TBH this was my reason not to use Signal at all... same with WhatsApp super annoying linking between mobile and desktop :/
Why can't we use XMPP where you can have multiple device and accounts without required mobile phone? Oh I know - because dumb walled gardens and BigTech not liking it... it's a mirracle we got away with e-mail before they came to power :/
Doing end-to-end cryptography is hard enough to get right. Adding multiple devices to the mix makes it even harder.
So it's an explicit trade-off, made to keep your communication safer. Signal, in general, is uncompromising about privacy and about keeping metadata out of their hands.
YMMV and it's always down to threat model... absurd ammount of information is sent via plain text email
in case of XMPP you have OMEMO which is multi device and works fine-ish (nowadays) though I would still prefer simpler OX (PGP; pefrect-forward-secrecy is an overkill IMHO for majority of people)
If you think a device with storage mechanism that can simply connect to another computer and view all your keys is safe enough for your communication needs, then it is fine, you don't need to use Signal.
People use Signal because they don't want to be compromised when they just leave their phone / laptop unattended for a couple minutes on a bus or a train. They don't want to be in a situation if one day their laptop gets computer virus and they have to assume all these accounts are compromised and have to restart their digital identity all over again.
Account is compromised as long as it could be accessible to someone for reading, and potentially impersonation. Possibility to revoke access doesn't mean 'uncompromisable', it means 'easier mitigatable'. The real barrier here is practical restriction of access, and OS-level data encryption, and it works equally well (or equally bad) for any software, whether it's XMPP-based or it's Signal.
Unfortunately linked accounts don't count as primary devices so you will always have to keep the original device active or else they'll eventually delete your account.
I have the opposite use case where I need to have two Signal accounts on a single phone. Having Molly alongside the official Signal app was always the solution, but I wish Signal would allow switching between profiles, or Android would allow arbitrary user accounts (I don't really want to add Signal to my work profile).
Which is a massive pain to use for stuff like this, and it explicitly recommends against using it with apps that use notifications when you enable it. It shuts down constantly, like as soon as your phone locks (at least for me), and won't process push notifications until the space is opened again.
I really don't get why they don't just give you a thing to install something as many times as you want. It's insane that you still have to use these weird workarounds.
I've used work profiles too. Together, that gives you a total of three installs of an app, all with strange (and different) interactions and limitations between them. All of which is quite different than you'd expect for a "let me have two of this app" feature (because it isn't one, though it's frequently propped up like it is).
Android work profiles allow you to run multiple isolated copies in parallel - with separate address book and all. Works very well for Signal. I wish there was something similar for iOS.
Someone in that thread notes that when you install the Signal APK from here [1] it "doesn’t get updates tho", but this isn't the case. Signal will update itself; you get a notification to update. Often earlier than the Play Store, probably due to its reputation to randomly delay updates.
Yes, it notifies of updates (once it did wake me up in the middle of the night), but last time I checked, it does not update itself automatically. Obtanium works, though, but a bigger issue is the extreme power drainage of the websocket.
Signal sends you a notification that says "new version available, tap here to update", but tapping it never did anything for me. I have to re-download the apk their website every time there is an update.
Yeah. Installed Signal as raw apk in GrapheneOS and you just need to open it to install the update. It does not update automatically in background. But anyway, works.
If anyone is interested, I run my own minimalist fork of Molly named Polly.
I just released a stopgap with the fixes:
- RingRTC 2.73.0-1, which includes the call-teardown fix (the hangup/hot-mic issue)
- Signal's blacklist of the eight compromised eMudhra TLS intermediates
It's still based on Signal 8.19.2. The build is arm64-only and Android 14+.
Plug: I also maintain my own UnifiedPush distributor app that optionally pairs with a notification gateway: https://git.lonecloud.dev/lone-cloud/prism-android
My motivation for Prism was to get Proton Mail email notifications delivered via UP, which requires a self-hosted Prism server.
Sometimes I get the feeling that Signal hates users who aren't total normies. Unified Push, which works flawlessly on Molly, could easily be implemented in the regular client. Just as they could easily offer a Google free version for F-Droid or simply for people who want nothing to do with Google. But they just refuse. Just like it took years for nicknames to be introduced, and registering without a phone number has only recently become possible and only through the Google Play Store.
Using the preinstalled Google services effectively turns your smartphone into spyware. In the standard Android that comes preinstalled on most smartphones, Google services run with system privileges and can collect all kinds of data including location data. If Signal exclusively supports this, it reinforces dependence on Google and discourages people from using versions of Android that don’t include Google’s spyware.
The whole point is that it's unusable without Google services due to battery drain. Meta got it right with WhatsApp and a battery-efficient WebSockets implementation for notifications without Google services, but Signal's implementation is poor.
This is an exaggerated take. I've been running Signal on LineageOS for years across at least 5 different phones in exactly this manner with no Google services installed. I'm currently using a Motorola G84 and charge every 2 days with moderate usage; Signal is my primary communication method with family.
The G84 has a very good battery by default though, judging from its predecessor. It can take some additional strain. Something weaker will suffer more.
I have run Signal on LineageOS or GrapheneOS for nearly a decade, no Google services, and I have always had satisfactory battery life, i.e. ~2 days of normal use.
I bought a PinePhone, so I definitely know what truly unoptimized battery life looks like, lol.
It's a moot point, as Signal isn't going to support self-hosted notification servers any more than it'll support self-hosted communication servers.
Signal works without GMS or any alternative, at the cost of more phone wakeups. This is much more preferable to everyone whose WiFi or data service you use see you connect to "push.myownname.com", or for you to rely in some rando gatekeeping your message delivery.
There is no reasonable reason why they shouldn't support it. Having my cell phone battery drain faster is a much bigger drawback for me than simply hosting my own push server at home.
I'm not sure if the comment above you is correct, but if it is (meaning Signal would benefit from the anonymity of every client being the same/similar, like TOR), then this would go against that.
That being said, I've never heard this mentioned as a benefit of Signal, and I figured the main benefit was y'know robust and proven E2E encryption.
This argument doesn't make sense, Signal is fundamentally not an anonymity tool. It's a privacy tool.
They intentionally store very little data about their users but their "mailbox" model explicitly means that the server (or an attacker) can figure out who is talking to whom. And that's fine! Signal isn't trying to be an anonymity network, so while stuff like sealed sender are nice features it's important to remember that anonymity breaks are explicitly not part of the Signal threat model.
"Don't stand out" only makes sense as advice for anonymity tools to avoid bifurcating the anonymity set -- it doesn't make much sense when you're taking about a service which links your account to your phone number and thus every server request is explicitly identifying you.
One of the goals of Signal is that they do not know who is talking to whom. Sealed sender and all that. This can possibly break down in certain scenarios with some server-side correlation. But they certainly do have a design goal that the social graph is entirely private.
I am aware of sealed sender, I even mentioned it in my comment. ;)
My point is that by construction they are not an anonymity tool, no centralised server can be. They can add features to make it less easy to track users but that's not the same as providing anonymity, and it's important to not confuse the two.
To give an example: my email provider has a feature to auto-encrypt all inbound emails to a PGP public key. Is this a nice feature to make it harder for someone to read my past emails if someone gets access to their infrastructure? Sure. Does this make my emails end-to-end encrypted? Absolutely not. In a similar vein, Signal making social graph correlation harder is a welcome feature but is not the same as making it anonymous.
> When you say "Each group of users can have their own servers" you aren't enhancing privacy you are standing out.
You're also hedging against mandated government backdoors.
A single organisation like signal can easily compelled to add a backdoor (or leave the territory) like the EU is trying to do. Going after thousands of servers individually is a whole different problem.
>You're also hedging against mandated government backdoors.
