> We have now reached the point where SMS support no longer makes sense
That is hard to swallow, being able to quickly send a message through SMS to the same receiver in emergency situations* was quite handy.
*like when you're at a protest and the tower is overloaded, or you're on a remote location and you see that the Signal message doesn't get through because of lack of 3G/LTE connectivity.
Just a guess, but this likely has something to do with 10DLC and/or Toll Free Verification and all of the complexities that are being pushed by the carriers for users to register their numbers and even pay to use if you want to use 10DLC.
I believe "SMS support" just means Signal can act as your SMS client using your existing modem & SIM card (something possible on Android), so from the carrier and phone network perspective there is no difference between this and using the stock SMS app.
I completely disagree and am disappointed in this decision. One app on my phone to handle all my messages is easier than making a context switch per-contact.
I also think it'll hurt the value proposition when getting people to join signal. Not overcomplicating the messaging scenario was a big winner to do that.
> all my messages is easier than making a context switch per-contact
A user already has:
- WhatsApp
- Telegram
- Facebook Messanger
- Instagram that has direct messages
- the good old email, or better, many of them
- Microsoft Teams for company communications
- Discord for communications with group of friends
- the old SMS (that I didn't even know that in some parts of the world were still used, since I receive them only for 2 factor codes, notifications about my card transactions, and spam)
Adding another app is that a big deal? By the way I don't use Signal, but not for the reason of not having another app on the phone, just because I don't know anyone that has it and actively use it.
Does anyone actually have all those? I certainly don't. I have Signal, Element, Telegram and I even think that's excessive. I can at least manage it, most RL contacts I know would not.
Well, not all of them, but usually you expect a young person to have all of them. Except Microsoft Teams, the company may use other media, and Discord.
Hell, even my aunt that doesn't know nothing about technology has WhatsApp and had me install Telegram because the church opened a channel on it!
You're right that there are many messengers available and Signal will, at best, be one of many that people juggle based on who they are contacting.
That's why it was a huge advantage that, on Android, Signal could replace a SMS client. You weren't adding _yet another_ messenger to the list, you were replacing the SMS client with one that could send secure messages. That made "switching" to Signal (which, ofc, was not a switch at all for my friends who use SMS) much easier for me. I could continue texting my friends and seamlessly switch to secure messaging if they ever got signal.
Contrast this with my friends who kept their old SMS client who reliably forget to check / use signal and generally tend to go back to texting me in a few weeks. Even if you send 0 signal messages for a long time, by switching you SMS client you are already setup to receive them and will habitually open an app that supports E2E encryption.
For example - Facebook Messenger also supports sending and receiving SMS messages - likely because they've done the research and found it drives adoption.
If you don't use Signal do you really have any skin in the game anyway? People obviously care that it has SMS capabilities and it is widely used for that, so naturally people will be upset.
This does not represent all users. My family has boomers who literally use just Signal (for 80% SMS) and FB Messenger. For many people, less apps is an important feature.
Literally the only reason I recommend others and use Signal myself?
Seriously, Signal doesn't have the userbase to drop SMS support. All my Signal contacts use WhatsApp or Telegram that I already have installed. I use signal mostly as a SMS app, secondly as E2E communication. It will be easier to uninstall Signal.
Seriously. I don't want to use another locked in messenger app, that everyone else must use or I won't get their messages. I use signal because it's secure, but also because it's low friction and seamless into SMS if the other user doesn't have signal. This is another step in the wrong direction for Signal.
The complete lack of awareness of this decision is astounding, the userbase is about to disappear. Those of us that convinced non-technical friends and family to use Signal are now expected to explain to them how to juggle 2 messaging apps? yeah it's not happening, the uninstall rate is going to be huge and there will be no recovery of those users
This feels like a slap in the face. I get the privacy ramifications, but one of the really strong aspects of Signal to me was to go all-in on privacy when needed, and default to something sensible when it wasn't. I'll definitely need to reconsider whether or not to continue my monthly donation, and I don't like that at all.
I for one welcome the change, because my phone does not have an SMS plan (data only) and the "send by SMS" is a bit confusing.
A messaging app should have one clear behavior per interface. This was "maybe secure, maybe not". I have an SMS app for that (well, VoIP-sms, because I'm weird).
You sound misguided if you're trying to explain the details of signal to get them to use it. All they need to understand to use the app is "its sms", any e2ee they benefit from as a result are completely in the background.
Further — can anyone recommend a good Open Source SMS Android app? The only ones I can find are AOSP Messaging and Simple SMS Messenger, both of which are "Okay".
This is an awful decision. I've converted some friends and family to Signal over the past years (it took a while) and it is now their default messaging app on their phones. This is going to confuse them and is going to make it difficult for me to keep convincing them that Signal is the route to use. ("Why do I need 3 apps (Android Messages, Signal, Whatsapp) to talk to people?")
I hope it's communicated well to users who aren't readers of Signal's blog. I have relatives who use Signal, and they rely on its fallback-to-SMS feature, possibly without fully understanding it. I'll make sure they understand and are aware of this change, but others may be in the same position.
That ship sailed a long time ago. Signal's userbase overwhelmingly objected to having their sensitive information permanently stored in the cloud too, but signal ignored them.
Yes, exactly. The ability to send SMS from the Signal app has meant I've been pretty successful in getting Android users to switch to Signal. Every iOS user I know always just goes back to using iMessage. Now many of those Android users won't bother either.
No. Secrecy will have backdoor keys, but that is not what walled garden means: it means more like people have no power over the decisions made in the garden.
"... those designated as gatekeepers will have to:
allow third parties to inter-operate with their own services, meaning that smaller platforms will be able to request that dominant messaging platforms enable their users to exchange messages, send voice messages or files across messaging apps. ..."
Thank you, I should have clarified that in the original comment.
(I admit that I actually edited that original comment, since the link I initially included was more speculative, talking about a law that was expected to pass, and being much more vague about when it might enter into force. The page at the updated link is more definitive, but not as narrowly focused, so I'm glad you managed to isolate the relevant section.)
I have never understood why decisions and options have to be mutually exclusive. Yes, you want to have a rock-solid, thoughtfully-design default install for new and casual users. You can still have an advanced control panel with everything a power user could want.
KDE is such a great example of how to do it right that I didn't even think of it. It just works so well and so transparently that I forget how great it is sometimes.
Rock solid and both works and looks great right out of the box. So customizable that using literally anything else feels like using a Fisher-Price computer for toddlers.
That review of KDE is so over-the-top it almost reads like satire. Is KDE really that great? (Using Gnome under Ubuntu - no complaints here. But I also am not sure what KDE is giving you. Control over look-and-feel of the windowing environment? Default utility applications? Perhaps a desktop API thick-client programmers can write against?
KDE is really that great. Used a GNOME desktop on Fedora recently and there were so many simple features missing.
Windowing rules for one. Simple example: Firefox picture-in-picture. On KDE I have a windowing rule so that if from any firefox window playing video I hit the picture-in-picture button the picture-in-picture window becomes a certain size, goes to a certain placement on my monitors, stays on top of all windows, and is visible across all virtual desktops.
Ability to control the layout of my virtual desktops is also incredibly useful to me. (I use a 3x3 grid, so switching from my "main" task in the center to any one of 4 sub-tasks up-down-left-right is easy, and my universal tasks (chat/email/etc) go in the 4 corners.
