Signal is operated by a nonprofit tax-exempt charity corporation in the United States.
Could you please be more clear about exactly what you are saying here?
this post was submitted on 05 Jul 2023
-18 points (36.8% liked)
Technology
59201 readers
4009 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
Signal has a single point of failure. If we really want a service that can't be taken away, then we need a free, open source alternative that is impossible for a single entity to control
That single point of failure is to facilitate ease of use, with minimal reduction in security.
The messages are e2e encrypted and the server is designed in such a way that attempting to listen in would bring it down.
The signal org doesn't even have your address book.
If your concern is "I don't like signal", you're not going to make much traction.
Briar is an app that is just as easy to use, plus you dont need a phone number, so it is easier. Yet it has no point of failure and it was simpler to write. It is P2P, uses tor, you dont get better privacy and security than that.
You dont know what their server is running, you cant prove that. They can release the code, but you have to trust them that they are running that exact code.
Ease of use is an excuse, they have a centralized model. That is a big flaw. There is more to security then E2E, xmpp clients have E2E as well, they use the same algorithm.
I'm not goin to shit on Briar, I hope they build out their dream.
It's fundamentally not as easy to use.
My Grandma already has a phone with a full addressbook.
If she's told to install Signal, it'll just work as a drop in replacement for iMessage.
Briar meanwhile suggests sharing your contact info using another such as signal: https://briarproject.org/quick-start/#:~:text=When%20you%20choose%20%E2%80%9CAdd%20contact%20at%20a%20distance%E2%80%9D%2C%20Briar,choose%20a%20nickname%20for%20them.
Briar is chasing different goals.
load more comments
(5 replies)
SimpleX also seems pretty promising and is more cross platform than briar. I'm self-hosting a server for my immediate family.
load more comments
(2 replies)
I'm not OP, I'm just explaining.
Okay. Which one are you building?
I'm not, I'm just explaining OP's post.
We have that in XMPP and Matrix. The problem is then to talk to people on it they all have to join the server on which you host your build. What if that server goes down? If you pay for hosting you're putting it into the hands of another corporation. If you self-host at home, what if your electricity goes out? Your internet gets cut off? Is everyone you convinced to ditch signal going to be happy and willing to sacrifice their convenience and ability to talk to people they want (or need) to talk to over ideology?
If we get hit by a big enough solar flare, everyone will be communicating by pigeon again. You make valid points. I haven't actually used XMPP before and only just started with Matrix. I think OP is right that we should keep an eye on alternatives for when/if the time comes.
load more comments
(7 replies)
Signal doesn't store your contacts or messages; it's end to end encryption. What are you suggesting they'll "sell out" if offered enough money?
load more comments
(9 replies)
Signal was the first app of its kind that I actually found "real" people using it. Most other protocols its coworkers wanting to try out a new app or service. But signal i found a big chunk of my address book already had accounts. Sadly i doubt I'll ever find an app like this with so much non-techie acceptance.
load more comments
(7 replies)
I get your point that having anything related to privacy or security under the control of one organization is not ideal. However, risk will always exist and trusting Signal, at this point, seems like a good risk to take. Particularly since there are no practical alternatives right now.
Also, not all organizations are bad or will turn bad eventually. We all have to trust a lot of people for all kinds of purposes. Civilization is built on it. They key is making good decisions about who those people will be.
load more comments
(1 replies)
You and everyone else in the fediverse needs to stop with this fanaticism that anything centralized is automatically a bad thing.
You don't understand how FOSS works. If signal "sells out" we just take a fork of the repo before the sell out and continue building the private app we love. Also signal uses no central server for your content. It's device to device, if they sold out right now all they would have is a list of users, but no conversations.
load more comments
(1 replies)
You can use Molly. I think its a fork of signal and used by many. Its on Droidify , not sure which repo.
load more comments
(1 replies)
From what I've seen of the people in charge of Signal- they'd probably close before they sell out.
That said, you make a very good point. Having all the registered users in one place, is a vulnerability. A great many of us have non technical friends/partners/siblings/coworkers/etc; and encouraging them to use ANYTHING new is pulling teeth. So Signal is great, but it's still eggs in one basket- if they do something user-unfriendly or sell out or close, we are back to square one in begging/pleading/cajoling people to (please) try this (much better) app.
I've also lost a few people who used Signal over one stupid problem- the iOS version has no backup/restore function. If you lose your phone, or uninstall the app, all your saved chats are gone and there's no way to get them back. Android version at least has a useful backup/restore.
