Hacker News Reader

Comment by harry8 | Hacker News Reader

Signal brought e2e encryption to the masses in a form that was and is usable. From signal having it came whatsapp asking the signal devs to "do that for whatsapp" and a billion more got it.

That is no small thing. Bitch all you want but make sure when you do you compare it to the success of literally ever other attempt to bring e2e to the masses and then if I'm gonna be snarky maybe compare it to your own achievements.

It would have been fantastic if signal also achieved other things on top of what they did. Maybe. Knocking what they did? Forget it. Signal is an outstanding achievement and nothing else comes close. I will cheer you so, so hard if you beat it.

View on HN

TFA acknowledged this specifically:

> Criticizing a security-sensitive tool like Signal is tricky, as it might be misconstrued as a call to abandon it, and move to alternatives that might be in fact worse. But here, at a hacker conference and with little risk of causing confusion and diverting users towards less secure platforms, can we please have an honest conversation about Signal's problems? And how 5 years after that blogpost, moxie's centralization has not solved them?..

Apparently the good intent they assume in a hacker conference does not extend to a hacker forum.

Their main complaints are 1) Lack of good clients, driven by a mostly closed ecosystem 2) Lack of good federation which brings down the whole network occasionally.

These are hardly knocking anything related to the security that Signal provides, and definitely does not count as "Bitching", as these are real problems that are absolutely good things to fix on top of a fantastic product.

> Apparently the good intent they assume in a hacker conference does not extend to a hacker forum.

That would be because this isn’t a hacker forum in the sense the OP was using. The OP was using hacker in the classic sense, security folks, the culture is different within that space compared to this one. (Not better or worse mind you just different with different values and understandings)

> The OP was using hacker in the classic sense, security folks

Really? I'd say that the classic meaning of "hacker" is what we have on HN. http://www.jargon.net/jargonfile/h/hacker.html

HN is mostly people trying to get rich selling themselves to VCs, so I'm not convinced that this is where the spirit of "hacker" is kept alive.

I'm here to read articles about hardware, software, and social hacking in the sense of "exploiting a system for fun, education, and only occasionally profit".

I think that is rather uncharitable, there is a pretty good mix of people here.

Yes, some are trying to sell themselves, which may be distasteful to you but people need to eat.

Others are activists, pushing their views.

Others here are just reading and occasionally commenting, like myself.

But there are also a lot of very passionate and smart people here who are pushing boundaries and limits with what they can do in terms of hardware and software.

and here we have the problem, defense. stop defending people “trying to eat”. we all are, and many of us are programmers. many of us are not here to have others buy our meal.

I’m just here for the occasional Don Hopkins mega posts.

"However, the Jargon File reports that considerable overlap existed for the early phreaking at the beginning of the 1970s. An article from MIT's student paper The Tech used the term hacker in this context already in 1963 in its pejorative meaning for someone messing with the phone system."

https://web.archive.org/web/20071025200829/http://listserv.l...

I would disagree.

> Their main complaints are 1) Lack of good clients, driven by a mostly closed ecosystem 2) Lack of good federation which brings down the whole network occasionally.

Both of these are very conscious, deliberate choices on Signal's part though. You can't "fix" them without fundamentally changing what Signal is trying to be. Demanding "fixes" for things without thinking about, or acknowledging the reasons why the current state of the world is how it is is just self-entitled "bitching".

Bitch all you want. No really. Do it. If you don't like the word, fine, use criticise in its place. Criticise ALL you want. Do it. Nothing is above reasoned criticism. Including my criticism of critics of signal who deride the choices made without acknowledging that the person who led those choices and the team and ultimately took responsibility for those choices also succeeded where nobody else had on a scale that is ridiculously large.

"I believe signal could have been as resoundingly successful in bringing e2e encryption to the masses as it was if it had done X and Y differently and tweaked Z." Is quite different to the critics around here who filled a page with comments without anyone acknowledging that they did pretty good in this one dimension. (Did ok in some others too, imho, but this one dimension is off the damn charts and there can be zero argument about that. They did it when it hadn't been done). So yeah, go right ahead, bitch all you like about my bitching about the bitching going on about signal. Please do. Nobody is being abused or disrespected here except maybe Moxie. I reckon it's happening to Moxie. Often.