KDE puts you in control, and gives you a LOT of control. IMO GNOME feels much more windows/mac in it's design philosophy. "We know best, do it the way we let you."
And as far as an API, yes, also that. With the Plasma desktop plugin Firefox remembers which virtual desktop each window is supposed to go to, so I have no issue rebooting with 5 or 6 different windows open.
I apologize if it sounds over the top, but for my use-cases at least the level of control and "just does the right thing" really do stand out above the alternatives.
I dunno, all my friends use at least a handful of messaging apps (iMessage, FB messenger, Discord, Telegram, SMS). Sure people grumble about a new messaging app but the younger generation seems to not have an issue adopting new things.
Yeah, I can understand that; but I've brought over various older family members, and non-tech friends (as in people that wouldn't have ever heard the words Discord or Telegram before in their lives) to Signal. That's who this will impact most.
And while older generations might be less willing to use a high number of apps side by side, having one kind of message in one app and the other kind of message in the other app is still much less confusing to them than dealing with the subtleties of multiprotocol if everything is forced through the single one-size-fits-all interface of a messenger that tries to do SMS on the side.
I wouldn’t frame it as an issue around adopting new things. Some don’t care, some go with the flow, and some prefer to make active choices about these kinds of things.
I am very intentional and active when it comes to what has push notification privileges. I factor that into my app use consideration. I have multiple email accounts in two different email apps, each that send me notifications. I have Signal, Discord, iMessages and SMS. I have a few Google chat apps. I used to have WhatsApp and Wickr and Telegram. I have Skype, Teams, and two Mattermost servers.
It’s exhausting to constantly switch between these, so over the course of a few years I’ve been very clear in where people can expect to reach me reliably. If you need or want to chat with me on Discord, Skype, or Google whatever you need to send me an iMessage, SMS, Mattermost, or Signal message. Sending me a message anywhere else will get you a response only the next time I open that app. That only happens when someone specifically asks.
I’m OK with having 63847394038 chat and video calling apps, but I’m not OK with being instantaneously notified by an infinity such apps. I can’t be that available.
I absolutely agree. Personally, I've managed to convert around 3 times as many Android users as iOS users, because of this feature. And the few people who stopped using Signal after starting using it did so because of limitations in the SMS/MMS features (fewer number of users allowed in group text, etc). I fully expect to loose 2/3 of my Signal contacts as a result of this decision, and may drop it myself if the number remaining is too small to be worth running a separate app, as most of the ones left will probably be on Matrix as well.
It also puts a spot-light on the "your phone number is your username" policy. This made perfect sense when you are using Signal for opportunistic encryption of texting. It is much less justifiable when using it as a Silo'd app. I really hope they change that and give people who were waiting for that change time to join before killing SMS support.
They say “opportunistic” as in similar to how iMessage works. If you’re both on the platform, it’s encrypted but you still can communicate with everyone else from one app.
That’s a major boost for those that might not particularly care about encryption to look for specific messaging apps, while still helping by building out the network slowly over time.
The downside is that they will opportunistically send your messages via Signal. If the recipient chooses to not have SIgnal installed any longer, then your messages go into a black hole.
This became much more of a problem for me after they rolled out their shitcoin; suddenly my techie friends were just not responding to messages, and Signal as my main SMS app was not falling back to SMS for these folks.
Apple has the same problem, and an article and entire process for disabling it out of band, plus a heartbeat so it’s done automatically after a while if you don’t reset your phone. It’s a major problem.
I’ve only done the switch from iOS to Android once and I remember it was a pain for a few days until everything realized I didn’t have iMessage anymore.
Even without an iPhone I sometimes miss texts from people using iMessage because my only occasionally used MacBook seems to randomly like to turn messages back on, and so anything from an Apple user ends up there instead of on my phone. It stays that way until I figure out I’m missing texts and go find them on the MacBook and have to manually turn off messages to it again.
> The downside is that they will opportunistically send your messages via Signal. If the recipient chooses to not have SIgnal installed any longer, then your messages go into a black hole.
The user cannot just log out of Signal and have the app on other people's devices automatically fall back on SMS the way it works with iMessage?
A lot of people will just delete an app and think there were no side-effects. There was an article here a few weeks ago about people not cancelling in-app subscriptions after deleting an app. Apple will remind you after it deletes it, Google does not.
Logging out might not even be enough, depending on the logic on Signal’s side. Do they use active devices, or just that an account exists?
> If the recipient chooses to not have SIgnal installed any longer, then your messages go into a black hole.
For two weeks, messages will be shown as sent but not delivered, and after two weeks Signal will not let you send messages to that number until it reconnects to the Signal servers.
For comparison, Apple automatically sends all SMS messages via iMessage opportunistically, and if the user then switches to another phone, all SMS messages from iOS users will be silently discarded in perpetuity. This is a big problem because the recipient has no idea that they're missing messages, and also if they no longer have access to an iPhone, there's no way for them to deregister their phone number from iMessage.
They will also deregister you automatically after some period of time. What you described is the situation several years ago, but it's much better now.
That's a link to deregister a phone number from iMessage without an iPhone, which is good, but I don't see any text on that page that confirms that they'll deregister you automatically, or if there's any user-visible indication of the issue. If that's the case, then I'm glad they finally addressed it, because it was definitely a problem for far too long.
In that case, Signal's current behavior would be comparable to Apple's, if Apple also deregisters you after a period of inactivity.
> It also puts a spot-light on the "your phone number is your username" policy.
I'm willing to bet that this decision is just jumping the gun by a month or two since usernames are around the corner (code exists, just not enabled. Can be used if built from source).
Though I haven't had a hard time converting (Android) users by using another app. Especially people that already use WA. The "other app" just comes off as normal. Apple is a different ball game because the walled garden, but that's also the weakness because you can't send photos/videos in group chats with mixed devices (but Signal can).
Honestly I'm pretty critical of the Signal app design: from the crypto nonsense, to the removal of chat bubble colors (used to be each person had a color, pretty useful in group chats), to the copious amounts of whitespace that have been linearly increasing for years, to the fact that the design has to change and break familiarity every 6 months or the devs have a stroke.
But I actually like this decision. It makes things less confusing and accidental use of unsecure SMS impossible. The downside is if you still use SMS you have to keep 2 apps, back them up separately, etc.
> "Why do I need 3 apps (Android Messages, Signal, Whatsapp)"
"You need Signal to talk to people on Signal, WhatsApp to talk to people on WhatsApp, and Messages to talk to people on SMS." Seems more straightforward than "use WhatsApp to talk to people on WhatsApp and Signal to talk to people on Signal or SMS; just pay attention to the color of the send button".
This issue for myself and many others is it makes something that used to be transparent, entirely unsupported. The UX is unambiguously worse. I could trust signal to upgrade my texts for me when possible, or not when my contacts were SMS. I don't care about always being encrypted 100% of the time. Signal was that perfect tradeoff between privacy, and ease of use, which is exceptionally rare. Providing this tradeoff is what made them popular, them going against it is counterproductive and will hurt them badly. I know this because now I'm considering leaving myself.
Is the snark and reducing of the parent comment to a “bla bla bla” really necessary? We’re all adults here, we can make a point while treating the other person with respect.
+1 to this. If Signal drops Android SMS support, I suspect it'll create friction within my friend group that uses it. I do not want yet another app for just text messages. No thank you.
