Improving first impressions on Signal(signal.org)
signal.org
Improving first impressions on Signal
https://signal.org/blog/keeping-spam-off-signal/
99 comments
Just got a new phone and migrating Signal was a total disaster. The first thing I did was login to the new phone which is apparently the wrong thing to do because you lose all your old messages and there's no option to import after you login. You have to logout but there is no logout. Gotta uninstall and reinstall, or clear app data. Next I tried the account migration feature which requires using both phones simultaneously, hope you didn't erase your old phone yet. But it doesn't work anyway, it's just broken. So after failing at that several times, then I had to manually make a backup on the old phone, write down a 20 digit numeric code that's only displayed once on screen, transfer the backup file manually, type the code on the new phone, and then it logged me in but silently failed to import the backup. Had to uninstall again and did the exact same steps again and then it finally worked. What a travesty. Security shouldn't come with this kind of UX disaster.
I do think it's too easy to do it the Wrong Way, but I've easily migrated from phone to phone several times now with both techniques and think they alright.
Signal presents both a "create account" or a "migrate account" option on a fresh install, which seems like the best compromise for UX flow.
Also, considering their guarantee is to keep your messages secure, of course you need your old phone. If you wipe your phone that securely contains all your old messages they are gone. That is security.
That said, if you have the backup of your messages and the code, then the developers might be able to debug what caused the migrations to fail if you submit a bug.
Signal presents both a "create account" or a "migrate account" option on a fresh install, which seems like the best compromise for UX flow.
Also, considering their guarantee is to keep your messages secure, of course you need your old phone. If you wipe your phone that securely contains all your old messages they are gone. That is security.
That said, if you have the backup of your messages and the code, then the developers might be able to debug what caused the migrations to fail if you submit a bug.
Recently got a new phone and the transition was super smooth. Tried to open Signal on the new phone, it somehow knew that I needed to transfer my backup, asked me to scan a QR code and keep the phones close together, a minute or so later, and done. Signal logged me out on the older device when it was finished.
I've learned this lesson before though. Always keep your old phone around while transitioning to a new device in case you need to pull anything off of it.
I've learned this lesson before though. Always keep your old phone around while transitioning to a new device in case you need to pull anything off of it.
Much like not quitting a job without having new employment lined up, it's a good idea to get a new phone or pc while your current device is still in good enough condition that migration is easy. If you ride it to failure things get messy.
... you never had a phone break down ? Now 8'm stressed about what will happen to my signal messages when my current phone inevitably suffers from a dreadful fate
I just want to add that you cannot migrate across ios and android, at all :( https://support.signal.org/hc/en-us/articles/360007059752-Ba...
This bit me when moving to iOS. Thankfully I didn't use Signal all that much, but I did "sign" some far away friends keys before so that was disappointing...
I recently moved phones and had the opposite experience. The Signal migration went very smoothly. Moving WhatsApp did not. I ended up managing to do it but not before about five attempts, each of which made me reauth my phone number and I hit rate limiting, etc.
Yeah, this is the #1 issue that holds me back from recommending Signal to everyone in my network. It seems like there are just too many ways to end up in an unrecoverable state. Phone died, lost, or stolen? Can't migrate. Phone number changed? Can't restore backup. And so on. Sure would be nice if there was at least a standalone viewer app which would let you view backups even if you can't restore them.
It's almost like keeping the messages secure is more important than persistence for the creators, and main stakeholders.
It's exactly like that. Which isn't necessarily a bad thing. But handling use cases like reading your own safely encrypted past messages after your phone number changes seems pretty reasonable to me.
Sounds like you were migrating from one Android phone to another. Try the same with iOS and you wouldn't even have any backup option to try out. The loss of older messages is the worst thing that a chat app could have, but it's still marketed as a general purpose chat app.
Sounds like you footgunned yourself. When starting Signal for the first time it gives the option to register OR migrate old account. There's no UI in the world that can totally protect users from themselves.
That's only one part of the struggle that was mentioned. Even when using the migration feature, the comment reported it not working, and needing to manually transfer the backup file.
Try Telegram.
It's easier to get seduced by tall sounding words like "cryptography", censorship, "security", anonymity etc. Those are just buzz words.
Try something that works seamlessly across platforms.
It's easier to get seduced by tall sounding words like "cryptography", censorship, "security", anonymity etc. Those are just buzz words.
Try something that works seamlessly across platforms.
This is nonsense, and borderline malicious.
Privacy used to be the default mode for human existence. You had to go out of your way to attract enough interest, positive or negative, to have that privacy curtailed, even in minor ways.
In the information age, privacy is liberty. Unless you take specific action to prevent it, all of your information is surveilled.
Encryption allows you to protect the content of your communications from intrusion. Ephemerality removes the traces of your communications to prevent future intrusion. Those two features reset human communication to the state of nature, allowing people the room to think and communicate difficult things in a context of trust.
When people are monitored, they limit themselves to thoughts and discussions that are socially acceptable. This leads to groupthink, siloing people within a collectively imagined social ideal which is readily shaped by the ones doing the surveillance. The outrage mobs, public ridicule, and notorious cancelations are communicated far and wide, and the narratives conveyed about the context of those moralistic social displays are the levers of power being moved to influence social momentum. Marketing, politics, religion, social movements, and all manner of ideologies use the violation of privacy to amplify their reach and influence without the benefit of rational discussion and tests of validity that would have prevented such memes from gaining traction in the past.
Authoritarianism seeks the destruction of privacy. Whether it's a dictatorship, a cult, an invasive workplace, or platform, they degrade privacy as much as they can in order to exploit the resulting loss of individual liberty and agency.
So no, censorship is real. Cryptography is a tool that sets people in their proper place as sovereign human beings. Privacy, security, and anonymity give people the ability to speak on equal footing with any group or organization or fellow human.
By using apps and platforms and services that don't respect privacy, you're willingly accepting a second class status, ceding your right to express ideas that don't conform.
Buzz words my ass.
Privacy used to be the default mode for human existence. You had to go out of your way to attract enough interest, positive or negative, to have that privacy curtailed, even in minor ways.