It appears to me "Bitch all you want but ... " [emphasis mine] has changed meanings between GGP and this comment.

From "You can grumble all you want in this article but those complaints pale in comparison to Signals contributions which are above your trivial reproach."

To "No product is above reproach, your complaints are entirely valid and I was saying this all along."

It's also possible I just missed the entire point of GGP entirely, for which I apologize if so.

> in this article

> those complaints pale in comparison

> Signals contributions which are above your trivial reproach

There's the problem. I never said that or indeed anything like it. Quotes are really out of line there. Eg Never mentioned TFA. Never said complaints were invalid, never described all reproach as trivial in comparison.

> your complaints are entirely valid and I was saying this all along.

Nope not that either. Actually read it again maybe, just what it actually says?

When considering criticism of decisions that led to a billion people using e2e encryption and not mentioning that those decisions directly led to a billion people using e2e encryption then yeah, maybe think about whether that criticisim has been well thought out. At the time of writing there were about 50-100 comments all critical of signal policy and app functioning with nobody mentioning even once that maybe some aspects of that policy, yeah, they actually worked a little bit in a way that was pretty useful.

>It's also possible I just missed the entire point of GGP entirely, for which I apologize if so.

Fair. I'm sure that's general it should be and not directed to me.

> Their main complaints are 1) Lack of good clients, driven by a mostly closed ecosystem 2) Lack of good federation which brings down the whole network occasionally.

Those might be security adjacent, but i'm not sure i would call them core security concerns.

It is pretty easy to say it is good if you dismiss anyone saying it isn't as bitching. Signal was insisting everyone using a phone number as identifier. We now know there were zero-click iMessage exploits being used by oppressive governments to target politicians, journalists and activists. All they needed was your phone number. It is slightly more complex than that but still you do the math.

Its even easier to criticise it and completely ignore "...but make sure when you do you compare it to the success of literally ever other attempt to bring e2e to the masses."

Signal is a stunning success. If you or anyone does better I will cheer and yell about your success often.

>We now know there were zero-click iMessage exploits being used by oppressive governments to target politicians, journalists and activists.

Firstly citation needed please. Secondly, great, should they have been using email and pgp? Or google chat? Or are you saying the NSA should have just had all comms on their servers without going to any further and targeted effort.

Any software project can be criticised. And _should_ be. Just when you do it don't overlook its success which for signal was the first one that actually worked after decades of efforts. Now go do better.

> Firstly citation needed please

Pegasus.

Nowhere have you indicated how you measure the success. Number of users is no indicator for quality, for one. Code quality would be a rough guestimate because it is not open. Pick your poison.

Wha?

Is it bad to quote yourself twice in the same thread?

"... success of literally ever other attempt to bring e2e to the masses."

Attempt to bring e2e to the masses. How many actually using it is that metric.

Before open whisper & signal: how about number of people I knew with whom I could communicate securely with using pgp. 1. Total number of people in the world who could do it. A few thousand tops? You reckon it got to 10k, 100k. I can't imagine it got anywhere near a million...

Today: Number of people doing it everyday without thinking about it. Over a billion.

Sometimes metrics are so overwhelming that you have to tip your hat to it. This says nothing about any other dimensions of analysis other than "Number of people actually using e2e." It's a hell of a metric we can give credit to Moxie & co. for. That /one/ dimension is just wow. People tried before, for decades. It just didn't work out on that one metric. Something would have to be pretty bad to make that metric not dominate the discussion of overall success. But yeah, this is just the success of getting people using e2e and it's a massive achievement.

Most of those people aren't using Signal but the Signal Protocol. When people say they want different identities, infrastructure or clients what they are essentially saying is they want to use the Signal Protocol but they aren't Facebook. They can't spent millions on development and maintenance so instead they want to integrate with the existing ecosystem.

Signal being successful because it is implemented by different parties and therefor used by many people seems more a counterargument to the state of Signal because it would suggest that Signal would be better if more people could use it for more things.

> Is it bad to quote yourself twice in the same thread?

pretty bad, actually.

The reported number of users does nit equate with number of securely e2e protected users

What's not open? Signal is open source.