This is an awful decision. I've converted some friends and family to Signal over the past years (it took a while) and it is now their default messaging app on their phones. This is going to confuse them and is going to make it difficult for me to keep convincing them that Signal is the route to use.
I learned to stop trying to improve the technical lives of other people after Dropbox's decision to restrict free accounts to three devices resulted in a shitstorm of angry and confused messages from half the people I know.
You know, I haven’t really thought of it like this. Those for whom I take an interest in their technical lives typically get a spiel from me about whatever solution I’m offering. That spiel often includes something about how “they’ll probably change this eventually in ways no one wants, but the most we can do is speak up. We probably won’t get options.”
But I have to admit your perspective calls to me. I can imagine it would feel quite freeing.
I’m in a minor mess of a situation with my dad’s phone and computer because I’ve tried to be helpful. Now he resists help and that makes both of us frustrated.
I'm happy to share the best information I have with others and most of them are glad that I do.
I had recommended signal to others, but thankfully I've already warned those same people against continuing to use Signal years ago. Nobody was mad at me for Signal's actions and changing your default SMS app isn't hard anyway.
I don't think you have to stop recommending things to people just because situations change. Hasn't everybody had some service or software they depended on go from great to shitty? It's just the nature of using someone else's stuff. At some point they get greedy or busy or decide to pivot into something different from what you want and you have to find something new. Isn't everyone used to that? Why would they blame you?
The US seems to be the only place where everyone uses iMessage, so Android users have to use SMS and suffer the bizarre shaming of the green bubble. In most countries outside the US, WhatsApp seems to be the default. SMS is just legacy 2FA messages, and various other transactional messages like parcel delivery notifications.
I'm guessing. Though I'm in the US but also in grad school. With a large number of foreign students there are similarly a large number of WhatsApp, Telegram, and WeChat users. I suspect this problem is very Americentric. India was able to get all its old people to use WhatsApp and multiple apps, I think there is a bit of an overreaction going on here. You'd think the world is ending for a feature most people didn't know existed (despite it being a prompt during signup).
I think I've burned a lot of social goodwill switching my family and close friends to signal and have no desire to support them through yet another change.
This change will have fewer people use Signal. One reason I was able to convince friends and family to start using it is because it is so seamless. I fear that with this change, Signal for most users will simply become unused, resulting in less e2e encrypted messaging overall.
I do not like this decision. Using Signal as a main SMS provider makes it easier for me to collect all of my messages in one place. Now I have to, YET AGAIN, download an SMS app for use while keeping Signal active.
I'm glad privacy is becoming mainstream but dislike lowering the bar for adoption to where it profoundly affects users.
It makes me yearn for the days with Pidgin where I had IRC, Google Chat (XMPP back then), AOL and whatever else chat protocols all running through the same client.
That's what is nice about signals implementation is it stands. It supports acting as the SMS default app on android and defaults to signal when it can.
One thing I liked about those multi-protocol clients is that some of them supported the OTR libraries for E2EE encrypted messages regardless of platform used. A couple of the implementations would automatically handshake with others to see if they supported OTR.
> That's what is nice about signals implementation is it stands.
Sure they handle SMS, but the real problem here is that Signal is just another walled garden: they have an overtly negative stance towards alternative clients, while also having very bad support for anything besides android/ios: they have a bad desktop client and they don't have a nice library. Altogether this means that Signal is overtly and willingly against things like Pidgin / multi-protocol clients or overlay, which is what the users want (ie not caring about protocols).
Signal doesn't want to deal with SMS anymore, which from an engineering and high-stakes security pov is a completely valid decision. Yet if it had clean and open local API or a simple and portable client library, or had a stable server API, then someone else could provide multi-protocol clients, tailored to each platform in a secure and stable way.
FYI Part of your website is broken on Firefox for Android. (Broken layout, content not shown etc.)
Now to my actual question: How is Beeper compatible with the ToS of platforms like Instagram and Facebook that, to my knowledge, don't allow their users to use 3rd-party apps? Case in point: I recently wanted to use a FOSS 3rd-party messaging app for Instagram and my account got promptly banned.
Question 2: Do you support full message backups in a well-documented format?
SMS support is literally how I got my family to switch to Signal in the first place. None of the non-techies want to switch apps or have to send the same message out multiple times in order to reach their friends and family. Having an app that provides privacy when able and still works for those not yet onboard was a godsend.
What dicks. I'm not looking forward to playing tech support for all the non-technical people I convinced to use Signal. Thanks for confirming everyone's suspicions about my weird-nerd chat client.
Oh no, the "did you remember to lock the door to the auditorium" messages I send to my boss may be unencrypted. The humanity.
What do you purists use to talk to all the random people around you? Do you reply "I'm sorry, it's too insecure for me to answer that, you'll have to install Signal first" messages when more distant colleagues ask you if you're at your desk right now? Do you teach your grandmother to use WhatsApp so her birthday greetings won't be intercepted by the NSA?
(Admittedly, the email situation at work being utter trash may be coloring my opinion here.)
Whatever they prefer. Whatsapp, imessage, or regular sms (when it makes sense). Or slack honestly. I have friends and family all over the world I only push for Signal where necessary and I want it to be good for that.
This one app nonsense is asinine. You’ll never get global adoption of one thing.
... and there's the reason I will likely stop using Signal?
Signal was always one of those "win-win" apps, get more security when it's available and I don't have to worry about adding to the giant bucket of messaging apps.
They were a paragon of putting the user first and I was a strong supporter... but now... Why not Telegram? Or anything else?
I don't need the security, it was nice-to-have. Having to switch between Signal and other apps is a heavy amount of friction.
I see, that's the 1 on 1 chats that are explicitly configured as secret. So by default for 1 on 1 chats and for all group chats the keys are stored on the server.
In reality almost no one bothers with secret chats (no syncing between devices, no backup and no group chat possible). Instead everything is stored online without E2E encryption, i.e. perfectly readable for the service provider.
> Telegram is absolutely the worst when it comes to privacy
Really? Telegram never said that they don't store your messages on cloud, they said that they do not sell your data or share it with third parties for profit.
Telegram has received a very good score on PrivacySpy (https://privacyspy.org), in fact better than any other messaging app. Telegram is good from a regular privacy perspective unless your threat model involves fearing cloud convenience.
If you're someone who requires spy-level opsec, you should be using Threema, Session or Speek. Maybe even a self-hosted XMPP instance.
Telegram is good at what it does and it states it very clearly. It does not lie about the things it does and it is open source. All while not selling user data, not manipulating user behavior through algorithms or censoring media by calculating hashes and providing what's arguably the most feature rich messaging app on the planet for free with a verifiable source code.
Also, be careful with what you're suggesting. Not only have Matrix servers been hacked twice but matrix also leaks metadata. If you're seriously suggesting true anonymity (not consenting privacy) then Matrix is not a good option.
> pp. Telegram is good from a regular privacy perspective unless your threat model involves fearing cloud convenience.
Telegram stores almost everything online without E2EE.
> Not only have Matrix servers been hacked twice but matrix also leaks metadata.
Even Signal leaks meta data.
> If you're seriously suggesting true anonymity (not consenting privacy) then Matrix is not a good option.
Out of Matrix, Telegram and Signal, Matrix is the best option. It is the only one not making you share your phone number giving you anonymity up to your IP address.
and yet I just did. Can we please stop confusing privacy and anonymity?