Let's see the law that allows compelling backdoor into Signal then. AFAIK https://en.wikipedia.org/wiki/Bernstein_v._United_States established code as speech, meaning compelling backdoor is compelled speech, which goes against the first.
There just is a contention between software freedom and privacy that people don't want to acknowledge sometimes. Signal is firmly on one side of the divide, and their software is open source because it is the convention to have the source public and auditable, not because they are interested in user freedom and respect.
It's not that they're not interested in user freedom and respect. They just have different ideas about what's important. If Signal federates, that will bring to the table all sorts of 3rd party clients who will have say in how Signal does things, yet no duty to comply with the Signal's spec sheet and deploy timely protocol updates and features. Any clients not keeping up are damaging the brand, as was in the case of Matrix clients' poor support for E2EE. Then there's the aspect that the larger the organization managing the spec becomes, the easier it is to infiltrate and clog with bikeshedding.
Signal's strength is its security agility and thoughtful feature design, not federation and availability.
But that is my point, there is a contention and they made their call. It is not wrong for them to do so, there are just plenty of people who prefer the other side.
Signal isn't anonymous. The server has access to your IP addresses and the server can at will build social graphs about the users.
Where Signal's safety in numbers happens is in normalization of end-to-end encryption. Users who want to protect their message content are not standing out from the rest, unlike in e.g. Telegram where the vendor sees with whom you enable secret chats.
>I think most messages are P2P unless the user activates relaying?
No they're all routed through the servers. It's only the calls that can be sent P2P and you have to opt in for that. The issue is that leaks your IP address to the contact who may not be trustworthy, so it's not used by default.
Discovery is important and a hard problem, worth making some trade-offs for. Signal published a good blog post about this, including this passage:
> In order to turn the address book on a device into a social graph for Signal, the Signal client needs to be able to determine which of the device’s contacts are Signal users. [...] The obvious problem with this method is that the hash of a user identifier can almost always be inverted. [...] This method of contact discovery isn’t ideal because of these shortcomings, but at the very least the Signal service’s design does not depend on knowledge of a user’s social graph in order to function.
When they say "social graph for Signal", afaik they don't mean 'on Signal servers' but 'social graph on your phone'. It's a personal social graph that exists on the end-user device.
I don't remember how the hash issue is dealt with, however.
> Signal is not peer-to-peer. It is a centralized, client-server architecture.
It's not a P2P mesh, but Signal's servers are involved only for certain functions. I think communication tx is P2P - to send a message via server (used to hide sender IP address from onlookers and the recipient), you need to enable relaying. Possibly finding the recipient still relies on the server - if I want to send a P2P message to Abel, to what IP address do I send it?
The official signal.org blog post I linked does actually explain how it works. They write that the client sends parts of hashed phone numbers to Signal:
> The client transmits those truncated hashes to the service. The service does a lookup from a set of hashed registered users. The service returns the intersection of registered users. The obvious problem with this method is that the hash of a user identifier can almost always be inverted. Regardless of whether the identifier is a phone number, a user name, or an email address, the “keyspace” of all possible identifiers is too small.
Also: Signal messages are currently never P2P. They always pass through Signal servers, which see (but apparently not retain) your IP and timing metadata. The Signal WebRTC calls are partially peer-to-peer, that is what the relaying in the Signal settings panel is about.
(Not to object the degoogeling, but:) To create a Signal account, you have to validate a phone number. So Signal is currently largly about privacy, not anonymity.
FWIW I wouldn't know why to message someone if I didn't know who they were. The same goes for them not knowing who I am. What would we even talk about?
The service operated by the incorporated 501c3 has full visibility into who else a user messages and when. This is not good for privacy.
What the non-low-value users are generally looking for is the option to not opt-in to discard anonymity with any potentially involved third parties such as server operators and network operators, and left at the discretion of the users solely.
Other systems have already solved this. One user can be not anonymous while another can choose to not opt-in to not be anonymous.
The users still know who the user on the other side is.
They could still implement these things in the app and put them behind a switch for users who care about independence more than one specific type of anonymity. Explain the tradeoffs on the settings screen.
The only valid reason to be against an optional feature is the maintenance burden, I don't think it's too much here but I also can't speak for the Signal team.
One of the most frustrating decisions from them was to stop allowing signal to be a catch-all messenger for encrypted and non-encrypted messages. I was able to onboard so many people, including very non techy relatives, because switching to a secure app for a small subset of people was never something they really wanted to do.
For security and privacy to really win out and raise the bar, it has to be able to happen in the background without the user even realizing it.
Making an app for enthusiasts is fine but Signal is going to remain niche if they can't make it more of an open ecosystem.
Yeah this resulted in a mass exodus of my contacts from Signal. The worst part is some of them never deactivated their Signal accounts, they simply uninstalled it from their devices. For a good while, I was sending messages to the void because Signal thought they were still active users.
I only have 2 people in my contacts that use it now. Every now and then somebody will install it for a couple weeks and ditch it again.
No it's the other way around. Signal is explicitly designed for normies, which is why so many people use it. I doubt they sat around and thought of ways to screw certain users.
>Just as they could easily offer a Google free version
Easily? There's no easy in maintaining and releasing two different versions of your app, especially for a small non-profit.
Hates users who are not total normies and designed explicitly for normies are not opposite. In fact an app that hates not normies would be designed for explicitly for normies.
> Easily? There's no easy in maintaining and releasing two different versions of your app, especially for a small non-profit.
It's literally just another job on your CI. They got a 50 million seed donation in 2017 and reported almost 30 million in revenue in 2024. They are not exactly small. If they were VC founded and not a non profit they would be a unicorn.
You're misreading. In 2024 they had $415k of revenue against $1.4 million in expenses, with $28.7M in assets (which I assume is what you're confusing). Assets have been steadily declining since 2022 as expenses have been consistently higher than revenue.
> They got a 50 million seed donation in 2017 and reported almost 30 million in revenue in 2024. They are not exactly small. If they were VC founded and not a non profit they would be a unicorn.
The donation to Signal and VC investment are very different things: Donations to Signal are for operating costs. VCs invest for the purpose of enabling and owning a share of exponential growth to 'unicorn' status.
> unicorn
Unicorns are billion dollar companies that are rapidly growing. Signal isn't close to that.
Yeah, the hostility toward F-Droid and wanting to run their app on LineageOS without gapps made me ditch Signal years ago. It seemed like the main gimmick back then was that it was also your SMS app, which IIRC isn't a choice anymore. So what's the draw now? Why would you not use XMPP+OMEMO or Matrix which work everywhere, don't need a phone number (at all, ever), and have free as in freedom clients and servers? It's insane to me.
To put it simply, I need a messenger app to talk to other people. Most people I talk to are not programmers or very tech savvy.
Putting them on Signal requires me to convince them to download an app from the play store, with thr same name. The app is very similar to messenger or whatsapp and they're used to the functionality already. So many of my friends made an account so we can talk.
Anything more involved and they stay on meta's garden. Any successful messaging app needs to prioritize "normies" to get users.
Before the smartphone era, non-tech-savvy young people were still pretty tech-savvy compared to modern computer (= phone) users, who rarely step outside a few corporate phone apps and have even lost the concept of the file and the directory. You can't expect the same curiosity and willingness to make an effort from normies today as back in the XMPP era.
Well I bet you didn't have to convince them to leave messenger back then.
It's not that they are not capable of figuring out something more complex. It's that it's hard to convince non-tech savvy friends to switch apps and it becomes much harder if the alternative needs setup or feels unfamiliar .
You can both appreciate Signal overall and be critical of some aspects.
What the user criticizes is due to sheer choices, which affect some users a lot; for example, numberless registration and full cloud backups can only be purchased with a Google or an Apple account, which clashes a bit with the privacy objectives.