Parts of it are open source. It's not like they'll let you come audit the AWS accounts.

No- for sure. But if that's the last argument someone can put forth about trusting Signal, that's pretty damn good. Most privacy/security investigations end by the second paragraph of a EULA where the service tells you that they farm and track every bit of information possible and sell it to third parties before the electrons/photons finish passing through their network cable.

And I'm fairly sure that's not what the poster above me actually meant, anyway. When you say "it's not open", do you really think they're saying that in the context of not knowing that the source code we can see is the code that's actually running on the server? If that's what they actually meant, then why would they say that at all, since literally no third-party service is "open" by that definition?

They clearly are under a misconception that Signal is closed source or that the protocol is secret or something. They're probably thinking of Telegram, which IIRC, is not open.

> Signal is a stunning success.

That is what those criticizing it disagrees with, at least in that area. It is not a stunning success at letting you communicate with someone without disclosing a phone number.

> If you or anyone does better I will cheer and yell about your success often.

And that is what people are criticizing about the ecosystem when they say that it is hard to run your own client or infrastructure.

> Firstly citation needed please.

Search "zero-click iMessage exploit" and pick your favorite source.

> Secondly, great, should they have been using email and pgp? Or google chat?

Most already do because Signal doesn't really cater to other use cases. When people say they want federation or different clients it is often because they want to replace things like e-mail.

“not a stunning success at letting you communicate with someone without disclosing a phone number.”

Which it has NEVER claimed to do.

The goalposts moved so fast my neck broke.

I didn't say it did. The post I replied to, which wasn't you, is arguing that Signal is successful. Therefor it is highly relevant whether it actually is. I don't know which goalpost you are talking about.

The measurement of success. First it was R2-D2 (I meant E2e, but I like the auto correct so I’m leaving it) encryption, then easily exploited vulnerabilities, now somehow phone numbers got drawn in the mix.

Basically you’re you’re shifting anytime you get pinned down and it shows.

No, the phone numbers are in the second sentence of my first comment. The exploits are in the sentence after as an explanation to why it was bad to use phone numbers. And that is only one example to make it a reasoned argument. Other such points can be found in the video.

I am happy to argue the points but don't make up some characterization. It wasn't "then", "now" or "shifting". I've made the same points all along.

The topic at hand was not phone numbers and vulnerabilities.

You bringing them into the argument doesn’t make it valid.

Basically hijacking a discussion with irrelevant points that vaguely support your case is not valid.

OP’s point, the article is incorrect because of the value brought by E2E encryption to the masses, then various debate on how that wasn’t such a big deal, or was done wrong.

Phone numbers and iPhone zero days have nothing to do with the impact of Signal’s e2e.

Communicating with someone without disclosing a phone number is a pretty important feature.

I love Signal, and I think you're spot on about what they did. But I've been having a difficult time with the direction Signal is currently going. It seems like they are just trying to create feature parity with WA and Telegram. Which, honestly they are pretty near that already and the differences aren't worthwhile. Worse, they'll always be playing catch-up, because those companies have 100-1000x the number of developers. Instead, I think Signal needs to do what it does best: protecting users. I don't think this needs decentralization, although I saw a user post a feature request that was about semi-decentralization/meshing and that seemed pretty useful.[0] If Signal can bring anonymity and censorship mitigation to the public that really gives us the full Monty. That's really what I want to see from Signal. It fits their mission and keeps their edge.

The best thing Signal has done is made everyone else adopt E2EE. Signal shouldn't be playing catch-up, they should be pushing others to follow suit. Companies like Meta say that they need data to protect users but Signal ,,demonstrates'' that this is not necessary. So continue in this direction. I know many want to just keep Signal as it is (Signal purists) but Moxie is right. The ecosystem is moving. Staying still will just get you killed.

[0] https://community.signalusers.org/t/signal-airdrop/37402

But in order to do 'bring privacy to masses', don't you think they need familiar features? Otherwise it's just 'oh that weird crypto privacy nerd chat app' that the masses don't want to use.

What "familiar features" is Signal missing? Honest question. It has reactions, groups, stickers (wish they linked signalstickers.org so you can get more from inside the app), replies, etc. I don't see anything that WA or iMessage has that Signal doesn't. I know WA has statuses, but every time I look at it none of my friends have posted one. Telegram has channels, but do we really need that?

