Signal – An Ethical Replacement for WhatsApp | Hacker News Reader

Signal – An Ethical Replacement for WhatsApp

greenstarsproject.org

187 pointsmiles281 comments

I ditched WhatsApp back in 2021 (and lost a couple og long-distance friends in the process), and I communicate mostly over DeltaChat, XMPP (née Jabber), and Signal, in that order of preference.

There are many other alternatives out there, e.g. SimpleX, but many — if not most — suffer from the inability to synchronize chats across several devices.

DeltaChat should pose no problems to users coming from WhatsApp, having more or less the same UI as I remember from WhatsApp back then. DeltaChat is an amazing app, check it out:

https://delta.chat/en/

You needn't even disclose who you are.

The UI of that Delta chat app looks completely like Telegram fork (client is opensource). Function wise as well.

What is the backend for it? It's hard for me to find on their website. If it's also Telegram, than what's the point?

I would also like to point out that Telegram has very smooth chats sync across devices because those are NOT end2end encrypted by default.

Delta chat uses email. So you can chat with anyone that has an email address. If they happen to use the app too it'll feel more like a chat for them as well.

Are there any problems with the fact that email wasn't created to be instant messaging? Are the messages sometimes delayed?

Not in my experience. It feels like chatting on Signal or any other instant messenger, except there are no typing indicators, especially if you use DeltaChat's chatmail server (the default if you just say “let me in”).

I have not noticed that problem, the messages are delayed by a few seconds, but not noticeably. Only using chatmail / own postfix though, YMMV.

Well, for a starter you will be limited to what email servers provide, which doesn't include video conferences, which most instant messaging solutions include these days

I think any competent email provider will throttle or block you the first time you send a burst of messages.

I haven't run into that problem, but yes, it's possible.

One problem I did run into was “allowed number of outgoing emails”. If you use groups in DeltaChat, even a small grouop of say 10 members will incur a lot of outgoing messages. The provider I originally used has a limit of 200 emails per day, so that was a showstopper.

If you use DeltaChat's chatmail server (which will happen per default if you don't provide an email account of your own), this will not be a problem.

This is why they provide a choice to use their own servers

Then why implement email as a backend if email cannot actually be used as a backend?

That's the tricky part of having email as backbone technology. It's an old and varied ecosystem.

I host my own email server and I am pretty sure chats will be instant with it as well as with their servers.

However, some email providers implement various throttling mechanisms.

If you are OK waiting for message to arrive or be dropped silently, you may continue to use Google and Microsoft email.

Wait, is that true over regular email too? Say I have a back and forth one liner emails every few minutes? It's competent for the provider to throttle or block these?

They do. All email providers have limits either specified or unspecified. It's usually a few hundred per hour and each recipient uses one quota.

The backend is: EMAIL! :)

It uses SMTP/IMAP to propagate and store individual messages. This means that DeltaChat it will work with your usual email account (it will create an IMAP folder named DeltaChat), but if you install the app and say “Yeah, just let me in!”, it will create a random username for you on one of its own chatmail servers.

It may sound like a bad thing to use email, but it works very, very well. Most people won't even notice.

See e.g.:

https://delta.chat/en/chatmail

https://providers.delta.chat/

Last time I tried delta chat they didn't have chatmail so this is new to me.

Kinda surprised to find this on privacy policy of the default chatmail instance:

> unconditionally removes messages after 20 days

Didn't see any warning about this in the GUI or the chatmail page.

Does this mean after 20 days the messages on my app will disappear? or just they'll only be available on my local app after that point?

In any case, that's a pretty big red flag that it's not clear.

It is deleted from the server only, it stays on your devices, and is also synced to new device when you add one.

Where did you see this? Or just learned from experience?

FAQ: What happens if I turn on “Delete old messages from server”?

https://delta.chat/en/help#what-happens-if-i-turn-on-delete-...

Cannot find it now, but that's how it was discussed at the time when chatmail server became a thing. It is also how it is configured in chatmail:

https://github.com/chatmail/relay/blob/96a1dbac08441034c5990...

You obviously must trust that the server runs this configuration, but you can always run your own chatmail, or regular postfix. (If you don't need "federation" with other mail servers, you don't even need port 25 open).

However, you can also configure your app to delete messages from the server sooner.

The FAQ reads:

»By default, Delta Chat stores all messages locally on your device. If you e.g. want to save storage space at your mail provider, you can configure Delta Chat to delete old already-received messages on the server automatically. They still remain on your device until you delete them there, too.«

https://delta.chat/en/help#what-happens-if-i-turn-on-delete-...

AFAIK, the downloaded messages are not deleted from your app.

So if you don't use the app for more than 20 days, you'll start to lose your oldest messages (that you haven't downloaded to your device yet).

Matrix has smooth chat sync across devices despite E2EE, so both don't exclude each other

It does, and I did try it for a couple of years — I even ran my own server. None of my close friends cared to try it, and I preferred XMPP myself, so I took down the server and delete the app.

It doesn't. I don't know how you can deny it at all, it's core Matrix functionality.

Even WhatsApp has sync by now (even if it's artificially limited and works differently).

The UI was actually taken from Signal in the early days[0].

[0] https://support.delta.chat/t/list-of-all-known-client-projec...

PS: I anyone wants to give DeltaChat a spin, follow the link on my HN profile and scan the QR with the DeltaChat app.

Signal doesn't let me synchronize my data between my phone and tablet.

I run signal on my phone, tablet and computer and they all are synced.

Actually, they just receive the same messages.

According to my expectations, resetting your computer app and data and reconnecting to your account should result in an more or less empty message history.

It does sync some timeframe in the recent versions.

It syncs everything that's on your phone, just not images and such older than 45 days I believe

didn't know about this!

The last time I added a new device to Signal, I was given the option to sync old messages. Not all of them, but I think it was the last 60 days, which I think is enough.

I think this is by n0_computer, the same people behind iroh.computer . If you care about, or just want to learn about, peer-to-peer and a Rust library for p2p that just works then check it out! They have great explanatory videos on YouTube as well. I'm a big fan!

That's actually kinda sad you lost friends. I feel like that should be a priority?

Your (reasonable, human) sadness over lost friends is precisely the moat these companies use to keep you trapped in their ecosystems.

You sound like Data from StarTrek. You too, with enough observation, will understand the importance of feelings to humans.

The context makes a big difference here. Human connections are indeed very important. But people used to manage those satisfactorily even before the advent of instant long-range communication systems. They still managed to keep each other updated and alerted about important events. Today's digital interpersonal connections feel important more because of the fear of losing them, than because of their actual worth. I realized this after having switched my communication media (chat apps, phone numbers, etc) numerous times. Many connections drop off in the process. But people with relations that truly matter always find a way to reestablish it.

That flexibility gives you the freedom to chose the communications platform according to your self-interests. And in today's targeted ads economy, those self-interests matter too much to neglect in favor of staying connected with everyone.

But people used to manage those satisfactorily even before the advent of instant long-range communication systems. They still managed to keep each other updated and alerted about important events.

There's got to be a logical fallacy for "people did x before y technology." Yes they did. And we still collectively found out that we could do it better with that thing, and that is the new standard. But you're free to go back to delivering letters by horse if that suits you.

I can post a story on Instagram, and somebody that I have't talked to in years might reply and we have a conversation and reconnect, or maybe it's just a simple gesture, but it's still meaningful and appreciated. But if I said "well I'm here on Mastodon now and anyone who truly matters will come find me," that's just not happening. And then I'm frustrated and complain about being lonely and yell at everyone to switch to Mastodon. Really bringing people together. But at least I didn't have to stomach seeing an ad that might actually pertain to my signaled interests.

Pointing out that it’s a business tactic abused by the company to stay relevant and having feelings aren’t mutually exclusive.

I am a big Data fan and take this as a compliment ;)

Losing friends over choice of messaging app is crazy work.

I also ditched WhatsApp long ago. And while I probably "lost" a few connections with people I knew from other countries, I stay managed to stay in touch with people who are important to me. Either because they downloaded Signal just to talk to me (I have a few friends who like to emphasize passive aggressively that every time we talk, LOL), or use Apple Messages, SMS or good old email.

I can relate to the loss. It's one directional. One side slowly forgets there's anything other than what Facebook properties puts in front of them.

I can relate to the common man that's just never been able to muster up the energy to give a crap. I use what the people I know use. I've felt way more annoyance towards that one friend using some obscure platform than I ever have about Mark Zuckberg "sharing my data." Truly two kinds of people on this issue.

I would say that depends on how strong the friendships are, and how strong your morals/beliefs are.

Facebook used to designate the 1,000+ people you incidentally talked to as "friends." I think the term does not have the same meaning for everyone.

Yes, it is kind of sad. I did give said friends (who were strictly online friends in faraway countries that I had never met in “real life”) the option of a handful of other instant messaging means of reaching me, and I also made sure to convey that the reason was my zero-tolerance for Facebook/Meta and not because I wanted to ditch them as friends. I have also tried to reach out through email and sms, and didn't get a response, so that's where it landed.

Some people just won't notice your message and then they'll forget to download and setup the app. It's normal. People have lives distinct from the messaging.