And it's not a problem of not having the infrastructure to support other payment methods, since the donations support all the common ones, and there's now even a cryptocurrency integrated in the platform.
Disallowing and ostracizing other clients is a choice, they spent effort to enforce it (for example by adding mechanisms to recognize the official clients).
Hear hear. It’s been my observation that HN in particular has become much more combative. It’s full on like the meme where someone says “I like strawberries” and someone else complains “oh, so you hate pineapples?! They’re a fruit too, you know?! My great-grandfather ate pineapples. You’re a monster”¹. Yeah, chill, no one said anything about pineapples, stop assuming things or thinking everyone is against you. Don’t succumb to the tribalism.
¹ Unfortunately, I feel I must point out that I’m (I hope obviously) exaggerating for comedic effect.
What really disturbs me as I’m watching myself engage it more frequently. I’ve left other sites because I didn’t like the side of me that came out. Feeling a little bit like that these days here.
Signal hates anyone who even thinks about using this IM app as the de-facto IM app, or with more than that one person who also tries Singal as an annual ritual in your friend circle. I tried to use the app again after a year or so. Gave it full contact permission and it wasn't able to pick friends who are alreasy on Signal. I was not even able to send them messages using the number. But a friend was able to send it a message to me. After 2-3 days finally the app started showing friend's name that's in contact. Tut there were scary warnings (I know, I know that's for my safery). The whole UX just feels at odd with anything and everything I've used. They manage to look and feel worse than WhatsApp of today and that I'd say is an achievement.
Signal is not good for normies: compare sending a message with Signal to WhatsApp. Didn’t go through? WhatsApp will try try try to resend. Signal tries far less then shows the dreaded red exclamation point. Not great while travelling or with poor reception.
Signal developer here: we should retry with reasonable backoff for 24 hours before showing a delivery failure. If that's not your experience, please file a bug if you get the time!
Thank you for all you do. All of my grandparents joined Signal to message me and they have no issues for the most part. Although, one of them didn't know to press the download icon on photos I sent. I'm not sure why they weren't downloaded automatically.
Also please accept cryptocurrency for buying username-based accounts. The overlap between people that want to buy an account and those that want to use a fully identified payment method is not a lot.
I spend about half of every year traveling the mountains and deserts of the world, often ones with poor infrastructure. I use Signal more than any other messenger app, and I have never had the deliverability issues you complain about; messages do all get through eventually.
Interestingly here, the sqlite DB would be trivially fixable, and messages restorable, with the `sqlite3` CLI.
But there's no way to get at that sqlite DB file. Even if you change Signal's code to add a feature to export the DB, it apparently cannot see your DB, because iOS sandboxes that so that it is only visible to Signal builds signed with the Signal developers' keys.
So that means your messages are all there, on your device, running open-source software, and yet you cannot get them.
This cannot have been the intention of Signal being Free Software. Where is "change it to make it do what you wish (freedom 1)"?
(I do not use iOS myself but have friends suffering this issue. Everybody involved is programmers and yet we seem to be able to do nothing about it.)
So it seems that even though the messages are on the user's device, it really is the Signal developers who "own" that data, and have the exclusive and ultimate control over it.
Makes me wonder:
Does this mean users suffering this need to GDPR-request their data out from Signal?
> Even if you change Signal's code to add a feature to export the DB, it apparently cannot see your DB, because iOS sandboxes that so that it is only visible to Signal builds signed with the Signal developers' keys.
This is not something exclusive to iOS; Android does the same thing.
I'm not sure about Signal, but I had a similar issue with another app, a SQLite db inaccessible. I found that you could take a computer-based full backup and then there are various 3rd party tools that will poke through that backup for whatever "hidden" app data you need. One I previously used is iMazing, but I'm sure there are free open source ones as well.
Something doesn't connect here. I have a workout tracker app I use, and while I can't access the sandbox from the outside, the app has a feature to import/export workout history and it lets me dump a sqlite db copy via iOS share sheets just fine.
To be sure this would mean Apple has to allow for 3p installs that have self signing keys that can let one gain visibility into the data of the app(in this case its in the sandboxes), yeah?
An owner of a device in physical possession of it and with the knowledge of all keys and passwords involved, they should be able to get all their personal data stored on it out of it, yes I think so, no matter who signs what on whatever app store.
The whole point of signal is that they cannot provide you with your data - they do not store it.
Further, I have been frustrated with similar design decisions with Signal - but how can they ensure you can export your messages without allowing letter agencies to do the same? Falling back on platform security guarantees is a rather good choice in terms of the economics - Signal need not gatekeep access to their private data - it is android and iOS that do the heavy lifting there. I’d love to move my messages between devices and sims - but I understand why that is not feasible for now.
I've used F-Droid for years. It's simple, has good apps that aren't full of ads, just works. PGP... sucks a lot, I never really got along with it. Maybe an age thing, but hardly anyone I've met uses PGP/GPG. Yet I have many friends/family on Matrix.
I also would like it to have stable supported libraries. But this doesn't seem to be a focus. It's a pitty, we have a Foss solution and it's hard to integrate with it....
As I understand it, Signal falls back to a persistent websocket when Play services are not available. FWIW.
I agree that working around a reliance on FCM by default would be a position that better aligns with the expectations from the freedom & privacy set, though.
2 years ago when I got a new phone, I had to re-register in both WhatsApp and Signal.
Both send you a code over SMS. I hate giving apps SMS access, so I refuse SMS intercept permission when an app asks for it, and instead I manually enter the received code in the app.
This was possible in WhatsApp, but was not possible in Signal. It won't allow you. You must give it SMS access to read the code. So much for privacy/security/... Only app I use which didn't allow me to manually enter the SMS code.
I understand you’re being a bit overdramatic to make a point, but no, Signal and Facebook messenger are not the same levels of secure for the user. That’s not the same as “trust them wholly,” but surely you understand they are on very different ends of the spectrum.
I’m pretty sure it’s for security reasons, it allows the app to ensure the code comes from a correct Signal phone number and not from a third party actor. It’s hand holding yes but it’s a trade off in favor of non-technical users.
> Sometimes I get the feeling that Signal hates users
one would think this is a well known fact already after the PIN nag screen forcing users to use PIN or have half of the screen blocked (at that time we left with family and never returned back) or removal of SMS feature, which would be only reason why to keep Signal in the phone for those few people who use it since you could use it at least to receive SMS
TBH Firefox devs are not much better, I remember waiting years and years for pull down to refresh while they kept playing with features nobody asked for (on related note Vivaldi for Android supports already extensions) or Proton Mail devs requiring Android 10 minimum to install the app, while all other clients (Nine Mail, Gmail, etc) are fine with older Android (I mention it because I was setting up old extremely locked phone for my kid recently, I have A16)
It explains perfectly why Signal does not want third-party clients.
To the haters: I am not saying that it is perfect, in an ideal world we could have secure third-party clients. I am just saying that it is pragmatic: in our world, we don't.
Signal has forever been a pragmatic approach to private messaging, and it succeeded at that: Signal literally put E2EE on the map!
Signal has a threat model, and they do the best app they can addressing that threat model. Which means that they cannot accept third-party clients or federation. They don't say "you cannot use XMPP or SimpleX or Matrix on the side", they just say "we provide this, if you benefit from it, use it for free".
Still, there is a very vocal minority that takes every opportunity they take to explain how "insane" that is, and how they "cannot imagine how anyone with some kind of intelligence wouldn't be revolted". I believe it is the same posture as those complaining about Android or GrapheneOS not giving root access ("even in the advanced settings"). The fact is that if you want root access on your phone, you should install a system that gives you root access, and not select a system that does not and then complain.