Your claims about Telegram being bad for privacy are baseless. Your concerns about messages is valid but it in no way compromises privacy because:
1. No telegram employee can read any messages. They use distributed key generation to encrypt data on servers which means no single server has access to decryption keys and all the servers are in different jurisdictions.
2. They do not sell message content data. If you can prove it, you can go ahead with a lawsuit and win a hefty sum.
3. They do not compromise security. They do not use E2EE by default. Their threat model and vision for a messaging platform is different than yours.
4. Telegram has never given message content for a court order. As mentioned in the privacy policy, they give out only the phone number and IP Address only in case of terrorism or child abuse and only when there's a court order from a country of a higher democratic index.
5. If you truly believe Telegram is bad for privacy even after all the evidence from FBI itself and PrivacySpy giving it a higher score than Signal, then please go ahead and sue them because surely they can't have a good privacy policy and bad privacy at the same time.
> 1. No telegram employee can read any messages. They use distributed key generation to encrypt data on servers which means no single server has access to decryption keys and all the servers are in different jurisdictions.
This is wrong. First, reported messages (via id) are read by employees. Second, regardless of your claims, Telegram can easily write a service which has access to plain text messages.
> 2. They do not sell message content data. If you can prove it, you can go ahead with a lawsuit and win a hefty sum.
How about you prove your claims? I hardly can bring them to justice when even the police doesn't have immediate access to them.
> 3. They do not compromise security. They do not use E2EE by default. Their threat model and vision for a messaging platform is different than yours.
Actually, they do by not using E2EE by default and providing bad encryption possiblities.
> 4. Telegram has never given message content for a court order. As mentioned in the privacy policy, they give out only the phone number and IP Address only in case of terrorism or child abuse and only when there's a court order from a country of a higher democratic index.
no idea about that
> 5. If you truly believe Telegram is bad for privacy even after all the evidence from FBI itself and PrivacySpy giving it a higher score than Signal, then please go ahead and sue them because surely they can't have a good privacy policy and bad privacy at the same time.
Since when is "bad for privacy" a reason for suing? The quality of a privacy policy doesn't have anything to do with privacy itself btw.
> and yet I just did. Can we please stop confusing privacy and anonymity?
> Actually, they do by not using E2EE by default and providing bad encryption possiblities.
These are again baseless claims. If you think MTProto 2.0, an encryption algorithm that has been audited multiple times by independent researchers is 'bad encryption', I'd like for you to prove it. Obviously, if you can prove it's bad, you could let Telegram know and win a bounty.
> How about you prove your claims? I hardly can bring them to justice when even the police doesn't have immediate access to them.
The burden of proof is not me as I did not make any claims, I simply restated what's on the Telegram website.
Even the FBI, Iran or Russian government couldn't bribe them so I do trust Telegram to not backdown on their statement and philosophy about not selling or using userdata for profit. https://twitter.com/durov/status/912812889236475904
> Second, regardless of your claims, Telegram can easily write a service which has access to plain text messages.
You do know even Signal could add a keylogger service to read message content right? I don't suppose their Google Play Store version has reproducible builds. See how easily arguments like these break down? You can almost assume anything and claim almost anything. As I said, these are baseless claims and assumptions. I'm only interested in the objective truth at the moment, not assumptions or guesses.
> Since when is "bad for privacy" a reason for suing?
You're suggesting Telegram's privacy policy is in direct violation of their privacy practices which is illegal. This is a huge claim, if you can prove it you should sue them, I'd honestly do that if I were you.
> I didn't, did I? please explain
Privacy is about choosing what to share, not about sharing nothing. You seem to lie more on the anonymity side of the argument than privacy rights. You're fighting for anonymity, not privacy if you claim malicious intent on Telegram's part because as I showed earlier, their privacy practices and security are totally A OK.
Correct.
But in the case of matrix you can host them in your home if you want, or maybe on your phone(they are still checking if this is possible or not)
Maybe I am capable to do so (although I already host an XMPP server, so Matrix is rather redudant) but expecting everyone to self-host is obviously not realistic.
Currently Matrix is operating in a way that larger instances aggregate private messages from bridges in plain text. Those messages would have stayed encrypted and secure if people didn't use Matrix.
> Currently Matrix is operating in a way that larger instances aggregate private messages from bridges in plain text.
That's not true in general. For most if not all messengers (at least encrypted ones), there is the option to use Bridge-to-End encryption on the Matrix side, which doesn't give the homeserver any possibility to inspect messages let alone aggregate them.
If I understand correctly, the Matrix encryption and message format is not compatible to other protocols so all messages must be decrypted and converted on the homeserver which runs the bridge.
The bridge and the home server are separate things.
So if you run the home server somewhere untrusted, but the bridge in your home with E2EE enabled, the decryption AFAIK happens in the bridge, and the home server doesn't see anything.
I doubt many users will host their own bridge. Also at least for XMPP I was not able to encrypt messages to Matrix users end-to-end or bridge-to-end, so I'd still recommend using XMPP with E2EE directly.
"why not anything else" is mostly (for me) because they are a non-profit, and unlikely to be bought by or turn into a megacorp, similar to how wikipedia runs, although they're certainly a mega-something at this point, it still feels a lot less evil than a facebook or a google.
> ... and there's the reason I will likely stop using Signal?
> Signal was always one of those "win-win" apps, get more security when it's available and I don't have to worry about adding to the giant bucket of messaging apps.
Same here. I see no reason to continue using Signal if they do this.
I agree. I picked signal over deltachat to replace group MMS threads because it was less startup friction than getting everyone to login to their email accounts on a mobile account since they got SMSes for free.
Now? Delta chat is looking plenty fine for doing private group chats.
My threat model is not nation states watching my metadata, I have horrible opsec for that. My threat model is discord and whatsapp etc. tossing me and my chat groups off a cliff at their sole discretion.
Signal gave me control over chat groups, and integrated with SMS as a bonus. Now? If I'm gonna have to deal with a separate SMS app anyways, I might as well use delta chat where I know my messages are automatically backed up in my email account.
I support this decision, I don't use SMS and I'm in support of everything that kills SMS.
Next step: Please stop using phone numbers as a user ID. I have lots of throwaway phone numbers, but many people don't want to leak their phone number to every single person they want to have an encrypted conversation with.
Yeah, I'll just tell the gas company, electric company, internet provider, my bank, my elderly neighbor who can barely use a phone and I taught how to text, every restaurant I order online from, the plumber I just texted literally an hour ago due to a pipe leaking to just... not use SMS. I'm sure they'll listen.
I assume you live in a place where SMS isn't necessary? In the U.S. it is.
> my elderly neighbor who can barely use a phone and I taught how to text,
I tell them to either e-mail me or stick a handwritten note on my door. E-mail is WAY easier to use for elderly people in my experience. You get nice big keyboards, big fonts, big screens, and it works on any device you own, not just one. But if they disagree they can still handwrite a note to me
> every restaurant I order online from,
I use a fake number for these. They don't need my number any more than I need their wait staff's phone numbers. Never been a problem. I just go pick up and say my name, no SMS bullshit.
> gas company, electric company,
Especially when there are issues that's how mine send updates. To say nothing about companies that require 2FA through text!
> bank
I can't use VOIP numbers with them, not sure about Twilio.
> my elderly neighbor who can barely use a phone and I taught how to text
You make the assumption that they even have a computer: they do not. They do normally just knock on my door, but they want to send and receive pictures to their family and other people who do not live close by.
