Comment by GuB-42 | Hacker News Reader

Comment by GuB-42 | Hacker News Reader

Parent Full thread

Signal used to be a pretty good SMS app, even disregarding the cryptography aspect. That how I treated it, and that's how it became successful among "normies". It was a good SMS app with encryption as a bonus. So much that as Signal discontinued SMS access, I was tempted to take an older version of Signal, strip out all the crypto, making it play well with the Android SMS system, and republish it as a simple SMS app.

But it seems that Signal failed grasp the importance of SMS, instead of fixing the ongoing issues, they let it rot before discontinuing it completely. Yes, SMS is bad for privacy, but they are not in a position to change that, they don't have the critical mass that Whatsapp has.

They thought they could take advantage of the boost they got with the Whatsapp/Facebook controversy and Elon Musk "use Signal" tweet to make people change their ways, probably not realizing that privacy is not that strong an argument for people outside of their bubble and that they have to offer "something else", and good SMS integration is "something else". And yes, having users that have "nothing to hide" is important for a privacy-focused app, because otherwise, the simple fact that someone is using that app can make him a target (see: EncroChat).

SMS was significant danger for an app that tries for the highest security. It was confusing that Signal was super secure unless you used SMS. It was actively dangerous if people got confused and sent private information over SMS. That is something that leads to people "falling out a window".

This is a problem for iMessage, but people don't have the same security expectations for that. The WhatsApp model, of everything going over the app and being secure, is better approach. I would argue that WhatsApp was more secure than Signal with SMS, the focus on security outweighed by danger of sending message in the clear.

That's the opinion of the idealists at Signal.

But Signal already made some compromises for convenience over privacy, such as the use of phone numbers and contact discovery. It can be a pretty insidious problem because it becomes possible to check if the owner of a phone number is a Signal user. Imagine you had an abusive relationship, you broke up, you blocked the other's number, and you go on with your life. You have each others in your contact lists, on your side, that's for blocking purposes. A few months later, you install Signal, the other did too, Signal then puts you in contact with the person you really don't want to get in contact with...

Sure, Signal does it securely, but it doesn't solve the problem. It is possible to prevent it now by choosing the right options, but the problem is not obvious at all and you are very likely to fall for it if you are in this situation.

The conflict between discovery and privacy is one that Signal acknowledges, but their default choice is not "maximum security", it is a compromise. SMS support is also a compromise, but I believe that it is actually a lesser compromise, because the UI makes it very obvious that your message won't be secure if you send a SMS.

WhatsApp doesn't need to make the SMS compromise because they already have a well-established network, Signal doesn't have the luxury.

they implemented usernames so phone numbers are no longer required

Phone numbers are still required for registration, and the option to make it undiscoverable (so that someone who knows your phone number won't find you on Signal) is not the default, and I think you can't set it before you create your account, leaving a small window of opportunity for someone to discover your account.

If Signal was uncompromising on privacy, being undiscoverable by phone number would be the default. In fact, they wouldn't ask for a phone number at all. These are reasonable compromises, but compromises nonetheless.

SMS almost doesn't matter outside of the USA. No one in my circle has once asked if Signal had SMS support, neither have I ever received an SMS since like 2010.

I live in France, SMS is really big here. Not as much as it once was, but it is still one of the most popular way to send text messages, probably not the most popular anymore, but close. In addition, it is still the standard way for businesses to notify you and for 2FA when they don't have a dedicated app.

but is it big enough that people will refuse a messaging app that does not support SMS?

Actually, yes.

The big argument for getting non-geek friends and family members to get Signal is "take this app, nothing will change for you, you can still SMS the way you did before, but you will have better privacy". Early versions of Signal could also import SMS, so it really was transparent. Well, mostly, there was still some issues they could have addressed, but didn't.

You can't use that argument anymore, the most likely reaction you will get is "I already have too many apps, I don't want another one, it is too complicated". Or you may install them Signal, and they proceed to send you another SMS, because that's what they always do, and it works, and they still have their SMS app. Or they already have WhatsApp, and so do you, and they are perfectly happy with it.

Really, for me SMS was the little thing Signal had that could help its adoption by the public at large.

Someone asked them why they dropped SMS a few years back and got a detailed reply: https://news.ycombinator.com/item?id=33258684

The most compelling bit here for me is RCS. Lots of devices will auto upgrade an SMS chat to RCS if they think that both ends support it.

Signal cannot support RCS (there's no API) so you'd end up with a situation where someone uses signal to send an SMS, the recipient device then replies over RCS and signal never gets the reply. Not great for usability.

Reply on news.ycombinator.com