In the information age, privacy is liberty. Unless you take specific action to prevent it, all of your information is surveilled.
Encryption allows you to protect the content of your communications from intrusion. Ephemerality removes the traces of your communications to prevent future intrusion. Those two features reset human communication to the state of nature, allowing people the room to think and communicate difficult things in a context of trust.
When people are monitored, they limit themselves to thoughts and discussions that are socially acceptable. This leads to groupthink, siloing people within a collectively imagined social ideal which is readily shaped by the ones doing the surveillance. The outrage mobs, public ridicule, and notorious cancelations are communicated far and wide, and the narratives conveyed about the context of those moralistic social displays are the levers of power being moved to influence social momentum. Marketing, politics, religion, social movements, and all manner of ideologies use the violation of privacy to amplify their reach and influence without the benefit of rational discussion and tests of validity that would have prevented such memes from gaining traction in the past.
Authoritarianism seeks the destruction of privacy. Whether it's a dictatorship, a cult, an invasive workplace, or platform, they degrade privacy as much as they can in order to exploit the resulting loss of individual liberty and agency.
So no, censorship is real. Cryptography is a tool that sets people in their proper place as sovereign human beings. Privacy, security, and anonymity give people the ability to speak on equal footing with any group or organization or fellow human.
By using apps and platforms and services that don't respect privacy, you're willingly accepting a second class status, ceding your right to express ideas that don't conform.
Buzz words my ass.
They're just buzzwords if you don't understand what they mean. Or don't want to.
End-to-end encryption is not just some buzz word, and Telegram requires you to opt-in to encryption, making it absurdly insecure by default.
And there is no E2EE on desktop. People should really stop talking about Telegram when we are talking about secure private messaging apps. Telegram DOES NOT HAVE E2EE on desktop and it is opt-in on phones.
Briar is the best choice on phones, and it is also available on desktop which is under development. For now, Ricochet is the best choice on desktop (only). I get that it would be nice to have a piece of software working on both desktop and phone, but still. For that I just use Element.
Briar is the best choice on phones, and it is also available on desktop which is under development. For now, Ricochet is the best choice on desktop (only). I get that it would be nice to have a piece of software working on both desktop and phone, but still. For that I just use Element.
I see an option of secret chat in my desktop app. Is that not E2EE? Because its the same option in mobile
Edit: I’m out of date for most of this. Way to go Signal team! See comments below my complainy post.
Forcing me to recite my PIN every few weeks is one of the most irritating UX I’ve seen.
I’m sure there’s some smart engineer explanation in terms of cryptography and being unable to recover it if lost. But just let me disable it if I’m okay losing my entire account if I forget it.
Also last time I checked the binding of a phone number to Signal was really bad. I had a friend abandon Signal and I could never sms them ever again.
Forcing me to recite my PIN every few weeks is one of the most irritating UX I’ve seen.
I’m sure there’s some smart engineer explanation in terms of cryptography and being unable to recover it if lost. But just let me disable it if I’m okay losing my entire account if I forget it.
Also last time I checked the binding of a phone number to Signal was really bad. I had a friend abandon Signal and I could never sms them ever again.
Huh? You can disable the PIN reminder in the settings if you want to. Or is that not available everywhere? It's working for me on Android and Windows.
I've disabled it as I store my PIN in my password manager.
I've disabled it as I store my PIN in my password manager.
Either that’s new or I’m just a loud bozo. Thanks for sharing!
You're definitely not a bozo. These defaults are the sort of things that need to be polished.
A simple one page screen on first install that asks a few questions would be a nice:
1. "Would you like to be nagged for your pin every few days?" - Yes/No
2. Are you moving from another device and would you like to restore from a backup? - Yes/No
etc...
A simple one page screen on first install that asks a few questions would be a nice:
1. "Would you like to be nagged for your pin every few days?" - Yes/No
2. Are you moving from another device and would you like to restore from a backup? - Yes/No
etc...
I've been using the feature for a couple months, but I haven't been using signal for much longer so I'm not sure.
Before I thought of looking in the settings to disable the pin checks they really annoyed me too :)
It's new, I felt the same way for a long time.
Your last paragraph provides an insight I hadn't had; that is a serious problem. I personally appreciate the PIN repetition, as it encouraged me to use a code I had not used before, since I knew If be reminded to practice it now and then.
To send an SMS to a signal contact, press and hold the send button then from the popup select `Insecure SMS`.
Cool!
Is there a way to say “always use SMS because this signal contact isn’t on signal anymore”
Is there a way to say “always use SMS because this signal contact isn’t on signal anymore”
When you stop using signal, you can log in to the signal website and say "I'm no longer using Signal"; that will solve the problem with your Signal-using contacts. I just checked and it looks life you have to deregister your account from within the Signal app (ie, can't uninstall first). I'm pretty sure it used to be more lenient: I remember friends being able to deregister their numbers after the fact.
Are you sure you don't mean iMessage or something else?
As far as I know, Signal offers no such option on their website.
As far as I know, Signal offers no such option on their website.
It looks to me like it's a per contact switch, so I think that's what you want, yea :)
Signal's message requests is a major selling point for me.
I recently created a Signal account after having a bad experience in which someone used my phone number to harass me with SMS/calls (every time, from a different VOIP number). It's frustrating that, even in this era, there is no good way to filter out malicious actors from SMS/call.
P.S. You can sign up with Signal via a VOIP number to avoid sharing your real phone number. See: https://theintercept.com/2017/09/28/signal-tutorial-second-p...
I recently created a Signal account after having a bad experience in which someone used my phone number to harass me with SMS/calls (every time, from a different VOIP number). It's frustrating that, even in this era, there is no good way to filter out malicious actors from SMS/call.
P.S. You can sign up with Signal via a VOIP number to avoid sharing your real phone number. See: https://theintercept.com/2017/09/28/signal-tutorial-second-p...
Yes, I do this. I really wish they and everyone else would stop using phone number as an ID and use an alphanumeric ID.
