extremely unlikely that one can be found, and therefore it's extremely unlikely that a publicly visible spam filter can be as effective as one that can be updated in secret.
The delayed release is supposed to achieve something, which it can succeed at, or not. I don't see what that is. The delayed release may also have an impact on the the software's and database's function as a spam filter. I don't have a good intuition for that impact either. Sorry.
Can't answer that but there were, for a long time, services that would run your "targeted emails" through spamassassin et al for you and give you advice on how to tweak them to lower the resultant score.
No. But that "no" is missing some qualifiers. It's not strictly true since you can implement some out-in-open options such as paying money, requiring a phone number, validating your physical identity, delays of use on new account creation, etc, that will make the barrier of entry for spamming much higher. There will still be spam, but it'll become more manageable to manually monitor and take action against. The downsides I feel are obvious based on the service we are talking about.
But I would say it is strictly true that you cannot have a free, anonymous, low barrier to entry service without hiding your anti-spam algorithms. There is fundamentally no difference in such an environment to differentiate a bot from a human besides the message content and patterns in who they message. If bots know what content they can't send or what patterns in messaging to avoid, they can still spam.
The rule is not to RELY on security by obscurity. It shouldn't be the last line of defense. But by all means, use it where the ROI makes sense.
However, there are plenty of opportunities to catch spammers when they make stupid mistakes. I've worked with web bot spam. I could catch a very popular bot brand by observing that it sent Accept header with content that was implausible for the User-Agent it sent. If the code was public, spammers could see `if (browser == safari && accept != safari-like) { spam }` and fix their header in minutes.
There's also a middle ground where the algorithm is public, but it's powered by secret data: blacklists, databases for classifiers, ML models. From accountability point of view data being secret is as problematic as secret code.
Interesting. Matrix solves this problem by not associating a username with a phone number or email address (unless you opt in to). Does anyone have views on if this will work into the future?
I'm moved ~90 of my friends onto Matrix (along with plenty of group chats), and most of them quite like the Element [1] app (though there are rough edges on iOS I'm hearing).
[1]: https://element.io/
They attempted ever more forcefully to make users to set a PIN to protect server-side state; it started with a dialog at the bottom of the screen, obscuring about 20% of the user list, which could not be dimissed, and then after a few weeks progressed to the a full page dialog, which could not be dismissed - rendering the app unusable.
All you saw upon starting was the full page dialog demanding you set a PIN to continue using Signal.
I did not want any server-side state, and so did not set a PIN, and stopped using Signal. After a few weeks, the full-page dialog went away, and I found I could use Signal again.
Signal actually blocked usage of the app to force users to adopt unwanted new functionality. It's hard to imagine any app doing well with such mis-management.
I opened a thread discussing the problem on their support/public discussion forum, which was deleted. I also at first opened a bug report on Git, before I understood it was all intentional, this was also deleted.
Since this experience, I've regarded Signal as on the way out, but it's still the best there is right now.
The PIN is a security option that prevents a SIM-swapping attacker from registering a new device under your phone number unless they know the PIN. You can opt out of it (and it might be opt-in to begin with). You can also easily opt out of PIN reminders. Both of these options are in Settings -> Account.
As for server state - my understanding is that Signal attempts to be zero-knowledge overall, but they definitely store some state on the server. I believe it's encrypted using your private key that's not backed up to the server. Setting the PIN does not change that.
Server state comment aside, it seems your main complaint is about a pop-up PIN entry UI that can be opted out of? I get that it might seem annoying, but it feels like a fairly weak criticism of a messaging platform, certainly not one that should warrant an impression that Signal is "on the way out"?
Moxies involvement is very muddy and never clarified, it was a pump n dump at best.https://amycastor.com/2021/04/07/signal-adopts-mobilecoin-a-...
That incident, they lost a lot of respect for me.
After that I was gone.
I am not talking about the PIN you would have to enter when starting Signal, to get into Signal.
I Googled a bit and found an approachable blog post from the time this all happened, here;
https://blog.cryptographyengineering.com/2020/07/10/a-few-th...
This has refreshed my memory of events.
In short, Signal wanted to store what had been purely client-side information (contact lists, for example) on their server, but - in principle at least - in a form Signal could not access.
The PIN in question is used to provide access to that information.
> Server state comment aside, it seems your main complaint is about a pop-up PIN entry UI that can be opted out of?
The dialog to force the user to set the server-side PIN disabled the app. You either had to do it, or stop using Signal. There was no opt-out.
I had a look at the app now. I found the settings you mentioned. It's not clear to me from what I see there is this if an app-locking PIN, a SIM protection PIN, or a server-side state PIN, or all three rolled into one.
In any event, at the time it happened, the presented dialog was full-screen and could not be dimissed; even if there had been options to disable this (and there were not prior to the full-screen dialog - I looked, in an effort to dismiss the permanent partial-screen dialog) you could not get to them, because it was a full-screen dialog which you could not dismiss; you could not get to the app, and so could not get to settings.
The only option was to stop using Signal or provide a PIN so your client-side state could be stored server-side.
Yes, they do upload your contact list, but I believe there's a prompt at setup time that allows you to opt out? It might even be an OS-level prompt to the tune of "Signal would like to access your Contacts". Not 100% sure on that one as I haven't set up a brand new Signal installation in years.