I honestly don't know what these features are. The only thing I hear from normal people is stickers and "but none of my friends are there." This is a genuine question because I can't figure out what others have that Signal doesn't.

Telegram has a bot API that is great. I use it for a lot of Projects. Used to be a niche feature I guess, but nowadays I see a LOT of people using some bot for some specific feature.

For starters, others don't lose all your messages if your phone breaks and allow you to actually send messages from desktop and tablet platforms without constantly breaking and losing data.

The "backup" system Signal has is a joke for everyone outside the paranoid community. Every messaging platform has a single chance of losing users data before they switch away. Signal does it constantly.

You should be setting a two-week auto-delete for all your messages anyway. Archive and backup features in other apps are a massive privacy hole. These chats are supposed to be ephemeral, if you want long lasting comms that you can search through later, use email.

The idea of any of my contacts logging every message I ever sent to them, and backing them up in clear text on whatever dumb cloud provider they're using this week, is a pretty scary one.

Please stop telling me and my family what to do with our private messages. If you want to destroy them immediately, that's fine. But stop demanding that Signal destroys pictures and messages my grandmother cares about without her own input.

This arrogance is the worst cancer on "privacy" software. Essence of privacy is _control_ over data, not destruction.

Not sure I agree with this. The problem is I don’t know what I’ll need later until I need it… old messages from months or years ago that I never expected to need have saved me multiple times for a variety of reasons by now.

It’s also awkward to try to herd a conversation partner from chat to email at some arbitrary point when you think the conversation is veering in a direction where preservation is important.

Try sending emails with E2E encryption. Good luck.

Live location.

I use Signal as my main messaging app now, but even for the contacts on there I have to fall back to Whatsapp to share our live locations in order to find each other. Doesn't happen very often but it is a useful feature that it is missing.

I extremely don’t want this in Signal.

Is it really that hard to tell someone where you are with words?

I like the social impact of real-time disclosure of my location. I’d rather share my location for an hour with someone that I’m meeting than send them periodic messages guessing about how far away I am.

I think Apple has done a really good job with this — you can share your location for an hour, the rest of the day, or forever. I use the “share for an hour” option all the time.

If you don't want to constantly be texting while riding a bike, it's hard to do.

Yes, people need it. Had to use Telegram for it recently, because Matrix didnt have it at that time, and I don't have WhatsApp.

Do people really need minutely updates on your bike ride? What value does it add to anyone's life to know what exact block you're on for the next 15 seconds?

Just tell them your final destination verbally, and you're done.

Maybe they were riding in a group and one of them stopped to take photos and lost the rest of them. Now they want to see where everyone else is and catch up to them.

Sometimes its about the journey, not the destination.

Yes. Try describing in words where you are in huge crowds of people or in open fields or beaches.

You can easily send a location pin. Yes I realize this isn't constantly updating, but seems enough to meet 90% (number pulled out of my ass) of the use cases.

"I am about 200 feet southeast of the large monument in the center of the park, wearing a red shirt"

"From the XYZ Street beach entrance, we're about 100 yards north, with a blue umbrella."

Using realtime GPS tracking for this sort of thing is fetishizing technology to overoptimize a problem that was trivially solved for millenia using verbal offsets from known landmarks, while at the same time introducing and normalizing grave privacy concerns in society.

>large monument

Good luck at long beaches where there are endless swaths of identical copy-paste tress, tents, deck chairs and umbrellas, without any unique elements to use as bearings. I would hate to have to send people on wild goose chases in the hot sun.

>wearing a red shirt

You've obviously never experienced how difficult it is to be found by your friends if you're short in a crowd of tall people at a concert or any sort of wide festival/gathering. Telling people what color your shirt is doesn't do anything to help if they can't see you until they're within 1m of you. And that's without it being dark at night. It's like finding Waldo IRL but more difficult.

> fetishizing technology to overoptimize a problem that was trivially solved for millenia

Ok Fred Flintstone, you do you, just let me enjoy the modern comforts of current technical achievements please and you feel free to follow the stars and buffalo tracks with your friends.

