Hacker News Reader

Comment by daedalus_j | Hacker News Reader

I've been using Signal for a long time. I have repeatedly been unable to convince iOS users to use Signal because "I don't want another app". Android users have been much more willing to give it a shot.

As an android user myself, I much prefer having SMS built in because I use the search feature often to look back through all my SMS/Signal chats. I also regularly forward an SMS message to a Signal user, or vice versa. I'm already starting to feel like those iOS users who told me "I don't want another app"...

Signal seems to be trying to move further and further from "my preferred way to chat with people" and closer to the chat equivalent of "that protonmail account I only log in to when I need secrecy".

I obviously love having security on messages in transit, but I also like being able to keep my message history around and search my conversations for something that happened a year ago. It seems like Signal is on a trajectory to turn everything into disappearing messages. Are they the "safe for activists" communication app, or the "let's try to make as many as possible safer by default" app? Feels like they don't know.

And on top of it all the messaging is just frustrating. "we've taken away an incredibly useful and heavily used feature so we have development resource to better implement shitcoins and such" is such an irritating defense of the decision that I disabled my monthly donation.

View on HN

I agree completely here. This is terrible news from my perspective too. I use Signal for _all messaging_ (e2e secure or not) for the reasons that you mention.

I've onboarded friends and family, too, ensuring them it should be set as their default messaging app and that it _just works_. Unfortunately, people in the general population seem to have pretty much zero tolerance for any friction whatsoever. If they have to use 2 apps, they'll just end up communicating with me in the clear using their "default SMS" app on their phone. That's what this is going to result it...a reduction in overall message security due to people defaulting to what's easier...which is to _not_ have to remember which app to use for which "send a message" purpose. Fuck.

I understand the argument about people in markets where SMS is expensive getting screwed sometimes when they don't realize they're sending a message over SMS. However could that not be fairly trivially solved for with some UI notification or app setting that warns you about this and allows the warning to be perm-disabled if the user doesn't care!?

I think the real reason here is this desire to transition the service into supporting usernames, which is a topic that's been discussed before (and is explicitly mentioned in the post). Right now the service is tied to your phone number. After this change I suspect it will not be or not need to be.

This is very, very unfortunate for those of us who've convinced a ton of non-technical friends and family to use TextSecure->Signal over the years...

If they have to use 2 apps, they'll just end up communicating with me in the clear using their "default SMS" app on their phone. That's what this is going to result it...a reduction in overall message security due to people defaulting to what's easier...which is to _not_ have to remember which app to use for which "send a message" purpose. Fuck.

Exactly right. In fact, I will be doing this too. Right now, I use Signal as my default messaging app, and messages go via Signal to people who've registered their phone number with Signal without me having to do anything to effect that. When Signal stops working as an SMS client, I'm not going to look up which of my contacts wants to use Signal and which can only use SMS - I'm just going to use my default SMS app for everything except the couple of group chats which are on Signal already. Messages which would have been opportunistically encrypted are now going to go out plaintext, because the friction to find out who uses Signal and who doesn't is too high.

This already happens with iOS, because the Signal app doesn't work as a default SMS client. People who use Signal and Android reliably send me messages over Signal, whereas my contacts who use Signal and iOS mostly send messages over SMS unless they're directly replying to something I've sent them over Signal.

And even if I wanted to do the work to send everything over Signal to those contacts, how am I supposed to remember exactly which of my kid's friend's parents use Signal and which don't? Fuck it, the juice isn't worth the squeeze, everything is going over SMS.

I'll just have to hope that Google figures out a way integrate a seamless, opportunistic end-to-end encryption protocol into the default Android messaging client, since Signal is deliberately dropping the ball here.

Holy crap, this 100%. I am absolutely distraught. I give monthly donations, have moved mountains to get family and friends over to Signal, and viewed it as a last bastion for security and interoperability between iOS and Android. Now we will get neither.

Gutted. I will end up switching to a different provider. Absolutely don't know if I'll be able to convince family and friends to switch again.

Yep. What a drag.

I don't really see Signal as a useful tool for my uses after this change. I liked the SMS and encrypted messages in one place thing even though some friends rarely check it. For those friends I send SMS through Signal. There are certainly issues with group chats and media but nothing bad enough to consider using two apps. Now I have to look for a new tool, and figure out what to do with certain archive conversations I'd like to retain.

>viewed it as a last bastion for security and interoperability between iOS and Android

>Now we will get neither

Correct me if I'm wrong, but:

- If you and your counterparty are both using Signal, nothing about the security of your communication changes.