> every restaurant I order online from
I want to know when my order is ready.
> the plumber I just texted literally an hour ago
He asked for a picture of the leak and to text it to him. He's reliable and has done good work before, I'm not going to switch just because he doesn't use email.
My point in all of this is that in the U.S. SMS is ubiquitous. As much as I would love to leave it behind, there are just so many situations where you need SMS.
Honestly not really, in the US. You can usually find ways around it if you tell the business that you don't have SMS. With governments I don't think they can legally require you to have SMS.
When they find out it's incredibly difficult to deal with you because of the design choices they made, it helps dethrone SMS, one business at a time. Vote with your behavior. Make them realize they made a bad choice by picking SMS.
I hate SMS too, but I think this decision will hurt Signal infinitely more than it will hurt SMS. By that I mean it will not affect SMS at all and only Signal.
I tell everyone I don't use SMS. The only ways to message me are e-mail, Signal, WeChat, FB, and Instagram.
E-mail is the best "generic" way to reach me that isn't tied to a company's platform, and a much, much better UX than SMS in almost every way, especially when travelling internationally with multiple devices.
Very disappointing and upsetting. I use Signal as my primary SMS/MMS app on my phone, and use a few Signal chats as well with people. This is going to be really annoying. I'm probably going to just stop using Signal altogether to be honest.
Most people in my social circle use Snapchat or iMessage for "texting", for reference.
Mmm...
You can use end-to-end encryption with Telegram if security is your main concern.
I don't see how it being "Russian owned" is of any concern, but if you feel like privacy is an issue then you're free to claim their $300,000 prize at stake or just take part of their ongoing bug bounty programme and be rewarded by spotting flaws.
Why doesn't anybody fork the Signal clients? There are so many bad design decision in the clients (for instance no message backup on iOS or no way to save all media to storage automatically) that I don't understand why people accept the Signal Foundation's stewardship of the client code.
There are forked clients, but usually you can't use Signal's server infrastructure, so you need to roll your own, and now it brings another set of problems.
Because while both the server and the client are Open Source, the server doesn't federate. If you want to be able to communicate with anyone, you have to use the official server instance. And the official server instance doesn't allow unofficial clients (though some clients seem to get away with it for a while).
Molly[1], a fork of Signal, seems to work fine. I've used it for a long time and never had any issues with it (and it connects to Signal fine). But for security reasons one of their changes was dropping SMS, so switching to it won't do you any good there.
One Signal feature that I always wanted, and will apparently never get, was the ability to send the same message via SMS & data, and have the duplicate cancel out on the other end. Service is spotty in my region, and I routinely have either cellular or data connectivity.
I initially downloaded Signal assuming it had that feature. Then they removed encrypted SMS entirely: https://signal.org/blog/goodbye-encrypted-sms/ -- I almost uninstalled the app then.
I'm very upset by this decision. I've been using Signal as my SMS app for a very long time.
Messages that I would have sent via SMS currently will automatically get sent via Signal if the person I'm sending to has started using Signal without my knowledge. This has happened in several instances where I was pleasantly surprised to see a friend had started using Signal. Now that I'm forced into a separate SMS app, this will no longer be a possibility. I certainly won't be firing up Signal to see if a contact has joined before sending them an SMS.
This. Now you have to remember who is in Signal and who isn't. All because apparently the double-check mark for messages between Signal users and the unlocked icon for SMS messages is too hard to comprehend. SMH.
I have been receiving notifications that a person in my contact list is now using Signal for years.
Apart from that, your use case has another possible issue.
If a person stops using Signal, your messages will go to the void until Signal actually removes the user and your client switches back to SMS. This has caused a lot of confusion for some of my friends when I switched my signal account to a different phone number.
I think it's more reliable to use Signal for Signal.
If I understand this, if I use SMS, I can send to everyone. If I use Signal, I can send to Signal users only. But I don't remember who's on Signal, and who's not. So I guess I will stop using Signal.
If I want to message someone I open the contact and click on one of the messengers that are listed for the phone number. Why would I leave the memorizing to my brain?
Huh. I've never used contacts that way. I suppose it could work but that's a new extra step. My Contacts list is gigantic and full of bullshit I don't care about because it's sync'd from work and flooded with people I don't know. Usually I just find the conversation from the chronological list (which is more of how I remember things). Maybe there's some way to sort contacts by recent use? It just seems like that's leaking metadata to push all of that context into Contacts. Anyway that seems maybe plausible if it can index or springboard to convos in other apps.
Theoretically couldn't an Android app be built using notification access to track notification history and coalate messaging notifications (combining notifications from all/selected/configured) messaging apps? That sort of a "messaging hub" could be even better, frankly.
What'd be even better is if there was a central "messaging" interface where all the various implementations can register as messaging service providers and all your conversations end up in one place.
Well this is also a problem. As it's said in the article, you risk getting charged for an SMS, that in some countries are expensive, most mobile plan in my country have 30+Gb for 7 euros at month, but SMS are 20 cent *EACH*. Practically in my country nobody uses SMS, and SMS are used only to receive 2 factor authentication codes (and spam).
Anyway a normal person already uses multiple messaging applications: WhatsApp, Telegram, Facebook Messanger, Instagram direct messages, the good old email, SMS (I guess somebody they are still used reading the comments), adding Signal it's not that big deal.
Off topic slightly, but it amazes me how much SMS is used in outside my country (maybe just US?). I literally never SMS any personal contacts, usually WhatsApp. Even business stuff, sometimes initial contact may be SMS and then could often move to WhatsApp.
I use signal with a small circle of friends, but no one I know uses SMS anymore.
I have WhatsApp installed for two different group chats, Google Chat for another couple of group chats, but apart from that SMS is the standard here (which means opportunistically iMessage / Signal). I'm in Australia, where SMS typically have no per-message cost (the only thing that's charged per use on most mobile plans here is data and international calls).
In Ireland, an SMS used to cost 13c, if I remember correctly.
So when apps like viber, WhatsApp, etc came on the scene, people jumped on them quickly and completely stopped texting.
This was before they even had voice calling.
With voice calling, it is also popular, as you can call someone irrespective of what country they are in and not worry about roaming or international call charges (even though in the EU now we do not have roaming charges anymore).
Some people even use WhatsApp for normal calls over normal cellular calls!
Oof. As an Android user, this sucks. Though I have my frustrations with Signal (cellphone number, address book hashing, centralization, the cryptocurrency stuff, removing storage encryption) -- it's still the only app I trust. Even more than the stock Samsung messaging app. I don't want to trust another, and I don't want to have to bifurcate my messaging flow.
All of my family use iOS though, so this is already their use case. I understand less code is more secure, and a unified codebase between devices is good -- heck. This might even lead to no more phone number requirement.
But this still stinks for my use case.
FWIW though, I was more upset about the cryptocurrency thing.
I am unhappy with this change, but I can cope with it. I'm more concerned with my tech-challenged family members who don't understand the distinction between different messaging services or have any understanding of security. Until now, Signal has been good for them because they only need to deal with one application and they get some added security among our group. After this change, I fear they'll just use the SMS app exclusively (out of inertia) and Signal will collect dust.
648 comments
[ 2.0 ms ] story [ 374 ms ] threadThat is hard to swallow, being able to quickly send a message through SMS to the same receiver in emergency situations* was quite handy.