Signal is great at what it does. It's okay to also want something else while acknowledging that Signal is great at what it does.
Under Signal's original leadership, there was definitely a hard stance against third party clients connecting to the network. I think they've been quiet on third party clients since Moxie left.
They can give you the right to reuse their source code for building your own service using your own network (an aspire to give you this right), but still forbid you to connect to their service on their network with third party clients.
In practice, they don't seem to enforce that a lot (anymore).
It doesn't necessarily go to court. In the past, there was a project that was a light fork of Signal, LibreSignal, that was Signal but without the google libraries. They have asked the developers to stop distributing a version of it that connected to their network, and the developers stopped the distribution.
I guess they didn't do so for Molly. I suppose a lot of water has passed under the bridge.
You can totally fork their projects! You just can't call yours "Signal" (trademark I guess?) and you can't connect to their servers. Molly seems to be tolerated, somehow? Maybe because it is niche.
But clearly connecting to the Signal servers with an outdated, modified fork is against Signal's goal.
I have my own third-party client called Corvus. However, it's only for the desktop, and uses a native Qt GUI. I haven't gotten the impression that Signal is doing anything to block third-party clients per se. https://github.com/ada-h00k/Corvus
Sure, it doesn't contradict what I said. The number of Signal users connecting through Corvus is probably a rounding error for Signal, it's not worth doing anything against it.
Signal is a non-profit. They won't shut you down because they want to make profit. They may shut you down if they think you lower the quality of their service. I'm pretty sure that with Corvus you're not on their radar because probably almost nobody is using Corvus, right? Or do you have tens of thousands of users?
Right now, it's probably only being used by a small number of people in the lower double digits. However, it's based on signal-cli, which a lot of people use and which Signal apparently has no objection to.
I have been a signal user from very early on, converted most of my family and quite a few friends. I did use Molly to register my second phone (just found I can do that with signal now, so uninstalled Molly and installed signal).I have the impression that the calling experience significantly degraded over the last year, i.e. calls just not ringing at the other end, sometimes even not showing as missed calls, Video calls being very low quality even though both ends are on high quality connections (and switching to other apps yields high quality). Just yesterday I was standing in a queue inside and a friend was outside. We both tried to call each other but the call was just giving ringtone without ringing on the other end. It's become so bad that I'm now considering setting up my own matrix server and transition to that.
Anyone else experiencing the same? I have been wondering if it might have been me using molly, so will test now after going back to signal for second device.
Now should be quite a good time to set up a Matrix server fwiw; we are finally at the tail-end of the journey to Matrix 2.0 (instant sync; auth via OAuth; native multiparty e2ee calling; encryption which operates invisibly). https://matrix.org/blog/2026/10/30/this-week-in-matrix-2026-... gives an overview of where things are at. I'm biased, but by far the easiest and most robust way to run a Matrix stack should be https://github.com/element-hq/ess-helm#ess-community.
As someone that follows This Week In Matrix, is there likely to be a major shuffle in the next few weeks regarding calling configuration for self-hosting? I see that there is work being done, thoug I'm not sure how much that will affect server operators
no, there shouldn't be; MatrixRTC calling has finally (after only 5 years of iteration :) stabilised. The biggest change is renaming the APIs from unstable to stable URL prefixes, but this should be invisible.
Signal only has one recent CVE, one which lets an attacker keep an audio or video stream open after you hang up. It doesn't disclose e.g. your chats with other users.
It's not great. But I prefer it over the risk of downloading an APK from signal's website that I don't know how to properly verify the integrity of (there's a key listed on the website, but who knows if it's correct?). (I don't use Google play)
Network-connected application developers have as a community, desensitized me to this. They are the Boy Who Cried Wolf. Continuous mandatory updates in the name of security. Guilting you into thinking each update is critical due to "security".
I don't care. It's a hassle, and I don't believe the threats they warn of are something to warrant my attention in the landscape of things I should worry about in my life. Anecdotes don't help. To overload with another analogy: Security is a "think of the children" or "full stop": it's a thought-terminating cliche, and I don't believe people who use it.
The incorporated 501c3 named Signal is, in IT terms, a vendor. Is it not?
The Signal client software is open source and some of the clients have reproducible builds. The Signal server software is open source, though has a history of being over a year out of date at some points. Other deployments of this server software for production use are rare.
Suppose you configured an instance of the Signal server software and others you know ran also a somewhat modified Signal client that could access that instance of the Signal server software.
But the centralized namespace of the hosted Signal service hosted by the incorporated 501c3 named Signal would not be accessible through that server instance now would it.
And, as dictated by the incorporated vendor of the centralized namespace, and other reasons, in practice, this client would have to run as a separate piece of software. "Another app".
This is vendor lock-in.
The service hosted by the 501c3 named Signal seems widely open yet is a permissioned namespace. A physical location tracking number aka phone number or a credit/debit card is required to access the namespace. This is for slaves. The profane.
Open Signal on your phone to keep your account active
This vendor is abusive.
And, I don't think this is what Moxie wanted.
Signal 501c3 is a centralized service. XMPP and Matrix are decentralized/federated. SimpleX is distributed.
> Moxie knows about everything I’ve said in this article. He’s a very smart guy and I am under no illusions that he doesn’t understand everything I’ve put forth. I don’t think that Moxie makes these choices because he thinks they’re the right thing to do. [...] Moxie can’t come out and say it openly, but he’s made the decisions he has made because they serve his own interests.
And it looks like it's working. The Signal social network is growing. Revenue is growing (revenue pays for ongoing maintenance). Alternative servers are not sapping user metrics. It's still easy to push both security fixes and eye-catching new features because one central server, and client upgrades are aggressively pushed. Spam is not a plague because registration remains expensive - you need a genuine phone number you control, or Google to vouch for you (who in turn have their own robust defences against account creation).
If it was a free sign up where you just need an IP address to play, spammers would have hundreds of millions of accounts and you'd get as much nuisance friend requests as you get email spam. Most people would leave. You've seen the scraperpocalypse, every sketchy person on the planet has money to fund a million sign ups each from a unique US residential IP (thanks to "smart" TV vendor neglect/corruption allowing residential proxies), IP reputation is worthless.
Personal instances of Signal would hide until spammers found them but you'd better have your own locked down registration because you can't hide forever. Not to mention that sending ongoing traffic to your own server tells everyone where and when you're posting, moreso than using Signal's centralised services.
You think, users should be required to carry a cell phone or make use of a debit card or credit card, in order to message another user, is exactly, what Matthew wanted?
A self-described anarchist who described the original cypherpunks as his teenage heroes?
When XMPP+OTR had already been, among competent people, the prevalent norm for over half a decade when he gave that DEF CON 18 talk?
That is just crazy, man.
In that DEF CON 18 talk, Moxie talked about scope of choice and how the scope of choice changed to "do I want to carry a cell phone, or not?". A notion that Matthew's dream was to impose on the world a demand to carry a cell phone or a debit/credit card transaction on others, such a tax, to enjoy what he and his friends and colleagues already on top of pure Internet Protocol, is on its face absurd.
_
> Spam is not a plague because registration remains expensive
The issue of spam is fully mitigated with an invite token, a 16 byte string ; "is", not "can be", because other systems in production have already been doing this.
The way it works is simple. If Alice wants to receive a message from Bob, Alice can share a connection string username+token to Bob. Then Bob can message Alice and for that time not other users of the hosted centralized namespace.
Very simple concept.
Simple enough for a mediocre dev to implement without an LLM.
The spectre of spam does not justify the demand for "checking in" with your local PSTN tower, nor the friction involved with an uninvolved and unwanted third party named Google (love Google overall but this is such a bastardly and disgusting concept), nor does it justify demanding a debit/credit card transaction become involved.