It's done to help their user acquisition. It uploads your contacts to match against other contact lists and let you know who's on Signal. I recall seeing a blog post explaining how they are doing it in a fully encrypted way, possibly using Secure Enclave (? though I think the 2021 version of that would probably involve ZK proofs/homomorphic encryption of some kind, and I hope they put some time into that).
I don't recall ever having to set a PIN specifically for that. And besides, a 4-6 digit PIN would be a terribly insecure way to "encrypt" anything server-side :) But yes, that would be a shame if it were the case.
I may be wrong, but I think this functionality existed prior to the server-side state effort. I recall when people in my contact list joined Signal, I was notified.
However, these days I do not keep contacts in the phone contact list. It's too big and juicy a target.
> And besides, a 4-6 digit PIN would be a terribly insecure way to "encrypt" anything server-side :)
Very much so. That does seem odd.
What I have received were creepy messages from long-lost acquaintances who had been suddenly reminded, by virtue of my having installed the Signal app, that I existed and that I was attending a security-focused event at the time.
And last I heard, Signal was adamantly opposed to removing these notifications. That's a big problem, IMHO.
I don't really like it either but all the other big players do this and it does really help. If signal doesn't it'll be even harder to get decent marketshare.
There's this weird situation where fighting something means adopting some of their tactics even if you don't agree with them, otherwise it's not viable to compete. I think Signal is still better than eg WhatsApp but they are pretty similar in some ways because less privacy-sensitive users expect certain features like auto discovery. And without them it'll always remain a fringe thing.
Why is this not done?
If the client is doing it, you need to come up with a system that is resilient to people using a bunch of different devices, getting new phones, etc.
This is a theme about building Signal: they're doing everything on hard mode, because they start from the premise that they don't get to know everyone's contacts. Virtually every other mainstream messaging system, including the ground-up E2E encrypted ones, keep a complete plaintext contact database serverside.
What is the problem with "people using a bunch of different devices, getting new phones, etc" in what I suggested?
If I make a fresh install, then next time a friend messages me, it costs them a few seconds of delay in sending their first message because my client asks them to prove themself.
I don't see the problem, but I imagine there are problems since smarter people than me are not doing it this way. I'd like to understand what I am missing here.
I guess tweaking the difficulty to be actually difficult for a server farm, yet possible for an old device would be the main problem.
We should try to bring this down, not up. And bitcoin showed how quickly the technology catches up with such requirements by using GPUs, ASICs etc.
Please let people allow Signal to automatically save their media to their photo roll (or whatever ios calls it). The number of people I have met who require this and left Signal _after starting to use it_ is astonishing.
I despise that it shows up in my main photos whenever someone sends a photo/gif/vid on these apps. Telegram segregates its local storage to a separate folder that Android doesn't seem to grab for the photo-roll and I want it this way; my photoroll should only be __my__ pictures, not random stuff my friends send me.
I talk to different people on different apps in very different ways; the ways I joke with my best friends is absolutely not appropriate for the ways I talk with the older people in my life, and vice versa. And it's absolutely not about me testing these waters; that's not for an App/OS to decide, that's for me to decide, and mixing these photos into one central location makes it more annoying and precarious for me to accidentally tap and share something I never meant to because the App/OS saved it to a central location that it never should have.
I don't even agree with "give people the option"; photocell/gallery/whatever are for __my pictures__. Downloads are for just that; Downloads. Apps should stay away from the pre-defined user space and put it in correctly named locations.
I realize I'm "reeeeee-ing" here, but it's honestly a huge pet peeve of mine to see all the photos from the chat apps I use to keep in touch with a small handful of people dump themselves into a user space that isn't theirs.
Telegram does it right, and apparently Signal does too -- I cannot understand why other chat-apps feel the need to behave otherwise; finding said photos is a matter of a single system call, so it's not like discoverability is a challenge for them. The users __will learn__, it's not hard to summon the file manager even with locked down permissions.
I think the way I think about it is that your phone's ‘photos’ app should have all the things you would think of as photos and things people sent you are included in that. Though I’m not sure what iMessage does (I think they don’t show up in photos. At least, things you take don’t show up). I also wish the app were better at differentiating between photos you took and photos that WhatsApp added, e.g. I once found a video of my feet walking through the snow in flip flops and I couldn’t remember where I was or why I did it, until I had worked out that it was my brother’s feet and came from WhatsApp. It would be nice to have some source metadata[1] and maybe a deep link back to WhatsApp, or at least have the app say “this is in the WhatsApp album by the way”
[1] ok, this actually exists for more recent photos and started exactly when I last upgraded my phone. So I am somewhat happy there I guess.
I certainly turn it off the moment I set up WhatsApp on any device -- why would I want random memes mixed into my photos?
But I have issues with the wisdom of such a feature, given that we're entering the age of client-side CSAM scanning.
I have consulted for the Signal Foundation in the past. None of the employees or consultants I worked with indicated that they'd had any problems.
Around 2010 timeframe, I hosted the RedPhone server backend on some spare colo hardware I owned. RedPhone, along with TextSecure, were the predecessors to Signal Messenger.
I have never had any (signal related) issues with the government.
I wish I could put up collateral, say stablecoin in a smart contract, where Signal can ban my account and keep the money if I abuse, but otherwise do not break my automation.