I mean people used to do this all the time. I sure did.it isn't that hard and is often more accurate than GPS, but I do get your point. For what its worth signal does have location sharing.it just doesn't update.

Don't iPhone and Android make it super trivial to get a live location link from the maps app that you can drop in the chat? I know Android does. Seems weird to put it directly into an encrypted messaging app when it's native to the OS.

I'm on Android and didn't know I could do that. Now I realise that you can, its just buried a little bit. Signal also lets you share photos directly from the app; I don't have to go to another app on the phone and share from there, so it does seem like a different UX route compared to what I'd expect.

Thanks for that.

Matrix clients have it: https://element.io/blog/element-launches-e2ee-location-shari...

Encrypted backups. That’s the one thing I miss and why I’m not - yet - recommending to switch to my friends and family.

Molly, a (compatible) fork, has this feature.

The ability to forward more than one photo at a time. When someone reacts to a message I get a notification but there's no way of determining what message has been reacted to. The backup system to restore messages when changing phones is fragile and something I have to help less technical friends / family members with.

Who are these older/less technical users that can't store text or images outside of an encrypted conversation, but somehow are still agile enough to search back through lengthy conversation histories?

Many people? The search box is right there, but filesystems confuse the crap out of people before mixing in the app/local file distinction.

I dont think I did a very good job of explaining what I mean. Im talking about the process to transfer Signal from one phone to another. In my experience it involves placing the phones near one another and transferring over bluetooth (I think) and this process has failed for me a number of times - a scary experience!

I did this but wired and everything worked fine. it just took awhile.

> The ability to forward more than one photo at a time

This is already possible (on Android at least), and has been for a long while.

Long press on one, press "select" which allows you to select other photos, select the photos you like, and then press forward.

One issue with that is that if multiple photos are grouped together, you have to select the whole group, but you can definitely forward multiple photos in one go.

Sorry, I meant forward from an existing message. So if I want to share a bunch of photos from one group to another, I dont believe theres any way to select multiple photos (on iOS at least).

Weird, I can do this on Android.

I don't use it, (I wish everyone used it or something similar, but nobody I know does, or certainly didn't when I last tried it and it was nothing like that, just SMS-like) so I can't speak to that, but my impression up-thread was that that was exactly the sort of thing people were wishing it wouldn't (have) focus(sed) on.

Isn't telegram also from a crypto nerd

Hmm, it’s not that hard to get people to use it. It’s got free stickers!

I guess it's great but gosh I hate stickers, to me they are over-engineered emojis.

The only feature parity I want is synced chat logs and not being tied to a phone number. And Signal doesn't support it.

>>It seems like they are just trying to create feature parity with WA and Telegram. Which, honestly they are pretty near that already and the differences aren't worthwhile.

Yeah, I don't know about that. I started using Signal about 6 years ago, I think. I remember back in the day there was a stable native Telegram desktop client that just worked (keeps working without single issue for years) and web WA client that just worked if the phone is online (mildly annoying, but very rarely a problem). Over time Signal developed an Electron-based client that annoyed me every time I use it. It requires relinking to the phone, it can't decrypt messages read from mobile, it can't send messages, it can send them, but the other party can't read them. I try it again every few months hoping that they fix these problems. Instead I get stickers and reactions =/

Yeah, I get it, multi-client encryption is hard, but WA seems to solve it using the same protocol. What I experience with Signal desktop client reminds me of Jabber OTP client compatibility issues 10 years ago. I almost stopped using Signal despite shiny E2EE. 90% of my texting is from desktop. I need it to work reliably. I don't care about stickers and reactions.

> Over time Signal developed an Electron-based client that annoyed me every time I use it. It requires relinking to the phone, it can't decrypt messages read from mobile, it can't send messages, it can send them, but the other party can't read them.

While I agree the app is a resource hog for what it is, I haven't ever had to relink my phone after the first time unless I reinstalled the app or got a new phone (duh). As for unreadable messages, I use Signal daily and have never had that issue once. I have had that issue multiple times using Whatsapp however.

>>It seems like they are just trying to create feature parity with WA and Telegram.

> Yeah, I don't know about that. […] What I experience with Signal desktop client reminds me of Jabber OTP client compatibility issues 10 years ago.