I'm pretty actively involved with my friends and just have the union of all messaging apps and even I frequently forget to respond to messages I've started to read because something else happens: baby cries etc

I believe Delta Chat is opportunistic PGP over email, so it's not comparable to something like Matrix or Signal. I suppose it might suffice if you have very basic privacy needs.

I have mixed feelings about DeltaChat.

It's cool that it uses email, but it's also not. Email is a notoriously painful standard to run a server for. I have ran a Matrix and Mastodon server, and I'm still running a BlueSky PDS, but I've never even tried to run an email server, since I know I'll get blocked the moment I try it for having a residential IP, and that it's a lot of work.

So most people will be stuck with commercial providers, with the largest happening to be Google, which needs users to set up an app password for DeltaChat to work. You've already lost most users at that point. Other large providers don't work or require setups: https://providers.delta.chat/

Then there's ChatMail relays, which are supposedly interoperable with email, but from the documentation it's very unclear to what extent that is. Not to mention that the possibility of them getting blacklisted by mainstream providers is very high, as they do text message analysis which doesn't work on encrypted blobs.

At this point, I have to ask: is email the right tool for the job? With all these drawbacks, it seems it would have been better to go with another standard, written from scratch.

I can only speak from personal experience.

People tend to have all sorts of reservations against DeltaChat, even if they haven't tried it, and I just haven't experienced those problems.

I have tried DeltaChat with my own mailserver, and with Gmail, FastMail and DeltaChat's chatmail, and it has worked flawlessly. If it hadn't, I wouldn't be a fan.

This is obviously only anecdotal, so other people may report other experiences.

If used as chat only, and with dedicated chatmail servers, the number of theoretical problems diminishes significantly. Using it as an email client and/or with standard email providers introduces potential points of failure, but not more than email to email.

Perhaps I should also add that DeltaChat is really just an email client with a user interface that is optimized for chat, and the chatmail servers are just IMAP/SMTP mail stacks optimized for DeltaChat.

DeltaChat uses AutoCrypt to provide gpg/pgp encrypted “email” + metadata, and the chatmail servers are set up to refuse unencrypted messages (thus avoiding the spam problem).

The optimal experience is acheived by using DeltaChat the way it was intended: DeltaChat to DeltaChat communication, and I'd say that using the chatmail servers is also preferable to using custom IMAP/SMTP servers (whether they are hosted by the big providers, smaller providers, or self-hosted). You _can_ use DeltaChat to communicate to email-only recipients, but it provides for a sub-optimal experience.

There is so much scaremongering about running mail servers that it almost looks as if interested parties are trying to dissuade people from running servers using this well-known open protocol and instead tell them to use whatever proprietary or single-sourced product. In reality running a mail server is not difficult at all, it hardly takes resources and once configured it tends to run fine without needing much in the way of maintenance. The main pain points seem to be the need to configure a bunch of DNS records for things like SPF and DKIM. Spam is solved using a filter like Spamassassin and possibly a graylist so that boogeyman is vanquished for now - I'm still waiting for the next wave of LLM-generated spam which is less easily recognised for what it is, this far is has not shown up yet. You may need to add some exceptions to the graylist for some of the bigger, non-standards-compliant services like anything run by Microsoft and you may need to use a "smart server" - an SMTP proxy for outgoing mail - if port 25 is blocked on your connection but these are not hard to configure.

I've been running my own mail services for close to 30 years now starting with handcrafted Sendmail configurations, now running Exim and Postfix. Running your own mail services isn't the scary problem it is made out to be.

>I've been running my own mail services for close to 30 years now...

There's the rub. 30 years ago this was true. Old systems have been grandfathered in.

A combination of rising spam and things like fraud via email have caused especially large services to be so much more aggressive in blocking. If your email has been around forever it's generally trusted.

The company I work for has been around for 15 years and we spent the first 5 or so getting yahoo and live/hotmail/outlook to accept our mail reliably despite proper dns/dkim/spf.

Self hosted on residential IP today is near impossible. Your only hope is pay to not be on a residential IP and even then strap in for years of struggle to get the biggest free providers to accept you as legitimate. Exacerbated by their thorough lack of actual support contacts.

> The company I work for has been around for 15 years and we spent the first 5 or so getting yahoo and live/hotmail/outlook to accept our mail reliably despite proper dns/dkim/spf

This matches my experience from roughly 10 years ago. Even with a non-residential IP address, correct SPF, etc, it took months to navigate the biggest providers' obstacle courses for whitelisting. After succeeding with those, plenty of smaller providers remained to identify and work through one by one. And then, every so often, an already-completed one would revert.

It was not impossible, but even for someone experienced in email system internals, it was a slog that seemed never to be 100% done. I don't expect it's any easier today.

I tried to stop using WhatsApp, but failed. I even promote Signal to my WhatsApp contacts (if they were to switch, Signal would be the most likely option). I succeeded with most of the people I talk to the most. Unfortunately, the majority of my contacts are still only on WhatsApp (and even less appropriate messengers like Telegram and Instagram). WhatsApp remains the lesser evil. I hope that one day I'll be able to stop using the last major tech service I rely on (at least those that don't allow anonymous access via a web browser), but today is not that day :(

> and lost a couple og long-distance friends in the process

This is sad, but also a reminder that nothing that matters should be tied to proprietary walled gardens. All of those are ephemeral.

Anyone I care to stay in contact with, I communicate via email. An open standard owned by nobody, so it cannot go away. My email has been the same for 30 years and will be the same forever. If you knew me in the mid 90s or later, you know how to reach me.

At some point you need to be pragmatic.

People will call the bad guys "hackers" (should be crackers!), in French they will say "show me the digits" when they mean "numbers" and so on.

If everyone uses Whatsapp then you will be alone with these apps nobody heard about. You can try to evangelize them but their friends use WhatsApp.

It's a choice between hard core values and keeping in touch.

Maybe it's different in the U.S. still, but where I live in Canada lately it seems like everyone is on Signal

Oh really? I am curious how Signal won with WhatsApp.

In France (and basically in all European countries, maybe except Germany, where all privacy things are very intense so maybe they use something else), WhatsApp is the go-to app.

Not only do most people use it, but you have services that suggest WhatsApp as one of the contact channels. This is not because they love WhatsApp for some reason - rather because people use it (and they want to make it easier to contact them).

You talk about "WhatsApp groups for X", never heard about "Signal groups for X". In rare instances, this would be Telegram (but usually specialized groups)

> Oh really? I am curious how Signal won with WhatsApp.

Probably because people are just about completely done with Facebook/Meta.

Signal is seen as the best option for privacy.

I understand that. What I was wondering about is what created the momentum to move.

There were attempts here (including mine, arguably feeble) to persuade people to switch, but Whatsapp is too much ingrained.

Not much point here (UK). It’s difficult to get anyone to move or even install it. No one cares enough to show any interest.

Needs to be a large billboard marketing campaign which is “zuck eats children and owns WhatsApp” or something. Then you might get 5% of people move over.

My immediate family are on it and two friends. That represents a year of trying.

I made that same experience. You can get individual people to install it, sure, you may even get a group to do this if you start it, but good luck convincing the other parents of your kid‘s sports team group, which btw you must be part of.

Unfortunately, we living beings tend to go with what costs the least amount of energy - this being thinking and going through extra efforts to achieve a goal. Hence, we‘re stuck with WhatsApp by a law of nature.

Yup. These apps are not used in isolation and I find it funny that the tech people argue which is better and why.

The one everyone uses is better.

If you dont have a way to move masses, it does not matter.

> If you dont have a way to move masses

Or the guts to say "I'm going this way, I'll be happy if you join me" and follow through

I’m in Turkey no UK or US so I can only speak for here. It’d be like denouncing electricity and saying join me. Good luck with that.

Its not friends and family. Our office administration basically runs on a WhatsApp group. I just sent a location to a plumber using WhatsApp. They dont know / use / want anything else.

At best, you might get some close people to use Signal or whatever but you have to use whatsapp to function.

Especially American people won’t understand that because I believe iMessage and SMS is still the de facto standard. That would be WA here.

So you don't go vote in elections either? Because "if you dont have a way to move masses, it does not matter."

I would strongly disagree (respectfully). I'm in the UK.

I've been using Signal for years, precisely because of WhatsApp and Meta and what they really stand for. Kids (adult) and family are all on it because of me.

Initially, I was the only person who used it, but I refused to used WhatsApp and got four of my friends (who were the only real group chat users I was interested in talking to) to use Signal. We all regularly use it, even though they are all on WhatsApp. They know my ethical objections to WA and Meta. Every Friday there will be a group call - even though we're all on iPhones now (I was on Android for many years).

One in particular takes the mickey out of me for it sometimes because he says "What difference are you making? One Person? Makes no odds."

But it -does- make a difference. A tiny one, maybe, but it's something that has been worth making the effort for. I think it's important to tread the right line between expressing why you're doing it and not making yourself unpopular but I think it's an important thing to try to do.

And now if anyone asks if I have WA I just say I don't use it, you can either text me or use Signal. I have probably 20 contacts on there, and anyone who I have meaningful connections with uses Signal. Once installed it's basically zero friction for them, they just find me there instead of WA.

