What Does It Mean to Be a Signal Competitor?
soatok.blog
soatok.blog
It too has frequently prioritized features and usability over security. For example:
- Relying on SGX-based security for some of their features (e.g., gif search) while SGX has been thoroughly broken again and again
- Using phone numbers as account ids, which allows nation states to capture just one phone and immediately unmask the IRL identities of all other group chat members and contacts
Signal's authors have previously argued that it's better to give a some security to 100% of people than 100% of security to some people. Which is why they cooperated with WhatsApp on their encryption, or why they used phone numbers to ease adoption.
Matrix for example is doing exactly the same, just with a slightly different focus.
This narrow view of "Signal competitor" is more harmful than good.
If the police is able to unlock one person's phone, even if that person used self-deleting messages, they immediately know the identity of every other person that person chatted with.
Signal might as well have used your SSN as your account ID, that would have been just as private.
Luckily Signal has finally started fixing that in the past few weeks.
Incorrect. Accounts can be set to not make the registration phone number either visible or findable by (or both) contacts.
It should even be a little more like WA because all said family use it with that pincode pop-up open... None of them understand it, and all of them expect to loose all their conversations when they loose their phone so who cares. For some I turned it off, but that should be easier. That said, I wish WA would have Signal's way of sending Gifs (or Jifs as some people call them).
I fully agree with this article by the way. Got my brother on Matrix and it was pain (he lost access quickly). I Started a Matrix group on fosdem, within a day people were complaining that I should turn of encryption because they had issues (from their own server probably), I never managed to do that... I love Matrix and use it a lot for communities, but Signal just works.
Obviously you weren't able to do that - contrary to what OOP's article wrote, in Matrix it's not possible to deactivate E2EE for a room after it has ever been enabled.
The closest thing to that you could do would probably be creating a new room without encryption and closing (tombstoning) the old room with a link to the new room.
Basically I want the ship to be steered by someone who is maximally inoculated against selling out. Spending a decade of your life publicly railing against capitalism and sellouts, building a big community of active crusty friends who will call you out for turning evil, that’s valuable. It’s not perfect but I believe that it works better than various alternatives
moxies “bad business models create evil companies” thing resonates a lot also
https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
Also how easy is it to run a custom Signal server?
See https://en.wikipedia.org/wiki/Security_through_obscurity
The argument for security for disallowing other clients would be being able to modify the protocol to patch out security issues without worrying about compatibility with other clients.
I love matrix, I use it a lot, it has its place. But Signal just works.
So it would have to be a fork, and so far nobody seems particularly motivated enough.
Molly (https://github.com/mollyim) uses their servers but not their name and seems to be operating just fine. I've been using it for almost a year now.
I found it primarily because I wanted to run Signal on a tablet.
I am personnally glad that both options exist.
I wonder what'd happen if a three letter agency subpoena'd Signal and demanded Signal's app signing key so they can ship a backdoored update to a handful of targets.
If we could connect to each other's phones as "hotspots," we could send messages over Briar that wouldn't get through any other way.
It also worked well with a local mesh net set up around the conference location for file sharing, but that didn't have internet access.
Not the intended use case from what I understand, but it worked surprisingly well, and better than the goTennas we tried the year before!
Again, this is my experience after 4 years of Signal use. My photo library is just missing so many memories because of this.
No, they aren't. They can be downloaded just fine. There is a download button.