The spectre of spam does not justify any of this horse shit.
"Hey Bob, here is my username to message me, provided you subject yourself to this horse shit", where such horse shit antithetical in a fundamental way to the values espoused founder of Signal.
The new, grossly degenerated Scope of Choice.
Perhaps some who call themselves "hackers" or software developers may have been actually fooled by this false spectre of spam. I was never among them.
Even worse, the phone numbers, Google Play accounts, debit cards and credit cards, these are cheap. Among the scammer underworld these are a plenty and fungible.
An invite token personally sent by Alice or read aloud by Alice to Bob, is not.
But if somebody wants to harass a specific user on Signal, that's relatively cheap to do.
_
> Not to mention that sending ongoing traffic to your own server tells everyone where and when you're posting
Uncle Jeff, AWS, who doesn't tell exactly everyone but a lot of people, not excluding ICE at any given time, knows when you are posting, from where, and to what other users. The last of which is specifically obviated by a separate namespace hosted on a separate server.
On the occasions I have run Signal's server software, I and other users did mitigate these concerns. We do appreciate that others also have these means, or not.
Another messaging system, you may have already read its name actually, has already solved these problems in a way that they are successfully mitigated in a wholly transparent way for casual users.
_
> Alternative servers are not sapping user metrics.
This imperative is not the users' problem and runs counter to the best interests of the users.
_
> Its tradeoffs all the way down.
Right. In Matthew's view, the horse shit is a tradeoff.
I believe there are other tradeoffs available that are ethical, not more ethical, but ethical, and carry much less technical complexity.
You should definitely avoid Session. While its decentralized nature is a positive, the developers have implemented many features insecurely and have also removed forward secrecy. There are blog posts by a cryptography expert on this topic: https://soatok.blog/2025/01/14/dont-use-session-signal-fork/
I'll just say that the main issue with SimpleX is that it lies in its marketing material that it has no identifiers. What they really mean is that they're not adding new identifiers in the app, it doesn't mean they're actively removing existing identifiers, that is, your IP address. The client currently routes messages through two hosting providers which reduces incidental metadata collection. But it does fuck all if the hosting providers collaborate unbeknownst to the users.
That being said, SimpleX has really good support for Tor, in that if you just install tor package to Linux over apt or whatever, and configure like two items in the app's proxy settings, the client will automatically switch to SimpleX Onion Service servers instead of routing to clearnet servers through exit nodes. I can respect that.
What I can't respect is the threat model being treated like a fine print that's buried beneath menus: When you claim to be the most private messenger out there you need to act the part.
Moxie as far as I know is still involved in the project and is the source of decisions such as requiring a phone number. My understanding is he is leaning hard on "encryption for anyone and everyone" over all other considerations such as decentralization.
A common criticism is "huh, not very anarchist of him!" Which, maybe? If decisions like that can get Signal into as many hands as possible, and if Signal can continue to operate in such a way as to have basically nothing to offer governments that demand data other than account join date, I think that's an improvement in material conditions.
Your bio has a pretty frank indication of the maximally decentralized, encrypted alternative, and how user hostile that still is:
> If you want to DM, I am generally open to chat. Generate a https://SimpleX.chat invite and paste it into a file simplex-invite.txt, then run the commands below and include pasted contents of DM.txt in one of your comments in any thread we're both participating in.
Signal's rigid anti-fork stance allows it to stay compliant with its 9-figure government contract, which requires it to include a backdoor in final builds that are not reproducible from the official source code.
All these poor, starving users who can't have any freedom unless they compile their own builds don't even have proof that Signal _doesn't do that_. And the worst thing is they probably have no idea there are already free and verifiable alternatives like Delta Chat and SimpleX.
Signal has reproducible builds for Signal Android.
Maybe some of Android users who are naive enough to use Google Play to manage a package like Signal could over time consistently inspect what APK they have and share results.
But reproducible builds for Signal Desktop are "experimental" and "may not work on the public releases yet", which in real terms means Signal Desktop doesn't actually have reproducible builds yet.
Maybe reproducible builds of apps for iOS and macOS will happen some day but the people with the necessary competencies to do reproducible builds are unlikely to believe in others using those systems enough to attempt reproducible builds for them.
Even with reproducible builds, whether packages on iOS can be verified seems to be a grey area at best and with no source code for iOS there is no starting point to believe anything iOS tells us.
SimpleX has been inconsistent with integrity of releases. Some releases have the expected GPG signatures but more do not.
For any release to not have at least one GPG signature on the source tarball is a serious concern.
Evgeny, the head of the SimpleX project, is doing much better with Git commits now than he has in the past. But a cursory look at the Git commit history at the link below shows an RSA4096 key that is over three years old.
What many would like to see from the SimpleX project are a combination of signatures on release source tarballs with RSA, ECC, and PQ keys where at least two of those are on hardware wallets.
I know there are some have urged Evgeny to use hardware wallets for signing source tarball releases and to be forthcoming that he is using a hardware wallet (something built into a Macbook is not sufficient) but there isn't anything on the SimpleX blog showing this.
https://simplex.chat/blog/
_
> users who can't have any freedom unless they compile their own builds
Those who don't have cicd don't have any freedom and have questionable security at best. Whether this is how things should be, I'll let others argue that. It's how it is.
>Signal's rigid anti-fork stance allows it to stay compliant with its 9-figure government contract, which requires it to include a backdoor in final builds that are not reproducible from the official source code.
This was my main reason to use Molly over Signal.
https://aboutsignal.com/news/signal-allows-iphones-to-be-lin...
Why can't we use XMPP where you can have multiple device and accounts without required mobile phone? Oh I know - because dumb walled gardens and BigTech not liking it... it's a mirracle we got away with e-mail before they came to power :/
So it's an explicit trade-off, made to keep your communication safer. Signal, in general, is uncompromising about privacy and about keeping metadata out of their hands.
in case of XMPP you have OMEMO which is multi device and works fine-ish (nowadays) though I would still prefer simpler OX (PGP; pefrect-forward-secrecy is an overkill IMHO for majority of people)
People use Signal because they don't want to be compromised when they just leave their phone / laptop unattended for a couple minutes on a bus or a train. They don't want to be in a situation if one day their laptop gets computer virus and they have to assume all these accounts are compromised and have to restart their digital identity all over again.
Besides - it's way more probable to lose train than a computer (even my laptop almost never leaves the house)
On the phone, no. You need to have a few 0-day to break into Secure Enclave to get access to Signal related keys.
But, apparently Android is also supported: https://aboutsignal.com/news/signal-allows-android-phones-to...
So glad they finally added this!
https://support.google.com/android/answer/15341885?hl=en
I really don't get why they don't just give you a thing to install something as many times as you want. It's insane that you still have to use these weird workarounds.
The last option would work just fine for you
You do realize you can still create a work profile through things like Insular/Island, right?
It's insane people complain about these things when they're legitimately non-issues
There are some tools available to make management even more straightforward, like Insular, a fork of Island: https://f-droid.org/packages/com.oasisfeng.island.fdroid/
I’ve been using Beeper to keep using Signal on my older iPhone when I upgraded.
Molly backups stopped working (probably due to lack of updates) and I can't seem to transfer between the two apps on the same device.
[1] https://signal.org/android/apk/
I just released a stopgap with the fixes: - RingRTC 2.73.0-1, which includes the call-teardown fix (the hangup/hot-mic issue) - Signal's blacklist of the eight compromised eMudhra TLS intermediates
https://github.com/lone-cloud/polly/releases/tag/v8.19.2-6
It's still based on Signal 8.19.2. The build is arm64-only and Android 14+.