Really, I don't want to give out a phone number to everyone.
Really, I don't want to give out a phone number to everyone.
Exactly. How hard can it be? It would make it way more secure for almost no effort. I would use Signal if it did not require a phone number or an e-mail address (whichever it requires).
I'm okay with it requiring an e-mail address, that's easier to be universally accessible, as long as your e-mail provider is sane and doesn't require SMS confirmation to login.
Phone numbers, for most people, only work within a certain part of the world and aren't easily accessible worldwide.
Phone numbers, for most people, only work within a certain part of the world and aren't easily accessible worldwide.
The reason I am not okay with it is that it is usually tied to your person in one way or another. Have you tried getting an e-mail while using Tor? Next to impossible. Plus, it is unnecessary really. You can use nicknames or say, a generated UUID of some sort, with perhaps a QR code for easy copying.
crating a new yandex email account works nicely via tor for me
I will check. I would say that it works... for now. :P It is not something we should rely on, I think.
It's complicated and can be expensive. Also people that has you real phone number cannot contact you on Signal, so you have to have two accounts, one with your real number to chat with your contacts and another one with the fake one to share with strangers that you don't trust, and as far as I know the Signal app doesn't support two account (yes on Android there are ways to have two instances of the app, on iOS you can't).
To me Telegram is superior to Signal because it gives you both options, use your phone numbers with people that already have you in the contacts, and don't share your number with strangers in a group.
To me Telegram is superior to Signal because it gives you both options, use your phone numbers with people that already have you in the contacts, and don't share your number with strangers in a group.
Completely agree. Telegram is far superior to any other platform out there. Balance of privacy and security, by default.
How can you say that when Telegram's end-to-end encryption is disabled by default, and you need to go out of your way to create a secret chat? Their default is the opposite of secure.
And again, there is no E2EE on desktop. Telegram looks nice, and it ends there.
I guess no security and no privacy does technically constitute balance.
More seriously, it does compromise security for usability, which can be ok in some cases – as long as you don‘t make bold claims stating the exact opposite. Telegram has done just that.
More seriously, it does compromise security for usability, which can be ok in some cases – as long as you don‘t make bold claims stating the exact opposite. Telegram has done just that.
Briar is far superior. Yes, there is support for desktop as well, but it is under heavy development.
For phones: Briar
For desktop: Ricochet
Yes, I get it, Ricochet lacks a lot of goodies Telegram has, but having stickers != secure. For secure chatting only, Ricochet does the job. No one will even know that you are using it. :)
For phones: Briar
For desktop: Ricochet
Yes, I get it, Ricochet lacks a lot of goodies Telegram has, but having stickers != secure. For secure chatting only, Ricochet does the job. No one will even know that you are using it. :)
> No one will even know that you are using it. :)
Apart from all the red flags you're raising by using tor though..
The problem with tor is that it's associated with a lot of malicious stuff. The same way that IRC was for a while. Using it on a VPS for example was forbidden at many providers. Though since the rise of Freenode (and its fall and re-emergence as Libera) it has re-established itself as a platform for serious communication.
Though this kind of legitimate use is exactly what Tor needs to get out of the "dark" corner in many people's eyes, I do think it's there at the moment.
Apart from all the red flags you're raising by using tor though..
The problem with tor is that it's associated with a lot of malicious stuff. The same way that IRC was for a while. Using it on a VPS for example was forbidden at many providers. Though since the rise of Freenode (and its fall and re-emergence as Libera) it has re-established itself as a platform for serious communication.
Though this kind of legitimate use is exactly what Tor needs to get out of the "dark" corner in many people's eyes, I do think it's there at the moment.
IRC has always been for serious communication to me at least and the people I knew... ever since I was 9. I am surprised it was associated with malicious stuff.
I have no idea why Tor is associated with malicious stuff. I mean sure, I do know, but people are people. Cash is associated with malicious stuff, too, or can be, because people buy all sorts of illegal stuff off the streets with cash. People are just being people, they always find a way. I hate it when things are ruined because of people who may do malicious stuff. Tor represents freedom to me. There has been anonymous chatting websites anyway, and it has nothing to do with malicious stuff. Or well, it may have, similarly to say, Omegle. If we banned everything that is associated with malicious stuff, we would have literally nothing, we would have no Internet, we would have no cash, we would not have anything for real. In any case, I hate this kind of thinking, that is for sure. :/
> Apart from all the red flags you're raising by using tor though..
Yep, I wish this was not the case. I am on IRC to which I connect using Tor. Now, both IRC and Tor is (or was) associated with malicious stuff! Imagine being on a shit list for this. :D I do it for my own privacy and security, but the reason is not that I am doing anything malicious. Sometimes I even use OTR on IRC just because I do not want the server to possibly know what I am talking about (no clue about the protocol right now, so I am not sure if they can actually read it, but I do not think it's P2P).
So yeah, people should stop with the false assumptions and silly heuristics. I mean, come on, I bought coffee and groceries with Bitcoin before, and many people bought illegal stuff with cash. Thus, I will never understand the argument against Bitcoin related to "Bitcoin is used for illegal stuff" bullshit. Both Bitcoin and cash has been used to buy illegal stuff, so what?! People are being people, stop blaming the technology that has benefits to many people who are not doing illegal stuff.
I have no idea why Tor is associated with malicious stuff. I mean sure, I do know, but people are people. Cash is associated with malicious stuff, too, or can be, because people buy all sorts of illegal stuff off the streets with cash. People are just being people, they always find a way. I hate it when things are ruined because of people who may do malicious stuff. Tor represents freedom to me. There has been anonymous chatting websites anyway, and it has nothing to do with malicious stuff. Or well, it may have, similarly to say, Omegle. If we banned everything that is associated with malicious stuff, we would have literally nothing, we would have no Internet, we would have no cash, we would not have anything for real. In any case, I hate this kind of thinking, that is for sure. :/
> Apart from all the red flags you're raising by using tor though..