- If your counterparty was not using Signal, your messages were over SMS/MMS and therefore not encrypted in the first place, and so once again, nothing about the security of your communication changes.

Are you seeing something I'm not?

That's definitely true! But if both are in one app you don't need to remember who uses Signal and who doesn't; it just works. Now with two apps, you have to run that mental check before sending a message and choose the right app.

> I'll just have to hope that Google figures out a way integrate a seamless, opportunistic end-to-end encryption protocol into the default Android messaging client, since Signal is deliberately dropping the ball here.

This is what Google's RCS implementation is, to my understanding.

Although the end-to-end bit might be a bit on the squishy "kinda-maybe-sorta" side, rather than Signal's enforcing of it.

I hope you're not too invested in Google making a chat thing work long term.

There's an overwhelming mountain of evidence that says that ends poorly.

Becoming too invested in any instant messaging thing is a recipe for disappointment and woe.

As far as instant messaging services are concerned, I have let go my earthly tether; entered the void; empty and become wind.

You say that but then Line, WhatsApp and WeChat have been hugely successful depending on which part of the world you're in.

I've run into a related problem:

I have (iOS-using) friends I have convinced to register their numbers with Signal...but they never check Signal. They do check SMS.

This actually drove me away from using Signal for SMS on Android, because I couldn't send those friends SMS messages through Signal. They could only go out as Signal messages, and my friends never checked them.

Fortunately, I only have a handful of friends in this category, and virtually everyone else I talk to does use and check Signal, but it's a usability problem both ways.

You can send those people SMS through Signal (for now!) by holding down the send button for a moment - it opens out to let you choose "Insecure SMS".

Man, this would have been great to know a year ago!

On my wifes phone she didn't receive notifications for signal because the OS she had would suspend signal when it was inactive. So I had to manually change its battery saving settings.

I use both Signal and SMS on my phone (iOS) and don’t find it to be that cumbersome to deal with. I already have to use multiple apps anyway to communicate with everyone I need to (Slack, some people are only on Telegram, WhatsApp, WeChat so I have to have those apps too). I default to SMS but if it’s a conversation where I care about privacy I’ll use Signal.

> Right now, I use Signal as my default messaging app, and messages go via Signal to people who've registered their phone number with Signal without me having to do anything to effect that

This is actually a complaint of mine. I've regularly had Signal send secure messages to people who have tried Signal in the past, but have since uninstalled the app (or in iOS's case, they 'offload' apps when you don't use them frequently which silences notifications). This results in me thinking my messages are sent only to find out that they'll never read them. I then get frustrated and have to go back and re-send the message via SMS.

I don't like some of the decisions taken by Signal.

However, if "dropping support for SMS messaging also frees up our capacity to build new features (yes, like usernames)", I think it is something I would not miss.

Besides, I agree with them on the point that SMS leak metadata.

But that's just a bullshit promise (in the sense of not being anchored to any commitment), no different from a politician saying some policy initiative will create jobs because that's how the economy works.

SMS does leak metadata but guess what, that leakage is going to continue because people aren't going to just cut off their SMS-only-using friends and relatives. Now they'll be leaking Metadata from an even less secure app, so the user is in no way better off.

There's another reason for iOS users to avoid Signal: It eats up Gigabytes of storage space, refuses to ever clear it, and the devs are rather resistant to accepting that it's even a problem at all: https://github.com/signalapp/Signal-iOS/issues/4916

Since there’s no server storing media, consider saving the stuff you want and dumping all the old photos and video you don’t. It’s a more secure communication tool, not an archive.

I'd take a decent "export my chats" option. I have chat history that goes back years that it's often convenient to be able to search. I'd love to be able to move it off the device, but instead the Signal backup just keeps getting larger and larger.

To be clear, Signal allows you to backup and restore back into Signal on android, which is great. What I meant is that it would be helpful to be able to export that content out of signal and keep an accessible searchable archive off of the device.

> I have chat history that goes back years that it's often convenient to be able to search.

> but instead the Signal backup just keeps getting larger and larger...

One begets the other.

> I'd love to be able to move it off the device

If you don't want infinite history, set a conversation length limit. It is in the storage settings.

If you want to backup messages on iOS go complain here[0]. For Android, you already have this ability.

[0]https://community.signalusers.org/t/ios-backup-keeping-messa...

If I set a conversation length limit though it prevents my ability to search back through my history, which is the feature I'd like to preserve. I value that history, it's useful to me.

My ideal solution would be to export any message older than a month to an archive on my NAS, ideally in a format that the app could search on request. Keep my history, keep the on-device space nice and small.