I know network effects are massive, and it won't shift any time soon, but I think it's important to draw an ethical line in the sand, and it's something I decided to do a long time ago. One guy gave me a WA ultimatum and I just said "OK, but that's not for me, I'm not using it", and that was that for about a month. Then he installed Signal.

Any business that communicates via it I express my preference and if they insist that's how they message (had this with an insurance company!) then I say I won't use their business any longer.

I think you might be an outlier.

I've got 150 contacts on whatsapp, over 200 on my phone. I am on several organised groups on whatsapp with 150+ members who use it for event management.

They are never going to signal. There isn't the momentum.

>I think you might be an outlier.

I may well be. But outliers are important. It is possible.

WA has massive network effects, of course. It's embedded. And I agree it's unlikely to change without a combination of legal controls and societal awareness (both of which seem extremely less likely than say a year ago).

But if everyone gave up when faced with such a situation, the world would be in a worse place than it is today. And Meta are relying on exactly that happening.

Appreciate your standing ground. I try too and just accept you will lose some and win some. It's actually quite liberating as long as the ones you lose you really are willing to lose. I expect this is very difficult outside of urban environments.

People are taking note.

Maybe it's because I'm mainly doing anti-fascist organizing and work now, but it seems like everyone I know is using Signal. Even people who don't care as much and for whom it's not their primary driver still have it and communicate with people who use it.

My family were the last hold-out but they've moved over recently as well because they knew it would be the only way to stay in touch with me

This article from Green Stars, whoever they are, is making the argument that you should switch away from Whatsapp because Zuck leaned hard into US conservative politics, and because of Cambridge Analytica and other ways that Meta has played fast and loose with its tracking of you.

I feel like that's all just wayyyyy too esoteric to the average person. I mean if those things (company founder has bad politics and too much invasive tracking) were a hard pass I would pretty much have to throw away my phone. We might care a lot about tracking here on HN but the average person really doesn't.

On the other hand, the big thing in the news right now is that Whatsapp will soon roll out ads. People don't really care that Zuck stole their data and kissed Trump's ass. But they do hate ads. I think the more ads Whatsapp shows, the bigger the opening will be for someone else to come along and convince people to switch.

I tried Signal, but it wouldn’t let me export chats, meaning the data is trapped within the app. Did they fix that?

You're looking for "chat backups". It's there.

You can make a chat backup, but it's an encrypted binary blob, not a mailbox file or a JSON file or some other more accessible format.

I think I understand why they do that (if you send someone a message on Signal, they try very hard to make it difficult for anyone but the recipient to read it, whether that's by intercepting traffic or reading data stored on your device, or rummaging through your backups) but it does make it a bit of a pain.

It is an encrypted sqlite database and there are tools to decrypt it. I think this is more or less as good and open as it gets.

Seems short-sighted. The more people who use Signal, the more secure their users' chats will be because they can use other apps less. Omitting basic features for "security reasons" reduces security overall, because you can't force other people to use Signal.

On iOS?

IMHO the constant complaints about losing chats or needing conversation backups aren’t technical problems—they’re social ones. We need to reclaim the freedom to speak with others ephemerally. No one should want all their conversations recorded, yet we’re heading toward the opposite with smart glasses.

Ideally, we’d agree universally: chats saved for one month (the context we can actually remember from a conversation), emails for five years (for administrative control), and conversations never recorded. However, we’ve been manipulated into needing exactly the opposite. Worse yet, we think it’s possible to maintain privacy while transcribing and archiving everything in our minds, making it public.

I want to be given the choice and I don't want companies or benevolent dictators making such choices for me.

For many people their messenger has replaced the photo album. Its where you have all your life memories such as baby photos, first school day, etc. Forcing those to be deleted just sounds dystopian.

40 years ago, we weren’t living in a dystopian society –we may be closer now. Back then, most people kept less than 50 photos at home but spent more time with their families, sharing stories and souvenirs.

Companies have taught us to do otherwise for their profit, don’t forget to back up that.

I would favor freedom over one size fits all "that is good, that is bad". 40 years ago you had no option to make and keep that many pictures.

Even if I would agree with you that people keep too many digital pictures, if someone wants to do it I would also defend their right, because I do not think it is that negative that is worth fighting against.

PS: to put it to the extreme shouldn't we spend any time on hacker news "but spent more time with their families, sharing stories and souvenirs."?...

You also might let them get some rest and sleep to fix memories ;-)

Recently, I found my old ICQ chat history from back in the day. It was a joy to go through, sometimes a little cringeworthy, but overall I really enjoyed it. It felt like a time machine taking me 25 years back, helping me reconnect everything with the memories I have.

What I do with my data should be a choice made by ME, and no one else, and definitely not by some uncontrollable entity on the other side of the world.

Here you speak about your data as if it were rocks you found trekking, but the data we’re talking here isn’t even paper or pictures: it’s digital data you can’t access or backup by yourself.

You definitely need uncontrollable entities all over the world for that data to exist. Somehow you’re doing what some of those entities allow you to do, and some want you to do. That’s my point.

Signal has many faults as a Whatsapp replacement and the export issue ranks also high for me. Other issues:

- Can't move from iOS to Android (and vice versa) without losing your chat history because backups aren't compatible.

- Can't send media with their creation timestamps. All photos shared with family/friends via Signal can't be used to build a photo album without manually sorting pictures.

- Can't automatically save pictures to Picture Roll, Google Drive, Dropbox for integration with your other pictures.

- Only one desktop/computer can be linked to Signal desktop.

- Many useful chat widgets such as polls or real-time location are missing.

- No transcription of audio messages (WhatsApp only has a few languages) and lot of issues with audio messages such as iOS users not being able to play audio messages created on Android but not with Signal.

I don't think they should strive to reach feature parity with Telegram or asian messengers, but why can't they try to at least match WhatsApp in core functionality?

I get the privacy focus, but most of us are not dissidents in foreign countries or journalists who could be killed over their picture metadata. Give us a mode for normal users.

I regret moving my family over to Signal because before I used to have all their pictures as part of my photo stream. Since switching I need to manually save pictures but they don't have the correct timestamps then.

>Only one desktop/computer can be linked to Signal desktop.

Absolutely not the case. I've got 2 at the moment, right now. Had 4 running when I had 4 computers I was using.

>Can't move from iOS to Android (and vice versa) without losing your chat history because backups aren't compatible.

Yeah, this is a real pain which I wish they had solved years ago. For personal reasons my daughter has her old android phone with our Signal messages on it, as it's the only way she can keep them as far as we're aware at the moment. It was a pain when I moved from Android to iOS for this reason.

>Can't automatically save pictures to Picture Roll, Google Drive, Dropbox for integration with your other pictures.

I would think this is by design. Signal is designed to be private.

>why can't they try to at least match WhatsApp in core functionality

I would imagine 'funding' and 'privacy' cover a lot of it.

> Absolutely not the case. I've got 2 at the moment, right now. Had 4 running when I had 4 computers I was using.

Thanks for the correction. It seems up to 5 desktops can be linked at least since 5 years, which is odd because I recall this not working or at least causing the old device to unlink.

I tried to install Signal once. First, it checks and matches your phone number. Strange, but acceptable. Then, it shows a Google Captcha [0], which sends my data to Google. I checked Signal's Privacy Policy and there are no details data sharing [1].

Signal might be good at message encryption, but let's not forget that it handles user privacy unacceptably poorly.

[0] https://github.com/signalapp/Signal-Desktop/issues/6002

[1] https://signal.org/legal/

Plausible they're anonymously proxying the captcha to google?

It's possible but if there's no transparency you can also assume the worst

Is that something that can be done?

Unless I'm mistaken, they use services provided by third parties, perhaps PayPal as indicated in the source code. But guess what - there's no mention of PayPal in privacy either.

No, there is (or was) just Google Captcha. Here is issue on Github about it.

https://github.com/signalapp/Signal-Desktop/issues/6002

Signal is famous for their privacy as well as encryption. Moreover, the comparison is against WhatsApp, which requires you share all your contacts with facebook, and likely cooperates with governments to gain backdoor access.

Perhaps Signal is famous for its encryption, but what is related to handling information about yourself is handled below any expectations, and you can check this yourself by reading the following document.

https://signal.org/legal/

Clarify what you see there that makes it below any expectations?

1. There is no list of service providers with whom they share personal user data.

2. The privacy terms themselves were updated 7 years ago, which is impossible for any company operating on the internet.

It's just impossible to claim to be famous for privacy and occasionally forget to update how you handle privacy for 7 years.

1. I’ll give you one guess why that is.

2. It is possible, and you better believe it. They haven’t updated it, because there is no need for it.

Signal is simply not interested in your messages. It’s also not interested in your metadata, because it’s not an ad platform or a SIGINT front masquerading as a free messaging service.

If all this sounds hard to believe, you should donate.

(I’m not affiliated)

This threat is not about messages.

“Unacceptably poorly” describes what Facebook & Google do with your data, which is to (essentially) sell your personal information to advertisers.

Google captcha sends your data to Google? Come on. Not even remotely in the same ballpark.