Plug: I also maintain my own UnifiedPush distributor app that optionally pairs with a notification gateway: https://git.lonecloud.dev/lone-cloud/prism-android My motivation for Prism was to get Proton Mail email notifications delivered via UP, which requires a self-hosted Prism server.
When you say "Each user can choose a different notification service" you aren't enhancing privacy you are standing out.
When you say "Each group of users can have their own servers" you aren't enhancing privacy you are standing out.
So yeah, it's only for "total normies" in the sense that if you insist on standing out from those "total normies" that's a problem.
Signal is taking advantage of the inherent camouflage of crowds, once you insist on standing out that's gone and you can't get it back.
Install vanilla LineageOS or GrapheneOS with no GApps. Then install Signal from https://signal.org/android/apk/
I bought a PinePhone, so I definitely know what truly unoptimized battery life looks like, lol.
Unified Push, which works flawlessly on Molly, could easily be implemented in the regular client.
Signal works without GMS or any alternative, at the cost of more phone wakeups. This is much more preferable to everyone whose WiFi or data service you use see you connect to "push.myownname.com", or for you to rely in some rando gatekeeping your message delivery.
Mozilla has one. Hell, Signal _themselves_ could host a UnifiedPush server. Not an excuse to say 'you use Google or our app uses 10x the battery'.
That being said, I've never heard this mentioned as a benefit of Signal, and I figured the main benefit was y'know robust and proven E2E encryption.
They intentionally store very little data about their users but their "mailbox" model explicitly means that the server (or an attacker) can figure out who is talking to whom. And that's fine! Signal isn't trying to be an anonymity network, so while stuff like sealed sender are nice features it's important to remember that anonymity breaks are explicitly not part of the Signal threat model.
"Don't stand out" only makes sense as advice for anonymity tools to avoid bifurcating the anonymity set -- it doesn't make much sense when you're taking about a service which links your account to your phone number and thus every server request is explicitly identifying you.
My point is that by construction they are not an anonymity tool, no centralised server can be. They can add features to make it less easy to track users but that's not the same as providing anonymity, and it's important to not confuse the two.
To give an example: my email provider has a feature to auto-encrypt all inbound emails to a PGP public key. Is this a nice feature to make it harder for someone to read my past emails if someone gets access to their infrastructure? Sure. Does this make my emails end-to-end encrypted? Absolutely not. In a similar vein, Signal making social graph correlation harder is a welcome feature but is not the same as making it anonymous.
You're also hedging against mandated government backdoors.
A single organisation like signal can easily compelled to add a backdoor (or leave the territory) like the EU is trying to do. Going after thousands of servers individually is a whole different problem.
Let's see the law that allows compelling backdoor into Signal then. AFAIK https://en.wikipedia.org/wiki/Bernstein_v._United_States established code as speech, meaning compelling backdoor is compelled speech, which goes against the first.
https://en.wikipedia.org/wiki/Code_as_speech goes into this in more detail and mentions https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d... where the defense was used.
And also, do we really trust the US government on this after Snowden?
Signal's strength is its security agility and thoughtful feature design, not federation and availability.
That said, I would like all users to look degoogled.
Where Signal's safety in numbers happens is in normalization of end-to-end encryption. Users who want to protect their message content are not standing out from the rest, unlike in e.g. Telegram where the vendor sees with whom you enable secret chats.
How could it build a social graph? I think most messages are P2P unless the user activates relaying?
No they're all routed through the servers. It's only the calls that can be sent P2P and you have to opt in for that. The issue is that leaks your IP address to the contact who may not be trustworthy, so it's not used by default.
> In order to turn the address book on a device into a social graph for Signal, the Signal client needs to be able to determine which of the device’s contacts are Signal users. [...] The obvious problem with this method is that the hash of a user identifier can almost always be inverted. [...] This method of contact discovery isn’t ideal because of these shortcomings, but at the very least the Signal service’s design does not depend on knowledge of a user’s social graph in order to function.
Src.: https://signal.org/blog/private-contact-discovery/
edit: Also, Signal is not peer-to-peer. It is a centralized, client-server architecture.
I don't remember how the hash issue is dealt with, however.
> Signal is not peer-to-peer. It is a centralized, client-server architecture.
It's not a P2P mesh, but Signal's servers are involved only for certain functions. I think communication tx is P2P - to send a message via server (used to hide sender IP address from onlookers and the recipient), you need to enable relaying. Possibly finding the recipient still relies on the server - if I want to send a P2P message to Abel, to what IP address do I send it?
> The client transmits those truncated hashes to the service. The service does a lookup from a set of hashed registered users. The service returns the intersection of registered users. The obvious problem with this method is that the hash of a user identifier can almost always be inverted. Regardless of whether the identifier is a phone number, a user name, or an email address, the “keyspace” of all possible identifiers is too small.
Also: Signal messages are currently never P2P. They always pass through Signal servers, which see (but apparently not retain) your IP and timing metadata. The Signal WebRTC calls are partially peer-to-peer, that is what the relaying in the Signal settings panel is about.
FWIW I wouldn't know why to message someone if I didn't know who they were. The same goes for them not knowing who I am. What would we even talk about?
What the non-low-value users are generally looking for is the option to not opt-in to discard anonymity with any potentially involved third parties such as server operators and network operators, and left at the discretion of the users solely.
Other systems have already solved this. One user can be not anonymous while another can choose to not opt-in to not be anonymous.
The users still know who the user on the other side is.
The only valid reason to be against an optional feature is the maintenance burden, I don't think it's too much here but I also can't speak for the Signal team.
If you don't know how computers work, yeah it sounds great. But those who do know how computers work see it for what it really is: a bucket of shit.
For security and privacy to really win out and raise the bar, it has to be able to happen in the background without the user even realizing it.
Making an app for enthusiasts is fine but Signal is going to remain niche if they can't make it more of an open ecosystem.
I only have 2 people in my contacts that use it now. Every now and then somebody will install it for a couple weeks and ditch it again.
No it's the other way around. Signal is explicitly designed for normies, which is why so many people use it. I doubt they sat around and thought of ways to screw certain users.
>Just as they could easily offer a Google free version
Easily? There's no easy in maintaining and releasing two different versions of your app, especially for a small non-profit.
That said I also wish they had a degoogled version.
I'd take an untested version over nothing, anyhow.
And I'm not sure that the current version undergoes that much testing, bugs are not very rare.
> Easily? There's no easy in maintaining and releasing two different versions of your app, especially for a small non-profit.
It's literally just another job on your CI. They got a 50 million seed donation in 2017 and reported almost 30 million in revenue in 2024. They are not exactly small. If they were VC founded and not a non profit they would be a unicorn.
You're misreading. In 2024 they had $415k of revenue against $1.4 million in expenses, with $28.7M in assets (which I assume is what you're confusing). Assets have been steadily declining since 2022 as expenses have been consistently higher than revenue.
https://projects.propublica.org/nonprofits/organizations/816...
The donation to Signal and VC investment are very different things: Donations to Signal are for operating costs. VCs invest for the purpose of enabling and owning a share of exponential growth to 'unicorn' status.
> unicorn
Unicorns are billion dollar companies that are rapidly growing. Signal isn't close to that.
Putting them on Signal requires me to convince them to download an app from the play store, with thr same name. The app is very similar to messenger or whatsapp and they're used to the functionality already. So many of my friends made an account so we can talk.
Anything more involved and they stay on meta's garden. Any successful messaging app needs to prioritize "normies" to get users.
People hated Facebook but still wanted WhatsApp. Free, no ads, no Silicon Valley. Privacy or anonymity are irrelevant.
It's not that they are not capable of figuring out something more complex. It's that it's hard to convince non-tech savvy friends to switch apps and it becomes much harder if the alternative needs setup or feels unfamiliar .