I take advantage of the Android backup feature, and the backup syncs over to my NAS via SyncThing automatically, but that's only useful for restoring a brand new phone up to the latest state.

> My ideal solution would be to export any message older than a month to an archive on my NAS

I'm confused at what is stopping you from doing this?

> ideally in a format that the app could search on request.

Are you not able to import these backups into the desktop client? IIRC it is just reading from a file structure. I don't see why a small script couldn't resolve this. Obviously you wouldn't be able to search on your phone, but you said you didn't want that data on your phone anyways. If you did want to search on your phone from your computer's storage, I think you're asking way too much of them (and in danger of asking them to store data for you, which they never will do). But this is hacker news, and I don't see why you can't hack together that tool in a weekend. Probably just a few beers on a Friday is enough for it tbh.

> I'm confused at what is stopping you from doing this?

As far as I know the backup is encrypted.

> Are you not able to import these backups into the desktop client?

No, the desktop client is not standalone, and ONLY syncs with the a phone to get content. Moreover, if you don't use the client for a period (2-3 weeks in my experience?) it de-syncs that desktop client. Re-connecting that desktop to your phone will only sync messages starting as-of the connection, so there's no way to get the desktop app to pull your whole history. (This is another gripe I have about their sacrifice of actual usability for security that only helps a few very specific use-cases.)

You're probably rigth about hacking something together. Someone has created a library [0] allegedly for decoding the backup files. Friday night is D&D night though, so I haven't had the chance. :-)

[0] https://github.com/pajowu/signal-backup-decode

I was more thinking to port chats from your phone to the desktop. The desktop client is on the NAS and serves as the "storage" where you can search your full backup. I would guess there would be a more difficult solution where you could hack the phone app to sync all data instead of just when your desktop connects. So that solution might take more than just a Saturday night ;)

I agree that there aren't really any great solutions. But the alternative is that Signal stores your data. I think this would make a lot of users very upset and compromise part of Signal's core mission.

Agree, I don't want them storing anything.

This is one area where, and I know what you're going to say, but Matrix actually does really well. My data, on my server, in my house, not tied to any specific single device I own but distributed across several and backed up in an encrypted manner.

But you've got me thinking about the data export option. Saturday is coming. Hmm...

> and I know what you're going to say, but Matrix actually does really well.

I'm actually a fan of Matrix. I just see Matrix and Signal as different tools. You're probably aware of it, but if not, there is a Matrix bridge for Signal.

> But you've got me thinking about the data export option. Saturday is coming. Hmm...

Hey, I'm really hoping it works. Let me know how it goes!

[0] https://matrix.org/docs/projects/bridge/mautrix-signal

Being rude to people by dismissing feature requests as invalid isn't helpful.

Sorry, I'm not trying to be rude. But I am confused at what they want. We have continued the discussion and the picture is clearer to me. Though I'm not sure exactly how Signal can help with it. It still appears to me that the user wants both reduced storage but to maintain search history, which are at odds with one another. Unless they expect Signal to store their history, which those expectations should be shot down because that is against their core philosophy. I did suggest a hack that might fit their needs (full history on desktop but not phone).

How can you be confused?

'I'd take a decent "export my chats" option' is a very simple statement. There is no way within Signal to just export a whole conversation to a file.

GP also said they want to be able to search their chat, however, which I believe is the source of the confusion.

Yes, exactly. It's fair, I was not specific enough with my feature request.

But I think that's what godelski is saying is a bit of a contradiction.

If this "accessible searchable archive" is stored "off of the device", how exactly would the device access and search the archive? Facebook can store your Facebook Chat history on their servers no problem, but E2E encryption makes this much more complicated for Signal!

It's not impossible, Apple does it with iMessage, although that was actually a pretty recent addition despite all of Apple's resources!

> But I think that's what godelski is saying is a bit of a contradiction.

Exactly. I'm saying you can't have both low storage and full chat history. These two cannot work without a storage server. I have suggested a method of using the desktop client as the storage server but I agree that there is no great solution.

> It's not impossible, Apple does it with iMessage

That does come with significant tradeoffs though. Now we have to trust Apple that they haven't taken our keys and that they still aren't handing over this data. It is a tricky situation.

> There is no way within Signal to just export a whole conversation to a file.

You can on Android and Desktop. On Mac see ~/Library/Application\ Support/Signal for your data. The only issue is with iOS which I agree is an issue, but does not seem to be the parent's issue.

No you can't. You can find that info at the OS level, or if you use the beta you could get at it via the Developer tools (since it's just a specialized browser window), but there's no userland option to export your conversation in the application.