Like for the sibling commentator, the desktop client has been working for me largely flawlessly. Sure, doing backups on the desktop (and restoring them) would be nice, and no longer needing a phone number or needing to link it to a phone would be even nicer.

Meanwhile, though, WhatsApp doesn't even have a desktop client to begin with and their web UI is still mediocre and unsafe.

And let's not even speak about E2E encryption (or the general state of security) in Telegram.

So yes, I would argue most of Signal's features are more than on par with WhatsApp and Telegram.

Whatsapp does have a desktop client, at least for Mac (also electron like Signal's) and you can use it on the web without even installing one. Much better than Signal which only has an electron client so you need to run a whole browser just for it.

If it's browser based just let me run it in a tab.

> multi-client encryption is hard

It's taken a few years, and there may be a few bugs left that I don't know about (out of sight, out of mind), but Matrix uses the same double-ratchet encryption, and has solved multi-client encryption with cross-signing. Some clients may be imperfect, but this is the price we pay for being able to develop other clients - something Signal steadfastly refuses.

> That is no small thing. Bitch all you want but make sure when you do you compare it to the success...

Approaching valid criticism from that angle, with that attitude only throws a big jug of fuel to the already volatile fire.

We are having these these kinds of arguments on another piece of software which I won't name, and it's leading to the same outcome. No productive discussion, no progress, nothing.

Signal achieved good things, yes. Kudos for them coming that far. But if there is a considerable volume of same feedback, it's at least beneficial to listen to them intently, ponder and then sleep upon them, and draw some insight out of it.

A kind reply and acknowledgement would be very fit and handsome jest, but it's not a must.

You might be thinking that Signal is a flawless piece of software, even better than the sliced bread itself, but not everyone is on the same boat with you, and this is the way it should be. If this thing is an infrastructure for some people, and use it that much, the users have at least the right to make their opinions heard.

I have a group chat in Signal of 12 people. Only me, and another person, have a moderately technical understanding of what Signal provides. Besides the obvious "secure chat".

There is no path for non-tech users to start using Element/Matrix or some Fediverse thing. These are excellent concepts, but they will remain there, as nice ideas. Because they are not a quick three-step process of Download -> Setup -> Chat with Friend

I'm guessing that most of those people have at least one account (on some sort of service) that uses the traditional email+password login. I don't think that adding one more thing (the server domain) to that is hard. Or they could just use the default (in basically every client it is matrix.org).

I am not sure why you think of that for Matrix. I am the only technical person in my group who self-hosts the Matrix server. All that my friends had to do was download the client, copy/paste the instance url provided by me, and boom we were chatting.

Copy/paste of some URL in a specific field to get started will cause at least some non-nerd friends to question the ease of use and inherit distrust.

"Why am I pasting a URL given by you in this app, will you be able to track all my private conversations as well? Hell, will you be able to hack into my phone now?"

You must have some horribly untrustworthy friends. Or, more accurately, your friends must not find you very trustworthy if they're constantly asking these questions whenever you suggest something.

A healthy dose of skepticism is warranted, but at the end of the day this whole thread is about friend groups talking to each other. This just wouldn't be a realistic line of questioning in this scenario imo.

It would absolutely be a realistic line of questioning for friends and even family.

There is terms and service, legal systems etc for corporations. There is no such thing for individual server admins. They are right to feel weird about their friend running their private chats as opposed to a company.

Extremely hard disagree.

People implicitly trust friends and especially family to be generally good and not misuse their information. Far more than they would trust a random stranger or corporation, regardless of legal systems, terms of service, privacy policy, etc. They are also generally grateful that you're providing a service they can use and can handle issues coming up moreso than from others.

And, of course they would, you've built up years of personal trust and relationships with them, which goes far deeper than anything professional.

Source: I do this. For multiple services. For multiple people. But also, just basic common sense.

You’re simply wrong dude.

The proof is all around us. People don’t want to use services run by their friends. Otherwise they would.

I trust my brother with my life, but I would prefer to use Instagram DMs rather than a chat service he is running on a VPS. There is so much that can go wrong with a service like that. No offense to him, but I’d rather a company handle it where people are getting paid to do it.