*like when you're at a protest and the tower is overloaded, or you're on a remote location and you see that the Signal message doesn't get through because of lack of 3G/LTE connectivity.
I also think it'll hurt the value proposition when getting people to join signal. Not overcomplicating the messaging scenario was a big winner to do that.
A user already has:
- WhatsApp
- Telegram
- Facebook Messanger
- Instagram that has direct messages
- the good old email, or better, many of them
- Microsoft Teams for company communications
- Discord for communications with group of friends
- the old SMS (that I didn't even know that in some parts of the world were still used, since I receive them only for 2 factor codes, notifications about my card transactions, and spam)
Adding another app is that a big deal? By the way I don't use Signal, but not for the reason of not having another app on the phone, just because I don't know anyone that has it and actively use it.
Hell, even my aunt that doesn't know nothing about technology has WhatsApp and had me install Telegram because the church opened a channel on it!
Also use DMs on Twitter relatively frequently.
Personally, I use only two of those apps you listed for messaging, and for all the others, I say, "Sorry, I don't use that one."
That's why it was a huge advantage that, on Android, Signal could replace a SMS client. You weren't adding _yet another_ messenger to the list, you were replacing the SMS client with one that could send secure messages. That made "switching" to Signal (which, ofc, was not a switch at all for my friends who use SMS) much easier for me. I could continue texting my friends and seamlessly switch to secure messaging if they ever got signal.
Contrast this with my friends who kept their old SMS client who reliably forget to check / use signal and generally tend to go back to texting me in a few weeks. Even if you send 0 signal messages for a long time, by switching you SMS client you are already setup to receive them and will habitually open an app that supports E2E encryption.
For example - Facebook Messenger also supports sending and receiving SMS messages - likely because they've done the research and found it drives adoption.
Literally the only reason I recommend others and use Signal myself?
Seriously, Signal doesn't have the userbase to drop SMS support. All my Signal contacts use WhatsApp or Telegram that I already have installed. I use signal mostly as a SMS app, secondly as E2E communication. It will be easier to uninstall Signal.
A messaging app should have one clear behavior per interface. This was "maybe secure, maybe not". I have an SMS app for that (well, VoIP-sms, because I'm weird).
Can you say more about what's confusing about this for you?
and the workflow when adding someone is different (waiting for approval or not).
Not that anyone really uses SMS anymore in [nearly everywhere].
4.4 stars. I believe it's $3 or $5 to remove ads now.
https://play.google.com/store/apps/details?id=com.textra
https://f-droid.org/en/packages/com.moez.QKSMS/
Heck I can't even use Google Messages in my phone without gapps.
I hope it's communicated well to users who aren't readers of Signal's blog. I have relatives who use Signal, and they rely on its fallback-to-SMS feature, possibly without fully understanding it. I'll make sure they understand and are aware of this change, but others may be in the same position.
https://community.signalusers.org/t/dont-want-pin-dont-want-...
Even when security concerns were brought up:
https://community.signalusers.org/t/proper-secure-value-secu...
Because Whatsapp and Signal are walled gardens. (Everyone knows why IM>sms)
Until next year?
https://www.europarl.europa.eu/news/en/press-room/20220701IP...
"... those designated as gatekeepers will have to: allow third parties to inter-operate with their own services, meaning that smaller platforms will be able to request that dominant messaging platforms enable their users to exchange messages, send voice messages or files across messaging apps. ..."
(I admit that I actually edited that original comment, since the link I initially included was more speculative, talking about a law that was expected to pass, and being much more vague about when it might enter into force. The page at the updated link is more definitive, but not as narrowly focused, so I'm glad you managed to isolate the relevant section.)
This is why we need at least open source clients that can be forked when these decisions are made.
[^1]: https://wordpress.org/about/philosophy/
Taking that factor away - allowing people to mess it up - makes it easier for developers.
Rock solid and both works and looks great right out of the box. So customizable that using literally anything else feels like using a Fisher-Price computer for toddlers.
Windowing rules for one. Simple example: Firefox picture-in-picture. On KDE I have a windowing rule so that if from any firefox window playing video I hit the picture-in-picture button the picture-in-picture window becomes a certain size, goes to a certain placement on my monitors, stays on top of all windows, and is visible across all virtual desktops.
Ability to control the layout of my virtual desktops is also incredibly useful to me. (I use a 3x3 grid, so switching from my "main" task in the center to any one of 4 sub-tasks up-down-left-right is easy, and my universal tasks (chat/email/etc) go in the 4 corners.
KDE puts you in control, and gives you a LOT of control. IMO GNOME feels much more windows/mac in it's design philosophy. "We know best, do it the way we let you."
And as far as an API, yes, also that. With the Plasma desktop plugin Firefox remembers which virtual desktop each window is supposed to go to, so I have no issue rebooting with 5 or 6 different windows open.
I apologize if it sounds over the top, but for my use-cases at least the level of control and "just does the right thing" really do stand out above the alternatives.
I am very intentional and active when it comes to what has push notification privileges. I factor that into my app use consideration. I have multiple email accounts in two different email apps, each that send me notifications. I have Signal, Discord, iMessages and SMS. I have a few Google chat apps. I used to have WhatsApp and Wickr and Telegram. I have Skype, Teams, and two Mattermost servers.
It’s exhausting to constantly switch between these, so over the course of a few years I’ve been very clear in where people can expect to reach me reliably. If you need or want to chat with me on Discord, Skype, or Google whatever you need to send me an iMessage, SMS, Mattermost, or Signal message. Sending me a message anywhere else will get you a response only the next time I open that app. That only happens when someone specifically asks.
I’m OK with having 63847394038 chat and video calling apps, but I’m not OK with being instantaneously notified by an infinity such apps. I can’t be that available.
It also puts a spot-light on the "your phone number is your username" policy. This made perfect sense when you are using Signal for opportunistic encryption of texting. It is much less justifiable when using it as a Silo'd app. I really hope they change that and give people who were waiting for that change time to join before killing SMS support.
That’s a major boost for those that might not particularly care about encryption to look for specific messaging apps, while still helping by building out the network slowly over time.
This became much more of a problem for me after they rolled out their shitcoin; suddenly my techie friends were just not responding to messages, and Signal as my main SMS app was not falling back to SMS for these folks.
I’ve only done the switch from iOS to Android once and I remember it was a pain for a few days until everything realized I didn’t have iMessage anymore.
The user cannot just log out of Signal and have the app on other people's devices automatically fall back on SMS the way it works with iMessage?
Logging out might not even be enough, depending on the logic on Signal’s side. Do they use active devices, or just that an account exists?
For two weeks, messages will be shown as sent but not delivered, and after two weeks Signal will not let you send messages to that number until it reconnects to the Signal servers.
For comparison, Apple automatically sends all SMS messages via iMessage opportunistically, and if the user then switches to another phone, all SMS messages from iOS users will be silently discarded in perpetuity. This is a big problem because the recipient has no idea that they're missing messages, and also if they no longer have access to an iPhone, there's no way for them to deregister their phone number from iMessage.
https://selfsolve.apple.com/deregister-imessage/
They will also deregister you automatically after some period of time. What you described is the situation several years ago, but it's much better now.
In that case, Signal's current behavior would be comparable to Apple's, if Apple also deregisters you after a period of inactivity.
I'm willing to bet that this decision is just jumping the gun by a month or two since usernames are around the corner (code exists, just not enabled. Can be used if built from source).