That's why I wrote 'within Signal.'

As a simple example of how this could get messy, suppose I wanted to back up all my Signal messages, install a different operating system, install Signal there, and load up my old messages. I do have the IT skills to just find the database file and move it manually, but I'm only confident about that because I know its an SQLite database, where the keys are stored etc.

It's still an IT problem I would prefer not to have, vs the simple option of 'Do you want to export this conversation, with all the security implications Y/N' or 'Import this previously archived conversation?'

Except that they make it a pain in the ass to save the stuff you want, because there isn't an easy 'export conversation' function. You can archive conversations so that old ones don't clutter up your chat list, but the only thing you can do with an archived conversation is...un-archive it. It has literally zero utility.

Your only way of saving things is to either manually save every picture and video, or manually highlight and copy the text in your conversations. The latter defeats any security arguments (other than of inconvenience) but also throws away useful information like timestamps of messages.

My Signal database takes up many GB on my phone, and it's constantly complaining about running out of space. Much of this is the years-long record of conversations with my wife. I'd like to back these up, but I can't. Are you gonna tell me that I shouldn't be using a secure messaging app to communicate with my own family members?

Precisely! So just give me an option to export my stuff to a password-protected archive. Make me check a "yes I'm fully aware that this means I am now responsible for the security of this information" if you want. But Signal doesn't let me do this.

Yeah, that would be nice. But an export-import. Or any backup function whatsoever is sorely missing on iOS.

Telegram has huge amounts of video and audio data but they allow you to easily select and remove the cache for certain chats or sections of chats. It's a UX decision that Signal could "easily" copy.

How? I’m looking for a “delete all messages over X days old” option.

Not “delete all my chats/delete an entire thread.”

On Android:

Settings > Data and storage > Manage storage > Keep messages

then choose from the listed options

Unfortunately, the option isn’t available on iOS, unless it’s hiding somewhere else.

How do I dump all the old photos and videos?

Because the in-app option to clear them all does not free the space.

People usually want both and that's what causes most people to ignore good tools.

Signal is in a weird place where they can do no right by users. It's a team of like 25 developers building extremely complex software criticized by people that don't understand security and trivialize everything. Reddit has a lot of evangelists that can't even program. Their community forums are a dumpster fire where users act like "my way or the world is going to end" (see the current username discussion. Most people are fair but you see[0]). Anything they say on Twitter gets spammed with questions about usernames by people that can't be bothered to see that it is in alpha testing and available for custom builds. And on HN everyone criticizes Signal and compares it to Matrix which is always better for every single purpose.

I do like Signal and I think they have done a lot of good. I do think they have a lot of valid criticism against them but also I think a lot of people aren't providing useful criticism (it is a shame that's happening here, on a forum that should be filled with tech experts). People also aren't realistic. A 25 person team working at a non-profit aren't going to have the same development capacity as a 250 person team.

[0] (maybe go to the bottom) https://community.signalusers.org/t/usernames-in-signal/9157

What do you "Matrix is always better for every single purpose"? Are you saying that you really believe that, or characterizing others as saying that wrongly? I don't know much about either, but I thought both had somewhat new (less-tested) encryption algos (one is 'double-ratchet' or something? that recently has shown security vulnerabilities?)

I'm saying that people put Matrix/Element in competition with Signal. These used to be dominating voices here. I do think the Matrix == Slack and Signal == Text philosophy has become more prominent now (the philosophy I prescribe to). But there are also major discussions about decentralization and users would suggest Matrix was more secure because of that even though at the time group chats were not encrypted (they are now) and E2EE was not enabled by default.

These are purely my observations of the discourse around Signal and should not be taken as a universal truth. Only my subjective reality.

I'm not aware of any major vulnerabilities in Matrix (but I'm not following) closely. I'm also not aware of any in Signal, which I know is frequently audited. There is an SGX attack, but it is often blown out of proportion (highly technical attack that requires an unlocked phone to be in the physical hands of the attacker).

Pretending like Signal is the second coming of Christ and implying that Telegram and all else is insecure and for dumb idiots and may have had something to do with it

That's far from what is happening. Everyone is complaining about Signal, including me.

Telegram gets a lot of shit because they prop themselves up as a privacy app but aren't. The default is that things are not encrypted. They use a proprietary encryption scheme. They store user data on their servers. These are not the marks of a privacy app.

Thanks for letting me know what I think? And we're all aware of Telegram shortcomings here, it was an example and correct me if im wrong but this thread is about Signal?

