Comment by nicholasjarnold | Hacker News Reader

Comment by nicholasjarnold | Hacker News Reader

Parent Full thread

nicholasjarnold

I agree completely here. This is terrible news from my perspective too. I use Signal for _all messaging_ (e2e secure or not) for the reasons that you mention.

I've onboarded friends and family, too, ensuring them it should be set as their default messaging app and that it _just works_. Unfortunately, people in the general population seem to have pretty much zero tolerance for any friction whatsoever. If they have to use 2 apps, they'll just end up communicating with me in the clear using their "default SMS" app on their phone. That's what this is going to result it...a reduction in overall message security due to people defaulting to what's easier...which is to _not_ have to remember which app to use for which "send a message" purpose. Fuck.

I understand the argument about people in markets where SMS is expensive getting screwed sometimes when they don't realize they're sending a message over SMS. However could that not be fairly trivially solved for with some UI notification or app setting that warns you about this and allows the warning to be perm-disabled if the user doesn't care!?

I think the real reason here is this desire to transition the service into supporting usernames, which is a topic that's been discussed before (and is explicitly mentioned in the post). Right now the service is tied to your phone number. After this change I suspect it will not be or not need to be.

This is very, very unfortunate for those of us who've convinced a ton of non-technical friends and family to use TextSecure->Signal over the years...

If they have to use 2 apps, they'll just end up communicating with me in the clear using their "default SMS" app on their phone. That's what this is going to result it...a reduction in overall message security due to people defaulting to what's easier...which is to _not_ have to remember which app to use for which "send a message" purpose. Fuck.

Exactly right. In fact, I will be doing this too. Right now, I use Signal as my default messaging app, and messages go via Signal to people who've registered their phone number with Signal without me having to do anything to effect that. When Signal stops working as an SMS client, I'm not going to look up which of my contacts wants to use Signal and which can only use SMS - I'm just going to use my default SMS app for everything except the couple of group chats which are on Signal already. Messages which would have been opportunistically encrypted are now going to go out plaintext, because the friction to find out who uses Signal and who doesn't is too high.

This already happens with iOS, because the Signal app doesn't work as a default SMS client. People who use Signal and Android reliably send me messages over Signal, whereas my contacts who use Signal and iOS mostly send messages over SMS unless they're directly replying to something I've sent them over Signal.

And even if I wanted to do the work to send everything over Signal to those contacts, how am I supposed to remember exactly which of my kid's friend's parents use Signal and which don't? Fuck it, the juice isn't worth the squeeze, everything is going over SMS.

I'll just have to hope that Google figures out a way integrate a seamless, opportunistic end-to-end encryption protocol into the default Android messaging client, since Signal is deliberately dropping the ball here.

Holy crap, this 100%. I am absolutely distraught. I give monthly donations, have moved mountains to get family and friends over to Signal, and viewed it as a last bastion for security and interoperability between iOS and Android. Now we will get neither.

Gutted. I will end up switching to a different provider. Absolutely don't know if I'll be able to convince family and friends to switch again.

Yep. What a drag.

I don't really see Signal as a useful tool for my uses after this change. I liked the SMS and encrypted messages in one place thing even though some friends rarely check it. For those friends I send SMS through Signal. There are certainly issues with group chats and media but nothing bad enough to consider using two apps. Now I have to look for a new tool, and figure out what to do with certain archive conversations I'd like to retain.

>viewed it as a last bastion for security and interoperability between iOS and Android

>Now we will get neither

Correct me if I'm wrong, but:

- If you and your counterparty are both using Signal, nothing about the security of your communication changes.

- If your counterparty was not using Signal, your messages were over SMS/MMS and therefore not encrypted in the first place, and so once again, nothing about the security of your communication changes.

Are you seeing something I'm not?

That's definitely true! But if both are in one app you don't need to remember who uses Signal and who doesn't; it just works. Now with two apps, you have to run that mental check before sending a message and choose the right app.

I've run into a related problem:

I have (iOS-using) friends I have convinced to register their numbers with Signal...but they never check Signal. They do check SMS.

This actually drove me away from using Signal for SMS on Android, because I couldn't send those friends SMS messages through Signal. They could only go out as Signal messages, and my friends never checked them.

Fortunately, I only have a handful of friends in this category, and virtually everyone else I talk to does use and check Signal, but it's a usability problem both ways.

You can send those people SMS through Signal (for now!) by holding down the send button for a moment - it opens out to let you choose "Insecure SMS".

Man, this would have been great to know a year ago!

On my wifes phone she didn't receive notifications for signal because the OS she had would suspend signal when it was inactive. So I had to manually change its battery saving settings.

> I'll just have to hope that Google figures out a way integrate a seamless, opportunistic end-to-end encryption protocol into the default Android messaging client, since Signal is deliberately dropping the ball here.

This is what Google's RCS implementation is, to my understanding.

Although the end-to-end bit might be a bit on the squishy "kinda-maybe-sorta" side, rather than Signal's enforcing of it.

I hope you're not too invested in Google making a chat thing work long term.

There's an overwhelming mountain of evidence that says that ends poorly.

Becoming too invested in any instant messaging thing is a recipe for disappointment and woe.

As far as instant messaging services are concerned, I have let go my earthly tether; entered the void; empty and become wind.

You say that but then Line, WhatsApp and WeChat have been hugely successful depending on which part of the world you're in.

I use both Signal and SMS on my phone (iOS) and don’t find it to be that cumbersome to deal with. I already have to use multiple apps anyway to communicate with everyone I need to (Slack, some people are only on Telegram, WhatsApp, WeChat so I have to have those apps too). I default to SMS but if it’s a conversation where I care about privacy I’ll use Signal.

> Right now, I use Signal as my default messaging app, and messages go via Signal to people who've registered their phone number with Signal without me having to do anything to effect that

This is actually a complaint of mine. I've regularly had Signal send secure messages to people who have tried Signal in the past, but have since uninstalled the app (or in iOS's case, they 'offload' apps when you don't use them frequently which silences notifications). This results in me thinking my messages are sent only to find out that they'll never read them. I then get frustrated and have to go back and re-send the message via SMS.

I don't like some of the decisions taken by Signal.

However, if "dropping support for SMS messaging also frees up our capacity to build new features (yes, like usernames)", I think it is something I would not miss.

Besides, I agree with them on the point that SMS leak metadata.

But that's just a bullshit promise (in the sense of not being anchored to any commitment), no different from a politician saying some policy initiative will create jobs because that's how the economy works.

SMS does leak metadata but guess what, that leakage is going to continue because people aren't going to just cut off their SMS-only-using friends and relatives. Now they'll be leaking Metadata from an even less secure app, so the user is in no way better off.

Reply on news.ycombinator.com