Actually not, because Facebook and Google at least explain what happens with your personal data. Again, Signal doesn't do even this.

[1] https://signal.org/legal/

First thing i saw when i clicked the link.

“Privacy of user data. Signal does not sell, rent or monetize your personal data or content in any way – ever.

Please read our Privacy Policy to understand how we safeguard the information you provide when using our Services.”

I clicked Privacy Policy and there is whole page explaining whats happening with your data.

Your comments seem a bit biased?

The primary purpose of a Privacy Policy is to explain how and with whom a company shares PII with service providers. This is something that is completely missing from this document for the last 7 years, according to the date of the last update at the bottom.

and what if they aren't sharing any personal data with service providers? Should they start so that you can feel their policy statement is more honest?

This is incorrect. Look at the code, there are many services integrations including PayPal, captchas etc. All this must be in privacy statement, as even IP is considered as PII according to GDPR.

Also, this is untrue, as they monetize personal data by sharing it with ad networks.

You can visit their donation page [1] that contains ad pixels from LinkedIn, Google Tag Manager and Reddit. Again, no details in the privacy terms [2] about sharing visitor data to those companies.

[1] https://signal.org/donate/

[2] https://support.signal.org/hc/en-us/articles/360032293251-Do...

That's fair critique. Their website uses third parties to work and some of the services they shouldn't use. Others they probably have to use.

But you are implying that this makes the app itself broken. I don't think this is proof that the app itself is not respecting privacy like their legal documents say.

I won't fight for them. I've never even been on their website. But this is classic situation where someone else is in charge of website and marketing. I wouldn't be surprised if slapping google analytics on a website was standard for every other "privacy focused" marketing product.

When someone takes clients' private information and shares it with other businesses without providing transparency over this fact, it is actually a breach of privacy. In terms of Signal, these breaches are both about their application and about their website, illustrating a complex issue with privacy in their business organization.

I'm not saying that the app is broken, I said that it handles user privacy unacceptably poorly.

It's not in the same ballpark, but this entire topic is about "An Ethical Replacement for WhatsApp". Should we then accept potential privacy issues with another service, if they are somewhat of an improvement overall? Or should we rather strive to find an alternative which also addresses or avoids those potential privacy issues.

I've been really hesitant to view Signal as a privacy friendly alternative to WhatsApp, because they still don't offer any way to make an account without a phone number, while a phone number is definitely not required to run a chat service.

Also the fact that servers are run by just one organization is very troubling to me. It's just not the right direction.

Perfect is the main enemy of good. I rather use Signal to escape the big tech clown show than wait for another decade for the perfect tech to come along, meanwhile either not communicating with anybody or using the exact services I really want to avoid.

I'm still waiting for the "other issues" to be explained that Signal supposedly has. I'm ok with my contacts knowing my phone number, and I opened the Signal account ages ago. Anything else to be concerned about?

I feel like "perfect is the enemy of good" only works when you (still) have to put considerable effort to make it better, e.g. when building software.

However currently there are already better alternatives than Signal, so in my personal opinion I feel like that saying does not apply.

It's very fine if you (and most people) are OK with sharing some personal information with a United States organization. That does not mean that everybody is fine with that, or that it's a very good solution to a chat service problem. I'm glad that Signal is a good match for your needs. But there are those of us who would rather see a decentralized service with which no personal information has to be shared.

In these kinds of discussions, I often find it a little strange when others decide that a certain solution or product must be good for everyone only because they are fine with it themselves.

If you read it again then you will notice that I didn't claim anything about everyone, only about myself. No strawmen please.

But I was asking for other issues, and you have not actually provided any?

> “Perfect is the main enemy of good”

Interesting to see this debate evolve.

Seems that phrase “perfect is the enemy of the good” is a relativistic argument. But the title’s frame is “ethics”, which one definition describes as “what is good in and of itself”. In that frame, perfection is the point, no? Though, I imagine you argue in this framework by elevating some aspects to that high standard, and work to convince other aspects are secondary. Otherwise, result is a preference argument where the trade offs you made are silent or obscured behind the practicality of your choices.

> I checked Signal's Privacy Policy and there are no details data sharing

Okay, so they are not sharing data and your whole premise was wrong. That happens. But now how do you change your mind?

On the contrary, they are sharing the data and not explaining this matter.

This is incredibly nitpicky compared to the low standard that Whatsapp is held to

Signal started out as an Alternative Android SMS app that opportunistically upgraded text messages to use encryption when both parties had Signal. It exclusively used sms for transport, so phone numbers were baked deeply into it in a way similar to Twitter's 140 character limit.

It's true that having to disclose your phone number to the service and especially to other users is now a significant drawback compared to internet-first services like WhatsApp that use entirely separate identifiers. Many people have raised this objection, and to their credit they've at last rearchitected to allow exchanging messages using user names and without your phone number being disclosed to the other party.

They still have the phone number at the core of account registration, I suspect for similar reasons to the use of a (one-time sign up) captcha: because they raise the cost to create spam accounts. I'd understand if that's not acceptable to you, but I don't think "unacceptably poor" is a reasonable assessment of their handling of user privacy.

Another example of their approach to privacy: they went to great lengths to design their Giphy search to avoid revealing your search terms to them or your IP address to Giphy: https://signal.org/blog/giphy-experiment/

When a company, through an application or website, communicates any of your personal data to a third-party provider, this should be mentioned in their privacy terms.

In the case of GIPHY that you mentioned, they are sending IP addresses, which is considered PII (according to GDPR), and this should be outlined in the terms and agreed to by the user prior to sending the data.

Signal's privacy terms were last updated in 2018. We are in 2025 now. It is unimaginable for any operational organization not to update their terms for 7 years.

All together, this is what I call "unacceptably poor" in terms of handling users' privacy.

> Signal's privacy terms were last updated in 2018. We are in 2025 now. It is unimaginable for any operational organization not to update their terms for 7 years.

As a privacy-concious user, I always get suspicious abouy privacy policy changes. They always become more loose instead of doing anything to my advantage. Typically because company has found a new way to use my data to make money and their lawyers realized that this requires relaxing the privacy policy. It's a good thing Signal is not playing that game.

Um, Whatsapp does that too?! Maybe there is a way to use it without a phone number, but the most common use is to have a phone number on some sign / store front with a Whatsapp symbol next to it. In many countries that's the default way to do business. Scolding Signal to use phone numbers is just weird in comparison.

Ah, that's my error, I haven't used WhatsApp personally.

Agreed. It's a weird open secret that your phone number is your UUID across all the tech giants. That Signal follows the flock here instead of an email/pass signup is never gonna win me over.

There's a practical reason for that; if they don't collect and store any other user information, they have no way to determine if someone trying to sign up is a bot or someone else trying to abuse the service.

I get far less spam messages on Signal than on telegram and discord, for example. There's a cost associated with setting up additional Signal accounts at the very least.

Strongly disagree. As a creator of tirreno platform [1] I can say that behavioural patterns are more helpful in fraud prevention (including spam) than phone verification, a specially taking into account that phone numbers could be bought in bulk online.

[1] https://github.com/tirrenotechnologies/tirreno

>but acceptable.

There is no acceptable reason for an online service to demand your phone number IMO. There are a lot of other issues with signal though.

For example?

The insistence that you use their automatically updated smartphone client makes the E2EE practically a no-op.

It's your choice to keep automatic app updates turned on. I turned it off.

In my experience that choice is available but choosing to leave it off means choosing not to use the service so it may as well not exist.

Unless they allow you to bring your own client E2EE is a no-op.

I have sympathies for this argument, though it boils down to trust. Even if you roll your own client, you still need to trust some things outside of your control, be it your build environment, your phone, whatever. But most people will use somebody else's client, so need to trust whoever built that one. Or whoever supposedly audited it. The Signal authors just play that role here. Their business model is fundamentally different that that of Google or Meta, which is a main source of trust people are putting into it. Offloading the exposure to a minimum (just the client which is open source) is another. Yes there are ways around all that for an attacker, but in the end it's a game of likelihood. A journalist or dissident fearing for their life may have a different conclusion than mom and dad who want to coordinate a birthday party without big tech reading those messages and selling them to ad companies. It's good to err on the side of caution, but acting like I am the former while in reality I'm closer to the latter user type is in the end just theatre.

Sure. E2EE is a no op but it's ok because you trust them.

At that point I'll just send an email though because I don't need to convince people to install apps.

The situation is not as black-and-white as you paint it. English is an ambiguous language. It's a "no op" in the sense that there is the possibility that they ship an app update in which the crypto is comprimised. Fair, that's possible, just like it's possible that your phone is backdoored or the CIA has installed hidden cameras in your bedroom. But as long as these things have not happened, specifically as long as Signal ships an app which corresponds to the code up on github which has been audited time and time again, it's not a no op and works perfectly fine. That's very different from sending a plain-text email or painting the message contents on your window. Please stop conflating these two.

perfect is the enemy of good, with WhatsApp being neither (at least wrt privacy)

Does anyone else find Signal quite hard to use? The syncing between devices stops working a lot of the time, and needing to sign in again fairly regularly. I’ve tried switching but it doesn’t stick because of the annoyance factor.