I explained how imo Signal has burned the goodwill of a some of its early adopters. Meaning not recommending it to my friends and buying my mom an iPhone. Now there's an argument to be made that it's not very smart to dismiss the app, but that's what happened.

I'd be very surprised if they manage to salvage its image at this point

Doing so comes at a cost to privacy — by signal having a hosting server, even if the contents are E2EE, retrieving and storing these contents creates a metadata trail. I actually go over these drawbacks and tradeoffs in a recent blog post: https://cassieheart.substack.com/p/notes-on-e2ee

Who said anything about a hosting server? Why isn't there a simple option to export a conversation to local storage, encrypted or unencrypted, along with a warning that 'your conversation is now leaving the secure Signal zone.'

It's not only your conversation but the one of others too. I like that it's hard to move it elsewhere.

If you don't trust the other end then disappearing messages should be used, simple.

This is one of the problems with Signal having a bit of confusion about what exactly it's use-case is. There are plenty of cases where locking down the ability to save/view/export messages are valuable, and Signal provides tools to be able to do that. Making that the mandatory case though means that it's harder to adopt as a general-purpose communication platform.

The need to decide if the goal is still to get as many people off of SMS/facebook-messenger as possible, or if the goal is to provide extreme security to dissidents and protestors, or if they're going to spend the effort to be able to do both effectively and let you choose which conversations or messages get which level of protection.

But I could just screenshot all of it, and you'd never know. There's a setting to prevent screenshots, but no way to tell if other persons have it enabled or when their setting change.

It's like when Signal asks you to put in your PIN, but it's the same PIN you use to unlock your phone. There's a different Signal PIN, but that functions as a check for when you install Signal on a new device. Your regular PIN is just a repeat of your phone PIN, and thus adds exactly zero security.

For starters, signal retains a conversation for the length of time you grant. That can be indefinite. The way it is retained is in a local storage database. It is intentionally guarded against export (although this is somewhat unavoidable with backup features on phones), so as to avoid companies like Cellebrite making it easy for LE to overstep their bounds and pull the message database when they take your phone. If you want some kind of export interface, your best option is a screenshot — signal does not take any action that threatens the mutual security between parties as explicitly agreed.

I don't want to be handcuffed for my own security, thanks. An export facility has little bearing on the integrity of my communications since a counterparty could simply have their phone taken over if they forgot to set a PIN or gave the PIN up to law enforcement. A warning that the exported data can no longer be considered secure (just like when I save a file or photo) is sufficient.

Meanwhile if my counterparty and I have communications in Signal that we want to preserve at scale, it's impossible to do so. A simple example would be that I have years' worth of conversations with my wife that I can't easily back up any where. We could export every picture and video by hand and screenshot or copy the text of every message, but that would be extremely time-consuming and tedious.

That's the basic problem. The data is already only semi-secure in that it's subject to exfiltration without consent. It's just inconvenient. And where parties do consent, it's very inconvenient because it's many many hours of work; in the end, it's just more security theater.

Weird. Signal is my primary messaging app (on iOS) and I'm sitting at 196MB storage used.

The biggest issue I can see with using two separate apps is checking who's on Signal and who isn't. That means opening up Signal to see if they're on there and then switching to SMS if they aren't. I much prefer having both types of contacts in the same UI and it's been obvious to me which messages are secure. Also, when someone then joins Signal, subsequent messages to them automatically get upgraded to being secure with no effort on my part.

Yes... Unless it's able to somehow alert you that you're texting someone with Signal, it seems like Signal will be phased out because everyone will default to SMS, unless they have a reason to use Signal for a conversation, which hurts the entire privacy ecosystem.

People often complain about the alert that you get when one of your contacts joins Signal but this is exactly what that attempts to solve

There was a time when contacts that use Signal were listed above contacts that are only reachable through SMS.

Those two groups of contacts then got mixed making it much harder to see who's on Signal and who isn't.

Back then I thought that was deliberate. It would be surprising to me, if the desire to avoid that self-inflicted confusion would have contributed to the decision to discontinue SMS support.

If I click the new message button I only see Signal contacts.

Yes, this is an idiotic decision that makes me question the decisions being made as a whole by Signal.

Does anyone have recommendations for a good default SMS app on Android?

Posted elsewhere in this thread but...

Personally like TextraSMS. Has a free ad-supported version, but I paid to remove ads when it was on sale several years ago (maybe $1).

4.4 stars. I believe it's $3 or $5 to remove ads now.

https://play.google.com/store/apps/details?id=com.textra

Also surprised me the other day when a friend used an iOS reaction, and it applied it correctly on my end.

> Added support for Reactions (also known as Tapbacks) received from iOS Apple devices.

