Comment on A fresh install of Signal takes up 410MB, blowing both Firefox and Chromium out of the water

• scarilog@lemmy.world ⁨5⁩ ⁨months⁩ ago

  This is because they don’t retain your messages on their servers right? Is this for storage reasons, or more just security philosophy of not being able to access ast chats when you login from elsewhere?

  source

  • JoeyJoeJoeJr@lemmy.ml ⁨5⁩ ⁨months⁩ ago

    This is not entirely correct. Messages are stored on their servers temporarily (last I saw, for up to 30 days), so that even if your device is offline for a while, you still get all your messages.

    In theory, you could have messages waiting in your queue for device A, when you add device B, but device B will still not get the messages, even though the encrypted message is still on their servers.

    This is because messages are encrypted per device, rather than per user. So if you have a friend who uses a phone and computer, and you also use a phone and computer, the client sending the message encrypts it three times, and sends each encrypted copy to the server. Each client then pulls its copy, and decrypts it. If a device does not exist when the message is encrypted and sent, it is never encrypted for that device, so that new device cannot pull the message down and decrypt it.

    For more details: signal.org/docs/specifications/sesame/

    source

    • Rin@lemm.ee ⁨5⁩ ⁨months⁩ ago

      That’s for your insightful comment. I’m now going down the rabbit hole of the signal spec :)

      source
  • huginn@feddit.it ⁨5⁩ ⁨months⁩ ago

    Correct

    source
• Squizzy@lemmy.world ⁨5⁩ ⁨months⁩ ago

  But if I reply on the phone will it populate the desktop chat and vice versa?

  source

  • JoeyJoeJoeJr@lemmy.ml ⁨5⁩ ⁨months⁩ ago

    Yes, as long as you set up the desktop client before sending the message.

    Messages sent with Signal are encrypted per device, not per user, so if your desktop client doesn’t exist when the message is sent, it is never encrypted and sent for that device.

    When you set up a new client, you will only see new messages.

    See signal.org/docs/specifications/sesame/ for details.

    source

    • Squizzy@lemmy.world ⁨5⁩ ⁨months⁩ ago

      Cool, could I recover a backup to te desktop to have access to the historical ones?

      source

      • JoeyJoeJoeJr@lemmy.ml ⁨5⁩ ⁨months⁩ ago

        From …signal.org/…/360007059752-Backup-and-Restore-Mes…:

        Signal Desktop does not support transferring message history to or from any device.

        source
  • Fetus@lemmy.world ⁨5⁩ ⁨months⁩ ago

    The chat continues on all linked devices from the point in time that they are linked.

    Imagine two people having a face-to-face conversation, then a third person walks up and joins in. The third person doesn’t know what was said before they joined the conversation, but all three continue the conversation from that point on.

    Linked devices are like the above example, if two of those people were married and tell each other every conversation they’ve had since their wedding.

    source

    • JoeyJoeJoeJr@lemmy.ml ⁨5⁩ ⁨months⁩ ago

      There is no sharing of messages between linked devices - that would break forward secrecy, which prevents a successful attacker from getting historical messages. See the first bullet of: support.signal.org/…/360007320551-Linked-Devices

      Messages are encrypted per device, not per user (signal.org/docs/specifications/sesame/), and forward secrecy is preserved (en.m.wikipedia.org/wiki/Forward_secrecy, for the concept in general, and signal.org/docs/specifications/doubleratchet/ for Signal’s specific approach).

      source

      • Natanael@slrpnk.net ⁨5⁩ ⁨months⁩ ago

        Message logs doesn’t break forward secrecy in a cryptographic sense, retaining original asymmetric decryption keys (or method to recreate them) does. Making history editable would help against that too.

        What Signal actually intends is to limit privacy leaks, it only allows history transfer when you transfer the entire account to another device and “deactivate” the account on the first one, so you can’t silently get access to all of somebody’s history

        source

        • -> View More Comments
    • eksb@programming.dev ⁨5⁩ ⁨months⁩ ago

      There is no reason why the message sync that works from phone to phone could not be implemented on the desktop client as well.

      source

      • sudneo@lemm.ee ⁨5⁩ ⁨months⁩ ago

        Does it work phone to phone? I was under the impression that a backup restore was needed if you wanted previous messages. It’s really an unnecessary security risk to have previous message sync. Someone gets your phone in their hand for 20 seconds, links your device and they get every message you have ever sent? No bueno.

        source

        • -> View More Comments
      • Azzu@lemm.ee ⁨5⁩ ⁨months⁩ ago

        Any new client doesn’t get old messages. Phone only allows the possibility of transferring a backup, which desktop doesn’t have.

        source
      • Fetus@lemmy.world ⁨5⁩ ⁨months⁩ ago

        I haven’t actually synced a new phone to Signal, does everything just carry over? I assumed you needed to transfer your account from phone to phone, not just link a new device.

        source
  • Fedibert@feddit.de ⁨5⁩ ⁨months⁩ ago

    Yes

    source