Today, I discussed my father's health condition with my family. Signal worked smoothly (even for my aging mother!), and it's free and secure.
Over the past five years, I have donated $500 to the foundation in total. I hope they continue to maintain the app into the far future.
What the user criticizes is due to sheer choices, which affect some users a lot; for example, numberless registration and full cloud backups can only be purchased with a Google or an Apple account, which clashes a bit with the privacy objectives.
And it's not a problem of not having the infrastructure to support other payment methods, since the donations support all the common ones, and there's now even a cryptocurrency integrated in the platform.
Disallowing and ostracizing other clients is a choice, they spent effort to enforce it (for example by adding mechanisms to recognize the official clients).
¹ Unfortunately, I feel I must point out that I’m (I hope obviously) exaggerating for comedic effect.
Also please accept cryptocurrency for buying username-based accounts. The overlap between people that want to buy an account and those that want to use a fully identified payment method is not a lot.
https://github.com/signalapp/Signal-iOS/issues/5813
Interestingly here, the sqlite DB would be trivially fixable, and messages restorable, with the `sqlite3` CLI.
But there's no way to get at that sqlite DB file. Even if you change Signal's code to add a feature to export the DB, it apparently cannot see your DB, because iOS sandboxes that so that it is only visible to Signal builds signed with the Signal developers' keys.
So that means your messages are all there, on your device, running open-source software, and yet you cannot get them.
This cannot have been the intention of Signal being Free Software. Where is "change it to make it do what you wish (freedom 1)"?
(I do not use iOS myself but have friends suffering this issue. Everybody involved is programmers and yet we seem to be able to do nothing about it.)
So it seems that even though the messages are on the user's device, it really is the Signal developers who "own" that data, and have the exclusive and ultimate control over it.
Makes me wonder:
Does this mean users suffering this need to GDPR-request their data out from Signal?
This is not something exclusive to iOS; Android does the same thing.
Best of luck!
Copy the backup off your phone and use https://github.com/bepaald/signalbackup-tools to extract everything.
If yes, that's exactly what the users in the linked bug report are asking Signal to add to be able to fix this problem themselves.
It seems to me like the app itself should be able to perform this operation and restore data? Why is this not just fixed in the app?
Which is all well; after all nobody is paying them to do it.
My complaint is that they + iOS simultaneously prevent able users from fixing it themselves, or paying somebody to fix it.
Further, I have been frustrated with similar design decisions with Signal - but how can they ensure you can export your messages without allowing letter agencies to do the same? Falling back on platform security guarantees is a rather good choice in terms of the economics - Signal need not gatekeep access to their private data - it is android and iOS that do the heavy lifting there. I’d love to move my messages between devices and sims - but I understand why that is not feasible for now.
Non-normies can continue to use PGP like they always have.
/s second paragraph.
As it stands it's a proprietary app with a lot o marketing to convince me otherwise.
I agree that working around a reliance on FCM by default would be a position that better aligns with the expectations from the freedom & privacy set, though.
Both send you a code over SMS. I hate giving apps SMS access, so I refuse SMS intercept permission when an app asks for it, and instead I manually enter the received code in the app.
This was possible in WhatsApp, but was not possible in Signal. It won't allow you. You must give it SMS access to read the code. So much for privacy/security/... Only app I use which didn't allow me to manually enter the SMS code.
Just tested with latest version of Signal. Can't reproduce. You can just tap away all the prompts, and paste the code.
Why would I give any app permission to read my messages, no matter how secure it claims to be?
Signal always has excuses, "we can't add usernames because we don't know how to make them secure"
But if they sent you the code, even if a third party actor could somehow see it and hand it to you instead -- so what? What's the difference?
one would think this is a well known fact already after the PIN nag screen forcing users to use PIN or have half of the screen blocked (at that time we left with family and never returned back) or removal of SMS feature, which would be only reason why to keep Signal in the phone for those few people who use it since you could use it at least to receive SMS
TBH Firefox devs are not much better, I remember waiting years and years for pull down to refresh while they kept playing with features nobody asked for (on related note Vivaldi for Android supports already extensions) or Proton Mail devs requiring Android 10 minimum to install the app, while all other clients (Nine Mail, Gmail, etc) are fine with older Android (I mention it because I was setting up old extremely locked phone for my kid recently, I have A16)
It’s security!
https://support.signal.org/hc/en-us/articles/360007320551-Li...
To the haters: I am not saying that it is perfect, in an ideal world we could have secure third-party clients. I am just saying that it is pragmatic: in our world, we don't.
Signal has forever been a pragmatic approach to private messaging, and it succeeded at that: Signal literally put E2EE on the map!
Signal has a threat model, and they do the best app they can addressing that threat model. Which means that they cannot accept third-party clients or federation. They don't say "you cannot use XMPP or SimpleX or Matrix on the side", they just say "we provide this, if you benefit from it, use it for free".
Still, there is a very vocal minority that takes every opportunity they take to explain how "insane" that is, and how they "cannot imagine how anyone with some kind of intelligence wouldn't be revolted". I believe it is the same posture as those complaining about Android or GrapheneOS not giving root access ("even in the advanced settings"). The fact is that if you want root access on your phone, you should install a system that gives you root access, and not select a system that does not and then complain.
Signal is great at what it does. It's okay to also want something else while acknowledging that Signal is great at what it does.
Their open source code is permissive of commercial forks.
Like, if their goal was to block third-party clients, then they would look more like Facebook or Reddit
They can give you the right to reuse their source code for building your own service using your own network (an aspire to give you this right), but still forbid you to connect to their service on their network with third party clients.
In practice, they don't seem to enforce that a lot (anymore).
I guess they didn't do so for Molly. I suppose a lot of water has passed under the bridge.
But clearly connecting to the Signal servers with an outdated, modified fork is against Signal's goal.
Signal is a non-profit. They won't shut you down because they want to make profit. They may shut you down if they think you lower the quality of their service. I'm pretty sure that with Corvus you're not on their radar because probably almost nobody is using Corvus, right? Or do you have tens of thousands of users?
Signal got an update yesterday and when I saw the notification I couldn't remember the last time Molly was updated...
Anyone else experiencing the same? I have been wondering if it might have been me using molly, so will test now after going back to signal for second device.
I don't care. It's a hassle, and I don't believe the threats they warn of are something to warrant my attention in the landscape of things I should worry about in my life. Anecdotes don't help. To overload with another analogy: Security is a "think of the children" or "full stop": it's a thought-terminating cliche, and I don't believe people who use it.
Don't you mean "learn grammar"?
If you're going to be an insulting pedant, at least be correct about it.
The Signal client software is open source and some of the clients have reproducible builds. The Signal server software is open source, though has a history of being over a year out of date at some points. Other deployments of this server software for production use are rare.
Suppose you configured an instance of the Signal server software and others you know ran also a somewhat modified Signal client that could access that instance of the Signal server software.
But the centralized namespace of the hosted Signal service hosted by the incorporated 501c3 named Signal would not be accessible through that server instance now would it.
And, as dictated by the incorporated vendor of the centralized namespace, and other reasons, in practice, this client would have to run as a separate piece of software. "Another app".
This is vendor lock-in.
The service hosted by the 501c3 named Signal seems widely open yet is a permissioned namespace. A physical location tracking number aka phone number or a credit/debit card is required to access the namespace. This is for slaves. The profane.
This vendor is abusive.And, I don't think this is what Moxie wanted.
Signal 501c3 is a centralized service. XMPP and Matrix are decentralized/federated. SimpleX is distributed.
I think this is exactly what he wanted, as these were the complaints levelled against the service when he was still in charge.