I am also using it on both devices, and I also paid for it using Google Opinion Credits :) Textra is an amazing SMS app.

I've been using QKSMS on Android 12 and haven't had any problems in about a year of use. I think its on Google Play as well.

https://f-droid.org/repository/browse/?fdid=com.moez.QKSMS

Last commit was a year ago. Do you know if it is still being developed?

Doesn't look good... https://github.com/moezbhatti/qksms/issues/1881

I'm not sure, but I haven't had any issues or want any more features than it already has so it's not an problem for me, but might be for some.

The Google Messages app is pretty good. It's a little thing, but it's the only app that supports tapbacks from iOS -- so on the (many) group threads I'm on that have iPhone users, I can see loves/like reactions instead of a flood of texts that say "Jane Doe loved an image".

I also use the "messages for web" sync that Google Messages offer: https://messages.google.com/web/

Really convenient to be able to respond to texts without having to take out my phone.

+1 google messages.

rcs support works well, the emoji reactions are good. the web ui for it is pretty alright. I use the quick responses and scheduled send from time to time. and it cleans up my 2fa codes automatically.

Also, it now sends emoji reactions over sms which is a nice little graceful degredation from sms.

It's terrible. Every once in a while they decide to convince me that I really don't want to be sending an SMS but I want to use google's messenger of the month, that will inevitably be gone next month.

Huh, it's never done that to me. How often does it happen?

Every time it updates it asks me if I want to enable "messaging features" the next time it opens.

Used to happen to push duo. I installed an sms app from fdroid after that.

https://f-droid.org/en/packages/com.simplemobiletools.smsmes... ?

This is what I'm switching to. I would have suggested Textra, but when I downloaded it just now, TrackerControl told me there are a bunch of tracking libraries in it. Simple SMS Messenger, on the other hand, not only doesn't have any tracking libraries, but doesn't ask for internet access!

I've used other tools in the Simple suite and I love them.

Although I like using F-Droid, this app is also available on the regular Play Store as well.

Update: I switched back to Textra because Simple SMS lacked a way to see timestamps for arbitrary messages. It will show occasional times when a message was received with some lull between it and the previous message. Otherwise, the timestamps are a mystery. I don't like that.

Pulse SMS is really good, but I blacklisted updates since they were bought in 2020

https://www.androidpolice.com/2020/10/29/it-looks-like-pulse...

QKsms is open source but abandoned more than a year, so I guess Simple SMS at Fdroid should be ok, it's from the guy behind Simple Gallery

Silence is like a less polished version of Signal. The only important feature I really think it's lacking is a search function. You can export your texts to an XML file though, so to find something from a long time ago I just export to a file and use grep to search through that.

SMS Organizer by Microsoft

https://play.google.com/store/apps/details?id=com.microsoft....

Been using this for years, I really like the Updates and finances tab.

https://i.imgur.com/hUABKGr.jpg

shudder

I've been using Chomp SMS a long time and it's still being updated.

Yeah, I like Chomp. As I recall, I first installed it because it had an optional emoji pack with the old blob emojis in it, which I was miffed to have had taken away from me in an Android update.

The provide a fairly clear rationale beyond the ideological concern: users don't know/see who is on SMS and who isn't, and are being hit with high fees, and they are concerned that users may believe they have privacy when they do not.

These are reasonable issues and concerns, so I don't follow why you would question all of the other decisions they make.

> users don't know/see who is on SMS and who isn't

They could just show the literal word "SMS" in the send button.

I think that would be more obvious than wha they do now (button being grey instead of blue with a minimally changed lock symbol [1]).

[1]: https://support.signal.org/hc/en-us/articles/360007318911#an...

Couldn’t they just do something like have the sms messages in a different color than the rest? Similar to how iOS used blue for iMessage and green for texts? Signal could use an annoying red color for sms to make it even more clear.

Not sure if this is a joke given that Signal uses Blue for sms and Red for encrypted...

I am on iOS and have never seen red. Only see blue. Color can be customized though.

I didn't specifically sate "on Android" since on iOS all messages are through Signal.

If only there were a company that had, at some point, demonstrated that you can use indicators such as colour to indicate to users whether their messages were being transported via SMS or an E2E secure transport layer.

I guess that's just a pipe dream though.

There are surely ways around this that don't limit the functionality of the application

As if Signal couldn't change the color of the text bubbles to some shade of, let's just say, green, to indicate when a user is chatting via SMS instead of a Signal secured message.

And then everybody and their dog would accuse them of green-shaming or whatever.

