What's the deal with Signal?

Comments

• salarua@sopuli.xyz ⁨1⁩ ⁨day⁩ ago

  Different people don’t like it for different reasons. Some people don’t like it because they think it has CIA financial backing (nope), and some people don’t like it because it requires your phone number, therefore it is not private (the privacy it provides is more than sufficient for anyone not actively being persecuted by a Five Eyes state), and some people don’t like it because it feels corporate (it’s a 501c3 nonprofit, and how corporate it feels is subjective).

  source

  • AtHeartEngineer@lemmy.world ⁨4⁩ ⁨hours⁩ ago

    Accurate. And if you are being targeted by 5 eyes, your phone is probably fucked, one app vs another probably won’t make a difference

    source
  • adespoton@lemmy.ca ⁨1⁩ ⁨day⁩ ago

    And some people don’t like it because it used to handle SMS on Android, and they removed that feature for security reasons.

    source

    • bg10k@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago

      That was a pretty wild decision

      source

      • -> View More Comments
    • guy@piefed.social ⁨20⁩ ⁨hours⁩ ago

      This was such a dumb decision

      source
    • IDKWhatUsernametoPutHereLolol@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago

      This might be offtopic but:

      Fun Fact, you can use an open source app like Secure Space Encryptor (SSE) (on iOS its called “Paranoia Text Encryption”) to send an encrypted ciphertext over any medium, like SMS, without the internet. (Most encrypted messaging apps require you have to have internet AFIAK, so people without a data plan is fucked, but with SSE, you can just send ciphertext over SMS) Its not intergrated with SMS, so you’ll have to type plaintext in the app then copy paste the ciphertext it spits out.

      Or you can also PGP over SMS

      I remember when Signal used to intergrate with SMS, and I kinda liked that more than the Signal today where you have to use the internet and go through their servers.

      source

      • -> View More Comments
  • felixwhynot@lemmy.world ⁨1⁩ ⁨day⁩ ago

    Some people don’t like that they attached a crypto wallet to the app. I couldn’t care less and use the messenger daily!

    source

    • guy@piefed.social ⁨20⁩ ⁨hours⁩ ago

      I don't care or use it either, but I haven't seen a single use case for that wallet nor mobilecoins. Does people actually use it and for what?

      source

      • -> View More Comments
  • wildbus8979@sh.itjust.works ⁨1⁩ ⁨day⁩ ago

    I don’t think I’ve ever seen people say it has CIA financial backing. It did however until only a couple of years ago have strong ties to the State Department Open Tech Fund (from the same financial envelope that brings you RFA/RFE/VOA).

    source

    • SnotFlickerman@lemmy.blahaj.zone ⁨1⁩ ⁨day⁩ ago

      The main developer of Lemmy seems to think there’s a solid connection. I’m not jumping in that fight, I got no dog in that fight, I don’t have that kind of threat model.

      dessalines.github.io/essays/why_not_signal.html#c…

      However, considering he’s openly Marxist, he may be just slightly biased.

      I suspect OP of this post actually saw the recent /c/Privacy thread over at lemmy.ml where Dessalines was proselytizing against Signal while not seeming to have a problem with SimpleX chat being funded by a group of Venture Capital investors, including Jack Dorsey.

      source

      • -> View More Comments
  • lapping6596@lemmy.world ⁨1⁩ ⁨day⁩ ago

    I understand why, but I get annoyed that I can’t integrate it into ferdium with my other things like discord, e-mail and calendar.

    source
• WolfLink@sh.itjust.works ⁨1⁩ ⁨day⁩ ago

  Signal is an open-source privacy-focused end-to-end encrypted texting platform (so competing with SMS, WhatsApp, iMessage, Telegram, and similar). It’s developed by a donation-funded non-profit organization.

  Signal is quite good compared to the competition, but it faces a lot of scrutiny because they make big promises about privacy and security so the people who care will really get into the details on that. Also IIRC there was a period when one of their competitors was trying to slander them more or less.

  In general there’s nothing wrong with Signal and it’s quite a good option. If you really care about the privacy details you can always host your own instance (but that would require you to convince your friends to use your instance … it’s not federated).

  source
• zergtoshi@lemmy.world ⁨1⁩ ⁨day⁩ ago

  The deal is that they run their program in a very transparent and wherever possible verifiable way.
  More details here: lemmy.world/comment/14775870

  source
• muntedcrocodile@lemm.ee ⁨1⁩ ⁨day⁩ ago

  Hey signal is better than most of the mainstream bs. I use it myself and I’m confident that the messages themselves are secure. However, it had issues.