Yep, I wish this was not the case. I am on IRC to which I connect using Tor. Now, both IRC and Tor is (or was) associated with malicious stuff! Imagine being on a shit list for this. :D I do it for my own privacy and security, but the reason is not that I am doing anything malicious. Sometimes I even use OTR on IRC just because I do not want the server to possibly know what I am talking about (no clue about the protocol right now, so I am not sure if they can actually read it, but I do not think it's P2P).
So yeah, people should stop with the false assumptions and silly heuristics. I mean, come on, I bought coffee and groceries with Bitcoin before, and many people bought illegal stuff with cash. Thus, I will never understand the argument against Bitcoin related to "Bitcoin is used for illegal stuff" bullshit. Both Bitcoin and cash has been used to buy illegal stuff, so what?! People are being people, stop blaming the technology that has benefits to many people who are not doing illegal stuff.
On Telegram if anyone else has your phone number in their contacts then they’d know it’s you even if you initiated the communication via username. Or that’s how it was. I am not sure if this has changed/been fixed.
This doesn't necessarily have to be the case. A couple of years ago when the large scale protests were going on in Hong Kong, authorities found people who were using Telegram, Signal, etc., by adding all phone numbers to their devices' address book/contacts list. Telegram quickly adapted and brought a new setting wherein others would only get to know you were on Telegram only if you had them in your contacts list. Telegram has been, and is, far superior in hiding your presence to others than Signal is.
Only by default, you can opt out this behaviour. But I don't see a problem with it, if someone already has my number he doesn't get much more information (beside the fact that I may want to have a "secret" Telegram account. But in that case you can register it with another phone number).
I've not had this problem with iMessage really. Are you SURE its not possible to block out bad actors on messaging?
Apple keeps detailed metadata records of who sends messages to whom on iMessage, when, and how often.
Signal does not.
Apple backs up iMessage plaintext contents to Apple, via non-e2e iCloud Backup, bypassing iMessage's end to end encryption.
Signal does not.
Signal does not.
Apple backs up iMessage plaintext contents to Apple, via non-e2e iCloud Backup, bypassing iMessage's end to end encryption.
Signal does not.
My point is whatever approach apple is taking, I'm not getting a lot of spam on iMessage, and the one time I did it was pretty easy to mark as spam if I remember.
iMesssage allows you to filter out bad actors -- but raw SMS (green text message) does not. I was getting a few SMS messages a day, each from a different phone number, likely with a service like TextNow.com
Is it strictly-true that anti-spam algorithms must be hidden to be effective?
It would seem that initially, spammers would have the upper hand, but in the long run, coordinated and open effort against spammers has the potential to pay off.
Furthermore, to have a closed algorithm that cuts off the ability for people to communicate opens the door to institutionalized censorship -- designating a political opponent's communication as spam could limit their ability to be heard.
It would seem that initially, spammers would have the upper hand, but in the long run, coordinated and open effort against spammers has the potential to pay off.
Furthermore, to have a closed algorithm that cuts off the ability for people to communicate opens the door to institutionalized censorship -- designating a political opponent's communication as spam could limit their ability to be heard.
I've fought spam in other contexts and found that to be true. A change stopped spam until spammers learned what the change was, which made them adapt. The adaption might not be perfect, but it would happen, so prolonging the blocked period was essential. If one can do something that's effective and that the spammers don't understand for months, that's great. If they can spam for days and then blocked for a longer period and that repeats, they'll go away and attack an easier target instead (well, some of them will look back later).
Let me try an argument other than "it's been my experience", though.
Suppose that it's not true. In that case, the anti-spam filter provides a publicly visible definition of spam in its code, and it's one that isn't grounded in the recipients' opinions. If the filter is to be effective, spammers must not be able to adapt their behaviour in a way that users consider spam but isn't according to the definition. Many people have tried to provide such a definition since 1995 and AIUI all have failed. I think the persisten failure indicates that it's extremely unlikely that one can be found, and therefore it's extremely unlikely that a publicly visible spam filter can be as effective as one that can be updated in secret.
Let me try an argument other than "it's been my experience", though.
Suppose that it's not true. In that case, the anti-spam filter provides a publicly visible definition of spam in its code, and it's one that isn't grounded in the recipients' opinions. If the filter is to be effective, spammers must not be able to adapt their behaviour in a way that users consider spam but isn't according to the definition. Many people have tried to provide such a definition since 1995 and AIUI all have failed. I think the persisten failure indicates that it's extremely unlikely that one can be found, and therefore it's extremely unlikely that a publicly visible spam filter can be as effective as one that can be updated in secret.
Do you think an eventually open style spam filter could work? One where the implemntation is released say 2 years after it was first written (including modifications)
I don't see what "work" means in that case.
The delayed release is supposed to achieve something, which it can succeed at, or not. I don't see what that is. The delayed release may also have an impact on the the software's and database's function as a spam filter. I don't have a good intuition for that impact either. Sorry.
The delayed release is supposed to achieve something, which it can succeed at, or not. I don't see what that is. The delayed release may also have an impact on the the software's and database's function as a spam filter. I don't have a good intuition for that impact either. Sorry.
> Is it strictly-true that anti-spam algorithms must be hidden to be effective?
Can't answer that but there were, for a long time, services that would run your "targeted emails" through spamassassin et al for you and give you advice on how to tweak them to lower the resultant score.
Can't answer that but there were, for a long time, services that would run your "targeted emails" through spamassassin et al for you and give you advice on how to tweak them to lower the resultant score.
> Is it strictly-true that anti-spam algorithms must be hidden to be effective?
No. But that "no" is missing some qualifiers. It's not strictly true since you can implement some out-in-open options such as paying money, requiring a phone number, validating your physical identity, delays of use on new account creation, etc, that will make the barrier of entry for spamming much higher. There will still be spam, but it'll become more manageable to manually monitor and take action against. The downsides I feel are obvious based on the service we are talking about.
But I would say it is strictly true that you cannot have a free, anonymous, low barrier to entry service without hiding your anti-spam algorithms. There is fundamentally no difference in such an environment to differentiate a bot from a human besides the message content and patterns in who they message. If bots know what content they can't send or what patterns in messaging to avoid, they can still spam.