Unfortunately, while you're right, it has plenty of annoyances, there's no real alternative.

Matrix doesn't have that problem and it's even federated, without a single point of failure.

I really want Matrix to succeed but it's not there yet, and not really making progress either.

It's vastly more complicated than Signal.

Matrix makes progress, see https://matrix.org/blog/2023/09/matrix-2-0/ and the UX has improved a lot since Element X (compared to previous Element), especially encryption settings have been simplified (a pain point I myself discovered when onboarding less experienced people)

> I really want Matrix to succeed but it's not there yet, and not really making progress either.

I suppose whether it's "there" yet depends on your personal needs, but it absolutely is making progress. Maybe slow, but steady and visible.

After a decade of holding on with a small pool of friends with Matrix, we finallly gave up this month over notifications dropping It hurts because I agree in principle - I don't even fully understand why notifications even should need Play Services or whatever Apple does. But after enough missed occasions, we decided it wasn't worth it and reverted to a blend of SMS and Jabber, where the notifications consistently work (on apps that dont use the above). I don't think the Matrix team is taking this seriousy enough. If you miss out on moments over dropped notifications, you or one of your group will fall back to another method and soon enough so will the whole group.

speaking as project lead of Matrix: i’m not aware of a general problem affecting dropped notifs. mine are fine on matrix.org on element x ios for instance. are you using unifiedpush on android on a ntfy server which is rate limiting notifs or something?

I don't really use Whatsapp, or any IM client on my phone, but do have a few friends use Telegram so I'm using it on my computer. We're looking at alternatives. We tried out Signal, and that feels extremely basic and spartan, like old ICQ or AIM. We tried Matrix (with the Element client) and it feels much more featureful and modern. And the federated aspect feels much better than the centralized nature of Signal.

Can you explain a bit more about where you feel the complication comes from?

This group of friends are mostly not very technical. They were able to create an account on matrix.org perfectly fine. They felt a bit strange that they had to pick a username "like in the past" and not use their phone number. But at the same time they felt pretty nice not giving away their phone number to a foreign company/organization.

Anecdotally, whenever I see someone mention Matrix online, very frequently it’s to complain about it.

Matrix does have that problem. I’ve lost so much message history to key management bugs.

Fwiw I still can read more than 5 years old messages in the new Element X app, which I recently installed.

This was pretty common until (I think) late last year, but GP was writing in present tense. The Matrix team have been fixing the various bugs responsible. I haven't seen an "unable to decrypt" error recently.

https://matrix.org/blog/2024/10/29/matrix-2.0-is-here/#4-inv...

The model Session came up with makes sense UX-wise. But I got yelled at for recommending it: something complicated about security, which was way over my head.

people will give zuck control over their entire life over having to sign in here and there … wild

Whatsapp at least claims e2e encryption don't they?

I also claim to have dated Giselle when I was younger :)

I’ve been using Signal on half a dozen devices for years and haven’t experienced what you describe.

Conversely I've been using Signal on 2 laptops and a PC for only a couple of weeks, and I face issues of messages not synchronizing approximately once a week...

I’ve been using Signal as my main chat app on iOS and desktop for a long time. Yes, this happens to me every other month too. It’s annoying, but I can live with it.

>Does anyone else find Signal quite hard to use?

In what way? I've found device sync to work fine now (better than messages on macOS/iPhone), and not lost sync with any of the other devices I'm using. Not had to sign in needlessly for over a year.

It’s always give me that Linux desktop feeling, where all the features are there, but it’s held together with spit and baling wire

I've had a broken Signal account for like a year. I migrated from an older phone and the process didn't work because apparently the version of Signal I had on the old phone was "too old" or something? (why didn't the new destination phone's copy of Signal tell me this?) ... I've been waiting, hoping they fix the issue where I can re-register my phone without having to delete the app and lose all my message history with photos from family etc. For a while, I could receive messages but not send them (yes, seriously). Recently a "re-register device" button appeared, but when I try to go through that process, I get the SMS with the verification code, I enter it, and the app crashes. Now I can't even access the message history because the app forces me to resume the "re-register" flow, but it doesn't work. I'm holding out hope that yet another app update will eventually fix THAT crash and I may indeed one day be able to use Signal again. Not that I want to, I'm not impressed with my experiences with it. :\

I have, it's atrocious. Then missing parts of history.

Also fuck them for requiring a phone number.

Signal has a central, proprietary server. It's between impractical and impossible to run your own Signal server like you can with Matrix, Revolt, or Delta Chat for example. BlueSky has a similar approach (compare to Mastodon).

Also Signal requires a phone number to sign-in. It's not exactly private. AFAIK the proprietary server can glean your IP, your phone number, who you talk to, and when you talk to them. This type of metadata is valuable information.

The WhatsApp co-founder gave Signal $105M in 2018. Signal costs ~$50M/year to run. It's also funded by wealthy donors such as Jack Dorsey (Twitter, BlueSky, Square). BTW Jack is now pushing Signal to integrate Bitcoin.

When evaluating the "ethics" of a chat platform, we should factor-in the metadata, soft power, and eventual leverage that centralized (controlled by a few) platforms like BlueSky and Signal afford to wealthy folks who are bankrolling it.

*Riot -> Element

Oops I meant Revolt, the Rust-based alternative to Discord. Updated. Thanks. https://github.com/revoltchat

> Signal has a central, proprietary server.

The signal-server repository is open source

And it doesn't matter if it's open source or not. because messages are encrypted P2P.

Critical portions of the server are not FOSS. Also the core software forces you to join their servers.

Also we have no proof that they are running the server software published on GitHub. This concern is exacerbated by the fact they didn't publish server code updates for many months.

I mean sure, but also, the client app source code lets us know that unencrypted data is not sent to the server. So at best they could perhaps be collecting some additional metadata, but I don't think it's a whole lot

> AFAIK the proprietary server can glean your IP, your phone number, who you talk to, and when you talk to them. This type of metadata is valuable information.

To the best of my knowledge, so can matrix.org or whatever servers you connect and federate to. This is required to route messages between users. What is your point?

As long as I need a phone to use those, they are not a solution.

Signal has a desktop app. Unless you mean phone number, in which case I get where you’re coming from, though I think they allow just usernames now.

Usernames are only for discoverability. You still need a phone number.

You need to install the phone app to be able to activate it. If you've been offline on the desktop app for too long, you need the phone app again to re-active the desktop app. I've also noticed a lot of issues synchronizing messages between computers using the desktop app, without having the app on a phone.

They allow usernames as an alternative to sharing your phone number with other people. You still need a phone number (and the phone app) to create and activate an account.

It's very phone-first.

It depends on your threat model. Since WhatsApp also requires a phone, Signal is the superior option and therefor a solution to using WhatsApp.

Also depends on where you're coming from. My friends use WhatsApp and I don't because of privacy considerations. If they switch to Signal, I might still not use it because they want my phone number (and their servers are centralized, owned by one organization). So for them, amongst each-other, it would be fine to all switch to Signal probably. But for those of us who have been avoiding it altogether so far, it might not change anything whatsoever.

> and their servers are centralized, owned by one organization

For what it's worth, everything about signal is open source and you can see how little data they can actually collect from you even if they wanted to. I believe they wouldn't be able to start collecting more data by modifying the server code, because the features which prevent them from receiving your info are built into the protocol and the client apps as well.

But since it is open source I suppose it would be possible to run your own server too... I suspect you just wouldn't be able to talk to the same people if you did (you'd effectively be running your own version of signal and that server would do the necessary coordination tasks for you and the other people using it)

I think in this day and age, it's "fine I guess" that it's set up that way: most services do that. But going forward, I think it's much better if services work in the way that e.g. email and IRC work: decentralized and federated. Nobody can know what will happen with Signal, or the USA in general. We'll be having this whole conversation about switching chat clients again in a couple of years. Whereas with a decentralized service, it doesn't matter. Anyone can build the software, anyone can run a server. Regardless of what happens to the people or organizations behind it.

You will need a phone number, but you can make it work without a phone.

signal-cli lets you register from a computer. If you have a modem in your computer, you can use this to receive the confirmation SMS. A friend also managed to register a landline (I think the phone received a code through a voice message).

I have just learn about delta chat. Uses mail. Seems good.

Then use Session:

https://getsession.org/

I got shouted at for recommending it. Something about cryptography they're doing wrong.

Wonderful UX though: account unlocked by seed phrase which you can note down and easily transfer between devices.

Signal doesn't provide any method to backup and restore my chats, at least on iOS. Imo this is a very important feature, I have chat history going back for years and it's basically a rich media diary of my life. It happens occasionally that I want to look up stuff that has been shared a few years ago, especially photos. Is ownership over my own data really too much to ask? The possibility of losing my entire chat history scares me. I get that some people even consider it a feature, but without the ability to backup and restore messages it's not really a "replacement" for WhatsApp, it's merely an alternative with pros and (very big) cons.

I'm still sad that they'll probably never provide a proper web client instead of that suboptimal Electron desktop thing.

https://github.com/signalapp/Signal-Desktop/issues/4466

I think the issue with a traditional web app, is if they deliver one, they can be probably compelled by three-letter agencies to modify the app served to users or a specific user, to collect that user's information.