No such thing as bad PR, unless you're removing features. Having people green-shame just means there are other people that are rolling their eyes and still getting their name out there.

so put SMS in different tab and let users turn on/off this feature in settings, done, problem solved, but I understand giving users options nowadays ain't trendy

Every friend using iOS that I've convinced to use Signal has uninstalled it. They stay registered, though, so I have to notice that my messages aren't reaching them, and re-send as SMS.

Yes, this is a massive pain.

> I have repeatedly been unable to convince iOS users to use Signal because "I don't want another app".

Here's how I've convinced my iPhone friends. I tell them if they actually want to send pictures and videos to me that aren't potato quality they can either switch to an Android, email me, or use Signal. At this point Signal is more like a cross platform iMessage. This tends to move people over because Apple's walled garden makes group chats infeasible with mixed devices.

Signal is another walled garden, where you have no say in their decisions and simply must obey or leave. Consider Matrix if you want to have the freedom.

I have got all my friends / family using signal, but everyone else I know and everyone else they know are using SMS or whatever.

They will no doubt stop checking their signal messages from me same as iPhone users often do and I will have to change to insecure messages for all my messaging.

This will break their trust in my recommendation, as much as it will break my trust in signal.

I get the reasoning over this, but I think they fail to realise that interoperability is the most important feature. I will have to stop donating to signal over this change, it will be useless to me...

This. I've switched to iOS recently and I hate that I need two apps now. Already longing to go back to Android.

When I switched from Android to iOS this was the number one technical regression, and for years my go-to example of nice things Apple keeps from us. It’s unbelievable how Signal is sabotaging itself here.

Just use iMessage. It's not as secure as Signal since the server has the keys, but it's the easiest way to ensure that the majority of text messages you send are encrypted.

There was just an article that said that 88% of teens have an iPhone. That means that almost all of their communication is encrypted.

So when the server has the key, how can you say it's encrypted?

I mean in context of signal we don't just talk about some form of transport encryption but e2e

It's various levels of encryption that are acceptable depending on your risk level.

I'm mainly concerned about SMS spoofing and mass surveillance. iMessage protects against that. The only way the government can read your messages is by serving Apple with a warrant to obtain your iCloud backup.

If I had a lower risk tolerance, I would disable iCloud backups to improve my security.

I don't think people are only concerned about the government, but rather the corporations that own your data (via storing the encryption key to use whenever they want, to look through whatever they want)

In the end signal and imessage (with backups off) provide roughly the same claimed guarantee here (on a technical level at least). They both promise not to secretly inject additional client keys into your account, (to at least obtain a forward-operating 'wire tap'), but the software you're running is all opaque and could certainly do so if they wanted (or were compelled) to.

I mean you followed Snowden right?

I would argue that if you are relevant enough apple and sms are both equally easy to get for them.

If we talk here about signal, I don't think the alternative should be iMessage but telegram etc.

Anecdotal evidence, but I've never had someone ask me to join Telegram.

In terms of encrypted messaging, the popularity in my friend group is:

1. iMessage

2. Signal

3. WhatsApp (only for talking to non-US people)

4. Matrix

fwiw, iMessage is actually E2E encrypted (without Apple storing the key) if you either don't have iCloud backup enabled OR don't enable "Message in the Cloud".

You need WhatsApp anyway, you’ll have several apps whatever you do.

>You need WhatsApp anyway, you’ll have several apps whatever you do.

Do I? Not being snarky here, I just really don't understand why I need WhatsApp.

No one I know uses WhatsApp to communicate with me. No business I deal with uses WhatsApp to communicate with me.

In fact, I'm not sure what value WhatsApp provides as I've never used it.

I'd appreciate it if you'd elucidate on your point. Mostly because if you're correct, I'm obviously missing something extremely important.

I suppose it depends where you are. I’m in Europe.

Almost everyone I message with defaults to WhatsApp, or even insists on it. A few also have Signal or Facebook Messenger or iMessage.

SMS is only for notifications and such. Even some businesses default to WhatsApp.

My understanding is that in many places outside the US it's near-universal. I've never used it myself either.

Historically WhatsApp filled in where SMS was harder to use, and places tended to use either WhatsApp or SMS ubiquitously. So the communities most affected by Signal dropping SMS don’t have an existing social need for WhatsApp.

> I have repeatedly been unable to convince iOS users to use Signal

We don't seem to have this problem so bad in the UK/Europe. Most people I know have WhatsApp and/or Telegram, and FB messenger, and Signal (in my friend circles); all alongside SMS. I have very few iMessage groups, and use it mostly for 1to1 SMS with people I don't know well.