Exactly my point is that if it closes we will have to push for new apps anyway and it is better to do it now, before more users potentially use SIgnal and are left without their app.
Personally I don't think it's likely that signal will close, or that they will sell out. I think the more likely problem is the sort of thing I mentioned, that having a single dev team will be a bottleneck or will reduce user choice. The iOS backup thing I mentioned is one example of that. Usernames rather than phone numbers is another one. Having only one code base does make it easier to audit. And having one foundation in charge does mean there's an easy path to pay for those audits. But it is still a single point of failure.
To be clear- as single point of failure go, I trust Signal more than the next 10 put together. What I don't trust is the whole using phone numbers and SMS verification for sign up. And I would prefer their architecture was a bit more open/federated.
I disagree. There are many FOSS decentralized projects that are still running today, including XMPP, that are doing fine and make even better and more secure software than Signal. All centralized privacy apps so far closed or started sharing data with governments. Statistically that is far more likely scenario then a popular FOSS app to lack devs.
I agree that there's plenty of FOSS projects as good as or better than Signal from a crypto POV.
NONE of them are anywhere close to signal when it comes to number of users. And if your friends don't have it, then you can't talk to anyone on it.
And if your friend loses their phone and finds out they just lost all their chats too, they're gonna say 'fuck that, I'll just use iMessage so next time I don't lose anything'.
Why would you trust Signal more than XMPP that uses same encryption? I think people are just afraid of things they haven't heard of, even if they have been there for longer and have a better reputation. This is why marketing is the biggest business in the world, google and facebooks only revenue is selling ad space and they are richest companies in the world. Fight that marketing, learn a bit about XMPP and you will see it is far better than Signal.
I tried hard to push XMPP back in its day. Little success sadly, that was when IM was going out of style in favor of SMS. I kept using Trillian and watching as more and more contacts went offline never to return. Then Google announced they were killing their XMPP gateway and that was a nail in the coffin.
The bigger problem with XMPP was varying support of various XEPs leading to an uneven user experience with mismatched clients. That in itself was fixable, and not a problem for people like us, but it became a problem when trying to get 'normies' interested. Tell someone like us 'you can't video chat that guy, his client doesn't have calling capability' and that makes perfect sense. Tell an average person that, and they hear 'this system sucks and I can't count on it to do what I want, I should stop using it'. Then they go on Discord or iMessage or whatever, and it works right the first time every time, and they stay.
And therein lies the real problem. You and I can wax poetic about the pros and cons of this or that system and its security, but if I can't get my non-cryptohead friends to use it, then it's worthless.
And THAT is why Signal succeeded and XMPP failed. Because it's dead fucking simple to set up. Download the app, punch in the SMS security code, and you're online. Questions like 'choose which client software you want' or 'pick which instance you want to sign up with' kill adoption for average non-techie people. They say 'I don't know what to choose, I don't want to choose wrong and cause a bigger problem, so I'll just not choose and close this'.
Doesn’t XMPP collect hella metadata unlike Signal?
There is no one to "collect" this data. You do have to trust the servers that others are on, since its federated, which is the issue with all services.
I think that’s where I’m icky about it. I don’t know that I trust other servers more than I trust Signal. Which, I mean, is not great to say given that in a perfect world I would rather not rely on one organization to keep my “data” private - but hey.
I don’t mind so much on Lemmy or Mastodon because I’m not looking for privacy but if encryption is the main selling point of something, a random XMPP instance doesn’t really inspire confidence at the moment. But hey maybe that’ll change in the future and XMPP will require less metadata to work.
You can pick servers run by groups that have just as good record of privacy or even better or are run by the person you know or yourself.
When you have a decentralized service you can choose who you trust, you are not stuck with one corporation. Picking a completely random server is the worst possible example you could have chosen.
XMPP is decentralized, you can run your own server. In open decentralized protocols, such issues are resolved by design. Further more most XMPP servers don't require a phone number, why would they, unlike Signal.
I don't really get the complaint here. There is no perfect solution with regards to privacy.
Either you have some centralization to help facilitate its ease-of-use for customers, or it becomes more difficult to setup and use. Much like the rest of life, there are trade-offs.
Are you suggesting any alternatives? Most of the ones I have tried are either too technical or too much effort for everyone I know so I have nobody to talk to outside of signal and plain sms
load more comments
(1 replies)
view more: next ›