Distributing it as a signed desktop/mobile application makes it so they can't tamper with what users are running to be made complicit in attacking their users

I don't think Signal is an ethical replacement as it forces others to use the same app and vendor as you.

Options like Matrix or XMPP give users more freedom

That's a great utopian ideal (and one that I subscribe to), but there is no way that is happening outside really nerdy circles such as we probably inhabit.

It is of course possible to create signal clients that are forks of Signal.

I don't see how this is an -ethical- issue though providing the ethics of Signal align with that of the user (they do with mine), and if they're doing something unethical then you should not be using them anyway (hence me not using WA)

> but there is no way that is happening outside really nerdy

Yep, see email and the phone network /s

> It is of course possible to create signal clients that are forks of Signal.

Which may be killed at any time when they connect to the central Signal server, see LibreSignal

>Yep, see email and the phone network /s

Which probably only exists because of network effects. My kids (18-25) don't use phones for phones, and rarely use email other than when they have to for work.

Trading one proprietary app that gives you ownership over your own data (WhatsApp) for another proprietary app that locks your data (Signal) is not an "ethical" replacement, it's merely a (worse) alternative.

I think you are completely reversed in how you're analysing the situation there, so I'd like you to expand on it - two questions:

1: How does WhatsApp give you ownership over your data that Signal doesnt?

2: How is Signal locking this data?

With WhatsApp I can backup and restore my messages. With Signal I cannot. I had to reset my iPhone 2 weeks ago because "system storage" was magically taking up 30GB of my 128GB iPhone. The iCloud backup restored everything perfectly, including my 15-year old WhatsApp history. However all my Signal messages were lost. And even worse, this is apparently by design. You can't backup your messages on an iOS device. It's my data, let me do it what I want. But that's not possible, the data can only exist in a proprietary compiled app.

WhatsApp is a lot better in this regard. I can backup my messages in multiple ways, and I can even export a conversation as a ZIP file straight from my iPhone.

You definitely can back up your messages on signal.

https://support.signal.org/hc/en-us/articles/360007059752-Ba...

Yes, and then it says...

"Messages are only stored on your devices. Without an existing message history accessible to you account transfers are not supported."

So that means: no backup and restore. A backup means: I can still access my messages after my phone ends up at the bottom of a lake.

Completely agreed. I want to be able to talk to people from any modern reasonably-secure operating system. Specifically, I found that there was no possible way to use Signal on OpenBSD natively. The only [poor] workaround was to create a Linux VM and use the Signal app for Linux in there. Frankly, if a communication protocol isn't usable on BSD it's not acceptable to me.

SimpleX[1], no phone number required.

[1] https://simplex.chat/

SimpleX is cool, but it has VC investors, so a lot of people won't trust it long-term (for exactly the same reasons we're talking about replacing WhatsApp now).

When I last looked at this it had severe battery drain issues on Android, to where users with only one contact and just a handful of messages were experiencing it. Appears that pinned issue is still open and unresolved.

Otherwise it seemed like the most promising alternative I've seen that satisfied various requirements.

I've used SimpleX for seeral years. I do like the concept, and I have supported the project, but in my opinion it suffers from two weaknesses/lacks:

1. It cannot synchronize chats across several devices, so you need a separat “account” for each device. This can, to some extend, be mitigated by creating a group for each contact you communicate with, and then add all their and your accounts to that group.

2. Message propagation is somewhat unreliable: If you use the method described in (1), some accounts may not receive a given message.

But yes, you needn't disclose your phone number in order to create an account/profile on SimpleX.

Some things that keep me away from SimpleX:

- No multi-device support.

- No group calls.

- Establishing a contact requires sharing a large link or QR code, which is often inconvenient.

- Message queues drop messages if not retrieved within a relatively short period. Last time I checked, it was 21 days, which is shorter than some of my off-grid vacations.

- I couldn't find clear information on who runs the message queues, so I have to assume most are controlled by a single organization. This makes it effectively a centralized service with respect to privacy and resilience.

- Funded almost entirely by venture capital, making its longevity questionable, and the likelihood of future exploitation relatively high. I'm not comfortable depending on such a service to keep in touch with people.

If I wanted to self host and offer my users something with encryption like Signal, what would be a good solution? Would love to enable accounts for everyone who has an account with us on supabase.

Any recommendations?

SimpleX has end-to-end encryption, fancy mobile clients, and does let you host your own server:

https://simplex.chat/docs/server.html

Does SimpleX even sync messages between the phone and the desktop? Last time I checked they didn't unless you were maybe on the same network

Depends on what you mean by sync. It has limited support for tethering a mobile device to a computer on the same LAN, but lacks the kind of independent multi-device support that's a available in e.g. Matrix.

That sounds like difficult UX. Especially when WhatsApp just works

When “just works” means “lacks real security”, I’d rather have something experimental.

They don't, and I think they argue it's a security feature.

It is, at least, intentionally designed that way, for better or worse.

You can get per-conversation sync by joining multiple clients to the conversation.

It's one of those things where you'd probably want to be less secure and always sync to all devices.

https:/matrix.org

Matrix as a protocol and any of the clients that use it. SchildiChat and Element being two.

In theory you could even make that interoperable with WhatsApp i( in the EU) since the DMA makes that mandatory, I am not aware if anyone who did it though.

https://developers.facebook.com/m/messaging-interoperability...

I used to run a matrix instance years ago. I remember the account setup being super difficult for my family members. And the client was so basic. Is it different nowadays?

yes; matrix has improved significantly - eg Element X is an unrecognisable improvement over the old Element app.

Matrix comes to mind (Synapse server and whichever client you choose). It has good encryption and can be federated. Downside is that it gets heavy for old devices when you're in a lot of encrypted group chats.

XMPP is very efficient and delightfully simple to use and administrate. I never tried E2EC with it, but there are options on the clients, like OMEMO. It has limited federation.

The simplest server IMO is Openfire, but offers range from Lua-written Prosody to the extremely expensive Isode servers that can do complete federation, HF radio XMPP and probably coffee and pizzas too.

I used to run a matrix instance years ago. I remember the account setup being super difficult for my family members. And the client was so basic. Is it different nowadays?

Omemo I heard of. from what I read it’s a solid alternative to Signal’s protocol. Is it easy to use? Is there something we can just run the server, spin up some users and have them easily dm each other?

ejabberd is a battle-tested XMPP server and they recently added a native Matrix protocol bridge module. So supposedly now you can have your users connecting over both networks seamlessly. Yet to actually try that.

WhatsApp's call quality is second to none. Also the fact that it's ubiquitous, and its sync just works, makes it difficult to move to anything else. Everyone's on it in South Africa. I think we can only hope for regulation to keep it safe and force interoperability with other chat apps.

>I think we can only hope for regulation to keep it safe and force interoperability with other chat apps.

Never going to happen unless legally forced to. Which is not happening any time soon in the USA.

>WhatsApp's call quality is second to none. Never had a problem with Signal - in fact I've had situations where it's been a better option than anything else available to me.

This simply must happen. I don't think there is another sustainable solution to the network-effect problem.

A few months back I opened Signal on my daily driver phone. All my contacts and message history were simply gone. Apparently this is a security feature designed to keep me safe.

There is always a tradeoff between usability and security, and Signal is too secure for me

> There is always a tradeoff between usability and security, and Signal is too secure for me

I'd reframe that. Inside information security, there is a tradeoff between integrity and confidentiality. Here you lost integrity and availability, which is still a security fail. In no way is Signal being "too secure" here.

Signal is a solid choice privacy-focused, open-source, and free from ads or data tracking. A true ethical alternative to WhatsApp!

It's not a replacement, since it doesn't have the same feature sets or ergonomics.

Don't get me wrong, I use signal a lot and I love it, but presenting signals as an alternative to whatsapp is only going to disappoint people.

Telegram is closer, but neither e2e encrypted nor open source.

Still, I would say if you are in America and not dealing with state or industrial secrets, getting spied on by russians is better than by meta.

Basically, I use both: signals for my privacy oriented friends that will go through the ordeal of using signal, and telegram with the normies so that at least they get of the zuck train.

As someone in the extremely near east, please create an ethical replacement for Telegram.

From a product point of view, maybe that's a fork of Signal? Maybe Signal Group, or something along those lines?

Try DeltaChat: https://delta.chat/

Matrix

The Telegram clients are actually open source and I think pretty solid. The Matrix protocol is open, federated, and secure, but the clients are kinda janky. I've been playing with the idea of what if someone were to fork the Telegram clients and modify them to work with Matrix. That would be a "best of both worlds" situation I think.

I really hope that you continue work on this!

The only secure comms I’m aware of would be something like the receipt of a signal over radio encrypted with a one time pad.

Transmission of the signal and key is another matter.

It's illegal to encrypt CB radio signals in the US and many other countries.

Toothless, since it's impossible to prove that any given message is or is not encrypted.

This comment I'm writing right here might not mean what it appears to mean, and might not be aimed at who it appears to be aimed at.

It's effectively merely illegal to pollute the shared medium with noise.