Though I haven't had a hard time converting (Android) users by using another app. Especially people that already use WA. The "other app" just comes off as normal. Apple is a different ball game because the walled garden, but that's also the weakness because you can't send photos/videos in group chats with mixed devices (but Signal can).
But I actually like this decision. It makes things less confusing and accidental use of unsecure SMS impossible. The downside is if you still use SMS you have to keep 2 apps, back them up separately, etc.
> "Why do I need 3 apps (Android Messages, Signal, Whatsapp)"
"You need Signal to talk to people on Signal, WhatsApp to talk to people on WhatsApp, and Messages to talk to people on SMS." Seems more straightforward than "use WhatsApp to talk to people on WhatsApp and Signal to talk to people on Signal or SMS; just pay attention to the color of the send button".
I feel like I'm not leaving Signal; Signal is leaving me.
I don't know anybody else who uses Silence so I could exchange encrypted messages with them.
Oh well. Maybe somebody here could resurrect this?
https://f-droid.org/en/packages/org.smssecure.smssecure/
https://git.silence.dev/Silence/Silence-Android/
I learned to stop trying to improve the technical lives of other people after Dropbox's decision to restrict free accounts to three devices resulted in a shitstorm of angry and confused messages from half the people I know.
But I have to admit your perspective calls to me. I can imagine it would feel quite freeing.
I’m in a minor mess of a situation with my dad’s phone and computer because I’ve tried to be helpful. Now he resists help and that makes both of us frustrated.
I had recommended signal to others, but thankfully I've already warned those same people against continuing to use Signal years ago. Nobody was mad at me for Signal's actions and changing your default SMS app isn't hard anyway.
I don't think you have to stop recommending things to people just because situations change. Hasn't everybody had some service or software they depended on go from great to shitty? It's just the nature of using someone else's stuff. At some point they get greedy or busy or decide to pivot into something different from what you want and you have to find something new. Isn't everyone used to that? Why would they blame you?
https://github.com/Telegram-FOSS-Team/Telegram-FOSS
>This is an unofficial, FOSS-friendly fork of the original Telegram App for Android.
Anyway, there is no need to worrying, MOSSAD watch as all.
I'm glad privacy is becoming mainstream but dislike lowering the bar for adoption to where it profoundly affects users.
That's what is nice about signals implementation is it stands. It supports acting as the SMS default app on android and defaults to signal when it can.
Sure they handle SMS, but the real problem here is that Signal is just another walled garden: they have an overtly negative stance towards alternative clients, while also having very bad support for anything besides android/ios: they have a bad desktop client and they don't have a nice library. Altogether this means that Signal is overtly and willingly against things like Pidgin / multi-protocol clients or overlay, which is what the users want (ie not caring about protocols).
Signal doesn't want to deal with SMS anymore, which from an engineering and high-stakes security pov is a completely valid decision. Yet if it had clean and open local API or a simple and portable client library, or had a stable server API, then someone else could provide multi-protocol clients, tailored to each platform in a secure and stable way.
Now to my actual question: How is Beeper compatible with the ToS of platforms like Instagram and Facebook that, to my knowledge, don't allow their users to use 3rd-party apps? Case in point: I recently wanted to use a FOSS 3rd-party messaging app for Instagram and my account got promptly banned.
Question 2: Do you support full message backups in a well-documented format?
Anyways e2ee and sms doesn't mix well
What do you purists use to talk to all the random people around you? Do you reply "I'm sorry, it's too insecure for me to answer that, you'll have to install Signal first" messages when more distant colleagues ask you if you're at your desk right now? Do you teach your grandmother to use WhatsApp so her birthday greetings won't be intercepted by the NSA?
(Admittedly, the email situation at work being utter trash may be coloring my opinion here.)
This one app nonsense is asinine. You’ll never get global adoption of one thing.
Do you not?
Signal was always one of those "win-win" apps, get more security when it's available and I don't have to worry about adding to the giant bucket of messaging apps.
They were a paragon of putting the user first and I was a strong supporter... but now... Why not Telegram? Or anything else?
I don't need the security, it was nice-to-have. Having to switch between Signal and other apps is a heavy amount of friction.
Telegram is absolutely the worst when it comes to privacy, it has access to everything you do and say.
If you want a master app, have a lot at matrix.org with bridges.
In reality almost no one bothers with secret chats (no syncing between devices, no backup and no group chat possible). Instead everything is stored online without E2E encryption, i.e. perfectly readable for the service provider.
Sorry, but "everything" != "almost everything". So it's false that "Telegram has access to everything you do and say".
False, I use them.
Really? Telegram never said that they don't store your messages on cloud, they said that they do not sell your data or share it with third parties for profit.
Telegram has received a very good score on PrivacySpy (https://privacyspy.org), in fact better than any other messaging app. Telegram is good from a regular privacy perspective unless your threat model involves fearing cloud convenience.
Even FBI's leaked documents confirmed that Telegram does not ever share user data easily. [Source](https://www.securitynewspaper.com/2021/11/30/leaked-fbi-docu...)
If you're someone who requires spy-level opsec, you should be using Threema, Session or Speek. Maybe even a self-hosted XMPP instance.
Telegram is good at what it does and it states it very clearly. It does not lie about the things it does and it is open source. All while not selling user data, not manipulating user behavior through algorithms or censoring media by calculating hashes and providing what's arguably the most feature rich messaging app on the planet for free with a verifiable source code.
Also, be careful with what you're suggesting. Not only have Matrix servers been hacked twice but matrix also leaks metadata. If you're seriously suggesting true anonymity (not consenting privacy) then Matrix is not a good option.
Yes, really. You don't even argue against it.
> pp. Telegram is good from a regular privacy perspective unless your threat model involves fearing cloud convenience.
Telegram stores almost everything online without E2EE.
> Not only have Matrix servers been hacked twice but matrix also leaks metadata.
Even Signal leaks meta data.
> If you're seriously suggesting true anonymity (not consenting privacy) then Matrix is not a good option.
Out of Matrix, Telegram and Signal, Matrix is the best option. It is the only one not making you share your phone number giving you anonymity up to your IP address.
and yet I just did. Can we please stop confusing privacy and anonymity?
Your claims about Telegram being bad for privacy are baseless. Your concerns about messages is valid but it in no way compromises privacy because:
1. No telegram employee can read any messages. They use distributed key generation to encrypt data on servers which means no single server has access to decryption keys and all the servers are in different jurisdictions.
2. They do not sell message content data. If you can prove it, you can go ahead with a lawsuit and win a hefty sum.
3. They do not compromise security. They do not use E2EE by default. Their threat model and vision for a messaging platform is different than yours.
4. Telegram has never given message content for a court order. As mentioned in the privacy policy, they give out only the phone number and IP Address only in case of terrorism or child abuse and only when there's a court order from a country of a higher democratic index.
5. If you truly believe Telegram is bad for privacy even after all the evidence from FBI itself and PrivacySpy giving it a higher score than Signal, then please go ahead and sue them because surely they can't have a good privacy policy and bad privacy at the same time.
This is wrong. First, reported messages (via id) are read by employees. Second, regardless of your claims, Telegram can easily write a service which has access to plain text messages.
> 2. They do not sell message content data. If you can prove it, you can go ahead with a lawsuit and win a hefty sum.
How about you prove your claims? I hardly can bring them to justice when even the police doesn't have immediate access to them.