...and there I am here in Germany where nobody seems to use SMS anymore.

I couldn't care less about this.

Didn't even realize there was SMS built into Signal (apart from the "Invite via SMS" screen once in a while).

> in Germany where nobody seems to use SMS anymore.

That's not true at all. I assume that besides Signal you use WhatsApp, though?

I haven't met a single person using SMS for so long that I can't even remember the phone I had last time I used it. I do work with a lot different contractors.

And yes, WhatsApp is prevalent here.

You're saying this as if it were preferable to give all your contacts and metadata to WhatsApp/Facebook.

Where am I supposed to have done that? It's not even the topic here.

I merely describe the current status in Germany.

Austrians don't care too.

I can't understand who and why anyone cares about SMS these day, besides receiving government emergency notifications.

Phone-based 2FA hasn't got to Austria yet?

Most sites and platforms use HOTP/TOTP (RFC 4226/RFC 6238) for 2FA, use an authenticator app of your choice.

Regardless of that, you can still always receive SMS for the 3 outdated services that still use it.

Interesting. What do they do with the grandpa/grandma population who have neither an idea nor the skills for "RFC 4226/RFC 6238"?

(As my friend used to ironically say: "Is your grandma so senile that she can't type `configure; make; make install`?")

Phone-based 2FA isn't really the problem here no?

I don't even open the SMS program if I get a code. I type it from the notification area. I certainly don't have to answer to it.

Not via SMS, anymore

> but I also like being able to keep my message history around and search my conversations for something that happened a year ago

I'm dreading the day where I lose or break my iPhone and thus lose my Signal chat history. I've been using Signal for years, but this makes me still prefer other messengers when starting new chats, even if Telegram (for example) is not e2e encrypted.

(Unfortunately, I've long overcome the "I don't want another app" thing and just installed all the messaging apps. Although I kind of want to look into setting up Matrix bridges and merging everything into Element.)

The only reason this isn't a dealbreaker for me is because their sms implementation was so buggy and feature-poor that I would never have used it.

(The only reason I use signal is to talk to my girlfriend. The only reason we use it is early in our relationship I was going through a phase where I adopted annoying privacy tools. I wanted to abandon it, but after years of using it she's developed positive emotional associations between our relationship and signal, so for non-technical reasons she likes to keep using it just to talk to me)

I used to use WhatsApp with my girlfriend because I had awful cell service at work but did have wifi. We switched to Signal and have been using it for years. She only talks to me on it and iMessage for everything else but I use it for SMS too. We would literally get into arguments sometimes because she wouldn't see SMS messages I'd send her with my one bar of 3G or they would be out of order and cause confusion. I love having all of my conversations in one app. I really like Signal and if this change goes through, it might make me seriously consider just getting an iPhone next time.

> The only reason this isn't a dealbreaker for me is because their sms implementation was so buggy and feature-poor that I would never have used it.

It took me a long time to find this comment. The number of SMS messages I never received was ridiculous. I still use the app all the time, but would never use the integrated SMS messages ever again.

I honestly don't remember when I sent or received the last SMS that was not the telco's "Welcome to $country, the rates are ...". I.e. I don't have a strong opinion on this, I simply do not use SMS.

This "I don't want another app" thing is senseless to me. Why? What does it hurt having more than one communication channel? In my experience people that say this generally have no space on their phone, usually because of an unfettered willingness to install the taco bell app and the Starbucks app and whatever else.

Their underlying reasoning is correct. SMS sucks, really really bad. They're a secure communications channel. People see signal and think they're secure. Signal has no business supporting SMS. The on boarding has reached critical mass, the neyworke effect is here. If you're smart you'll abandon SMS altogether forever and just tell people to reach you some other way, not ditch the actual, over the internet encrypted channel.

Maybe in the circles you move, saying "Sorry, I don't SMS, you'll have to download this other app to message me" would fly, but I for one have to interact with a lot of people for which it would not.

I have SMS, right, you kind of have to have a phone number, but to me it's legacy support, I pay for the mobile data. I'll do SMS as a sort of fallback.

The people you want to send you SMS like companies that need your phone number can't do SMS, and the ones you'd rather message you elsewhere sometimes insist on SMS. It's annoying.

> This "I don't want another app" thing is senseless to me. Why?

My elderly mother pushes one button to text me and everyone else anything else is a show stopper, End of story.

My elderly mother uses Whatsapp, signal and element. They're all the same.

At least you can do backups.

meanwhile, i, on iOS and all my friends use Signal together ¯\_(ツ)_/¯

Reply on news.ycombinator.com