Generally speaking, if someone is running a service out of the goodness of their heart, they are doing it as a hobby. And you have to wonder why it is so fun to them? They enjoy handling peoples’ chats? Seems a lil weird. I love my brother, but just seems a little off.

People do think like this.

Agree to disagree, but your conclusions and what you consider "weird" are just absurd. The reason people don't use their friends' services is because the supply doesn't exist, not because there's no demand.

And /r/homelab (and the numerous spinoffs) would highly disagree with you; the fact that they exist is what you would call "the proof" which is "all around us".

Hell, the non-technical end user can just leave the client at the default matrix.org homeserver if they want to have the same setup experience

Even without you providing an instance URL, most clients give a drop-down list of servers with open registration when you sign up. For some reason, these days, that's seen as an impossible barrier to entry.

Literally, my Grandma uses Mastodon! It is not hard! Many of us are old enough to remember a time (before gmail became the de-facto standard) when we had to hand-hold non-technical friends and family members through the process of choosing an email provider. Choosing a Mastodon/Matrix server is pretty much the same thing. Once you have an account on the server, there is pretty much nothing no downsides even for non-technical users...

Element/Matrix is literally "Download -> Setup -> Chat with Friend". I know, because I invited many non-technical people successfully and without any issues. OK, there was an issue back in the days when verification was much shittier, but it has been resolved by now.

> Signal brought e2e encryption to the masses in a form that was and is usable.

The general users do not care, just like how no-one cares about the inventor of the smartphone and Apple repackaged it and brought out the iPhone to billions of users.

Therefore, WhatsApp is the chosen one because in reality and contrary to what the herd believe here on HN, research [0] shows that even when Signal was boosted by some famous people, 'the masses' gave up using Signal when migrated and instead moved back to WhatsApp or Telegram.

I think Signal has done a terrible job at selling itself and retaining its users migrated from other messengers and was only riding on the back of boosters that don't even use it, which allowed Signal to get distracted and rush and push in a private cryptocurrency project useful to criminals and scammers to execute a pump and dump scheme for the founders.

The level of delusion in the comments about that so-called 'mass migration' or great 'messenger migration' to Signal seems to be as present as a haunted house.

What a shame. And nope, anecdotes is not evidence.

[0] https://medium.com/@carlagriggio/the-great-messaging-app-mig...

But actually there were events, when millions of users migrated to Signal, from Whatsapp. Like the last time when Whatsapp was down. So it is not as onesided as you make it out to be.

From your reference:

> but only 0.5% uninstalled WhatsApp. Let me put these numbers into perspective: if we translated this result to the entire population of WhatsApp users (approx. 2 billion), we’d be talking about 500 million users trying to flee from WhatsApp, and only 10k uninstalling it

0.5% of 2 billion is 10 million not 10k, which incidentally corresponds quite closely (within order of magnitude) to the number of people who downloaded signal at the time. As a side note if someone argues with numbers and is 3 orders of magnitude of in their calculation are their conclusions still valid? It doesn't give a good look.

+1 though to his credit he does caveat it a bit and states it’s still worth talking about the issues given the technical audience.

I do think Moxie is right though and the talk is wrong on the core issue which is federation doesn’t work as well unless you really boil the ocean to do it (urbit) and even that still has to prove itself. Signal is really good at doing what it does well and I’m grateful for that. Matrix is cool, but my family/friends will never use it (and element still sucked last I checked, especially to deal with encryption).

Signal is easy to use, extremely secure, and I can actually use it with less technical people I care about.

Like you said - these are major wins among an ocean of failure from technologists who have for years complained while failing to ship a solution with the right tradeoffs (normal) people would actually use.

I don’t find his other arguments very convincing either.

> I do think Moxie is right though and the talk is wrong on the core issue which is federation doesn’t work as well unless you really boil the ocean to do it (urbit) and even that still has to prove itself.

I'm not so sure about that. I feel like Matrix has pretty much solved the problems with federation, E2EE, and multi-device usage. I typically have Matrix clients running on three devices, talking to my self-hosted homeserver, with encrypted chats with people on different homeservers, and it's been... at least a year?... since I had any issues with encrypted messages.

It's been really good at disproving Moxie's assertion that you have to have centralization to evolve a protocol, too. The introduction of Spaces (like Discord servers) was really smooth and backward-compatible.