> 3. They do not compromise security. They do not use E2EE by default. Their threat model and vision for a messaging platform is different than yours.
Actually, they do by not using E2EE by default and providing bad encryption possiblities.
> 4. Telegram has never given message content for a court order. As mentioned in the privacy policy, they give out only the phone number and IP Address only in case of terrorism or child abuse and only when there's a court order from a country of a higher democratic index.
no idea about that
> 5. If you truly believe Telegram is bad for privacy even after all the evidence from FBI itself and PrivacySpy giving it a higher score than Signal, then please go ahead and sue them because surely they can't have a good privacy policy and bad privacy at the same time.
Since when is "bad for privacy" a reason for suing? The quality of a privacy policy doesn't have anything to do with privacy itself btw.
> and yet I just did. Can we please stop confusing privacy and anonymity?
I didn't, did I? please explain
These are again baseless claims. If you think MTProto 2.0, an encryption algorithm that has been audited multiple times by independent researchers is 'bad encryption', I'd like for you to prove it. Obviously, if you can prove it's bad, you could let Telegram know and win a bounty.
> How about you prove your claims? I hardly can bring them to justice when even the police doesn't have immediate access to them.
The burden of proof is not me as I did not make any claims, I simply restated what's on the Telegram website.
Even the FBI, Iran or Russian government couldn't bribe them so I do trust Telegram to not backdown on their statement and philosophy about not selling or using userdata for profit. https://twitter.com/durov/status/912812889236475904
> Second, regardless of your claims, Telegram can easily write a service which has access to plain text messages.
You do know even Signal could add a keylogger service to read message content right? I don't suppose their Google Play Store version has reproducible builds. See how easily arguments like these break down? You can almost assume anything and claim almost anything. As I said, these are baseless claims and assumptions. I'm only interested in the objective truth at the moment, not assumptions or guesses.
> Since when is "bad for privacy" a reason for suing?
You're suggesting Telegram's privacy policy is in direct violation of their privacy practices which is illegal. This is a huge claim, if you can prove it you should sue them, I'd honestly do that if I were you.
> I didn't, did I? please explain
Privacy is about choosing what to share, not about sharing nothing. You seem to lie more on the anonymity side of the argument than privacy rights. You're fighting for anonymity, not privacy if you claim malicious intent on Telegram's part because as I showed earlier, their privacy practices and security are totally A OK.
Currently Matrix is operating in a way that larger instances aggregate private messages from bridges in plain text. Those messages would have stayed encrypted and secure if people didn't use Matrix.
That's not true in general. For most if not all messengers (at least encrypted ones), there is the option to use Bridge-to-End encryption on the Matrix side, which doesn't give the homeserver any possibility to inspect messages let alone aggregate them.
So if you run the home server somewhere untrusted, but the bridge in your home with E2EE enabled, the decryption AFAIK happens in the bridge, and the home server doesn't see anything.
But its definitely better than falling back to SMS and maybe better than having all chat apps installed.
(Even though I still think Element isn't good enough)
> Signal was always one of those "win-win" apps, get more security when it's available and I don't have to worry about adding to the giant bucket of messaging apps.
Same here. I see no reason to continue using Signal if they do this.
Now? Delta chat is looking plenty fine for doing private group chats.
My threat model is not nation states watching my metadata, I have horrible opsec for that. My threat model is discord and whatsapp etc. tossing me and my chat groups off a cliff at their sole discretion.
Signal gave me control over chat groups, and integrated with SMS as a bonus. Now? If I'm gonna have to deal with a separate SMS app anyways, I might as well use delta chat where I know my messages are automatically backed up in my email account.
Next step: Please stop using phone numbers as a user ID. I have lots of throwaway phone numbers, but many people don't want to leak their phone number to every single person they want to have an encrypted conversation with.
I assume you live in a place where SMS isn't necessary? In the U.S. it is.
Mine don't need SMS
> internet provider,
Also doesn't need SMS for me
> my bank,
F them, I use a throwaway Twilio number for this
> my elderly neighbor who can barely use a phone and I taught how to text,
I tell them to either e-mail me or stick a handwritten note on my door. E-mail is WAY easier to use for elderly people in my experience. You get nice big keyboards, big fonts, big screens, and it works on any device you own, not just one. But if they disagree they can still handwrite a note to me
> every restaurant I order online from,
I use a fake number for these. They don't need my number any more than I need their wait staff's phone numbers. Never been a problem. I just go pick up and say my name, no SMS bullshit.
> the plumber I just texted literally an hour ago
I don't text plumbers, I e-mail or call them
> bank I can't use VOIP numbers with them, not sure about Twilio.
> my elderly neighbor who can barely use a phone and I taught how to text You make the assumption that they even have a computer: they do not. They do normally just knock on my door, but they want to send and receive pictures to their family and other people who do not live close by.
> every restaurant I order online from I want to know when my order is ready.
> the plumber I just texted literally an hour ago He asked for a picture of the leak and to text it to him. He's reliable and has done good work before, I'm not going to switch just because he doesn't use email.
My point in all of this is that in the U.S. SMS is ubiquitous. As much as I would love to leave it behind, there are just so many situations where you need SMS.
Honestly not really, in the US. You can usually find ways around it if you tell the business that you don't have SMS. With governments I don't think they can legally require you to have SMS.
When they find out it's incredibly difficult to deal with you because of the design choices they made, it helps dethrone SMS, one business at a time. Vote with your behavior. Make them realize they made a bad choice by picking SMS.
I lost you there
I tell everyone I don't use SMS. The only ways to message me are e-mail, Signal, WeChat, FB, and Instagram.
E-mail is the best "generic" way to reach me that isn't tied to a company's platform, and a much, much better UX than SMS in almost every way, especially when travelling internationally with multiple devices.
Most people in my social circle use Snapchat or iMessage for "texting", for reference.
[1]: https://github.com/mollyim/mollyim-android
Messages that I would have sent via SMS currently will automatically get sent via Signal if the person I'm sending to has started using Signal without my knowledge. This has happened in several instances where I was pleasantly surprised to see a friend had started using Signal. Now that I'm forced into a separate SMS app, this will no longer be a possibility. I certainly won't be firing up Signal to see if a contact has joined before sending them an SMS.
Apart from that, your use case has another possible issue. If a person stops using Signal, your messages will go to the void until Signal actually removes the user and your client switches back to SMS. This has caused a lot of confusion for some of my friends when I switched my signal account to a different phone number.
I think it's more reliable to use Signal for Signal.
Bingo.
My launcher (Niagara) does that already to display notifications in popups connected to app icons.
Notification processing is one of Android's greatest features over iOS.
Anyway a normal person already uses multiple messaging applications: WhatsApp, Telegram, Facebook Messanger, Instagram direct messages, the good old email, SMS (I guess somebody they are still used reading the comments), adding Signal it's not that big deal.
So when apps like viber, WhatsApp, etc came on the scene, people jumped on them quickly and completely stopped texting.
This was before they even had voice calling.
With voice calling, it is also popular, as you can call someone irrespective of what country they are in and not worry about roaming or international call charges (even though in the EU now we do not have roaming charges anymore).
Some people even use WhatsApp for normal calls over normal cellular calls!
All of my family use iOS though, so this is already their use case. I understand less code is more secure, and a unified codebase between devices is good -- heck. This might even lead to no more phone number requirement.
But this still stinks for my use case.
FWIW though, I was more upset about the cryptocurrency thing.