I can imagine somebody could make with some AI a system that talks something that makes more or less sense, but has encoded information in the message

In principle, yes. Technically, no. D-STAR vocoder.

I didn’t mention CB, any particular frequency, or country. My comment was on secure communication at the abstract / theoretical level.

lol I'm from Germany and most people I know use for many years already :D

lol I'm from Germany and most people I know use WhatsApp, especially for groups, events, activities. Almost nobody uses Signal and even less use Threema. The place after WhatsApp is Telegram.

Lol exactly. Try to organize something in the school or kindergarten with “normalos” and try to convince them to setup signal!

Lol I'm from Germany and i think it wouldn't be a problem as normalos typically don't own mobiles in the kindergarten already. The "unnormalos" with mobiles - yes - but, if you're the kindergartener, then you dictate. But no lol - it's a pain. The mouse cant bite of the thread.

It is not so difficult to understand I was referring to organizing smth between parents…

I don't know, I don't have kids. May be just write what you referring to in first and not to expect others with different scopes of experiences to understand what you meant? The best thing about languages is the possibility to exactly formulate, so there's no misunderstanding possible.

Just about everybody I know uses both. The pattern I see is that groups associated with some entity like a company or a club are on signal, because at some point (before Musk took over as chief billionaire villain) it became a thing to not have your brand associated with Meta, while many groups on the more the friends&family end of the spectrum remained on Whatsapp. And 1:1 conversations are simply on whatever messenger they started on. Which is super convenient, because of the way the Android multitasking model works (and I suspect it's similar on the other side?). Far more convenient to switch between a Signal, a Whatsapp and the occasional Facebook Messenger than between two WhatsApp groups, worse if those are Whatsapp groups with a channel hierarchy.

(Telegram: even just having it installed would be seen as a political statement, it's where the weirdos congregate to antivaxx and flatearth and reinstate monarchy or whatever they do)

I'm from Germany, too. This heavily depends on your social environment. There are milieus where Signal is ubiquitous and there are mileus where people don't even know what Signal is. But I think most people live in the latter.

My experience is absolutely the 2nd group.

That hasn’t been my experience. A few tech-savvy people and those close to them may use alternatives, but even then, it’s usually just for groups where someone refuses to use WhatsApp. For everything else, they still rely on WhatsApp.

On top of that, nearly all groups related to kindergarten, school, or various clubs use WhatsApp, and there’s practically no way to convince them to switch. If my wife weren’t in those groups, I’d have no idea what’s going on.

For me no, until Signal will fix video call quality between ios and android.

I use them both to connect with my family, signal for chats, but whatsapp for video calls, because very often in Signal you are minecraft.

First place here is FaceTime link (so it opens in a browser), and second is WhatsApp.

How does Signal make money? All chat apps suffer from the same problem that users want to use someone else’s infrastructure for free. WhatsApp is great because it is run by a for—profit company, listed on a stock market, allowing users to take an ownership stake.

> WhatsApp is great because it is run by a for—profit company

That also what causes the problems. The sad part is that it didn't have to be this way, but being publicly listed currently means that you got to pump those stocks. Very few people invest in stocks because they believe in the long term future of a given company, that's old school thinking.

The types of stockholders that "take ownership" also isn't going to help fund the company long term. They buy the stock once and the hold on to it. How is that going to help?

WhatsApp needed to be a subscription to not go down the ads and data collection rabbit hole. Now there's no going back, more and more ads will appear and more and more tracking will sneak in. This is a Meta product after all, so I don't even understand why people are surprised.

It is sustained by grants and donations, although I'm not clear how near or far it is from being indefinitely sustainable.

The Signal foundation was established in 2018 with $105 million from WhatsApp co-founder Brian Acton, and it actively solicits donations. I give $20 a month.

They released a blog post at the end of 2023 emphasizing the need for donations and estimating operating costs would cross $50m/year in 2025.

https://en.m.wikipedia.org/wiki/Signal_Foundation

https://signal.org/blog/signal-is-expensive/

Mostly donations [1]. The yearly budget is around $30M, which is a lot but pretty tiny for an app so many people use. They only have around 40 employees [2].

Personally I think the small staff, donation-based funding, and security-focused security constraints are a plus: the platform seems way more stable than most and does what it needs to do.

[1]: https://projects.propublica.org/nonprofits/organizations/824...

[2]: https://en.wikipedia.org/wiki/Signal_Foundation

They run a cryptoscam called MobileCoin

I see people mentioning all sorts of alternatives, but not one of Session. I can't tell if you all know something I don't and that it's garbage, or if it's just that obscure.

It is not very secure:

https://soatok.blog/2025/01/14/dont-use-session-signal-fork/

https://soatok.blog/2025/01/20/session-round-2/

They also wrote an article about Signal security, worth to read:

https://soatok.blog/2025/02/18/reviewing-the-cryptography-us...

Pointing out that WhatsApp was used to spread misinformation before Brazilian elections under the header “Ethical issues with WhatsApp” seems weird to me.

According to the Guardian article[0] this article uses as a source, WhatsApp has had updates to limit the number of times messages can be forwarded. But there’s obviously a limit to what can be done because the chats are e2e encrypted.

What does the author want from WhatsApp? Reading messages and blocking them if they don’t pass Meta’s moral guidelines is the opposite of want you’d want from your private chats and I don’t see any other way to effectively combat spreading misinformation.

And is there any indication that Signal would prevent situations like this if it gets more widely used?

[0] https://www.theguardian.com/world/2019/oct/30/whatsapp-fake-...

Wake me up when Signal stops depending on a phone number. One of the few things I feel I could lose very easily. And some people (eg my kid) don't even have a phone number!

The history of chat networks over the last quarter century is that they come and go and there is no long term loyalty to any of them. ICQ, AOL, MSN, Yahoo Messenger, Facebook Messenger, Google's many messengers, etc. are long forgotten and some of those used to be dominant and their disappearance seemed unimaginable. Mostly this is due to corporate stupidity and big corporations getting greedy about "owning" their user base and then throwing away the baby with the bathwater.

It seems Meta (a repeat offended with this) is yet again making that mistake with whatsapp. Prediction: they'll run it into the ground just like they ran Facebook Messenger into the ground. And Facebook itself of course.

Whatsapp only showed up because of extortion prices for SMS messages. It did the same thing for a fraction of the cost (1$/year initially). Easy sell, so it grew to many users. But who uses SMS at this point? I get a few once in a while. Mostly stupid 2FA codes. The core premise for Whatsapp has long disappeared.

Whatsapp is probably going to implode as Meta starts pushing through unpopular things like advertising and continues to be in the spotlight for routinely doing dodgy things with respect to privacy, surveillance, etc. They are just not a great brand when it comes to that and they are losing a lot of trust over time.

Mostly people use whatsapp because other people use whatsapp. Not because it's particularly good. IMHO it actually always was a bit meh compared to other things. But world+dog seems to like sending me messages with it so I'm on it.

For the same reason I've had Signal on my phone for a few years now and more and more messages are coming in via that. Neither are optional at this point. I expect Signal will eat a lot of the Whatsapp traffic soon.

And if not Signal than something else. Whatsapp was famously built with only a small team. That's 16 years ago. These days building something like that from scratch could be done in a fraction of the time with minimal effort. You could vibe code an MVP in an afternoon and it wouldn't be horrible. This stuff is a pure commodity at this point. We don't need trillion dollar big tech companies doing this for us.

very ethical phone-tied centralized metadata collection

I'm persuaded

No, it's just crypto bullshit.

If you are from the U.S. sure, serves the interests of your country

If you are not from the U.S., then no, it's not a replacement for WhatsApp, it's the same

https://en.wikipedia.org/wiki/CLOUD_Act

"but E2E encryption my dude"

You have forgotten about RSA, my dude

Why Signal, why not X, Y, Z? ask yourself why something from Cali always gets picked up and talked about, but people's favorite? nevaaaaaaah

we have already an ethical replacement for WhatsApp, and it's called Telegram. Unlike WhatsApp the clients are opensource (you can download it from F-Droid) and it's secure enough: https://x.com/Pinboard/status/1474096410383421452

The FSB loves Telegram.

https://www.newsweek.com/telegram-messenger-russia-fsb-ties-...

https://istories.media/stories/2025/06/10/kak-telegram-svyaz...

I love Telegram but our family switched back to WhatsApp after that came out.

I hate to break it to you, but essentially all Android and Apple devices on US carriers can (potentially as a capability, but it's extremely unlikely in the real world) be remotely screenshotted, location tracked, and microphone and cameras activated by US intelligence agencies because they can get whatever they want inserted onto endpoints (phones and other SIM devices) by the carriers. This probably happens in most countries. State actors therefore don't really need RCE or local priv esc 0days to break into any phone or backend, social engineer an engineering shop, or plant a spy software developer to gain in-app access. WhatsApp maybe good enough, but it leans heavily towards MAANG feudalism while Signal doesn't currently. Signal won't help this massive endpoint vulnerably either, but it's backed and design is more trustworthy. Only an audited FOSS hw/sw stack that doesn't agree to carrier and local regulations requiring unknown, untrusted code loaded on a user's device would. And, honestly, I'd like a phone that can switch to e2e voip automatically should the other party have Signal or similar installed rather than making a conventional call. IDK if Silent Circle's Blackphone 2 did this or not, but the Silent Phone app that replaced it defeats the whole purpose of a Blackberry-like device.