There are features it lacks that I miss (stickers, sending multiple images in one message), but they're not essential.

I do still also use Signal with less technical people, and I think Signal has been very successful at making adoption very easy, but with serious trade-offs for anyone not on the happy path (changing devices is a nightmare, it's too easy to lose chat history, multi-device is a trainwreck).

>Signal brought e2e encryption to the masses in a form that was and is usable.

Not really. It has the same weakness that other E2EE schemes have when it comes to general usability. In a usability study involving Signal[1], 21 out of 28 computer science students failed to establish and maintain a secure end to end encrypted connection.

The usability issue is a huge ongoing problem but there is a tendency to want to talk about everything but usability. We are having an animated discussion about the paint scheme while the barn is on fire.

[1] https://www.ndss-symposium.org/wp-content/uploads/2018/03/09... | When SIGNAL hits the Fan: On the Usability and Security of State-of-the-Art Secure Mobile Messaging

This feels like moving the goal posts a bit. Before Signal, literally all the other options were orders of magnitude worse on either the privacy or the usability dimensions. Which is why there was essentially no mainstream E2E messaging app to speak of. After Signal there were multiple. For any system someone creates there will be weaknesses. The question isn't and shouldn't be did they create a system with no weaknesses? The question instead is did they meaningfully improve the privacy of of a large number of mainstream users and the answer there for Signal is Yes.

Does nobody remember Pidgin OTR? It has been around for decades.

And none of the mainstream used it. Which only makes my point for me.

I remember it being a broken cluster fuck. Hell, even early TextSecure was a usability mess.

E2EE in WhatsApp is here because Meta does not care about the content of your messages. Analyzing natural language is hard anyway, whereas determining who you are, what you aspire to, and how to trick you into thinking your life won't be whole until you buy $PRODUCT is scandalously easy given your (weighted) relational graph.

That doesn't make sense . If they didn't care about the content of your message why would they ask signal to help them add ee2e in the first place . they could have left it on tls like it used to be.

What I meant what "who you talk to and how often you do" is as valuable as "what you say".

> If they didn't care about the content of your message

I'm not saying they don't care, just that e2ee in a centralised platform whose business is data collecting does not accomplish as much as one can think.

> why would they ask signal to help them add ee2e in the first place.

"Marketing" is why.

I hate that it relies on phone numbers instead of usernames. Sure, for the masses it is easier and certainly a success formula. But I still like to have an alternative anonymous service.

Me too. At least you can use VoIP numbers with Signal. You can also get a prepaid SIM anonymously, use it to create a Signal account, and then not use it. So there wouldn’t actually be any cell network activity tied to the phone number.

> You can also get a prepaid SIM anonymously

That's actually harder than you may think in more and more countries. Even with VoIP it's hard to not associate your banking details with your phone number. It won't be long until anonymous phone numbers will disappear again.

Yup. Travelling in an Asian country recently and in order to buy a prepaid SIM they needed to take scans of my passport and visa.

I have more contacts on Matrix than on Signal, and that's really saying something.

WhatsApp brought encryption to the masses. Sure, they did so using Signal's code, but they could've picked any code base for E2EE. Even XMPP has secure encryption.

Signal is "that alternate WhatsApp some people use".

I don't understand the point of your comment. Are you saying that because Signal solved a problem in one way it should be immune from future criticism? This seems like a really narrow perspective, the opposite of the kind of curiosity and creativity this site tries to foster.

I think it's good to take a look at Signal, recognize that it's better than what came before, and still come to the conclusion that it could be better. Signal is far from perfect despite its achievements, and today, years down the line from its original success, there is much room for improvement (or, barring that, replacement).

Google brought us some, a lot maybe even, of good stuff. May we not be critical of the things they could do better?

Always this endless either you with us or against us shit . smh.

Signal, as a means of developing the signal protocol, really brought encryption to the masses. Signal, WhatsApp, and RCS accounts for about 90% of my text communication. All encrypted by variations of the signal protocol.

the masses have never heard about it

and people who need E2E and are sufficiently knowledgeable about it don't use it either, for a number of reasons

it's a for-profit, centralized, closed-source product for privacy larpers

Reply on news.ycombinator.com