No. But that "no" is missing some qualifiers. It's not strictly true since you can implement some out-in-open options such as paying money, requiring a phone number, validating your physical identity, delays of use on new account creation, etc, that will make the barrier of entry for spamming much higher. There will still be spam, but it'll become more manageable to manually monitor and take action against. The downsides I feel are obvious based on the service we are talking about.
But I would say it is strictly true that you cannot have a free, anonymous, low barrier to entry service without hiding your anti-spam algorithms. There is fundamentally no difference in such an environment to differentiate a bot from a human besides the message content and patterns in who they message. If bots know what content they can't send or what patterns in messaging to avoid, they can still spam.
It's the same as anti-cheat in a game. Given how easy it is to create a cheat for open source code, it's just way more cost effective to keep it closed.
The rule is not to RELY on security by obscurity. It shouldn't be the last line of defense. But by all means, use it where the ROI makes sense.
The rule is not to RELY on security by obscurity. It shouldn't be the last line of defense. But by all means, use it where the ROI makes sense.
Depends how high is your bar for "effective". For example there's nothing secret in rate limiting and IP bans, and these are fundamental techniques.
However, there are plenty of opportunities to catch spammers when they make stupid mistakes. I've worked with web bot spam. I could catch a very popular bot brand by observing that it sent Accept header with content that was implausible for the User-Agent it sent. If the code was public, spammers could see `if (browser == safari && accept != safari-like) { spam }` and fix their header in minutes.
There's also a middle ground where the algorithm is public, but it's powered by secret data: blacklists, databases for classifiers, ML models. From accountability point of view data being secret is as problematic as secret code.
However, there are plenty of opportunities to catch spammers when they make stupid mistakes. I've worked with web bot spam. I could catch a very popular bot brand by observing that it sent Accept header with content that was implausible for the User-Agent it sent. If the code was public, spammers could see `if (browser == safari && accept != safari-like) { spam }` and fix their header in minutes.
There's also a middle ground where the algorithm is public, but it's powered by secret data: blacklists, databases for classifiers, ML models. From accountability point of view data being secret is as problematic as secret code.
> To keep Signal a free global communication service without spam, we must depart from our totally-open posture and develop one piece of the server in private: a system for detecting and disrupting spam campaigns.
Interesting. Matrix solves this problem by not associating a username with a phone number or email address (unless you opt in to). Does anyone have views on if this will work into the future?
I'm moved ~90 of my friends onto Matrix (along with plenty of group chats), and most of them quite like the Element [1] app (though there are rough edges on iOS I'm hearing).
[1]: https://element.io/
Interesting. Matrix solves this problem by not associating a username with a phone number or email address (unless you opt in to). Does anyone have views on if this will work into the future?
I'm moved ~90 of my friends onto Matrix (along with plenty of group chats), and most of them quite like the Element [1] app (though there are rough edges on iOS I'm hearing).
[1]: https://element.io/
Signal was superb for a long time, and then received a hefty chunk of funding, and, although I may be wrong, has declined since then, and in fact jumped the shark about a year ago.
They attempted ever more forcefully to make users to set a PIN to protect server-side state; it started with a dialog at the bottom of the screen, obscuring about 20% of the user list, which could not be dimissed, and then after a few weeks progressed to the a full page dialog, which could not be dismissed - rendering the app unusable.
All you saw upon starting was the full page dialog demanding you set a PIN to continue using Signal.
I did not want any server-side state, and so did not set a PIN, and stopped using Signal. After a few weeks, the full-page dialog went away, and I found I could use Signal again.
Signal actually blocked usage of the app to force users to adopt unwanted new functionality. It's hard to imagine any app doing well with such mis-management.
I opened a thread discussing the problem on their support/public discussion forum, which was deleted. I also at first opened a bug report on Git, before I understood it was all intentional, this was also deleted.
Since this experience, I've regarded Signal as on the way out, but it's still the best there is right now.
They attempted ever more forcefully to make users to set a PIN to protect server-side state; it started with a dialog at the bottom of the screen, obscuring about 20% of the user list, which could not be dimissed, and then after a few weeks progressed to the a full page dialog, which could not be dismissed - rendering the app unusable.
All you saw upon starting was the full page dialog demanding you set a PIN to continue using Signal.
I did not want any server-side state, and so did not set a PIN, and stopped using Signal. After a few weeks, the full-page dialog went away, and I found I could use Signal again.
Signal actually blocked usage of the app to force users to adopt unwanted new functionality. It's hard to imagine any app doing well with such mis-management.
I opened a thread discussing the problem on their support/public discussion forum, which was deleted. I also at first opened a bug report on Git, before I understood it was all intentional, this was also deleted.
Since this experience, I've regarded Signal as on the way out, but it's still the best there is right now.
Correct me if I'm wrong, but I believe your comment is misguided.
The PIN is a security option that prevents a SIM-swapping attacker from registering a new device under your phone number unless they know the PIN. You can opt out of it (and it might be opt-in to begin with). You can also easily opt out of PIN reminders. Both of these options are in Settings -> Account.
As for server state - my understanding is that Signal attempts to be zero-knowledge overall, but they definitely store some state on the server. I believe it's encrypted using your private key that's not backed up to the server. Setting the PIN does not change that.
Server state comment aside, it seems your main complaint is about a pop-up PIN entry UI that can be opted out of? I get that it might seem annoying, but it feels like a fairly weak criticism of a messaging platform, certainly not one that should warrant an impression that Signal is "on the way out"?
The PIN is a security option that prevents a SIM-swapping attacker from registering a new device under your phone number unless they know the PIN. You can opt out of it (and it might be opt-in to begin with). You can also easily opt out of PIN reminders. Both of these options are in Settings -> Account.
As for server state - my understanding is that Signal attempts to be zero-knowledge overall, but they definitely store some state on the server. I believe it's encrypted using your private key that's not backed up to the server. Setting the PIN does not change that.
