Meanwhile if my counterparty and I have communications in Signal that we want to preserve at scale, it's impossible to do so. A simple example would be that I have years' worth of conversations with my wife that I can't easily back up any where. We could export every picture and video by hand and screenshot or copy the text of every message, but that would be extremely time-consuming and tedious.
That's the basic problem. The data is already only semi-secure in that it's subject to exfiltration without consent. It's just inconvenient. And where parties do consent, it's very inconvenient because it's many many hours of work; in the end, it's just more security theater.
This is one of the problems with Signal having a bit of confusion about what exactly it's use-case is. There are plenty of cases where locking down the ability to save/view/export messages are valuable, and Signal provides tools to be able to do that. Making that the mandatory case though means that it's harder to adopt as a general-purpose communication platform.
The need to decide if the goal is still to get as many people off of SMS/facebook-messenger as possible, or if the goal is to provide extreme security to dissidents and protestors, or if they're going to spend the effort to be able to do both effectively and let you choose which conversations or messages get which level of protection.
It's like when Signal asks you to put in your PIN, but it's the same PIN you use to unlock your phone. There's a different Signal PIN, but that functions as a check for when you install Signal on a new device. Your regular PIN is just a repeat of your phone PIN, and thus adds exactly zero security.
I do like Signal and I think they have done a lot of good. I do think they have a lot of valid criticism against them but also I think a lot of people aren't providing useful criticism (it is a shame that's happening here, on a forum that should be filled with tech experts). People also aren't realistic. A 25 person team working at a non-profit aren't going to have the same development capacity as a 250 person team.
[0] (maybe go to the bottom) https://community.signalusers.org/t/usernames-in-signal/9157
These are purely my observations of the discourse around Signal and should not be taken as a universal truth. Only my subjective reality.
I'm not aware of any major vulnerabilities in Matrix (but I'm not following) closely. I'm also not aware of any in Signal, which I know is frequently audited. There is an SGX attack, but it is often blown out of proportion (highly technical attack that requires an unlocked phone to be in the physical hands of the attacker).
Telegram gets a lot of shit because they prop themselves up as a privacy app but aren't. The default is that things are not encrypted. They use a proprietary encryption scheme. They store user data on their servers. These are not the marks of a privacy app.
I explained how imo Signal has burned the goodwill of a some of its early adopters. Meaning not recommending it to my friends and buying my mom an iPhone. Now there's an argument to be made that it's not very smart to dismiss the app, but that's what happened.
I'd be very surprised if they manage to salvage its image at this point
To be clear, Signal allows you to backup and restore back into Signal on android, which is great. What I meant is that it would be helpful to be able to export that content out of signal and keep an accessible searchable archive off of the device.
> but instead the Signal backup just keeps getting larger and larger...
One begets the other.
> I'd love to be able to move it off the device
If you don't want infinite history, set a conversation length limit. It is in the storage settings.
If you want to backup messages on iOS go complain here[0]. For Android, you already have this ability.
[0]https://community.signalusers.org/t/ios-backup-keeping-messa...
My ideal solution would be to export any message older than a month to an archive on my NAS, ideally in a format that the app could search on request. Keep my history, keep the on-device space nice and small.
I take advantage of the Android backup feature, and the backup syncs over to my NAS via SyncThing automatically, but that's only useful for restoring a brand new phone up to the latest state.
I'm confused at what is stopping you from doing this?
> ideally in a format that the app could search on request.
Are you not able to import these backups into the desktop client? IIRC it is just reading from a file structure. I don't see why a small script couldn't resolve this. Obviously you wouldn't be able to search on your phone, but you said you didn't want that data on your phone anyways. If you did want to search on your phone from your computer's storage, I think you're asking way too much of them (and in danger of asking them to store data for you, which they never will do). But this is hacker news, and I don't see why you can't hack together that tool in a weekend. Probably just a few beers on a Friday is enough for it tbh.
As far as I know the backup is encrypted.
> Are you not able to import these backups into the desktop client?
No, the desktop client is not standalone, and ONLY syncs with the a phone to get content. Moreover, if you don't use the client for a period (2-3 weeks in my experience?) it de-syncs that desktop client. Re-connecting that desktop to your phone will only sync messages starting as-of the connection, so there's no way to get the desktop app to pull your whole history. (This is another gripe I have about their sacrifice of actual usability for security that only helps a few very specific use-cases.)
You're probably rigth about hacking something together. Someone has created a library [0] allegedly for decoding the backup files. Friday night is D&D night though, so I haven't had the chance. :-)
I agree that there aren't really any great solutions. But the alternative is that Signal stores your data. I think this would make a lot of users very upset and compromise part of Signal's core mission.
This is one area where, and I know what you're going to say, but Matrix actually does really well. My data, on my server, in my house, not tied to any specific single device I own but distributed across several and backed up in an encrypted manner.
But you've got me thinking about the data export option. Saturday is coming. Hmm...
I'm actually a fan of Matrix. I just see Matrix and Signal as different tools. You're probably aware of it, but if not, there is a Matrix bridge for Signal.
> But you've got me thinking about the data export option. Saturday is coming. Hmm...
Hey, I'm really hoping it works. Let me know how it goes!
'I'd take a decent "export my chats" option' is a very simple statement. There is no way within Signal to just export a whole conversation to a file.
You can on Android and Desktop. On Mac see ~/Library/Application\ Support/Signal for your data. The only issue is with iOS which I agree is an issue, but does not seem to be the parent's issue.
That's why I wrote 'within Signal.'
As a simple example of how this could get messy, suppose I wanted to back up all my Signal messages, install a different operating system, install Signal there, and load up my old messages. I do have the IT skills to just find the database file and move it manually, but I'm only confident about that because I know its an SQLite database, where the keys are stored etc.
It's still an IT problem I would prefer not to have, vs the simple option of 'Do you want to export this conversation, with all the security implications Y/N' or 'Import this previously archived conversation?'
If this "accessible searchable archive" is stored "off of the device", how exactly would the device access and search the archive? Facebook can store your Facebook Chat history on their servers no problem, but E2E encryption makes this much more complicated for Signal!
It's not impossible, Apple does it with iMessage, although that was actually a pretty recent addition despite all of Apple's resources!
Exactly. I'm saying you can't have both low storage and full chat history. These two cannot work without a storage server. I have suggested a method of using the desktop client as the storage server but I agree that there is no great solution.
> It's not impossible, Apple does it with iMessage
That does come with significant tradeoffs though. Now we have to trust Apple that they haven't taken our keys and that they still aren't handing over this data. It is a tricky situation.
Because the in-app option to clear them all does not free the space.
Your only way of saving things is to either manually save every picture and video, or manually highlight and copy the text in your conversations. The latter defeats any security arguments (other than of inconvenience) but also throws away useful information like timestamps of messages.
My Signal database takes up many GB on my phone, and it's constantly complaining about running out of space. Much of this is the years-long record of conversations with my wife. I'd like to back these up, but I can't. Are you gonna tell me that I shouldn't be using a secure messaging app to communicate with my own family members?
Not “delete all my chats/delete an entire thread.”
Settings > Data and storage > Manage storage > Keep messages
then choose from the listed options