From 2018: https://drewdevault.com/blog/Signal/
> Moxie knows about everything I’ve said in this article. He’s a very smart guy and I am under no illusions that he doesn’t understand everything I’ve put forth. I don’t think that Moxie makes these choices because he thinks they’re the right thing to do. [...] Moxie can’t come out and say it openly, but he’s made the decisions he has made because they serve his own interests.
And it looks like it's working. The Signal social network is growing. Revenue is growing (revenue pays for ongoing maintenance). Alternative servers are not sapping user metrics. It's still easy to push both security fixes and eye-catching new features because one central server, and client upgrades are aggressively pushed. Spam is not a plague because registration remains expensive - you need a genuine phone number you control, or Google to vouch for you (who in turn have their own robust defences against account creation).
If it was a free sign up where you just need an IP address to play, spammers would have hundreds of millions of accounts and you'd get as much nuisance friend requests as you get email spam. Most people would leave. You've seen the scraperpocalypse, every sketchy person on the planet has money to fund a million sign ups each from a unique US residential IP (thanks to "smart" TV vendor neglect/corruption allowing residential proxies), IP reputation is worthless.
Personal instances of Signal would hide until spammers found them but you'd better have your own locked down registration because you can't hide forever. Not to mention that sending ongoing traffic to your own server tells everyone where and when you're posting, moreso than using Signal's centralised services.
Its tradeoffs all the way down.
> I think this is exactly what he wanted
You think, users should be required to carry a cell phone or make use of a debit card or credit card, in order to message another user, is exactly, what Matthew wanted?
A self-described anarchist who described the original cypherpunks as his teenage heroes?
When XMPP+OTR had already been, among competent people, the prevalent norm for over half a decade when he gave that DEF CON 18 talk?
That is just crazy, man.
In that DEF CON 18 talk, Moxie talked about scope of choice and how the scope of choice changed to "do I want to carry a cell phone, or not?". A notion that Matthew's dream was to impose on the world a demand to carry a cell phone or a debit/credit card transaction on others, such a tax, to enjoy what he and his friends and colleagues already on top of pure Internet Protocol, is on its face absurd.
_
> Spam is not a plague because registration remains expensive
The issue of spam is fully mitigated with an invite token, a 16 byte string ; "is", not "can be", because other systems in production have already been doing this.
The way it works is simple. If Alice wants to receive a message from Bob, Alice can share a connection string username+token to Bob. Then Bob can message Alice and for that time not other users of the hosted centralized namespace.
Very simple concept.
Simple enough for a mediocre dev to implement without an LLM.
The spectre of spam does not justify the demand for "checking in" with your local PSTN tower, nor the friction involved with an uninvolved and unwanted third party named Google (love Google overall but this is such a bastardly and disgusting concept), nor does it justify demanding a debit/credit card transaction become involved.
The spectre of spam does not justify any of this horse shit.
"Hey Bob, here is my username to message me, provided you subject yourself to this horse shit", where such horse shit antithetical in a fundamental way to the values espoused founder of Signal.
The new, grossly degenerated Scope of Choice.
Perhaps some who call themselves "hackers" or software developers may have been actually fooled by this false spectre of spam. I was never among them.
Even worse, the phone numbers, Google Play accounts, debit cards and credit cards, these are cheap. Among the scammer underworld these are a plenty and fungible.
An invite token personally sent by Alice or read aloud by Alice to Bob, is not.
But if somebody wants to harass a specific user on Signal, that's relatively cheap to do.
_
> Not to mention that sending ongoing traffic to your own server tells everyone where and when you're posting
Uncle Jeff, AWS, who doesn't tell exactly everyone but a lot of people, not excluding ICE at any given time, knows when you are posting, from where, and to what other users. The last of which is specifically obviated by a separate namespace hosted on a separate server.
On the occasions I have run Signal's server software, I and other users did mitigate these concerns. We do appreciate that others also have these means, or not.
Another messaging system, you may have already read its name actually, has already solved these problems in a way that they are successfully mitigated in a wholly transparent way for casual users.
_
> Alternative servers are not sapping user metrics.
This imperative is not the users' problem and runs counter to the best interests of the users.
_
> Its tradeoffs all the way down.
Right. In Matthew's view, the horse shit is a tradeoff.
I believe there are other tradeoffs available that are ethical, not more ethical, but ethical, and carry much less technical complexity.
Session is a decentralized Signal fork that creates the account on the device without associating it with a phone number.
https://getsession.org/
See also maqp2's comment here regarding Simplex:
https://web.archive.org/web/20250302182017/https://reddit.co...
I'll just say that the main issue with SimpleX is that it lies in its marketing material that it has no identifiers. What they really mean is that they're not adding new identifiers in the app, it doesn't mean they're actively removing existing identifiers, that is, your IP address. The client currently routes messages through two hosting providers which reduces incidental metadata collection. But it does fuck all if the hosting providers collaborate unbeknownst to the users.
That being said, SimpleX has really good support for Tor, in that if you just install tor package to Linux over apt or whatever, and configure like two items in the app's proxy settings, the client will automatically switch to SimpleX Onion Service servers instead of routing to clearnet servers through exit nodes. I can respect that.
What I can't respect is the threat model being treated like a fine print that's buried beneath menus: When you claim to be the most private messenger out there you need to act the part.
Moxie as far as I know is still involved in the project and is the source of decisions such as requiring a phone number. My understanding is he is leaning hard on "encryption for anyone and everyone" over all other considerations such as decentralization.
A common criticism is "huh, not very anarchist of him!" Which, maybe? If decisions like that can get Signal into as many hands as possible, and if Signal can continue to operate in such a way as to have basically nothing to offer governments that demand data other than account join date, I think that's an improvement in material conditions.
Your bio has a pretty frank indication of the maximally decentralized, encrypted alternative, and how user hostile that still is:
> If you want to DM, I am generally open to chat. Generate a https://SimpleX.chat invite and paste it into a file simplex-invite.txt, then run the commands below and include pasted contents of DM.txt in one of your comments in any thread we're both participating in.
All these poor, starving users who can't have any freedom unless they compile their own builds don't even have proof that Signal _doesn't do that_. And the worst thing is they probably have no idea there are already free and verifiable alternatives like Delta Chat and SimpleX.
Maybe some of Android users who are naive enough to use Google Play to manage a package like Signal could over time consistently inspect what APK they have and share results.
But reproducible builds for Signal Desktop are "experimental" and "may not work on the public releases yet", which in real terms means Signal Desktop doesn't actually have reproducible builds yet.Maybe reproducible builds of apps for iOS and macOS will happen some day but the people with the necessary competencies to do reproducible builds are unlikely to believe in others using those systems enough to attempt reproducible builds for them.
Even with reproducible builds, whether packages on iOS can be verified seems to be a grey area at best and with no source code for iOS there is no starting point to believe anything iOS tells us.
SimpleX has been inconsistent with integrity of releases. Some releases have the expected GPG signatures but more do not.
For any release to not have at least one GPG signature on the source tarball is a serious concern.
Evgeny, the head of the SimpleX project, is doing much better with Git commits now than he has in the past. But a cursory look at the Git commit history at the link below shows an RSA4096 key that is over three years old.
What many would like to see from the SimpleX project are a combination of signatures on release source tarballs with RSA, ECC, and PQ keys where at least two of those are on hardware wallets.I know there are some have urged Evgeny to use hardware wallets for signing source tarball releases and to be forthcoming that he is using a hardware wallet (something built into a Macbook is not sufficient) but there isn't anything on the SimpleX blog showing this.
_> users who can't have any freedom unless they compile their own builds
Those who don't have cicd don't have any freedom and have questionable security at best. Whether this is how things should be, I'll let others argue that. It's how it is.
No reproducible builds from them when they are now very common is really suspicious.
[citation needed]