Server state comment aside, it seems your main complaint is about a pop-up PIN entry UI that can be opted out of? I get that it might seem annoying, but it feels like a fairly weak criticism of a messaging platform, certainly not one that should warrant an impression that Signal is "on the way out"?
My complaint with them is the whole thing with mobilecoin. They hid that integration for a year, by not pushing server updates and when the news hit, they promised to do an AMA explaining it all. Its been months since that has happened and the AMA never happened.
Moxies involvement is very muddy and never clarified, it was a pump n dump at best.https://amycastor.com/2021/04/07/signal-adopts-mobilecoin-a-...
That incident, they lost a lot of respect for me.
Moxies involvement is very muddy and never clarified, it was a pump n dump at best.https://amycastor.com/2021/04/07/signal-adopts-mobilecoin-a-...
That incident, they lost a lot of respect for me.
No kidding - what garbage that was. That said, I think they were able to pump mobilecoin (as a nonprofit!) to something like 6x before the dumps came.
After that I was gone.
After that I was gone.
I think we may be talking about different PINs.
I am not talking about the PIN you would have to enter when starting Signal, to get into Signal.
I Googled a bit and found an approachable blog post from the time this all happened, here;
https://blog.cryptographyengineering.com/2020/07/10/a-few-th...
This has refreshed my memory of events.
In short, Signal wanted to store what had been purely client-side information (contact lists, for example) on their server, but - in principle at least - in a form Signal could not access.
The PIN in question is used to provide access to that information.
> Server state comment aside, it seems your main complaint is about a pop-up PIN entry UI that can be opted out of?
The dialog to force the user to set the server-side PIN disabled the app. You either had to do it, or stop using Signal. There was no opt-out.
I had a look at the app now. I found the settings you mentioned. It's not clear to me from what I see there is this if an app-locking PIN, a SIM protection PIN, or a server-side state PIN, or all three rolled into one.
In any event, at the time it happened, the presented dialog was full-screen and could not be dimissed; even if there had been options to disable this (and there were not prior to the full-screen dialog - I looked, in an effort to dismiss the permanent partial-screen dialog) you could not get to them, because it was a full-screen dialog which you could not dismiss; you could not get to the app, and so could not get to settings.
The only option was to stop using Signal or provide a PIN so your client-side state could be stored server-side.
I am not talking about the PIN you would have to enter when starting Signal, to get into Signal.
I Googled a bit and found an approachable blog post from the time this all happened, here;
https://blog.cryptographyengineering.com/2020/07/10/a-few-th...
This has refreshed my memory of events.
In short, Signal wanted to store what had been purely client-side information (contact lists, for example) on their server, but - in principle at least - in a form Signal could not access.
The PIN in question is used to provide access to that information.
> Server state comment aside, it seems your main complaint is about a pop-up PIN entry UI that can be opted out of?
The dialog to force the user to set the server-side PIN disabled the app. You either had to do it, or stop using Signal. There was no opt-out.
I had a look at the app now. I found the settings you mentioned. It's not clear to me from what I see there is this if an app-locking PIN, a SIM protection PIN, or a server-side state PIN, or all three rolled into one.
In any event, at the time it happened, the presented dialog was full-screen and could not be dimissed; even if there had been options to disable this (and there were not prior to the full-screen dialog - I looked, in an effort to dismiss the permanent partial-screen dialog) you could not get to them, because it was a full-screen dialog which you could not dismiss; you could not get to the app, and so could not get to settings.
The only option was to stop using Signal or provide a PIN so your client-side state could be stored server-side.
Fair. And I think I know what you're referring to.
Yes, they do upload your contact list, but I believe there's a prompt at setup time that allows you to opt out? It might even be an OS-level prompt to the tune of "Signal would like to access your Contacts". Not 100% sure on that one as I haven't set up a brand new Signal installation in years.
It's done to help their user acquisition. It uploads your contacts to match against other contact lists and let you know who's on Signal. I recall seeing a blog post explaining how they are doing it in a fully encrypted way, possibly using Secure Enclave (? though I think the 2021 version of that would probably involve ZK proofs/homomorphic encryption of some kind, and I hope they put some time into that).
I don't recall ever having to set a PIN specifically for that. And besides, a 4-6 digit PIN would be a terribly insecure way to "encrypt" anything server-side :) But yes, that would be a shame if it were the case.
Yes, they do upload your contact list, but I believe there's a prompt at setup time that allows you to opt out? It might even be an OS-level prompt to the tune of "Signal would like to access your Contacts". Not 100% sure on that one as I haven't set up a brand new Signal installation in years.
It's done to help their user acquisition. It uploads your contacts to match against other contact lists and let you know who's on Signal. I recall seeing a blog post explaining how they are doing it in a fully encrypted way, possibly using Secure Enclave (? though I think the 2021 version of that would probably involve ZK proofs/homomorphic encryption of some kind, and I hope they put some time into that).
I don't recall ever having to set a PIN specifically for that. And besides, a 4-6 digit PIN would be a terribly insecure way to "encrypt" anything server-side :) But yes, that would be a shame if it were the case.
> It's done to help their user acquisition. It uploads your contacts to match against other contact lists and let you know who's on Signal.
I may be wrong, but I think this functionality existed prior to the server-side state effort. I recall when people in my contact list joined Signal, I was notified.
However, these days I do not keep contacts in the phone contact list. It's too big and juicy a target.
> And besides, a 4-6 digit PIN would be a terribly insecure way to "encrypt" anything server-side :)
Very much so. That does seem odd.
I may be wrong, but I think this functionality existed prior to the server-side state effort. I recall when people in my contact list joined Signal, I was notified.
However, these days I do not keep contacts in the phone contact list. It's too big and juicy a target.
> And besides, a 4-6 digit PIN would be a terribly insecure way to "encrypt" anything server-side :)
Very much so. That does seem odd.
This is an ios problem. Never seen this on Android
These all seem like useful changes, but I've never received spam over Signal. I'm glad that solves a problem for someone.