> In March I argued that we should choose Bluesky over X/Twitter, based on the obvious reason of boycotting companies connected to Musk.

Let’s f*ck up Zuck just because OP doesn’t like him. How can a post like this be at the top?

Please not that I advocate people to use Signal.

The whole site appears to be about advocating “ethical” choices and canceling ones he does not agree with.

Is there a problem with that? It's difficult to tell from your post whether you think that's a good idea, other than the quotes which intimate you think the ethics are off?

> It's difficult to tell from your post whether you think that's a good idea

The quotes around ethical and the misuse of the word "cancel" makes me think they pretty much don't like whatever the site author is doing.

Free market and money vote and yadda yadda yadda requires consumers to be aware of and mobilize on boycotts. If we want competition, anti-consumer practices to disappear, price transparency, privacy, and on and on, then we need to be willing to mobilize on a boycott on the grounds of ethics or morality.

We all have this theory of the invisible hand and market dynamics but as soon as people actually, you know, practice that then we get a sour taste in our mouth. The truth is cancel culture, or whatever you want to call it, is fundamental to capitalist economies in a classical sense.

>Let’s f*ck up Zuck just because OP doesn’t like him. How can a post like this be at the top?

Because the ethics of WA and Signal are completely different, and Meta is finally moving in the direction of putting adverts into WA which was predicted years ago when it was bought by Meta.

Signal is cool, I think it has made a huge contribution to whatsapp through its collaboration.

But I think that there's room for nuance, sure it's closed source and a closed garden, but that's precisely what allows it to be gratis and free of spam (you can't build the client, you can't build a spamming client)! Sure it's controlled by an entity that may or may not use that data for ads. But it's metadata and not content, sure the NSA or some three letter agency may tap it for national security reasons(or at least masquerading as natsec reasons), but not even subfederal law enforcement and courts can access the contents of the message (E2E encryption).

The contributions of Free Software has been unquantifiable, but if it continues to treat all closed source things as equally bad, then you get extremism. Surely there's a difference between an entity seeing metadata, and an entity seeing message contents, this is a non trivial distinction.

Congratulations to signal if they develop an algorithm where they can't even see the metadata, but I'm not even convinced that it's good? The article cites cases of Meta products being used for malicious purposes, at least we hear from them? At least Zuck shows up against the senate to answer when shit hits the fan, if Signal is used in other parts of the world to organize coups or ethnic cleansing, you just would never hear about it because it's all super anonymous 5 stars, but ethically they would still be contributing as much as Facebook or Whatsapp.

And on that topic, I don't think overfixating on Meta's role in a multi actor causal chain to be very productive? I think it comes more of a place of Free Software developers being jealous that they didn't win the popularity contest, and less from a place of genuine concern. I used to be anti Whatsapp too, but at some point I realized that 1B users have as much say in what technologies we should use than developers, it's not all about the tech. Whatsapp has gained the trust from billions of users, ignoring them and telling them we know better because we have been indoctrinated by recruiting evangelists of an extremist ideology is not the way forward. I do believe in moderate free software and Whatsapp is one of the lowest hanging fruits to accept in the path to moderate FS

> but at some point I realized that 1B users have as much say in what technologies we should use than developers, it's not all about the tech. Whatsapp has gained the trust from billions of users, ignoring them and telling them we know better because we have been indoctrinated by recruiting evangelists of an extremist ideology is not the way forward.

Cab you envision systemic reasons that lead to Whatsapp's users using the software without trusting Meta?

I get my internet through Comcast or AT&T. I certainly don't trust either.

Are there no municipal or co-op ISPs in your area? GVEC here, started by farmers to get electricity where there was none, is awesome and still largely a co-op.

1 Gbps fibre of similar quality to GFiber for $89/month (vs 70) in almost the middle of nowhere. 2.5 and 5 exist too, but are pricier.

Not to detract from your post because it's worth considering, but

>Whatsapp has gained the trust from billions of users

Bear in mind what Brian Acton said ("It's time, delete Facebook"). If billions of users trust it it might be because they're not aware of the shell games they pull https://news.ycombinator.com/item?id=25662215

> Free Software developers being jealous that they didn't win the popularity contest

I don't think most of us are driven by this. We care about user rights and good software.

> it's not all about the tech.

We agree. It's all about politics.

> telling them we know better because we have been indoctrinated by recruiting evangelists of an extremist ideology

Caring about having control on one's computing is not extreme.

> moderate free software

What is moderate free software? Having access to the source code but not too much? Being able to modify but just a little? Being able to redistribute but to a limited number of people? Being able yo use it but only for a restricted set of goals decided by the software provider?

The idea that free software is extreme needs to die.

I fail to see what you are actually proposing and what drives you.

>What is moderate free software? Having access to the source code but not too much?

Thanks for asking. My postulate would be having access to binaries.

You can achieve the four user freedoms with binaries to some extent. Mathamtically Freedom(source)>freedom(binaries)>freedom(SaaS)

You can use software for any purpose with a binary. You can study software, although in a less efficient manner, with a (complete, offline) binary. You can modify the software with a binary! You can share software with a binary.

To give a concrete example, Users can share WhatsApp, if a user doesn't have Whatsapp, it sends a link to their phone through SMS to download the application , you can also share the installer files on desktop. The right to share is not infringed. That said, you are not allowed or empowered to modify Whatsapp. This is a distinct type of partial freedom which is easier to concede, that some of the freedoms can be infringed. Whereas the stronger claim above is that even a single freedom can be partially fulfilled.

I think that's my motive, to recognize that WhatsApp isn't the Devil as a 0.5 star rating would suggest. Extremism goes even against the very goals of the ideology, as it's very hard to take seriously if it requires so much dedication and extreme stances, it's much easier and reasonable to ignore free software than it is to accept is tenets completely or moderately. Make it more moderate and achieve more penetration.

You can't possibly maintain software in good conditions without the source code. You've lost the ability to take your software with you and stop relying on the provider, unless you rewrite it.

More penetration of something which has lost its substance seems useless.

I would say if WhatsApp is a good baseline for you w.r.t freedom, there's nothing more to do: any gratis software does the job, and most software is already gratis. You get Big Tech-controlled users with ad and tracking-ridden software, and you seem happy with this.

You are probably not even allowed to share WhatsApp binary (likely disallowed by the EULA), and as for studying the software, you are probably not allowed to disassemble the binary (also prohibited by the EULA). It's as non-free as it can get. There's also nothing moderate about disallowing these things.

I don't see anything to be happy about in this deal.

The meaning you have of moderate is "please don't alienate Big Tech and force them to let users have the minimal control of their computing". Poor Big Tech, I feel for them. Yes, that's not a nice thing to say, but you are calling perfectly reasonable, non-violent, harmless opinions "extreme". I hope you reconsider.

> if Signal is used in other parts of the world to organize coups or ethnic cleansing, you just would never hear about it because it's all super anonymous 5 stars, but ethically they would still be contributing as much as Facebook or Whatsapp.

Claiming the platform is responsible for the actions of their users is a bit too much, I oppose to that kind of thinking.

Have you heard about net neutrality?

Yeah I heard about net neutrality, against it. At least in my country, Whatsapp used to be free even if you had no internet. Now due to net neutrality, it's not. All it accomplished is that Whatsapp is not gratis, but they still have the monopoly, so it was a net loss. Can you hand to your heart say that forcing people to pay for internet to receive and send de facto phone messages is somehow better? When you don't pay your phone bill you get cut from tiktok and messaging by the exact same policy. With the phone line and sms you can still receive calls and messages, but whatsapp gets cut because it's internet and that's what you get with net neutrality.

Regarding the responsibility for user actions. I'm assuming you'd think the same of Facebook in the cases of Myanmar and the Trinidad Tobago cases? I was just trying to hold the original article in estoppel without espousing a specific view, I think it's nuanced with a lot of grey areas.

How long ago did net neutrality laws force carriers to charge for WhatsApp traffic?

Not 100% sure. In argentina it looks like the law for net neutrality was passed in 2013. Free whatsapp being implemented sometime around 2017, but it must have been reverted shortly after possibly due to FSF lobbying, which was quite close to the government.

Radio and TV neutrality was a hot political topic at the time as well, the incumbent government was pro-intervention and regulation, so that helped. But the FSF had a big impact, going as far as getting Linux to be installed as a dual boot in state sponsored Notebooks for Kids programs.

The good thing is that the field is a bit more open if anyone wants to dethrone whatsapp, but since they were first movers and they have the network effects now, it seems like almost inconsequential, a contender could have negotiated zero-rating with a carrier anyways and work up from there.

> Can you hand to your heart say that forcing people to pay for internet to receive and send de facto phone messages is somehow better?

Absolutely yes, I can say that, because the answer is to pay for unlimited service, not having some websites having free traffic and pay through the nose for all others.

And whatever Meta is doing, will prevent this unlimited service, where I can download 20GB each day and my bill stays the same.

Reply on news.ycombinator.com