  Since we cannot verify the software they run on the server is the software that is open source then we must assume it is not.

  We know for a majority of cases a phone number = a real identity. Signal implements sealed sender but since signal is a centralised point they can correlate the sealed sender extraordinarily easily. We must therefore assume signal knows when and who is communicating (We can verify they don’t know what is being said) this therefore means signal could theoretically have a full social graph of real identities for every singe user.

  This is of course after we remember signal received funding from BBG which is an organisation funded by the us government purely for the purpose of promoting american propaganda.

  Also I believe they used to have federation but all evidence of this seems to have been wiped from the internet.

  Signal can either adapt and prove themselves with more than a “trust me bro” or they can die. Just cos they are better than the alternatives does not mean we should not demand better.

  source

  • zergtoshi@lemmy.world ⁨1⁩ ⁨day⁩ ago

    If they encrypt meta data like they say they do (signal.org/blog/signal-is-expensive/), it should be very hard to use meta data the way you explained.
    Whether they do can be looked up here (github.com/signalapp) by those who know what to look for.
    As Signal uses reproducible builds (signal.org/blog/reproducible-android/), itcan be verified that the builds are made from the public source code.
    They make offering a secure and trustable app a lot better (by being verifyable) than other messengers.

    source

    • muntedcrocodile@lemm.ee ⁨1⁩ ⁨day⁩ ago

      The point is we cannot trust they run the software they claim to run. Identifying a sender despite sealed sender is trivial if u have a centralised server.

      Say I am the signal server and all the clients run the known/provable secure clients that are used. I as the signal server an subject to wiretap and gag orders so I can be obligated to run software that is not the published server software and into tell anyone. As a server I by definition have everyone’s IP address. A message with signal protocol has a sealed sender and a known identity recipient. As the signal server I can see when u send a message and from what IP and to which identity and what ip that identity is. I can then simply associate IPs and identities.

      I trust the app I cannot trust the server. A reproducible build does not prove anything about the server it only proves the client.

      source

      • -> View More Comments
  • einkorn@feddit.org ⁨1⁩ ⁨day⁩ ago

    Also I believe they used to have federation but all evidence of this seems to have been wiped from the internet.

    They never had.

    The talk about federation originated when the EU demanded interoperability from gatekeeper software i.e. Whatsapp. Signal said on day one they wouldn’t do from their end because it would mean lowering security.

    source

    • racc@lemm.ee ⁨1⁩ ⁨day⁩ ago

      There was LibreSiganal once but it got shut down by Signal. It’s quite old. This was like 10 years ago.

      source
    • muntedcrocodile@lemm.ee ⁨1⁩ ⁨day⁩ ago

      I mean long before that with one of the 3rd party apps they used to federate their own server with signal iirc.

      source

      • -> View More Comments
• BlastboomStrice@mander.xyz ⁨18⁩ ⁨hours⁩ ago

  This is a good comparison of messengers here:

  eylenburg.github.io/im_comparison.htm

  source
• False@lemmy.world ⁨1⁩ ⁨day⁩ ago

  It’s mostly minor shit, it’s better than the alternatives unless you self-host (which has a boatload of other issues).

  source
• Hawke@lemmy.world ⁨1⁩ ⁨day⁩ ago

  The thing is I have yet to see any reasonable alternatives.

  Threema is the closest but it’s not free-of-charge, so a non-starter for most of my friends.

  The others are controlled by Russia (telegram) or Meta. What else even is viable?

  source

  • baltakatei@sopuli.xyz ⁨1⁩ ⁨day⁩ ago

    Session, an Australian fork of Signal with onion routing, seems promising.

    source

    • evujumenuk@lemmy.world ⁨22⁩ ⁨hours⁩ ago

      Session disables forward secrecy for no reason.

      Personally, I assume it’s a honeypot.

      source

      • -> View More Comments
    • felixwhynot@lemmy.world ⁨1⁩ ⁨day⁩ ago

      This also disables notification text which is a good choice IMHO as those can be provided by Apple/Google to law enforcement

      Didn’t know it was a Signal fork, interesting

      source
  • jeena@piefed.jeena.net ⁨1⁩ ⁨day⁩ ago

    I'm trying to move my family to Matrix with a self hosted server. It's not easy though because of bugs in it.

    source
• corsicanguppy@lemmy.ca ⁨1⁩ ⁨day⁩ ago

  • it wants my phone number
  • it’s not GETTING my phone number
  • it no longer exists as an option

  source
• jupiter2643@lemmy.ml ⁨1⁩ ⁨day⁩ ago

  How does simplex compare?

  source