What I have received were creepy messages from long-lost acquaintances who had been suddenly reminded, by virtue of my having installed the Signal app, that I existed and that I was attending a security-focused event at the time.
And last I heard, Signal was adamantly opposed to removing these notifications. That's a big problem, IMHO.
What I have received were creepy messages from long-lost acquaintances who had been suddenly reminded, by virtue of my having installed the Signal app, that I existed and that I was attending a security-focused event at the time.
And last I heard, Signal was adamantly opposed to removing these notifications. That's a big problem, IMHO.
They usually oppose that because it helps them build engagement. People discovering each other helps increase app usage.
I don't really like it either but all the other big players do this and it does really help. If signal doesn't it'll be even harder to get decent marketshare.
There's this weird situation where fighting something means adopting some of their tactics even if you don't agree with them, otherwise it's not viable to compete. I think Signal is still better than eg WhatsApp but they are pretty similar in some ways because less privacy-sensitive users expect certain features like auto discovery. And without them it'll always remain a fringe thing.
I don't really like it either but all the other big players do this and it does really help. If signal doesn't it'll be even harder to get decent marketshare.
There's this weird situation where fighting something means adopting some of their tactics even if you don't agree with them, otherwise it's not viable to compete. I think Signal is still better than eg WhatsApp but they are pretty similar in some ways because less privacy-sensitive users expect certain features like auto discovery. And without them it'll always remain a fringe thing.
Is there a reason, when they have control of the client software and the protocol, that they don't introduce computational cost to establishing contact?
Like, if I send a message to a particular number, and their client receives a message from me for the first time, it responds with "prove that it's worth it for you to message me: find an `n` character string that together with `random string` hashes to 5 leading zeroes", or something like that.
Somehow I imagine that doing a few seconds of computation per initiated first message is unproblematic, but doing it for thousands or millions of numbers starts to be a problem.
Why is this not done?
Why is this not done?
If the server is mediating that proof-of-work system, then the server is building a list of contacts, and not doing that is the #2 goal for the whole Signal project.
If the client is doing it, you need to come up with a system that is resilient to people using a bunch of different devices, getting new phones, etc.
This is a theme about building Signal: they're doing everything on hard mode, because they start from the premise that they don't get to know everyone's contacts. Virtually every other mainstream messaging system, including the ground-up E2E encrypted ones, keep a complete plaintext contact database serverside.
If the client is doing it, you need to come up with a system that is resilient to people using a bunch of different devices, getting new phones, etc.
This is a theme about building Signal: they're doing everything on hard mode, because they start from the premise that they don't get to know everyone's contacts. Virtually every other mainstream messaging system, including the ground-up E2E encrypted ones, keep a complete plaintext contact database serverside.
Thanks.
What is the problem with "people using a bunch of different devices, getting new phones, etc" in what I suggested?
If I make a fresh install, then next time a friend messages me, it costs them a few seconds of delay in sending their first message because my client asks them to prove themself.
I don't see the problem, but I imagine there are problems since smarter people than me are not doing it this way. I'd like to understand what I am missing here.
I guess tweaking the difficulty to be actually difficult for a server farm, yet possible for an old device would be the main problem.
What is the problem with "people using a bunch of different devices, getting new phones, etc" in what I suggested?
If I make a fresh install, then next time a friend messages me, it costs them a few seconds of delay in sending their first message because my client asks them to prove themself.
I don't see the problem, but I imagine there are problems since smarter people than me are not doing it this way. I'd like to understand what I am missing here.
I guess tweaking the difficulty to be actually difficult for a server farm, yet possible for an old device would be the main problem.
I'm not saying it isn't potentially workable, just that it's deceptively hard to deploy across the whole Signal userbase. A company like Slack or Discourse could build something like this easily, because it'd be mostly managed from the servers, which they control, working from a single source of truth about who's talking to who. Signal doesn't have that luxury.
The issue with these sorts of HashCash schemes is that legitimate users need to PoW their messages on a battery powered phone with a basic CPU and GPU. Spammers can use big, mains-powered GPUs, or better yet, botnets full of stolen CPU-time from mains-powered desktops/servers/etc.
I think with the current climate crisis we should be wary of introducing more unnecessary computation. The internet already uses a substantial amount of the world's energy.
We should try to bring this down, not up. And bitcoin showed how quickly the technology catches up with such requirements by using GPUs, ASICs etc.
We should try to bring this down, not up. And bitcoin showed how quickly the technology catches up with such requirements by using GPUs, ASICs etc.
This is great! I haven't ever received Signal spam but have been getting say 5 junk SMS and 15 junk calls each week. They must be doing something right.
Still requiring SIM, no go if you care about privacy
Great, but...
Please let people allow Signal to automatically save their media to their photo roll (or whatever ios calls it). The number of people I have met who require this and left Signal _after starting to use it_ is astonishing.
Please let people allow Signal to automatically save their media to their photo roll (or whatever ios calls it). The number of people I have met who require this and left Signal _after starting to use it_ is astonishing.
This surprises me greatly, as it's my biggest annoyance with WhatsApp and Google Hangouts or whatever they call it now (I've not yet accepted the new app, so it still calls itself hangouts, but clearly is using the new chat app backend...)
I despise that it shows up in my main photos whenever someone sends a photo/gif/vid on these apps. Telegram segregates its local storage to a separate folder that Android doesn't seem to grab for the photo-roll and I want it this way; my photoroll should only be __my__ pictures, not random stuff my friends send me.
I talk to different people on different apps in very different ways; the ways I joke with my best friends is absolutely not appropriate for the ways I talk with the older people in my life, and vice versa. And it's absolutely not about me testing these waters; that's not for an App/OS to decide, that's for me to decide, and mixing these photos into one central location makes it more annoying and precarious for me to accidentally tap and share something I never meant to because the App/OS saved it to a central location that it never should have.
I don't even agree with "give people the option"; photocell/gallery/whatever are for __my pictures__. Downloads are for just that; Downloads. Apps should stay away from the pre-defined user space and put it in correctly named locations.
I realize I'm "reeeeee-ing" here, but it's honestly a huge pet peeve of mine to see all the photos from the chat apps I use to keep in touch with a small handful of people dump themselves into a user space that isn't theirs.
Telegram does it right, and apparently Signal does too -- I cannot understand why other chat-apps feel the need to behave otherwise; finding said photos is a matter of a single system call, so it's not like discoverability is a challenge for them. The users __will learn__, it's not hard to summon the file manager even with locked down permissions.
I despise that it shows up in my main photos whenever someone sends a photo/gif/vid on these apps. Telegram segregates its local storage to a separate folder that Android doesn't seem to grab for the photo-roll and I want it this way; my photoroll should only be __my__ pictures, not random stuff my friends send me.
I talk to different people on different apps in very different ways; the ways I joke with my best friends is absolutely not appropriate for the ways I talk with the older people in my life, and vice versa. And it's absolutely not about me testing these waters; that's not for an App/OS to decide, that's for me to decide, and mixing these photos into one central location makes it more annoying and precarious for me to accidentally tap and share something I never meant to because the App/OS saved it to a central location that it never should have.
I don't even agree with "give people the option"; photocell/gallery/whatever are for __my pictures__. Downloads are for just that; Downloads. Apps should stay away from the pre-defined user space and put it in correctly named locations.
I realize I'm "reeeeee-ing" here, but it's honestly a huge pet peeve of mine to see all the photos from the chat apps I use to keep in touch with a small handful of people dump themselves into a user space that isn't theirs.
Telegram does it right, and apparently Signal does too -- I cannot understand why other chat-apps feel the need to behave otherwise; finding said photos is a matter of a single system call, so it's not like discoverability is a challenge for them. The users __will learn__, it's not hard to summon the file manager even with locked down permissions.
For WhatsApp it is just settings->chats->save to camera roll which doesn’t feel like a huge burden.
I think the way I think about it is that your phone's ‘photos’ app should have all the things you would think of as photos and things people sent you are included in that. Though I’m not sure what iMessage does (I think they don’t show up in photos. At least, things you take don’t show up). I also wish the app were better at differentiating between photos you took and photos that WhatsApp added, e.g. I once found a video of my feet walking through the snow in flip flops and I couldn’t remember where I was or why I did it, until I had worked out that it was my brother’s feet and came from WhatsApp. It would be nice to have some source metadata[1] and maybe a deep link back to WhatsApp, or at least have the app say “this is in the WhatsApp album by the way”
[1] ok, this actually exists for more recent photos and started exactly when I last upgraded my phone. So I am somewhat happy there I guess.
I think the way I think about it is that your phone's ‘photos’ app should have all the things you would think of as photos and things people sent you are included in that. Though I’m not sure what iMessage does (I think they don’t show up in photos. At least, things you take don’t show up). I also wish the app were better at differentiating between photos you took and photos that WhatsApp added, e.g. I once found a video of my feet walking through the snow in flip flops and I couldn’t remember where I was or why I did it, until I had worked out that it was my brother’s feet and came from WhatsApp. It would be nice to have some source metadata[1] and maybe a deep link back to WhatsApp, or at least have the app say “this is in the WhatsApp album by the way”
[1] ok, this actually exists for more recent photos and started exactly when I last upgraded my phone. So I am somewhat happy there I guess.
Do you think that's really the reason they are abandoning it? I think the bigger issue is probably that most of their friends are not on there and they use it less frequently until they abandon it.
They abandoned it for two reasons: the reason above (automatic saving of family photos doesn't exist), and notifications not showing up.
I mean, I'm not opposed to this feature existing, but I always thought it was one of WhatsApp's weirder choices as a default behavior.
I certainly turn it off the moment I set up WhatsApp on any device -- why would I want random memes mixed into my photos?
I certainly turn it off the moment I set up WhatsApp on any device -- why would I want random memes mixed into my photos?
I think if people want this, it could be opt-in.
But I have issues with the wisdom of such a feature, given that we're entering the age of client-side CSAM scanning.
But I have issues with the wisdom of such a feature, given that we're entering the age of client-side CSAM scanning.
I’m interested in applying to and working at Signal. But is there a chance I would get put on a list of some sort making my life more difficult by the government?
No one can give you a 100% answer, but I can relay some personal anecdotes which might help.
I have consulted for the Signal Foundation in the past. None of the employees or consultants I worked with indicated that they'd had any problems.
Around 2010 timeframe, I hosted the RedPhone server backend on some spare colo hardware I owned. RedPhone, along with TextSecure, were the predecessors to Signal Messenger.
I have never had any (signal related) issues with the government.
I have consulted for the Signal Foundation in the past. None of the employees or consultants I worked with indicated that they'd had any problems.
Around 2010 timeframe, I hosted the RedPhone server backend on some spare colo hardware I owned. RedPhone, along with TextSecure, were the predecessors to Signal Messenger.
I have never had any (signal related) issues with the government.
First impressions? I left Signal years ago after using it for years, but I have one question - do they still actively hide that by long pressing Send button you can force send SMS instead Signal message or they show it to user at first launch somehow?
Not looking forward to this... I use bots and I bet this will make them stop working at some inconvenient time.
I wish I could put up collateral, say stablecoin in a smart contract, where Signal can ban my account and keep the money if I abuse, but otherwise do not break my automation.
I wish I could put up collateral, say stablecoin in a smart contract, where Signal can ban my account and keep the money if I abuse, but otherwise do not break my automation.
Unless your bots are doing things that get their messages reported by recipients, this shouldn't affect you at all.
Hope you're right. I only create groups and add my approximately 10 users to. The bot posts events in a group and also takes action based on commands users can say in group. I used to have an onboading process where my bot would message a user to ask if it's ok to be added to the group.. the purpose being for the user to reply so the bot can learn the safety number. Recent changes kinda broke that.
Why are you not using elements?
Have definitely considered this. Running your own matrix server definitely solves the spam problem, and element has some cool looking plugin featues that go beyond simple chat bot... Just have been using Signal for many years already, find it very convenient on mobile, and already put quite a bit of effort into my bot for it.